- cypherpunks@lists.ogf.org

RC4 still sucks in the year 2014 - A Practical Attack Against the HIVE Hidden Volume Encryption System
by coderman 03 Nov '14

03 Nov '14

""" A Practical Attack Against the HIVE Hidden Volume Encryption System Kenneth G. Paterson and Mario Strefler Abstract: The HIVE hidden volume encryption system was proposed by Blass et al. at ACM-CCS 2014. Even though HIVE has a security proof, this paper demonstrates an attack on its implementation that breaks the main security property claimed for the system by its authors, namely plausible hiding against arbitrary-access adversaries. Our attack is possible because of HIVE's reliance on the RC4 stream cipher to fill unused blocks with pseudorandom data. While the attack can be easily eliminated by using a better pseudorandom generator, it serves as an example of why RC4 should be avoided in all new applications and a reminder that one has to be careful when instantiating primitives. """ - http://eprint.iacr.org/2014/901

1 0

are USB floppies toxic?
by Eugen Leitl 03 Nov '14

03 Nov '14

We know USB flash is is Biosafety 4, what about other sneaker-net suitable storage media? USB floppies are still around, as well as media, which are write-protectable. How easy to hop the air gap with these?

9 10

Brain decoder can eavesdrop on your inner voice
by Eugen Leitl 03 Nov '14

03 Nov '14

http://www.newscientist.com/article/mg22429934.000-brain-decoder-can-eavesd… Brain decoder can eavesdrop on your inner voice 29 October 2014 by Helen Thomson Magazine issue 2993. Subscribe and save For similar stories, visit the The Human Brain Topic Guide As you read this, your neurons are firing – that brain activity can now be decoded to reveal the silent words in your head TALKING to yourself used to be a strictly private pastime. That's no longer the case – researchers have eavesdropped on our internal monologue for the first time. The achievement is a step towards helping people who cannot physically speak communicate with the outside world. "If you're reading text in a newspaper or a book, you hear a voice in your own head," says Brian Pasley at the University of California, Berkeley. "We're trying to decode the brain activity related to that voice to create a medical prosthesis that can allow someone who is paralysed or locked in to speak." When you hear someone speak, sound waves activate sensory neurons in your inner ear. These neurons pass information to areas of the brain where different aspects of the sound are extracted and interpreted as words. In a previous study, Pasley and his colleagues recorded brain activity in people who already had electrodes implanted in their brain to treat epilepsy, while they listened to speech. The team found that certain neurons in the brain's temporal lobe were only active in response to certain aspects of sound, such as a specific frequency. One set of neurons might only react to sound waves that had a frequency of 1000 hertz, for example, while another set only cares about those at 2000 hertz. Armed with this knowledge, the team built an algorithm that could decode the words heard based on neural activity aloneMovie Camera (PLoS Biology, doi.org/fzv269) The team hypothesised that hearing speech and thinking to oneself might spark some of the same neural signatures in the brain. They supposed that an algorithm trained to identify speech heard out loud might also be able to identify words that are thought. Mind-reading To test the idea, they recorded brain activity in another seven people undergoing epilepsy surgery, while they looked at a screen that displayed text from either the Gettysburg Address, John F. Kennedy's inaugural address or the nursery rhyme Humpty Dumpty. Each participant was asked to read the text aloud, read it silently in their head and then do nothing. While they read the text out loud, the team worked out which neurons were reacting to what aspects of speech and generated a personalised decoder to interpret this information. The decoder was used to create a spectrogram – a visual representation of the different frequencies of sound waves heard over time. As each frequency correlates to specific sounds in each word spoken, the spectrogram can be used to recreate what had been said. They then applied the decoder to the brain activity that occurred while the participants read the passages silently to themselves (see diagram). Despite the neural activity from imagined or actual speech differing slightly, the decoder was able to reconstruct which words several of the volunteers were thinking, using neural activity alone (Frontiers in Neuroengineering, doi.org/whb) The algorithm isn't perfect, says Stephanie Martin, who worked on the study with Pasley. "We got significant results but it's not good enough yet to build a device." In practice, if the decoder is to be used by people who are unable to speak it would have to be trained on what they hear rather than their own speech. "We don't think it would be an issue to train the decoder on heard speech because they share overlapping brain areas," says Martin. The team is now fine-tuning their algorithms, by looking at the neural activity associated with speaking rate and different pronunciations of the same word, for example. "The bar is very high," says Pasley. "Its preliminary data, and we're still working on making it better." The team have also turned their hand to predicting what songs a person is listening to by playing lots of Pink Floyd to volunteers, and then working out which neurons respond to what aspects of the music. "Sound is sound," says Pasley. "It all helps us understand different aspects of how the brain processes it." "Ultimately, if we understand covert speech well enough, we'll be able to create a medical prosthesis that could help someone who is paralysed, or locked in and can't speak," he says. Several other researchers are also investigating ways to read the human mind. Some can tell what pictures a person is looking at, others have worked out what neural activity represents certain concepts in the brain, and one team has even produced crude reproductions of movie clips that someone is watching just by analysing their brain activity. So is it possible to put it all together to create one multisensory mind-reading device? In theory, yes, says Martin, but it would be extraordinarily complicated. She says you would need a huge amount of data for each thing you are trying to predict. "It would be really interesting to look into. It would allow us to predict what people are doing or thinking," she says. "But we need individual decoders that work really well before combining different senses." This article appeared in print under the headline "Hearing our inner voice"

