- cypherpunks@lists.ogf.org

GPAs vs todays anonymous overlay networks
by grarpamp 06 Apr '15

06 Apr '15

On Mon, Apr 6, 2015 at 10:03 AM, Alexis Wattel <alexiswattel(a)gmail.com> . > https://cpunks.org//pipermail/cypherpunks/2015-April/007186.html > traffic analysis/correlation is not part of their threat model. The problem > is that it is nowadays a definitely proven capability of adversaries. > They say that randomized wait times at each relay would make the traffic too > slow. The delay parameters must be specified before using words like "too slow[ed]" to describe the relative impacts to the full path. Further, relevance to chosen application must be considered. Some users do realtime HS2HS text/voice/video over it. > The other solution, randomized length of packets with dummy padding > discarded at each relay would impact even less on responsiveness. Using a fixed length cell network and keeping links otherwise full of chaff of said length is interesting defense to GPA correlation attack. Random length cells, even if some cars are removed, still form a uniquely identifiable train (particularly at entry/exit). Thus not useful. > deliberate desire of keeping Tor at government's reach [queue usual comments on funding, centralized dirauths, TCP only, etc] It's opensource, fork it.

1 0

How to have your encrypted mail in two places at once
by Mike Ingle 05 Apr '15

05 Apr '15

IMAP and webmail makes it easy to access your mail on two or more machines, and have all your folders stay in sync. Encryption tends to break that: your inbox might work across machines, but your Sent Items and personal folders tend to be stuck on one machine. Confidant Mail 0.24 has a solution for that problem. You can have the same GPG key on two or more machines. Using a secure replication protocol, your sent items, read status of incoming mail, personal folders, and deletions are all automatically copied to the other machines. This provides an IMAP-like experience with encrypted mail. I am looking for advice on how to implement a mobile client: Option A is to re-create the current client functionality for the mobile platforms. That is a lot of work, and I am not experienced in mobile programming. There is a port of gpg to Android, but I don't know how good it is. I know zero about Apple. This has disadvantages: for example, if I receive a 1GB message at home, there is no way for the phone to get only part of that message. It needs the whole message to check the signature. The worst problem, however, is that you are carrying your private key around with you. Phones are not secure and cannot be made secure. The carrier has root on the phone, whether you do or not. Phones are easy to physically take, and do not have trustworthy encryption. I do not want my GPG key on my phone. Option B is three-tier client server. Your PC at home has the private key, and talks to the Confidant Mail server. It also exposes a port which the phone accesses over a secure connection. The phone can request parts of messages, and the PC does the GPG encryption and decryption. This has the advantage that the phone client is smaller, the big message problem is solved, and the exposed key problem is solved. The middleware on the PC could have constraints such as not allowing the whole mailbox to be downloaded, and logging itself out after some number of failed remote access attempts. The downside is you need a PC running, you need to be smart enough to expose a port, and the PC is sitting there unattended, with the private key in memory, waiting for someone to come and grab it. Option C is a mobile web client. Similar to B, but instead of a client-server protocol, it uses HTTPS and generates mobile friendly HTML. Advantages relative to B are that one client supports all the mobile platforms, and there is no mobile code to write. Disadvantage is that the mobile browser is pretty easy to hack, and there is likely plaintext cached in the phone at any given time. Anyone who needs strong security probably should not use a mobile device. However, many people will want access to Confidant Mail on their phones. Do you have an opinion on the right way to provide it? http://www.confidantmail.org/forums/index.php?topic=27.msg47 Mike Ingle <mike(a)confidantmail.org> d2b89e6f95e72e26e0c917d02d1847dfecfcd0c2

