- cypherpunks@lists.ogf.org

Re: www.nsa-observer.net
by John Young 04 Feb '15

04 Feb '15

Swell initiatives by all the Snowden distributors. Except most fall prey to PDF manipulation of tagging, implanting, tracking, by willful intent or by technical ignorance. It is virtually impossible to sanitize PDFs due to Adobe's inherent design to meticulously spy on use of its products as well as deluded user attempts to hide who, when, what, how by users from creation to modification to wiping to stego to signing to forging to stinging. Image or accessible-text or other PDF formats, locked, redacted, watermarked, et al. Well behind and below the metadata Adobe allows users and abusers to see, lurks Adobe's advanced persistent meta-meta to aim for NSA/Tor-multi-level obscurantism by which accessible meta is used to hide inaccessible. Below dark is darker, ever darkening as new tools are developed to pry farther into the less visible and off-oscilloscopic spectrum. DoD issued today a short directive on the Center for Countermeasures and Counter-Countermeasures (including cyberweapons like PDFs). Presume NSA, aided by Adobe, has tracked, will track, Snowden's material in all its iterations from the time he snatched it to the latest distributor, consumer and secret archiver in Oahu, Maryland, Hong Kong, Berlin, Rio, NYC, DC, online and off. PDFs (and DOCs) are more treacherous than log files, backdoors, 0-days, APTs, what have you due to their popularity. HTM and TXT are much safer. Courier fonts are safer than other fonts, especially those promoted by Adobe and others who use fonts to spy (all rationalized as protection of IP -- ie, comparable to natsec). At 09:29 PM 1/30/2015, you wrote: >On 1/30/15, grarpamp <grarpamp(a)gmail.com> wrote: > > https://www.nsa-observer.net/ > > https://github.com/nsa-observer/ > > > > fyi, coderman et al. > > >thanks, checking them out. one thing i don't see mentioned is how the >OCR was performed. same as Reuters DocumentCloud service, or open >source tool, or ? > >next bigsun update will demonstrate this challenge better, as i am >using a handful of techniques for text extraction, character >recognition, and annotation, as well. in a sense, this is how the >sausage making gets started... > >(i will see if there is a convenient way i can feed back out again, >like to nsa-observer, since bigsun is intended to be operated entirely >within hidden services - no public services, especially not github or >document cloud) > > >best regards,

8 10

Re: www.nsa-observer.net is on clear web, don't use clear web.
by coderman 04 Feb '15

04 Feb '15

On 2/4/15, grarpamp <grarpamp(a)gmail.com> wrote: > ... > Moving 10G/day/node to or from clearnet is possible. Posting in the > darknet might find you parallel armies of sympathetic nodes willing > to help with task. don't use clear-web, not even once. not even one-way. it is DEF CON wireless; pre-pwned and malicious since many years. this includes: - don't use DNS - don't use HTTP over public IPv4 or IPv6 - don't use HTTPS over public IPv4 or IPv6 - don't use TCP over public IPv4 of IPv6 - do use UDP VPN at least past first last-mile ISP, most likely to be onery and RST'ery. - do use Tor bridges to avoid like UDP VPN above, with even better cover. - must use resume capable HTTP/1.1 range based capable client with secure digest verification! (multiple reports of cryptome.org streams of Cfour.7z getting RST inline, or otherwise frequent and frustrating failures before complete on some specific provider networks; bonus points for RST inject filtering, but not all OS support it.) for array of onion hosts (location hidden mirrors) - 5 x connections, to 5 of 9 onions, max two conns per host - 18 x connections to 9 onions, two conns per host [ e.g. aria2c --piece-length=1M --min-split-size=1M --split=18 --max-connection-per-server=3 --max-concurrent-downloads=18 ... aria2c does sha256 for free ] => 1.8MByte/sec to 3.5MByte/sec sustained over 50G archive in whole over various rounds of testing the fy2014 dist. add randomized filling, and you can stack parallel instances with multiple Tor clients for added capacity. ... anything more seems limited by client side, even in best of circumstances ... hey look, latter is simpler! two things to solve it. ;) best regards,

1 2

www.nsa-observer.net
by grarpamp 04 Feb '15

04 Feb '15

https://www.nsa-observer.net/ https://github.com/nsa-observer/ fyi, coderman et al.

