- cypherpunks@lists.ogf.org

What Is Good Encryption Software?
by John Young 28 Nov '14

28 Nov '14

Reader asks: What Is Good Encryption Software? http://cryptome.org/2014/11/what-is-good-crypto.htm I have contacted you asking about certain security questions. After reading a few of the Snowden leaked documents, I have started to be more aware of my privacy being at risk. I have a few questions concerning certain programs and safety tips. First, I've recently started to doubt about my encryption software. Is Symantec's "PGP Endpoint" a good hard drive encryption software? In other words, is it trustworthy since it is an American company. And if not, what encryption software is the best for Mac. Second, is "ProtonMail" as secure as they say it is? If not, what email provider doesen't let the NSA see into my account. Third, is Jetico inc's "Bestcrypt Container Encryption" trustworthy? If not, what could be an alternative. Fourth, are these encryption types good? Blowfish, Gost & AES - 256bit. And which encryption type remains the best above all? Last, is Kaspersky a good anti-virus software? If not, which one is the best for Mac. ----- Important, difficult questions, likely to produce a range of answers. We will publish for answers.

2 1

Re: Delivery Status Notification (Failure)
by coderman 28 Nov '14

28 Nov '14

On 11/28/14, Mail Delivery Subsystem <mailer-daemon(a)googlemail.com> wrote: > Delivery to the following recipient failed permanently: > > cryptography(a)metzdowd.com speaking of failures, nothing expresses my contempt for email like a gmail account :) happy plain text holidays!

1 0

Re: [Cryptography] STARTTLS, was IAB Statement on Internet Confidentiality
by grarpamp 28 Nov '14

28 Nov '14

On Tue, Nov 18, 2014 at 11:29 PM, John Gilmore <gnu(a)toad.com> wrote: > Censorship of customer communications is always a "best practice" > according to some people. Blocking communications based on the port > number in use? Today some people on this list tried to tell me that 'Port 25 is SMTP'. That's funny because I use it for SSH. > That seems to many people to be heinous, > "picking winners and losers", discriminating against > traffic based on what the endpoint services are, etc. Wasn't > Network Neutrality supposed to outlaw all such discrimination? Yes it was. > Or, is it a catchphrase for "only the politically correct people > are allowed to censor or discriminate against traffic"? It's doublespeak now, said political promises vanish once elected. If the discriminators get their way you better hope you have real estate in the Balkans. > The fact that some ISPs covertly built that censorship into a > supposedly transparent network must be why I never get any spam these > days. But it doesn't matter to zealots whether their methods actually > work or not. They're mad at spammers, and "Hulk smash" is their main > response. Reason, principle, protocols, and respect all went out the > window. > > Anti-spammers have done far more damage to the Internet than spammers. > Now they are claiming that we can't be permitted to encrypt our > Internet connections because then their censorship scheme would stop > working? Yes they are. You better encrypt the net now before they're able to inject that power twist into arguments of political arms. > I don't see any spammers claiming that end users should not > be permitted to encrypt their emails nor any other traffic. To take > the privacy of our communications into our own hands, it is the > anti-spammers who stand in our way, not the spammers. Just like AdBlockPlus, user's mail clients should be shipped and extensible with simple local filtering spam/virus/malware processing engines. Users, having no such simple plugin tools available to them in early days, complained of spam which drove provider/anti filtering more than providers separate ability to handle the traffic load did. All the anti position did for providers was shift their cost from disk spool storing it to cpu rejecting it. And users got censorship tools developed and deployed against them in return. Failure! Users need to do their own filtering and encrypt now. >> Here, for example, is a >> recommendation on the topic that MAAWG published in 2005: >> >> https://www.maawg.org/sites/maawg/files/news/MAAWG_Port25rec0511.pdf > > Exactly -- an anti-spammer group, the "Messaging, Malware and Mobile > Anti-Abuse Working Group", MAAWG. Hmm, there seem to be more M's in > there than in their domain name. Perhaps once they started advocating > censorship for one reason ("Messaging"), they found all sorts of > other reasons for it, too. When you have a censorship hammer, every > problem looks like a need for censorship. > > John Gilmore > (who regularly, daily, gets his personally typed emails - just > like this one -- censored without recourse, by the ISPs of > recipients who rely on unreliable third party censorship > blacklists.)