5 9

Re: Warrant Canaries
by Softy 05 Apr '15

05 Apr '15

But that is the point of why there is no safety in "everyone flouting the law". Everyone is breaking the law and the persecutors get's to cherry pick who they will target. Most likely a pleasant mix of high profile (with trivial/non-existent penalty) and peon targets (with disproportionate penalty). Consider various Jay Walking, Loitering, Trespassing laws which exist in every town. Do all people always use the crosswalk? Do the persecutors ever ticket people? Not if the Mayor or Business Man Alpha are jay walking, but if I shout to a persecutor driving their armoured patrol car "get off the cell phone" ... you can bet your sweet un-free, psuedo-liberty ass I would be. > On 04/01/2015 05:26 AM, Andrew wrote: > > flouting the law and thereby render it ineffectual > > works... IF EVERYONE cooperates to flaunt, flaut, and disregard it. > > Could you IMAGINE the gubmint trying to take every internet provider and > major website operating in the US to court? > >

2 1

Re: Fwd: Warrant Canaries
by Ryan Carboni 05 Apr '15

05 Apr '15

I am a thousand feet tall platypus-bear, prove me wrong. On Sat, Apr 4, 2015 at 3:33 PM, Lodewijk andré de la porte <l(a)odewijk.nl> wrote: > On Apr 5, 2015 4:29 AM, "Ryan Carboni" <ryacko(a)gmail.com> wrote: > > > > IANAL, but laws are pretty clear. You cannot change your behavior in any > way that a jury could judge would lead to someone being tipped off. > > This could force you to behave in any which way. It's a completely > ridiculous law that expects superhuman feats of deception from every > citizen. Many (all?), for example, cannot help but show it when they lie > (generalized: hide the truth). Being a bad liar is a crime? Ok, wow. > > Having laws dictate what you should do instead of shouldn't do... > absolutely retarded. > > Good luck there. >

1 0

Fwd: Warrant Canaries
by Ryan Carboni 05 Apr '15

05 Apr '15

IANAL, but laws are pretty clear. You cannot change your behavior in any way that a jury could judge would lead to someone being tipped off.

2 1

Fwd: [tor-talk] Hi!
by bbrewer 04 Apr '15

04 Apr '15

Moral outrage from anyone here? Not I, per se, but curious to the politicks on-list. -Benjamin > Begin forwarded message: > > Date: April 4, 2015 at 12:51:55 AM EDT > From: mail4torlist(a)Safe-mail.net > To: tor-talk(a)lists.torproject.org > Subject: Re: [tor-talk] Hi! > Reply-To: tor-talk(a)lists.torproject.org > > Well in short, I used TOR to create and run HYIPs ("investment" programs that offer outrageous returns - Ponzis), various programs during about 8 years. Using e-currency (e-gold, libertyreserve, perfect-money, e-bullion etc). Cashing out e-currency with anonymous debit cards or bank accounts opened online with false scans (documents, photosop!). Net profit about 10 millions bucks. All runing through TOR! > > But this isn't possible so easy now, due to bank controls.. At the good old time, debit cards allowed, in "good" countries, withdrawals of thousands of bucks every day... Ah I remember the bags full of cash, LOL! > > Thank you TOR, thank you e-gold (founders got arrested), libertyreserve (founders got arrested), ebullion (founder got arrested for murder and is now sitting in death row), perfectmoney (still running but they are friends and got a nice percentage in exchange of they close their eyes))) > > Sure that isn't of a high morality level, but look: People decided by themselves to send me money, expecting to get 100% return by month (My average promised rate :) > > As somebody said, one idiot gets born every minute... > > >> I'm writing about Tor for my Ethics module. Do you guys mind if you tell >> me some malicious uses with Tor? Anything will be of great help. Yeah I >> already know of the basic or common use cases. :) > > > mail4torlist(a)safe-mail.net > -- > tor-talk mailing list - tor-talk(a)lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

2 1

How I Wish You Were Here...
by grarpamp 03 Apr '15

03 Apr '15

https://www.youtube.com/watch?v=wYa1Wmb2f8Y Musician and bitcoin believer Andrew Kalleeen shows us how to stand up for our rights as sovereign human beings with calmness dignity and grace.