2 1

Re: <unlike-us> news on the alternative social media front
by rysiek 03 Nov '14

03 Nov '14

Hi there, Dnia poniedziałek, 3 listopada 2014 11:24:28 carlo von lynX pisze: > The problem is that interoperability is not solving any real problem. I disagree. The small number of users and the confusion of which network to use is a real problem, related to the network effect aka Metcalfe's law: http://en.wikipedia.org/wiki/Metcalfe%27s_law The same problem exists with truly distributed social networks, like SocialSwarm, MaidSafe, Twister et al. How should a user decide which one they should use? Let's make that step easier by at least making an attempt at interoperability. > As if any of those platforms was scalable, functional and sexy enough > to attract a relevant number of people away from the cloud-based systems. > If one of them was so cool, we wouldn't really need the other ones, so > interoperability is unnecessary. To some extent you're right. > Interoperability is something you should ask from competing proprietary > systems, but it is irrelevant for free software systems. I don't agree. These systems already have tens of thousands of users, and getting these users together on a single network is one of the challanges. > So after eleven years working on free "federated" social web thingies all we > got is some platforms that can talk to each other although they can't scale > to real world relevant numbers or hide their data from government > authorities. How do you know they can't scale? I see Diaspora scaling pretty well so far. And as far as hiding data from governments is concerned -- sure I'd prefer everybody to jump into RetroShare, but that's not gonna happen. And a decentralized system is much better, privacy-wise, than a centralized one, even if it's not perfect. > (...) > > >> Most "evil" services we use, just need a decent easy to use functional > > >> alternative. > > > > > > That's the crux, right after getting a common protocol implemented > > > across > > > different federated social networks. Also consider: > > > http://rys.io/en/88 > > That document mentions SocialSwarm, with a link to > http://wiki.socialswarm.net/Beyond_the_federation > which I think explains pretty well how federation will never take off. Fair enough. But it already has hundreds of thousands of users. For me, the endgame is indeed complete decentralisation and peer-to-peer social networking, a'la SocialSwarm, RetroShare and Twister. None of these are ready yet, though, the way Diaspora or Friendica are ready and usable today. So I'd rather help people switch to Diaspora or Friendica today rather than have them wait unspecified amount of time fort the Golden Age of Social Networking. Because once we have them on the free software, decentralised, federated sid, we can write bridges/gateways, and have SocialSwarm connect with userbase on The Federation. That's not possibble with *any* walled garden. > Then it says this, as an excuse for dismissing SocialSwarm: > > The problem with FreedomBox and SocialSwarm I see is that they are trying > > to make two hard transitions at once: from centralised to de-centralised, > > and from third-party-hosted to self-hosted. I believe this is a tad too > > an ambitious plan and it should be split into two separate steps. > > However, if we did Step 0 and Step 1 right, they both would have at least > > a part of their work done for them. > And that again is wrong because if you have identified the two or > three crucial problems, trying to fix just one while maintaining > all the mess of the other two problems is years of efforts for > little gain: you and your nerd friends are having their own little > social network, still fully visible to the NSA, while the people > that you would like to spend more time with you have all logical > reasons on their side to stick to Facebook etc. > ( See the examples at the end of > http://wiki.socialswarm.net/Beyond_the_federation ) But my girfriend doesn't have to use *my* server, she can choose any of the tens of pods worldwide. > So now you have interoperability which doesn't solve any of the > three problems: > - scalability > - social graph protection > - end-to-end encryption (the reason why your significant other > will not be free to talk about you while using your server) So, this is interesting: https://joindiaspora.com/posts/5069036#b894222043d8013279201a960f0f49a1 RedMatrix supports end-to-end encryption. > > > Also, please join us at The Federation Assembly at #31C3: > > > https://events.ccc.de/congress/2014/wiki/Assembly:The_Federation > > Great! Server federation! Keep promoting bad ideas! > Federation does not solve the problem that SERVERS AREN'T SAFE! No, they're not. Still, many federating servers controlled by different people is much better than a single, centrally controlled network. Somewhere there's a video of Bruce Schneier talking about how 10000 different small and medium e-mail providers is so much better a situation, than 10 large ones. That's exactly my point here. > Servers should not be confided with the social graph of humanity, > not even if we pay 8 euros a month for them - because their > virtual memory is easily automatically reapable by authorities. It is indeed. But if they have to do it on 10000 different servers, that's a different ball game than when they have to do it on 10 or 100. > Even if the FSW solved the problem of efficient distribution, > which of course it hasn't even properly addressed, it still > lets the agencies have the entire cake and eat it. As above. > How can you guys dare to go to the 31C3 and act as if > Snowden didn't happen? You know what? At this point let me say from the depth of my heart: fuck you. Don't you dare lecture me on Snowden and privacy. The fact that I have different take-away from these revelations (e.g. "done now is better than perfect in a decade") doesn't give you the right to be a condescending little prick, smirking with contempt from your high horse of theoretical technical superiority with not much to show for it but a few texts critical of projects that work *here and now*. Where's the code? Where are the tools? How can I get involved? Can I test anything, apart from your ability to throw tantrums? Please don't tell me that's all you've got in the pipeline since 28C3! Here are some news for you: FreedomBox is not yet usable. SocialSwarm is not yet usable. I'd love them to be, but they're simply not. And while you berate others about how they act as if "Snowden didn't happen", these others are getting people off of Facebook at least, today. That's not perfect, but it's a *step*. A step you can either try to build upon, or a step you can try to undermine. Guess which has a higher chance of eventually solving most or all of the problems you mentioned? Here, have a read: https://medium.com/message/81e5f33a24e1 Especially the "In the end, it’s culture that’s broken" part. Come back when you do. > It's annoying that the things we said in 2011 on > http://secushare.org/2011-FSW-Scalability-Paranoia > still apply. No progress at all. Had the "federated > social web" crowd understood and invested half the > energy in a P2P/onion-relay/multicast kind of "GNU > Internet" infrastructure, instead of insisting on a > broken model, we would now have a distributed social > network that works AND respects basic civil rights. Had my grandmother had mustache, she would be my grandfather, as we say in Poland. Cry me a fucking river. Also, had you spend the time you have spent writing this e-mail on development work, you'd be a few steps closer to your goal. So, there's that. > Thank you, low-hanging-fruit people, for keeping so many brilliant > developers off the important projects and distracting even public > financing with the undead federation rhethoric. What, now it's my fault that people that are completely unrelated to me and that make their own decisions are working on project A instead of project B which you tend to prefer? How sad is your world, how filled with bile must you be that your pet project is not my pet project, or Friendica/Diaspora/Red developers' pet project! Go out, talk, explain, reach out and convince people it's worthwhile to invest their time and effort in your idea. Heck, convince me that's worthwhile and that it will get people off of Facebook sooner than in a decade, and I might start helping you out! Hint: blaming me for your own problems with communication and having a fit over other people taking different paths than yours is not the perfect strategy for that. > There's nothing as strong as a bad idea whose time has come. > > Terrible to see we haven't made much progress since I said > that at unlike-us 2012. Ever thought that might somehow be related to how you go about introducing people to your ideas, maybe? -- Pozdr rysiek

