- cypherpunks@lists.ogf.org

Re: Appeals Court Rules NSA Phone Program Not Authorized by Patriot Act - WSJ
by John Young 07 May '15

07 May '15

Correction: The decision and three opinions Decision: http://cryptome.org/2015/05/aclu-v-clapper-170.pdf Judge Sack: http://cryptome.org/2015/05/aclu-v-clapper-169.pdf Judges Lynch and Broderick: http://cryptome.org/2015/05/aclu-v-clapper-168.pdf Sack opines it's not about Snowden.

1 0

Appeals Court Rules NSA Phone Program Not Authorized by Patriot Act - WSJ
by Robert Hettinga 07 May '15

07 May '15

> http://www.wsj.com/articles/appeals-court-rules-nsa-phone-program-not-autho… <http://www.wsj.com/articles/appeals-court-rules-nsa-phone-program-not-autho…> > > Appeals Court Rules NSA Phone Program Not Authorized by Patriot Act > > ENLARGE > A sign stands outside the National Security Agency campus in Fort Meade, Md. Photo: PATRICK SEMANSKY/ASSOCIATED PRESS > > By > Devlin Barrett > May 7, 2015 9:31 a.m. ET > A federal appeals court ruled Thursday the National Security Agency’s controversial collection of millions of Americans’ phone records isn't authorized by the Patriot Act <http://blogs.wsj.com/washwire/2015/04/22/mitch-mcconnell-readies-bill-to-re…>, as the Bush and Obama administrations have long maintained. > > The ruling by the three-judge panel in New York comes at a delicate point in the national debate over government surveillance, as Section 215 of the Patriot Act is due to expire next month and lawmakers are haggling about whether to renew it, modify it, or let it die. > > The court’s ruling came in a lawsuit by the American Civil Liberties Union arguing the data collection should be stopped because it violates Americans’ privacy rights. A lower court judge ruled the program was constitutional, and the civil liberties group appealed, leading to Thursday’s decision. > > “The text of (Section 215) cannot bear the weight the government asks us to assign to it, and...does not authorize the telephone metadata program,’’ the court wrote. > > The court declined to address the issue of whether the program violates Americans’ rights, because, they found, it was never properly authorized by existing law. > > The judges didn't order the collection to stop, noting that the legislative debate and the looming expiration of Section 215 will force action on the issue one way or another. > > The judges also note that if Congress decides to approve some version of the phone data collection program in coming days, then the privacy issue could be revisited in court. > > The panel sent the case back to the lower court judge for further review based on the appeals court findings. > > Write to Devlin Barrett at devlin.barrett(a)wsj.com <mailto:devlin.barrett@wsj.com>

2 1

Re: we are fucked [was: Jim Bell vindicated]
by John Young 07 May '15

07 May '15

US armed forces (like other nations) have copious religions represented in uniform to bless crusades, vendettas, suppressions, mass murders, technical savagery, genocide by strategic bombing of civilians (Saudi Arabia relishing that in Yemen), exculpation of policy setters and enforcers and salve those who die, are savaged and family-death-benefited serving nations of holiers than thou. The current US giant pie of all-religions demon-fighters memoralized on patriotic headstones and dog-tags: http://prhome.defense.gov/RFM/MPP/AFCB/Endorsements.aspx If your cybersecurity faith is not listed, engage a faith-based lobbyist like EFF, ACLU, The Intercept, WikiLeaks. Not hard to believe all wars are narrow-minded religious wars, the more pea-brained, vicious and deadly the greater the faith in terrifying people into submission or by Your God or Godless teaching the resisters and atheists to RTFM and believe it. Manual burners, body immolators, head loppers, come on, those are the long-time recruiters. Nice thing about the AP manual is how ancient and modern it is, in law banking weapons strategy temples games. Not hard to believe the Internet is an EM, electricity wasting manual for AP adherents, following Gutenberg's WMD of pulp and carbon.

