- cypherpunks@lists.ogf.org

What the dear NSA allegedly mean by "Mystic site"?
by Georgi Guninski 08 Feb '15

08 Feb '15

>From cryptome: http://cryptome.org/2013/11/snowden-tally.htm 19 May 2014 12 Various Pages 12 http://cryptome.org/2014/05/nsa-intercept-14-0519.pdf p. 2 of the pdf: "Approx 10-15 SIGINT reports pers week from "Mystic sites" other than Sca....." 1. What does "Mystic site" mean to the dear NSA? 2. Is "site" in the usual computer sense?

3 3

OpenBSD 2015 Fundraising Campaign
by why not 08 Feb '15

08 Feb '15

Hello, I just want to spread the word a little bit by saying the OpenBSD 2015 Fundraising Campaign webpage is out with new hopes: http://www.openbsdfoundation.org/campaign2015.html Have a safe day.

1 0

ODNI Counsel: Governments Want Accessible Crypto from Business
by John Young 08 Feb '15

08 Feb '15

ODNI counsel Robert Litt is "optimistic" cryptographers will devise secure encryption which provides government access, it's "what many governments want." "One of the many ways in which Snowden's leaks have damaged our national security is by driving a wedge between government and providers and technology companies so that some companies that formerly recognized that protecting our nation was a valuable and important public service they could perform now feel compelled to stand in opposition." http://cryptome.org/2015/02/odni-litt-15-0204.pdf

4 4

healthcare & wearables
by brian carroll 08 Feb '15

08 Feb '15

(who says assassination politics is not alive & well..) Industry professionals create framework for measuring HIT value http://www.fiercehealthit.com/story/industry-professionals-create-framework… "Healthcare professionals have created a framework for measuring health information technology with a goal of making "HIT evaluations more relevant to the current needs of the healthcare system," according to a paper published at the American Journal of Managed Care..."

1 0

OnionShare - what do you think about this piece of software?
by Александр 07 Feb '15

07 Feb '15

https://github.com/micahflee/onionshare https://onionshare.org/ Well, it's too "young", but it's OpenSource and the idea is good. any thoughts?

5 7

Confidant Mail binaries for TAILS and MacOS
by Mike Ingle 07 Feb '15

07 Feb '15

Confidant Mail 0.20 is available at http://www.confidantmail.org No major functional changes, but there are ready to run binaries for TAILS Live CD 1.2.3 and MacOS 10.9 Confidant Mail is an encrypted, and optionally Tor-anonymized, email system supporting large file transfers. Mike Ingle <mike(a)confidantmail.org> d2b89e6f95e72e26e0c917d02d1847dfecfcd0c2

1 0

Re: [tor-talk] Fwd: I Encourage Everyone, Right Here And Now, To Donate Money To His Three Main Security Programs, Which He Uses The Most!
by grarpamp 07 Feb '15

07 Feb '15

On Sat, Feb 7, 2015 at 2:52 AM, Lara <lara.tor(a)emails.veryspeedy.net> wrote: >> when2plus2is5(a)riseup.net: >> In addition, Facebook and the online payment processor Stripe each >> pledged to donate $50,000 a year to Koch’s project. Useful. > So Facebook is not that evil after all. But on balance, merely a political photo op. http://en.wikipedia.org/wiki/File:PRISM_Collection_Details.jpg http://en.wikipedia.org/wiki/File:Prism_slide_5.jpg http://news.sciencemag.org/social-sciences/2015/02/facebook-will-soon-be-ab… http://www.cracked.com/quick-fixes/5-terrifying-ways-google-facebook-are-us… http://www.businessinsider.com/10-reasons-to-delete-your-facebook-account-2… https://www.eff.org/deeplinks/2010/04/facebook-timeline/ http://buzz.money.cnn.com/2014/07/01/facebook-evil-stock/ http://pitweston.com/facebookevil/

2 2

Calyx institute announces canarywatch.org web site
by Seth 07 Feb '15

07 Feb '15

"Warrant canaries rely upon the legal theory of compelled speech. Compelled speech happens when a person is forced by the government to make expressive statements they do not want to make. Fortunately, the First Amendment protects against compelled speech in most circumstances. In fact, we’re not aware of any case where a court has upheld compelled false speech. Thus, a service provider could argue that, when its statement about the legal process received is no longer true, it cannot be compelled to reissue the now false statement, and can, instead, remain silent. So far, no court has addressed this issue." https://canarywatch.org/