2 1

Microsoft Root Certificate Bundle, where?
by grarpamp 28 Nov '14

28 Nov '14

MS root cert docs indicate they switched at vista from manual/auto downloadable updates to some form of OS online on the fly only auto update system. Where link at microsoft can one still download a file containing their entire current root cert bundle in some parseable format? It has to be somewhere near here but I'm dense today... http://social.technet.microsoft.com/wiki/contents/articles/3281.introductio… ex: mozilla is here https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/b…

4 6

Deanonymisation of clients in Bitcoin P2P network
by grarpamp 27 Nov '14

27 Nov '14

http://orbilu.uni.lu/handle/10993/18679 Biryukov, Khovratovich, Pustogarov Nov-2014 Bitcoin is a digital currency which relies on a distributed set of miners to mint coins and on a peer-to-peer network to broadcast transactions. The identities of Bitcoin users are hidden behind pseudonyms (public keys) which are recommended to be changed frequently in order to increase transaction unlinkability. We present an efficient method to deanonymize Bitcoin users, which allows to link user pseudonyms to the IP addresses where the transactions are generated. Our techniques work for the most common and the most challenging scenario when users are behind NATs or firewalls of their ISPs. They allow to link transactions of a user behind a NAT and to distinguish connections and transactions of different users behind the same NAT. We also show that a natural countermeasure of using Tor or other anonymity services can be cut-off by abusing anti-DoS countermeasures of the bitcoin network. Our attacks require only a few machines and have been experimentally verified. We propose several countermeasures to mitigate these new attacks.

1 0

Re: [Cryptography] Blogpost: CITAS, a new FBI security program proposal
by grarpamp 26 Nov '14

26 Nov '14

>>> http://www.metzdowd.com/pipermail/cryptography/2014-November/023693.html >>> http://dillingers.com/blog/2014/11/24/citas-threat-assessment-system/ >> let alone biased LE >> Heads up to Tor people, and cpunks to carve it up further. > This isn't the usual LE proposal Following on some related and technical comments... While my analogy and definition of security may not have been best suited, nor is this reply, the point remains that there is nothing special here for you as a corp. Anything you say that LE can provide for *you* with honeypots can also be sourced internally or from the open market and your subsequent call to LE to mop up upon discovery of badness therein. What is unique here is that LE will be classifying things learned from the HP's as gov't secrets. That's a hard problem. As opposed to telling you all of what you need to know to secure your own net under internal policies and vendor contracts that you would otherwise remain in control of. Further, technically, parking an HP on your net only tells you about what happens regarding via that HP, nothing else. And since you must distrust this other party HP [1], then all you've got is a cracked HP outside your trust zone, no different than any other box on the internet. It's limited vantage point and bogus security metrics argument. Sure, the US gov't might be able, on the whole from this, to correlate and expose more nation-state/international crime sources against the US and embarrass some foreign diplomats. That's always a good and fun thing [2]. And the services of LE are indeed valuable. However do not make the mistake of thinking that *you yourself* will benefit *directly* from this program, that's not what it's designed for or capable of. In fact, you will be left out as dog food in case of 'national security priorities/secrets' arise. The responsibility for securing your net still rests with you and you alone as always. The better way to be more secure is to ignore these silly sales schemes and look same effort at your own processes, weaknesses, code, OS/hardware, compartmentalization, etc. Maybe <=1% of that ends up being the use of HP's. Improve those own things overall and you'll be far better off. > This arrangement also strikes me as problematic in that it would also > allow the FBI to set up a huge pool of Tor, Gnutella, Bittorrent, etc, > nodes truly indistinguishable to users from genuine nodes run by people > who support anonymity, uncensored journalism, whistleblowers, and free > speech. Last, what if one day *you* _need_ to use a freedom network and they've sybil'd up their nodes *against you*? Be careful what you ask for and invite into your home in the name of security, you might just get it... applied against you in time of need. > economic output if it didn't cost so damn much to keep MS boxes > secure Well then the solution there is clear... get rid of the MS boxes, and those who sold and administer them. Like HP's, nothing special about MS either. Time limited I maybe not reply further. [1] For reasons of both sanity and legal insufficiency of any indemnity offered. [2] Note that some megacorps follow their own allegience... claiming the flag of whichever market suits them best at the moment.