1 0

How are the Baltimore riots going?
by Georgi Guninski 06 May '15

06 May '15

How are the Baltimore riots going? https://en.wikipedia.org/wiki/2015_Baltimore_riots > Mandatory curfew effective April 28 – May 5 from 10pm-5am

16 32

Euros trending all PATRIOTic after a few dead bodies
by grarpamp 06 May '15

06 May '15

http://www.nytimes.com/2015/05/06/world/europe/french-legislators-approve-s… Mr. Valls promised that the law would be “targeted” and insisted that its main focus was to protect French citizens from terrorism. “The means of surveillance for anticipating, detecting and prevention of attacks will be strictly limited,” he promised. “It is a state lie,” said Pierre-Olivier Sur, the head of the Paris bar association. “This project was presented to us as a way to protect France against terrorism, and if that were the case, I would back it.” “But it is being done to put in place a sort of Patriot Act concerning the activities of each and everyone,” he said, “I think that opportunistic laws are always bad laws,” the editor in chief, Gérard Biard, said “The requirement that the Internet companies use the black boxes is a requirement that Russia has as well,”

1 0

Re: [tor-talk] German University signs up 24 tor relays
by grarpamp 06 May '15

06 May '15

On Tue, May 5, 2015 at 6:47 PM, W. Greenhouse <wgreenhouse(a)riseup.net> wrote: > grarpamp <grarpamp(a)gmail.com> writes: > >> Tor is not some private kingdom. It's an open application >> used and operated by whoever for whatever. It is absolutely >> the business of interested users to report, bring attention, >> interrogate and make lists of relays to use, promote or badexit as >> desired. And the business of relays to contactinfo, family, or >> ignore them as they wish. And of people to sniff passwords, inject >> malware, study traffic, researchers to research and others to have >> interest, bandwidth to be donated, disruption and exploit to be attempted, >> fileshare, illegal/legal use, promote best practices, etc. That's the nature, >> strength and weakness of open apps. A free for all where people use >> it as they wish, that's their purview, no police. You expect that, else you >> didn't read the label. Nothing you can do about it. Deal with it or >> create / fork >> your own kingdom. Tor's certainly not the last / best iteration of an anonymity >> network that there will ever be. > > Ack. I wouldn't want Tor to be anything but an open protocol/network. > That said, the lack of network security researchers treating their research > as human subjects research when human subjects can be put at risk by it is > troubling. Most researchers ultimately work for or at pleasure of "The Man" through R&E funding, grants, taxes, etc, so what do you expect? It's the same reason Tor Project gets endless amounts of shit piled on them for choosing to accept government funds. It's a fine line. At the same time you can't deny the benefits the research, usually attacking your network of choice... someone will do it anyways, or patching your net more resistant. So you have to take it as the free for all it is. It doesn't help that politic and media representing such systems as inhabited nearly entirely by FHOTI (and where good uses remain unseen by nature), and whatever bits of morality regarding human subjects may get used as cannon fodder. Very few work truly independantly for the fame of building resistant / resistance systems, let alone anonymously, sustainably, and at a level that results in a usable product that is used at scale. Just another reason anon-capable virtual currencies are feared by governments. They can support such models. Though as a user, due diligence is still required. In a connected digital world, that has and is developing faster than evolution's capacity to deal with it, everything is human subjects, and that's something everyone involved must consider... the outcome when your work is inevitably turned towards you or someone or something you care about... is that the work you want to be doing?

1 0

Re: Meeting Snowden in Princeton
by Juan 05 May '15

05 May '15

On Sat, 02 May 2015 21:14:35 -0600 Mirimir <mirimir(a)riseup.net> wrote: > I won't quote much, but I can't resist sharing this: "And it’s a > matter of record that Ed [Snowden] trusted his life to Tor, because > he saw from the other side that it worked." > Huh? 'trusted his life', how? It's a matter of record that you are quoting a guy making a baseless assertion in some random blog. > I wonder what the haters say to that. Actually, I know: "He's a double > agent, and it's all a con." Amirite? Snowden keeps sounding like an american nationalist. That's a big red flag.