4 6

Re: Tox.im
by Markus Ottela 05 Feb '15

05 Feb '15

On 03.02.2015 20:38, rysiek wrote: >> yet the source of randomness and crypto implementation are not explained >> properly. The wiki talks about public keys and PFS without explaining >> the relation between the two. >> https://github.com/irungentoo/toxcore/blob/master/docs/updates/Crypto.md > ACK. So, the PDF I linked to goes a *bit* further (just a wee bit). Go > have a > look at the "Crypto" section: > https://jenkins.libtoxcore.so/job/Technical_Report/lastSuccessfulBuild/arti… > > > So, at least not a "we hold your keys -- FOR SAFETY!!1!" kind of > snakeooil. > Half of an "AOK" from me here. > Just because it could be worse doesn't mean it couldn't be better. Thanks for the whitepaper, I'll have a look when I've the time. >> *5. There is no threat model* >> "/With the rise of government monitoring programs/" implies it's >> designed to be secure against state surveillance. >> "Tox does not cloak IP addresses when communicating with other users" >> In disclaimer it is also just stated that >> "/Tox prevents message contents from being read or altered by third >> parties, or anyone else other than the intended recipient/", yet it >> doesn't even bother to evaluate the system against HSAs or MSAs. > True. One has to consider their own threat model and assess if Tox is the > answer. Tox does *not* provide anonymity, it at least *tries* to > provide OTR- > like features (encryption, integrity, etc.). > IIRC the DH signing keys are bound the the account ID. Appelbaum recommended in his 31c3 talk 'Reconstructing Narratives' that users rotate their OTR keys often and verify the hash using off-band channel. I'm not sure it's a convenient thing users have to re-add their contacts every time the DH signing key needs to be refreshed. It's sort of good thing users are immediately using the public signing key (Tox ID) but the issue is, while the Tox ID doesn't have to be secret, it must be authentic: so users unaware of this can be subjected to MITM attack. >> *7. Neglects general sad state of host security * >> > Well, yes, and my beef with Tox is also that the private keys do not > require a > passpharse to unlock. So that's a no-no in my book. This only changes the type of attack: a keylogger has to be used along the private key exfiltration tool. > Still, this doesn't look like snakeoil; rather like a good idea with > not-so- > stellar execution, which *might* get better. > > Am I missing anything? > I would argue the current OTR/PGP/ZRTP implementation has limited lifespan regardless of execution, given the fact intelligence community is expanding end-point exploitation to mass surveillance levels: methodology is changing, not the scale: https://www.youtube.com/watch?v=FScSpFZjFf0&t=37m35s There's a lot of misconception on 0-days being expensive 'one-time-hacks' that must be used only when necessary. How many anti-virus programs detect and report these? What percentage of users are running some sort of IDS? How many users assume sudden system crash is due to malfunctioning exploit/payload? A 0-day is more like a master key for given OS with average lifespan of 300 days ( http://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf ) > Could we have a *separate* thread for it? I'm really interested in > having a > more in-depth discussion of Tox and this could potentially hi-jack this > thread. Much obliged. > I agree it should be separate. I tried to keep that section short and the intention was to provide contrast and show each of these can be addressed simultaneously.

8 20

Re: Pixel Dust Is Futile like FOIPA
by coderman 05 Feb '15

05 Feb '15

On 2/5/15, John Young <jya(a)pipeline.com> wrote: > Peter Gutmann's pixel dust protection of privacy works as > an update for faith in elaborately futile shenanigans to evade > and to nab evaders inherently implanted in fetuses then re-implanted > in corpses: dust to dust... speaking of pixel dust futility, US Marshals sent back a tracking pixel nope, need vetting. ''' We sent you a form to have you certify your identification. You have not replied to this certification. We also ask you to clarify the information you were seeking as you were unclear in your request. See highlighted portion of our email below. << insert honeytoken >> '''' - https://muckrock.s3.amazonaws.com/foia_files/WRD000_630.jpg [ or was it muckrock failing protectively? or both? or one as cover for the latter? ... *grin* ] --- request to DHS rejected on specificity grounds, cycle continues, , hey John, want to file FOIPAs through MuckRock like the fucking mad you are? :P

1 1