- cypherpunks@lists.ogf.org

List Administrivia
by grarpamp 30 Dec '14

30 Dec '14

I believe google may be offering to transmit a better combination than RC4-SHA. Please check configs on your receive end. Received: from antiproton.jfet.org (antiproton.jfet.org. [209.141.47.85]) by mx.google.com with ESMTPS id bar (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128) 30 Dec 2014 Received: from google.com (google.com [a.b.c.d]) by antiproton.jfet.org (8.14.4/8.14.4/Debian-4.1) with ESMTP id foo (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <cypherpunks(a)cpunks.org> 30 Dec 2014

2 1

Re: [tor-dev] Hidden service policies
by grarpamp 30 Dec '14

30 Dec '14

I've blocked Mike's known nodes from my configs as I simply do not agree with his apparent ethos in this regard. That being themes of censorship, policing, etc. It's better individuals decide for themselves, or upon peer input, than upon hard forms of tracking prevail. There is a lot of oppurtunity and in fact effecting the desired outcomes in permitting such freedoms. But only misunderstanding and debilitating hatred and lack of progress of society in such proposed controls as Mike hints at from time to time. In example via forum, the power of interpretation is upon the consumer, and is received by the publisher. There is feedback there such that the Mike's of the world need not be entertained.

1 0

Fwd: 78716A
by Ryan Carboni 30 Dec '14

30 Dec '14

Common Americans are no longer considered worth protecting as part of national security. ----------- Mr. Carboni, Thank you for providing the information below. We have conducted an initial search within the organization that is most likely to hold records. That organization advised that the request, as worded, is overly broad. Querying any of our organizations would likely result in the same response. The phrase “malware transmitted through USB firmware” is overly broad, such that any of our internal organizations would not be able to determine which files to search or be able to conduct a search with a reasonable amount of effort. Terms such as “malware” or “firmware” may turn up in any number of NSA records and most likely would not be related to securing home networks. Furthermore, added search without a clarification of context and specific records sought, would incur significant fees which would be passed on to you as an “all other” requester. A large facet of the NSA/CSS mission is to protect National Security (i.e. government, DoD, Industry partners) information systems. In doing so, this Agency provides guidance on Information Assurance security solutions to our Industry and Government customers regarding risk, vulnerabilities, mitigations, and threats. While it is not part of our mission to provide guidance on securing home networks, we may occasionally post information on our website as you may recall from our letter. Our Information Assurance Directorate (IAD) has provided some information to the public that may be of interest to you. Here are some additional links that you may peruse: https://www.nsa.gov/ia/mitigation_guidance/index.shtml https://www.nsa.gov/public_info/press_room/2014/nsa_seal_scam_alert.shtml (this is a recent article the does provides a link regarding malware) https://www.nsa.gov/ia/index.shtml The last paragraph provides a video link under “IAD's Latest Security Guide Helps Customers Protect Home Networks,” and there is also a fact sheet titled “Best Practices for Keeping Your Home Network Secure.” Since the information you appear to be requesting (protecting home networks) does not fall under the purview of NSA/CSS missions, continued search of our files would not be productive. Your request will be administratively closed as an improper FOIA. If, after reviewing the information on our website, you wish to submit a FOIA request on similar topic(s), please provide enough detail to allow for an accurate and focused search. Regards, Cindy B NSA/CSS FOIA Requester Service Center (301)688-6527

3 3

Re: [cryptome] Re: What the hell can be done with this trinity?
by Александр 30 Dec '14

30 Dec '14

Lodewijk, Thank you very much for your broad answer. Food for thought and action.

1 0

What the hell can be done with this trinity?
by Александр 29 Dec '14

29 Dec '14

>From the "Spiegel" article If all else fails, the NSA and its allies resort to brute force: > 1. They hack their target's computers/ > 2. > > They hack Internet routers to get to the secret encryption/ > 3. T > > hey intercept computers on the way to their targets, open them and insert > spy gear before they even reach their destination. Ok. Nothing new. But what the hell can be done with this trinity?

2 1

Question about something said about Tor in the Der Spiegel data dump
by Cypher 29 Dec '14

29 Dec '14

First, let me say I'm sorry if this is posted twice. My mail client gave me an error and, since I still haven't seen it hit either list, I'm sending it again. My apologies if this is a duplicate. So I'm looking through the Der Spiegel data dump and noticed the following statement on document 35543: "The client must not be running a Tor router of their own..." That made me thing of a few questions but I'm specifically wondering what they mean here. 1. Do they mean that it is confusing to them if I am connecting to the Tor network from a computer that also runs a relay but I do not have my client configured to use my relay or 2. Do they mean that it is confusing to them if I am connecting to the Tor network through a relay running on my own machine? Perhaps I'm not even asking this question correctly as it 'feels' like the wrong way. But I'm curious. What are your thoughts? Cypher