2 1

Sign of New Order: US police kill boy, 12, carrying replica gun
by Georgi Guninski 26 Nov '14

26 Nov '14

http://www.bbc.com/news/world-us-canada-30172433 A 12-year-old boy has died after being shot by police in the US city of Cleveland, after carrying what turned out to be a replica gun in a playground.

1 0

Re: [Cryptography] Blogpost: CITAS, a new FBI security program proposal
by grarpamp 25 Nov '14

25 Nov '14

> genuinely seems likely to support rather than subvert security Security is not bringing more people onto your net or with you as partners, let alone biased LE. Do you let cops sleep in your house to protect you? What about that little dimebag you like to toke on Fridays? Besides, if they want the service, corps don't need LE to do what they can already do together neutrally on their own, or by subscribing to equivalent commercial honeypot services. What is this, infraguard 2.0? Clipper? Dept of redundancy? Big brother? TIA? Also, latency/TTL detection of remote hosting.. Heads up to Tor people, and cpunks to carve it up further. On Mon, Nov 24, 2014 at 8:24 PM, Ray Dillinger <bear(a)sonic.net> wrote: > Note to list participants: check the CC line of the original message > before responding. We are aware that this list is always monitored, but > this time I have explicitly invoked monitoring and explicitly invite > response. Hello Agent Chesson; feel free to join the (list and) > discussion if you have something to add or correct. It's a moderated > and usually very polite list, although events in the last couple of > years have caused some resentment and a great deal of distrust here > toward American Three-Letter agencies. > > Brief: The FBI is proposing a security service to assist American > companies in achieving network security. It is called CITAS, for > "Computer Intrusion Threat Assessment System." It is not an active > program yet; My impression that it is the proposal and brainchild of > special agent John B. Chesson and that he is actively trying to raise > support for it both within the agency and among its potential clients. > > This is one of very few proposals I have seen from any US agency that > genuinely seems likely to support rather than subvert security, in the > strict sense of owners retaining control of the assets they own. It > does not require backdoors, it does not require keeping insecure > plaintext traffic on the network, and it does not propose to compel > participation. > > What it proposes is that companies who join the service allocate an IP > address on their company's subnet for the use of the FBI, and the FBI > can then set up a honeypot at that IP address. Routers and switches in > the company's DMZ would direct traffic to the honeypot just as though it > were a company machine, leaving no clues to the contrary in route traces > or DNS, but the traffic would tunnel over some other channel, probably a > VPN, to a location controlled by the FBI. > > The honeypot would be physically located at and controlled by an FBI > data center. This does not imply that the FBI gets any > "behind-the-firewall" view of a company's network; the company's > firewall can distrust the honeypot just as much as it distrusts unknown > IP addresses out in the wild. > > The FBI would monitor the honeypots in real time for threats and > attacks, and when any "significant" threat or breach is detected, share > the information immediately with the subscribing company. > > Less briefly: > http://dillingers.com/blog/2014/11/24/citas-threat-assessment-system/ ‎ > > This arrangement strikes me as likely to be highly effective in terms of > security, because the FBI could leverage manpower and monitoring effort > across a huge pool of honeypots truly indistinguishable to attackers > from genuine targets. Effort spent by an FBI agent to understand and > script a log checker for a new threat would instantly apply to thousands > of companies via the honeypots sharing software, where the equivalent > effort spent by anyone else takes weeks to months to achieve wide > adoption, and never achieves wide adoption until after it is redone for > the nth time by many open-source volunteers. > > This arrangement also strikes me as problematic in that it would also > allow the FBI to set up a huge pool of Tor, Gnutella, Bittorrent, etc, > nodes truly indistinguishable to users from genuine nodes run by people > who support anonymity, uncensored journalism, whistleblowers, and free > speech. The data would, of course, be shared across all the usual > law-enforcement, espionage, and security agencies of the US. Although to > be honest, these services are already so heavily monitored that there is > little left to lose. > > Although Agent Chesson, whose presentation I attended, did not mention > these other uses, I would expect widespread adoption of this system to > mean effectively the death of "anonymous" P2P services such as Tor, due > to the simple fact of most of the gateway nodes being FBI-operated > sockpuppets. While Tor or something like it remains the only way in > most of the world to use the Internet for uncensored journalism or > whistleblowing, the FBI cannot possibly ignore that as a channel it is > also used by criminals. > > There is also some risk to the companies involved in the existence of > machines which they do not control but which have addresses publicly on > record as belonging to that company's subnet. They could experience > adverse public perception if a honeypot became publicly known as > someplace where an unsavory or criminal activity were happening and its > address were traced back to the company's IP block. > > > Ray "Bear" Dillinger > > > > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: [tor-talk] Propsal for decentralization of the Tor network
by grarpamp 24 Nov '14