6 12

Surveillance forces journalists to think and act like spies
by Lorenz Szabo 03 May '15

03 May '15

Interesting read. Found via HackerNews on ycombinator.com. Original here https://cpj.org/x/5fdd <https://cpj.org/x/5fdd>; cleaned up ASCII version below. ~ BizDevCon ___ Austria, Vienna PGP: 3542726F Surveillance forces journalists to think and act like spies April 27, 2015 By Tom Lowenthal Once upon a time, a journalist never gave up a confidential source. When someone comes forward, anonymously, to inform the public, it's better to risk time incarcerated than give them up. This ethical responsibility was also a practical and professional necessity. If you promise anonymity, you're obliged to deliver. If you can't keep your word, who will trust you in the future? Sources go elsewhere and stories pass you by. Grizzled correspondents might recall this time with nostalgia. For many young journalists, it's more like historical fiction--a time when reporters could choose not to give up a source, gruff editors chain-smoked cigars, and you could spot a press hack by the telltale notebook and card in the brim of a hat. The experience of a new generation of news writers tells a different story. Whether you choose to yield a source's name is secondary. Can you even protect your source to begin with? Call records, email archives, phone tapping, cell-site location information, smart transit passes, roving bugs, and surveillance cameras--our world defaults to being watched. You can perhaps achieve privacy for a few fleeting moments, but, even then, only with a great deal of effort. Yet this is journalism's brave new world. In the United States, the National Security Agency, otherwise known as the NSA, seeks to listen to every electronic communication sent or received. In the U.K., the Government Communications Headquarters, or GCHQ, has succeeded in intercepting and storing every peep that passes over the wires. Commercial spy software FinFisher (also called FinSpy) monitors citizens in at least 20 other countries, according to a report by The Citizen Lab, a research group based at the Munk School of Global Affairs at the University of Toronto in Ontario, Canada. Global Information Society Watch's global report details the state of communications surveillance in plenty more. Even Canada's spy agency may be watching Canadians illegally, though the GISWatch report could not say so conclusively. If a journalist can protect the identity of his or her sources at all, it's only with the application of incredible expertise and practice, along with expensive tools. Journalists now compete with spooks and spies, and the spooks have the home-field advantage. Shadowy worlds of subterfuge and surveillance should not be a journalist's habitat. The time a journalist spends learning to play Spy-vs.-Spy could be better spent honing his or her craft. Every hour spent wrangling complex security tools could be an hour spent researching and writing. All the staff on a newsroom's security team could be writers and editors instead. Each geeky gizmo and air-gapped computer (a computer that is never connected to a network) could be another camera or microphone, or the cost could be spent on payroll. All the extra labor and logistics dedicated to evading espionage is a loss. This poses sometimes-steep financial costs on newsrooms. If journalists and media organizations are to protect themselves, they must buy more tools and adopt practices that limit their efficiency. Robust security practices are complex and time-consuming, imposing logistical costs. The psychological toll of constant surveillance leads to exhaustion and burnout. Few journalists do their best work when they know that government thugs could break down the door at any moment--as they did at the home of independent New Zealand reporter Nicky Hager in October 2014, according to The Intercept. Many have worked to slow the swing of the pendulum from privacy to panopticon, increasing development of anti-surveillance tools and advice for journalists. The response to widespread knowledge of the long arm of the surveillance state has been gradual but impressive. Developers have increased work on surveillance-resistance projects and anonymous tip lines. Experts have put together numerous digital security guides and training programs, all intended to help reporters from falling under the focused gaze of government surveillance. Perhaps the flagship of this proliferation is SecureDrop, a secure and anonymous submission system for journalists. First pioneered by the former hacker and current digital security journalist Kevin Poulsen and the late programmer and political activist Aaron Swartz under the moniker DeadDrop, SecureDrop is intended to allow a potential source or whistleblower to get in touch with journalists without leaving any dangerous records of his or her identity. SecureDrop combines several pieces of security and privacy software into an integrated system, ensuring that only the journalists can read anonymous tips. Messages are protected with PGP, the tried-and-true gold standard for this task. Sources' anonymity is provided by Tor, the anonymity network that underpins private communications for everyone from the U.S. Navy and CIA to large businesses and survivors of domestic abuse. The result is safely encrypted messages and no metadata trail. With SecureDrop, journalists don't just choose not to reveal a source's identity. Unless a source chooses to reveal his or her identity, the reporters could not unmask the source even if they tried. Initially just an idea and some prototype code, SecureDrop was mostly theoretical until early 2013. The first major deployment was at The New Yorker. The project was soon adopted by the nonprofit Freedom of the Press Foundation, which was founded with the specific mission of facilitating journalism that governments oppose. FPF, as the foundation is known, soon took over SecureDrop's development and maintenance, as well as outreach and funding. More