2 1

Re: FOIPA adventures ending in "No record letter mailed"
by coderman 03 Apr '15

03 Apr '15

On 4/3/15, coderman <coderman(a)gmail.com> wrote: > ... > does this happen very frequently, i wonder? (i feel another FOIA coming > on... :) https://www.muckrock.com/foi/united-states-of-america-10/psdos-17156/

2 1

Fwd: Warrant Canaries
by Steven Schear 03 Apr '15

03 Apr '15

My thinking, when I first proposed what are now called Warrant Canaries, was to rely on the U.S. constitutional protection against ex post facto. In the same way that you can never know what laws might someday be passed which could criminalize current, lawful, behavior or speech, a service can never know in advance if they might someday receive a warrant or NSL. Can someone be compelled to refrain from free speech because someday that speech might be prohibited? If more than one person is engaged in the creation or publication of a Warrant Canary could it be viewed as a conspiracy? Can someone be compelled to speak falsities under court order? Until there are prosecutions which reach high enough in the Federal courts we may not know. Steve On Wed, Apr 1, 2015 at 8:32 AM, Stephen D. Williams <sdw(a)lig.net> wrote: > On 4/1/15 5:26 AM, Andrew wrote: > > Alfie John: > > On Mon, Mar 30, 2015, at 10:01 AM, Steven Schear wrote: > > Looks like Australia has banned use of my idea. > http://boingboing.net/2015/03/26/australia-outlaws-warrant-cana.html > > If its true that a man's status can be measured by his enemies.. then > I've taken a position at the top of the cypherpunks heap :) > > How about the reverse? As the point of canaries is to let people know a > warrant is in place while thinking that you're not breaking any laws by > telling them (good luck), hypothetically why not just be up front and > tell people that a warrant is in place via a tor and a hidden service > (let's call it WarrantWatch). Each post is a message from an admin of a > website saying that a warrant is in place, with the message being signed > via the website's TLS private key for verification. > > Alfie > > > So, you're suggesting that instead of going into a legal 'gray area', > website operators should simply obviously violate the law and then > publish a non-repudiable cryptographic proof of their lawbreaking. > > Am I missing something here? Is the idea to get everyone flouting the > law and thereby render it ineffectual, or is it just April Fools? > > Andrew > > > The point of a warrant canary is to communicate in a legal way something > that is illegal for you to communicate directly. That involves something > like setting laws against each other in some prioritized way or otherwise > splitting hairs so that no one can technically be prosecuted. It is a bit > of a legal arms race. > > You have to find something you cannot be compelled to do or not do. A > dead man's switch of some kind where not doing something is ambiguous and > unassailable. Can you be required by law to go to Starbucks every > morning? To report or not report on Facebook something factual, like you > ate Wheaties that morning? You have a headache? Something that is > protected by a higher priority law, although if the First Amendment is > trumped by these laws that's going to be difficult. Perhaps a group of > people probabilistically do or not do something, but any evidence of > collusion would be a problem so they would have to act independently. Some > mechanism that relies on someone's thoughts might be sacrosanct. Visual > dwell, polygraph (not that they work at all), etc. > > Perhaps every day someone proposes that the warrant canary has triggered, > and every day but one someone objects. > > Is there or is there not a way to do this legally? That seems like a gray > area, if the First Amendment is trumped, along with other legal protections > that could apply. > If there is no way to do this legally, what are the ways to dilute the > situation as to be effectively legal, i.e. prosecution would be unlikely or > ineffective? > Since the First Amendment is strained here, reasonable people could > conclude that the conflicting law is unconstitutional. That could lead to > a sense of responsibility to do the right thing. > > sdw > >

1 0

Re: Firefox 36+ listens on UDP:1900
by Ryan Carboni 02 Apr '15

02 Apr '15

> > More importantly, they ditched off their lead developer, > Brendan Eich, the creator of javascript at Netscape times, > because of made up gay-related donation scandal. Someone donates to prevent gay marriage: BOYCOTT HIM Someone donates to the political campaign of a war monger: eh, big deal. Government funds terrorists: eh, big deal.

12 25