24 Nov '14

> prove decentralization creates vulnerability to a larger degree > than centralization Maybe the centralization issue should revolve around things other than such two sided math proofs should neither side win... 1) There's expectation that some TPO-like entity will blackball known bad nodes, a non-human distributed authority (be it DHT or otherwise) doesn't permit that. Which is actually a non issue because users can simply subscribe to whichever trusted blackball source they desire. Onionland may still be providing some of these bad node listing services. AFAIK, that's the only real service Tor authorities provide today. The rest is under the hood of the *only protocol* in (3) below. 2) The network simply cannot run if some or all of the nine authorities are taken offline. Even users passing around their descriptors file and continuing to run can't be done because the code doesn't support that. So the network dies. Tor right now is like the centralized 'illegal' filesharing traffic model ie: Napster... every single central sharing service that had human figureheads in control of the network got shutdown. When the heat comes to Tor, it will get shut down if its fixed human authorities can't stand the heat. There are not an endless number of figureheads, but there are an endless number of users. For which, as with DHT torrenting and bitcoin, the responsibility for those networks is so distributed that it's pointless to try taking them down. Phantom, I2P, and a number of others are also distributed and seem to be working fine as well. 3) Bitcoin and torrent also work as protoools because all users agree that the protocol is *the one and only true protocol*, they are at risk if they change, so a self maintaining gravity is both present and natural. If there are forks, they don't last because users figure it out and abandon them or at least stop until the network figures itself out. This is why Tor bootstrapping isn't an issue either... you're unlikely to bootstrap yourself into a bogus network for very long, especially if you do reasonable research in the network socialnet beforehand. Self host the repository, ship with signed recent descriptor and bad nodes subscription lists, bootstrap into that, and let network dynamics and user choice run from there. At least that's the model of some other networks. Tor is probably central today as a result of inheriting a central design model. Thereafter if not remaining so from simple gravity then from either: A) waiting for a chance to stand up with its authorities for the sake of proving out fundamental privacy/speech geopolitics. B) putting them in the position of standing as test fodder. C) trending nefarious. Tor is a US entity which has certain benefits and weaknesses. And the international support structure of (A) should be analyzed and stress tested to determine its strength bfore relying on it. All the while noting and incorporating similarities to the WL, Snowden, filesharing, and crypto battles, etc. Curiously, whenever all is said, it's still useful to have both centralized and decentralized networks surviving under pressure. Yet is centralization actually *required*, say to achieve something specific beyond that, or which cannot be modeled decentrally with some decision elements pushed out to the user.

1 0

Fed proposal for Virginia cellphone data sharing network
by Gregory Foster 23 Nov '14

23 Nov '14

United States Attorney’s Office in the Eastern District of Virginia (~2011) - "A Proposal for the Creation of the Hampton Roads Telephone Intercept Sharing Network (HRTISN)" by Investigative Analyst Paul B. Swartz: https://www.documentcloud.org/documents/1364622-hampton-roads-usatty.html via arstechnica (Nov 21) - "Feds proposed the secret phone database used by local Virginia cops" by @cfarivar: http://arstechnica.com/tech-policy/2014/11/feds-proposed-the-secret-phone-d… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1