than a dozen other news organizations and prominent journalists have now deployed SecureDrop. With an ongoing crowdfunding campaign, FPF plans to bring it to many more. SecureDrop works hard to evade even targeted attacks and surveillance. Making use of cutting-edge technology and contemporary security best practices, SecureDrop separates different tasks onto different computers. Each machine only performs part of the puzzle, so it's very difficult to compromise the whole system at once. This makes SecureDrop quite expensive to deploy. FPF estimates that a single SecureDrop installation would set a newsroom back around $3,000, which is a lot to ask for a tool designed to protect the most important of tips from the most advanced of snoops. Other organizations have developed and distributed best practices and training materials. Universities have deepened their research into the threats journalists face. The Citizen Lab, already discussed in this piece, is dedicated to deep research about how technology and security affect human rights and is the source of some of the most detailed and comprehensive technical reports of recent years. If you want to know about the threats facing journalists and human rights groups, Citizen Lab is the place to go. Yet, as deep as Citizen Lab's work goes, it is as likely to induce security nihilism as it is to produce savvy security practices. An August 2014 report tells of terrifying new tools for state attacks on the media. Called "network injection appliances," these devices insert malicious software into otherwise innocuous traffic. Used right, one can modify an online video, adding malware that takes over a journalist's computer. If a journalist is using a service such as YouTube or Vimeo, session cookies allow the journalist to be targeted precisely. This makes these attacks very difficult to detect and prevent. With this new technology, journalists don't have to make a mistake to be compromised. Gone are the phishing days of opening a malicious attachment or clicking a suspicious link. There's no trap to notice and avoid. Just browsing the Web puts one at risk, and avoiding online video is an impractical ask of a journalist conducting research. Network injection appliances have likely already been deployed in Oman and Turkmenistan, according to Citizen Lab, and because they're commercially developed by private companies, the price of these devices will only continue to drop as their capabilities expand. Another Citizen Lab paper paints a disturbing picture of government cyberattacks. Journalists, among the principal victims of this sort of technological espionage, face state-level threats while lacking the funds and expertise to protect themselves. Attacks on computer systems can reach across borders into seemingly safe locations, allowing attackers to disrupt communications and impairing journalists' ability to do their core work. Sometimes attacks are simply a nuisance or a resource drain; at other times they present major risks to individuals' safety. It's all but impossible for journalists to learn the strategies of the state and appropriate countermeasures on a shoestring budget. Websites and service providers are often better positioned to protect journalists from these attacks. Securing the everyday tools of the trade works much better than does demanding that journalists jump through arcane hoops to stay safe. Simple measures can go a long way. Just enabling secure HTTPS rather than insecure HTTP can make a huge difference. The New York Times has called on all news sites to adopt this very measure by the end of 2015. As noted security expert The Grugq puts it: "We can secure the things people actually do, or we can tell them to do things differently. Only one of these has any chance of working." Since we first saw Edward Snowden's face, in 2013, computer-security guides for journalists have multiplied, but using computers safely is hard when a government is trying to get the drop on you. Many guides only scratch the surface, detailing basic--but important--steps. Turning on automatic software updates or using password managers and two-factor authentication for online accounts make a big difference. These first steps make journalists slightly harder to attack. In fact, simple practices probably have a greater impact than do more complex ones. Esoteric security strategies are a lot of work and sometimes only inconvenience a savvy attacker. Simple measures completely stymie simple attacks and force advanced attackers to change their tactics. A sophisticated attacker will never use an advanced technique when a simple one will do. More sophisticated attempts require more work, cost more, and are more prone to detection. Changing the game by forcing attackers to use scarce resources helps everyone stay safe. Other guides delve deeply into advanced principles of operational security. Abbreviated "OPSEC," the term is military jargon for measures taken to keep critical information out of hostile hands. If the phrase sounds more at home in a spy thriller than in a journalism manual, that's a hint at the problems posed by press surveillance. Mainstream journalists and press organizations openly acknowledge their need to learn spies' tactics and techniques to stay a step ahead. The adoption of military tactics and an espionage mindset has a substantial downside. The Grugq explains: "OPSEC comes at a cost, and a significant part of that cost is efficiency. Maintaining a strong security posture ... for long periods of time is very stressful, even for professionally trained espionage officers." Yet even in apparently free democratic societies, compromising a free press is the day-to-day work of the security services. Intelligence services sometimes target journalists for surveillance, even when the missions of the agencies involved are ostensibly centered around foreign intelligence. Iranian spies orchestrate elaborate campaigns to bamboozle journalists; they even pose as journalists when