1 0

crypto from the trenches - #31c3
by coderman 27 Dec '14

27 Dec '14

"I don't have a revocation key or a subkey" - admission of guilt? this is sane practice compared to lesser alternatives of: - using revocations keys or subkeys improperly, leading to vulnerability or loss of access (denial of service) - not using crypto at all, out of frustration. - using non-end-to-end encryption, out of frustration. and in fact, if you have good operational controls and understanding, with defense in depth, this is a reasonable solution. --- one minute ago i mention my contempt for email in general, and my special contempt for encryption over email. (see list archives and threads by others :) VLC works best on SD streams: rtmp://rtmp.stream.c3voc.de:1935/stream/s1_native_sd , rtmp://rtmp.stream.c3voc.de:1935/stream/s2_native_sd , rtmp://rtmp.stream.c3voc.de:1935/stream/s4_native_sd , rtmp://rtmp.stream.c3voc.de:1935/stream/s3_native_sd web view is: http://streaming.media.ccc.de/saal1 http://streaming.media.ccc.de/saal2 http://streaming.media.ccc.de/saal6 http://streaming.media.ccc.de/saalg i watched watching http://ecchacks.cr.yp.to/ on rtmp://rtmp.stream.c3voc.de:1935/stream/s1_native_sd and it was flawless. this stream also flawless so far, on continuous feed over 3G on Android VLC. --- in addition to their report of hour for GPG over Email, i see 15-20 min for Tor Browser and Of-the-Record plugin to Onion XMPP on average. also 20min for Qubes minspec setup: ### Custom CoreBoot Qubes FDE boot: ### Boot command, at grub> prompt, type: configfile (ahci0,msdos1)/grub2/grub.cfg ### At disk passphrase prompt, type: aMiosowahcieFo2aLiewaibidoor4lie wae7ugaiFua5Yeushah3ahV6goowooyo ### When the graphical desktop starts, the user account password is: sunlight ### You will also need this password to unlock the screensaver if idle too long. DONE. You will now be in the Qubes R2 Desktop Environment! --- # Launching Document Editor 1. Open the Qubes Quick Launch Menu at lower left. 2. Select "Domain: editor" for the apps available in this VM. 3. Then click "editor: LibreOff..." to launch Document Editor (Libre Office) # Launching File Browser 1. Open the Qubes Quick Launch Menu at lower left. 2. Select "Domain: editor" for the apps available in this VM. 3. Then click "editor: Files" to launch File Browser. NOTE: The File Browser is also how you can see mounted USB devices and also where to copy files back and forth, or just explore. # USB Storage 1. Plug in the USB device. Ignore the message notifications at lower right. 2. Locate "Qubes VM Manager" Window. If you close by accident, re-launch. 3. In "Qubes VM Manager" Window Menu, select to highlight "editor" VM as row / item. 4. Right-click on editor for VM menu, select -> "Attach/detach block devices" 5. In the "Attach/detach" submenu, you should see your device listed. for example, "Attach: dom0: sdb 1863 GiB ST20000LM003_HN..." 6. Click this option to attach storage. 7. Launch "editor: Files" command, then select attached device at left sidebar. for example, "2.0 TB Volume" DONE! # To Shutdown, you should always shutdown "gracefully" to avoid file system issues. 1. Open the Qubes Quick Launch Menu at lower left. 2. Select "Leave" menu options, then "Shut down" 3. Confirm the shut down prompt, or wait 30 seconds. # Launching the "Qubes VM Manager" 1. Usually started by default, it can be re-started if closed. 2. Locate the System Quick Launch Menu at lower left. It is a blue Qubes icon. 3. Open Launcher menu, then "System Tools" option. 4. From "System Tools" menu, select -> "Qubes VM Manager"

1 0

Russia want completely ban Bitcoin and other cryptocurrencies
by Anton Nesterov 27 Dec '14

27 Dec '14

Ministry of Finance of Russia drafted a bill to ban cryptocurrencies with administrative or criminal penalty for mining and other operation. Also they want to censor bitcoin-related websites. This will come into force in 2015. http://top.rbc.ru/economics/01/08/2014/940521.shtml (in Russian)

7 17

Tribler also means you're an exit node?
by Ryan Carboni 27 Dec '14

27 Dec '14

Tribler also means you're an exit node? http://forum.tribler.org/viewtopic.php?f=2&t=6906 To quote: I received two copyright notices from Comcast while letting Tribler idle. > This is the first and only time I have received these notices. > > 1) I have not downloaded anything at all. Nothing. The test file popped up > to idle. Otherwise, not a movie of any variety, not even a linux ISO to > test. I had subscribed to a few channels. > > 2) These only came up after I installed Tribler and have left it idling. > > 3) I was not seeding anything. > > Infringing Work: The Newsroom > Filename: The.Newsroom.2012.S03E06.HDTV.x264-KILLERS[ettv] > Infringement Date: 2014-12-19 > Infringement Type: BitTorrent > Infringement Method: BitTorrent > IP Address: > Reporting Party: copyright(a)ip-echelon.com > > Infringing Work: Teachers > Filename: Teachers > Infringement Date: 2014-12-19 > Infringement Type: Movie > Infringement Method: P2P > IP Address: > Reporting Party: support(a)cegtek.com

4 3

Re: Tribler also means you're an exit node?
by Ryan Carboni 26 Dec '14

26 Dec '14

> > It is also chock-full of child-porn torrents, based on my limited > testing. So not only are you exposing yourself to copyright infringement > suits.. > downloading "crypto" anything when it is being hyped is a bad idea only because news reporters need to receive training from their sources to do crypto anything.

1 0