6 9

get chipped at your local tattoo parlor
by brian carroll 04 Feb '15

04 Feb '15

Swedish office gets under employees' skin with RFID microchips; Forget your office door key? Can't remember the code for the photocopier? No need to worry if you happen to have a microchip implanted in your hand. // (2.3.2015), 2 min. video http://www.cnet.com/news/swedish-office-gets-under-employees-skin-with-rfid… in-article reference, (9.12.2014): The rise of the Swedish cyborgs By Jane Wakefield Technology reporter http://www.bbc.com/news/technology-30144072 '"The idea is to become a community that is why they get implants done together," [Mr Sjoblad] says.'

3 2

Re: www.nsa-observer.net
by John Young 04 Feb '15

04 Feb '15

Forensics of paper docs, by, say, FBI, examined paper constituents (ecology of trees, soil, tree-cutters, haulers, pulp mill, paper mill, coating mill, shipping containers, distributors, sellers, buyers, lenders), inks and their constituents, human and machine handling and using and transmitting detritus, attempts to camouflage, divert and hoax. Forensics of digital docs do all this and much more from creation to transceiving, forging, hoaxing, tracking, calling home, so forth. Coupled with the Internet and commodiously ID'd digital processing devices from manufacturers of programs and devices to the poor user blocked from seeing the galore of peeping toms, diverted by promises of privacy and comsec from, sad to say, promoted by orgs receiving funds from the.manufacturers to play that very user narcosis role, what can be done? If a bio-hazard suit promises protection from ecological hazards, what digital-hazard suit is available not contaminated with data siphoning of the wearer like products tagged for sale to end of world believers. Crypto is trap- and back-doored and corrupt, so it is warned by those offering an NSA career in the womb of Rosemary's Baby, privacy is delusionary, so it is preached by those inviting into OTR communities filled with Google-SM-informants and XXers, openness worse deception than official secrecy, so blind-justice visionaries reveal and beckon to get off the grid and underground deep and dark far away from the electromagnetic spectrum -- quanta-land, teleportation nirvana, across rivernet of Styx Stux. Remember when cpunk seers cautioned commodiously of sinister authorities and their vilainous contractors, and encouraged heroically to assassinate them anonymously? Remember the gradual hiring of those seers to remain in place while aiding and abetting the authorities as contractors to invent and promise comsec and privacy and anonymity, generously trap- and back-doored and trojaned and Call Homed tracing the arc of Snowden and gobs of others requiring forenics to counter and counter-counter forensics of fora like this, like Post-Snowden journalism enthralled with the adopting of secure drop boxes, leak sites, secure comms, PK swaps and signings, to camouflage long-standing lunches and briefings with officials to agree on what can be slipped into public perception of acceptable corruption to hide the unacceptable. Adobe brags PDFs can simulate paper docs exactly. Indeed, and much more forensically easy. At 02:16 AM 2/1/2015, you wrote: >On 1/31/15, Jason McVetta <jason.mcvetta(a)gmail.com> wrote: > > ... > > For Ubuntu users: > > > > sudo apt-get install libimage-exiftool-perl > > exiftool -a -G1 > > adobe-acrobat-xi-scan-paper-to-pdf-and-apply-ocr-tutorial-ue.pdf | less -S > > >per the python PDF tools, (with varied options), > or reduced option command line pdf2txt, or pdftotext, or > also: > >strings --bytes=$varlength ... with varying --encoding= ... , for as >John mentioned, all the metadatas and annotations typically unseen, > > >consider that the specific "configuration and input parsing" as a >"profile" for a given "input document" identified by "self certifying >identifier" for all of the above results in collaborative simplified >text paragraphs as a working base. > >so sha256(generated corpora) == sha256(sha256(doc) ^ sha256(config of >parse opts) ^ sha256(parse-product) ) > >if i use a convenient generated slang, ... > >this means at least a dozen "to text" engines with configuration, >(parse opts and parse products) per input document as a working state. > >and ten to twenty times the input pages as simplified output text >paragraphs (common base) collected from the useful parts of the best >transformations, used for subsequent text based natural language >processing. > >in a sense, this is devops come to document processing, where the >process itself is embodied in version controlled and complete archives >with self certifying integrity. this means boring, and also done >decades ago, more or less, in varying contexts. everything old is new >again ;P > >there are a whole field of customer parser and data sets and scrapers >all dedicated to variations on this theme, although sadly they don't >live public lives, for the most part. > > >best regards,