targeting think tanks and lawmakers, Wired has reported. The FBI has also admitted using the latter tactic and actually defended it publicly when criticized. In the U.K., security services have abandoned restraint when it comes to surveillance of journalists and civil society, Ryan Gallagher wrote in The Intercept, summarizing: "An investigative journalist working on a case or story involving state secrets could be targeted on the basis that they are perceived to be working against the vaguely defined national security interests of the government." Some journalists have risen to this challenge. After meeting with Snowden, Laura Poitras and Glenn Greenwald realized that traditional newspapers and media groups were not well suited to this world of watchers. They needed a new sort of organization--one ready to play spy games with professional spies from the very start. They founded the First Look Media group with help from fellow investigative journalist Jeremy Scahill and funding from eBay mogul Pierre Omidyar. First Look's flagship online magazine, The Intercept, is dedicated to exposing the abuses of the surveillance state. Choosing such powerful foes meant that The Intercept had to stay one step ahead from the start. Micah Lee is The Intercept's resident security expert. Formerly a staff technologist at technology civil rights group the Electronic Frontier Foundation, Lee was on The Intercept team from the beginning. He designed and implemented the security measures that Greenwald, Poitras, and Scahill--and now a team of 20--use to stay safe. When asked about the infrastructure needed to protect the publication, he frankly admitted: "When we think it'll make us safer, we normally just buy another computer or device. We're willing to spend money on these things when there's a clear security benefit." Lee was referring to security practices typically only needed when one is facing adversaries with the sophistication of governments. Protecting important information on separate air-gapped computers is a common practice at The Intercept. Lee and other technologists are fond of a security principle called "defense in depth," an approach that assumes that some security measures will fail and calls for systems that remain secure even when that happens. In the planning for defense in depth, a process should become insecure not when one security measure fails but instead when dozens do. Systems built this way demand more hardware than do those where security is more brittle. Several computers ensure that the compromise of one will leave the others safe. Smartcards protect cryptographic keys even when other things go wrong. All of this tech costs money and requires experienced technologists like Lee to design and operate. In keeping with this level of prudent paranoia, Lee and his colleagues often eschew regular smartphones in favor of the CryptoPhone. These $3,500 devices, made by German manufacturer GSMK, don't just provide encrypted calls; they're heavily customized and locked-down Android devices loaded with a whole host of custom software. They even try to detect anomalies in cellular networks that might be indicative of an attack or targeted surveillance. These practices and this technology are the best that media organizations can buy. It's a far cry from the James Bond-esque gadgetry that one might see at MI6 or the CIA, but, used correctly, it can keep the spooks at bay long enough for you to meet with sources and write the stories that need to be written. Staff at The Intercept use PGP for email encryption by default. Lee estimates that more than 80 percent of the emails he sent in the last six months were encrypted in this way. For most people who aren't security experts, PGP is a niche tool with a notoriously steep learning curve. Getting started requires hours of training and practice to wrap one's head around complex and unintuitive principles of public-key cryptography. The process takes even longer if one doesn't have an experienced guide. Between building sustainable long-term security strategies and jetting around protecting the magazine's VIP writers, Lee quickly ran out of the time needed to show each new hire how to use PGP. But he noticed that he wasn't always needed: "Folks learn PGP the same way they do any other tricky technical thing--they Google it, or they ask their nerd friends, and sometimes they get bad advice," he said. At The Intercept, new hires were learning PGP from folks already there--journalists and editors as well as technologists. The Intercept had developed what Lee calls a "security culture," an operational security term that has its roots in activism. In a "security culture," a community adopts customs and norms that protect its members. It's a wholesale adoption of operational security practices into the everyday work and activities of the group. The Intercept team considers security a core value, so people there are willing to work together to protect one another, even when that's outside their usual work. "Of course, having Erinn in New York helps, too," Lee joked, referring to Erinn Clark, the most recent member of First Look's security team. Clark came to First Look from the Tor Project, the nonprofit group responsible for developing Tor. Another security virtuoso, Clark is more than familiar not only with the nitty-gritty of security tools but also with the adoption of secure practices across an organization. In technology circles, the Tor Project is famous both for the exotic ways in which states have tried to infiltrate and attack it and for the extreme security measures its members have adopted to protect themselves. Leading the incredible heavy hitters of First Look's security team is Morgan "Mayhem" Marquis-Boire. A security superstar, Marquis-Boire worked on Google's security incident-response team, and he is a senior researcher at The Citizen Lab. This incredible brain trust isn't just there to keep just First Look safe. Once First Look's basic security needs are met, the group plans to branch out. "We want the security team to start developing tools and hardware and doing bigger research." Lee said. The team members plan to use their skills and expertise to help other organizations that can't afford their own elite security teams. The challenge is always resources. First Look has a billionaire on call to pay for the latest technology and fancy technologists. This is a rarity. Other journalists may face a stark choice between hard-hitting stories and staying safe. What does information security look like at publications that don't have First Look's billionaire funding? FPF regularly sends technical experts to help newsrooms install, set up, and upgrade SecureDrop. Every time they set foot in a newsroom, FPF techs find themselves flooded with security questions from reporters and editors. Questions aren't just about SecureDrop or FPF; news teams want to know about everything from the ins and out of other tools, such as OTR and Tails, to the sort of advanced operational security measures that can help them keep their heads above water when spies come snooping. Runa A. Sandvik, a member of FPF's technical team, said, "Even if you wanted to use these tools and had all the patience to learn them, there's still so much conflicting information--it's very confusing, very intimidating." And though few media organizations have the ability to hire technologists to work with their reporting staffs, Sandvik notes that the situation for journalists not affiliated with a major organization is even bleaker: "If you have a technologist, someone to help you, that's one thing. If you're freelance and not overly technical, I don't know how you're going to work this stuff out." She added, "Many feel overwhelmed; they don't know who to ask for help." Just having a technologist to help with analysis and security may not be enough. The newsroom has to commit to understanding the issues and taking good advice. Barton Gellman, who currently writes for The Washington Post, was one of the recipients of the document cache Snowden assembled, and he knew that he didn't have the technical skills to work on the documents alone. He brought prominent security researcher Ashkan Soltani (now chief technologist for the Federal Trade Commission) on board to help. Soltani bolstered Gellman's security practices and helped Gellman analyze and understand the more technical material in the collection. To make matters worse, intelligence agencies encourage confusion and misunderstanding when it comes to secure tools and practices. They try to associate a need for privacy with wrongdoing. This association makes it even harder for journalists to protect themselves and their sources. Persuading a source to protect him- or herself is harder when the tools of safety are associated with suspicion. In some cases, making secure tools seem suspicious actively endangers sources who live in less tolerant environs, such as dissidents in mainland China who use Tor. This doublethink is a strange flip side to the surveillance state: First, watch everyone, always, then vilify any attempt to recover some privacy. This is especially disruptive to journalists and their ability to serve as watchdogs. Even without state propaganda and unforced errors, covert action takes a substantial toll on the press's ability to hold leaders accountable. Espionage targeting journalists and their sources impairs the healthy function of the states where it occurs. And these practices are not just a feature of regimes known to be restrictive or autocratic. In 2013, David Miranda was detained for most of a day while making a connection between flights at Heathrow Airport in London. Miranda was changing planes on a journey from Germany to Brazil on which he was transporting documents and video footage between Glenn Greenwald and Laura Poitras. British police held him under measures designed to combat terrorism. Their reasoning? Miranda was promoting a "political or ideological cause." In July 2013, surveillance agency GCHQ destroyed computers at the Guardian newspaper in London. The security agency had already threatened the newspaper's editors, demanding that the Guardian stop reporting on government surveillance. A security service literally knocked on the doors of a prominent and critical newspaper in Western Europe. They ground a computer into pieces with the use of power tools. All of this was done in a vain attempt to prevent the publication of more articles on a topic that discomfited the government. These are the tools the state has at its disposal to discourage dissent. It is understandable that, for some, the risk of challenging this authority is simply too great. When these are the consequences of hard-hitting reporting, sticking to "safe" topics and innocuous pieces is a reasonable response. But even for those who choose to continue the hard work of comforting the afflicted and afflicting the comfortable, evading the panopticon comes at a tremendous cost. There are the costs incurred in avoiding simple tools in favor of secure ones. The costs of using extra hardware to protect sensitive materials. The costs of hiring elite security teams instead of extra editors. The costs of worrying that you've made a mistake in your security measures. The costs of wondering whether your hotel room will be undisturbed when you get back. The costs of hoping that today isn't the day that a government agent knocks at the door and asks to destroy your work, or worse. When journalists must compete with spies and surveillance, even when they win, society loses. Disclosure: The author previously worked at the Tor Project, the non-profit organization responsible for developing and maintaining the Tor software and network Tom Lowenthal is CPJ's resident expert in operational security and surveillance self-defense. He is also a freelance journalist on security and tech policy matters. Web site content (c) CPJ. All rights reserved. Articles may be reproduced only with permission.