2 1

[OT] pre-Snowden movie involving the dear NSA: "Travelling Salesman"
by Georgi Guninski 03 Feb '15

03 Feb '15

Off-topic, FIY, 2012 movie involving NSA: "Travelling Salesman": http://www.imdb.com/title/tt1801123/ >From the above trivia: > The film was made for under $10,000. > Principal photography was accomplished in just 10 days. > The film won 3 Awards at the 2012 Silicon Valley Film Festival > including Best Feature Film, Best Lead Actor, and Best Editing.

2 1

Tox.im
by Cathal Garvey 03 Feb '15

03 Feb '15

Anyone looked this over? I only just discovered it, but it seems nice: * P2P * Encrypted * Voice/Video/Chat/Files * GPL'd https://github.com/irungentoo/toxcore It's written mostly in C(++) with a dash of assembly, which worries me security wise.. -- T: @onetruecathal, @IndieBBDNA P: +353876363185 W: http://indiebiotech.com

9 15

China backdoors
by MrBiTs 03 Feb '15

03 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Not sure if somebody posted it, but: http://spectrum.ieee.org/tech-talk/telecom/security/chinas-new-rules-ask-te… CheerS - -- echo 920680245503158263821824753325972325831728150312428342077412537729420364909318736253880971145983128276953696631956862757408858710644955909208239222408534030331747172248238293509539472164571738870818862971439246497991147436431430964603600458631758354381402352368220521740203494788796697543569807851284795072334480481413675418412856581412376640379241258356436205061541557366641602992820546646995466P | dc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJU0QjeAAoJEG7IGPwrPKWrB4MH/137/TFnO1J0TiSDsDNdtUcO 6S8qRZFxZBTEu66STW58JJD9pzQQVulAQRZvUD+pPOXYlw8JMvLVcfthYMCXcA7q 2WokokB5IsGj9/clsy+uFZcImwWGKjikTqB2Kt6X+CU+O3fqklmIO7SrPBE6Qeao IPd597JoQcuOMLLfVzRIty44vYmvNRsgXi8aiHCJjtw3eMTzGFILzRyteTsD5Q3r 78FJyZY50b74yIc/3N47ho19im9JCXOsTm4uzO6bujHxAM7wFwxjXcrQUuG2nJ3l 5rPDWN/M2SJphVnNMWU3V0+sY/In6qAmbc9rZXyvYj6RgQu8rfELVz9dVP6x6Ck= =/tiP -----END PGP SIGNATURE-----

1 0

Wickr vs stef's seven rules of thumb to detect snakeoil
by Seth 02 Feb '15

02 Feb '15

Searched the cpunk archives and was surprised to find no mention of wickr yet. I thought I'd run it through stef's seven rules of thumb to detect snakeoil so here goes: * not free software - Closed source (although audited by Veracode) * runs in a browser - no * runs on a smartphone - yes * the user doesn't generate, or exclusively own the private encryption keys - unsure (displays a message about 'securing your phone using military grade encryption' during first app launch/sign-in, believe local keys are generated during this step.) * there is no threat model - (claims to be 'last messaging app standing with no 0days to date', claims nation threat attacks were expected from day one, claims zero knowledge company infrastructure server configuration) * uses marketing-terminology like "cyber", "military-grade" - displays message 'securing your phone using military grade encryption' during app setup * neglects general sad state of host security - unsure Additional notes: - Offers desktop app for Win/OSX/Linux since 2014/12 - https://wickr.com/ appears to require javascript to view - Founder Nico Sell is long time Def-Con organizer, founded Def-Con for kids (now called Rootz Asylum) in 2010 - Wickr company infrastructure security audited by iSecPartners

4 6

PSA: Archive of cypherpunks@toad.com
by Mirimir 02 Feb '15

02 Feb '15

See <http://diswww.mit.edu/menelaus/cpunks/N> for 0<N<122556. It seems complete, covering 1993-04-27 through 2002-08-17. Search would be sweet. Google with "site:http://diswww.mit.edu/menelaus/cpunks/" works, but the indexing is iffy, with no substring hits.

1 0