6 8

Fwd: design for a Tor router without anonymity compromises
by coderman 03 May '15

03 May '15

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Sat, 2 May 2015 20:37:17 -0700 Subject: design for a Tor router without anonymity compromises To: tor-dev <tor-dev(a)lists.torproject.org> a friend and i are working on a Tor router design that doesn't compromise anonymity for convenience. [0][1][2][3][4] we're soliciting feedback as part of a go / no-go decision on continuing this effort. in particular, the design is intended to meet the scrutiny of Nick M., Roger, and Mike P. as the focus on support for Tor Browser and Tor on each client indicates. --- the design and prototype code is marked "copyright Tor Project Inc. by assignment", which means that we're using a notary public to formally assign copyright ownership to the corporate entity "Tor Project, Inc.". your comments will be taken into consideration, however, please defer patches / code contributions under other owners (you) until assignment complete. --- last but not least, we're trying to eat our own dog food. all of our planning, development, and operations use hidden services, called Onion services in the document, and this bootstrap is more difficult than expected. [5] please provide feedback in reply on this thread or to me directly.[6] assuming the project continues, we will have Onion services to support collaborative development up soon. best regards, and my thanks in advance for your scrutiny! 0. "Tor Enforcing Privacy Router" http://serqet345qt265xp.onion/ 1. "Op-ed: Why the entire premise of Tor-enabled routers is ridiculous" http://arstechnica.com/security/2015/04/18/op-ed-why-the-entire-premise-of-… 2. "[tor-relays] Anonbox Project - Mike Perry" https://lists.torproject.org/pipermail/tor-relays/2014-October/005541.html 3. "[tor-relays] Anonbox Project - Roger Dingledine" https://lists.torproject.org/pipermail/tor-relays/2014-October/005544.html 4. "[tor-talk] Cloak Tor Router (thread)" https://lists.torproject.org/pipermail/tor-talk/2014-November/035436.html 5. "Onion services" came in behind "Tor sites" because sites felt too web browser focused. we're trying to avoid the legacy "hidden services" nomenclature. 6. i have a long history of extreme dislike for encrypted email, key servers, web of trust, and other moral hazards. however, if you encrypt to my key you can send private mail, if desired. note that some encrypted email clients will fail insecure if the intended recipient doesn't match a keyring identifier! https://peertech.org/keys/0x65A847E7C2B9380C-pub.txt

2 2

Re: Backward compatibility bites again (like RC4 in WPA2), "Cryptanalysis has been seen of RC4"
by coderman 03 May '15

03 May '15

On 3/3/15, coderman <coderman(a)gmail.com> wrote: > ... >> 2015, RC4 still in WPA2, WPA2 still in everything, ... regarding Snowden in Princeton, https://www.lightbluetouchpaper.org/2015/05/02/meeting-snowden-in-princeton/ "There’s no evidence of a “wow” cryptanalysis; it was key theft, or an implant, or a predicted RNG or supply-chain interference. _Cryptanalysis has been seen of RC4_, but not of elliptic curve crypto, and there’s no sign of exploits against other commonly used algorithms." RC4 still in WPA2 (targeted attack) allowing decryption of collected signals. this is why VPN is necessary over WiFi networks regardless of WPA2 security settings in the Tor router requirements. best regards,

1 0