1 0

Re: [tor-talk] Facebook brute forcing hidden services
by tigrutigru＠gmail.com 02 Nov '14

02 Nov '14

I've been to FSCONS today session: "Blurry line between private service and public infrastructure" covering a problem with decentralised, federated services and platforms which can be used as an alternative to FB. There are many (Diaspora, Frendica, GNU social etc) , but use incompatible protocols, making it hard for users to choose, and fragmenting the community, making it look weak and small. Another problem is that most of them don't have client API's and do have a sorry-looking interface. However, if those platforms would be compatible and talk to each other - in a session it was called "The Federation", this problem of fragmentation and poor user database is solved. So far is the most promising solution I heard which can help to get people of Facebook hook, or at least use it when absolutely necessary, not to post your entire life on it. Most "evil" services we use, just need a decent easy to use functional alternative. In the actual lecture the federation of decentralised social networks is described from the 28th minute https://m.youtube.com/watch?v=R_uvYp3fog4 > On 1 Nov 2014, at 17:00, cypherpunks-request(a)cpunks.org wrote: > > Re: [tor-talk] Facebook brute forcing hidden services

5 9

https://facebookcorewwwi.onion/
by rysiek 02 Nov '14

02 Nov '14

Hi all, so, you've probably seen this: http://venturebeat.com/2014/10/31/facebook-announced-it-is-now-providing-di… Apart from being torn about the move (good on Facebook to support TOR, but I don't really feel like praising Facebook for anything I guess), there are two WTFs here: https://facebookcorewwwi.onion/ 1. HTTPS to TOR Hidden Service? Why? /that's the smaller one/ 2. How did they get to control 15 characters (I assume the "i" was random) in the .onion address? That's a *LOT* of number crunching. If they are able to do this, it means they are able (or are very close to) bascially spoof *any* .onion address. Am I missing something? -- Pozdr rysiek

8 10

IPv5 is a laser
by coderman 02 Nov '14

02 Nov '14

http://phenoelit.org/stuff/CSLI.pdf

1 0

Re: GamerGate
by John Young 02 Nov '14

02 Nov '14

I had not followed GamerGate until today's New York Times article about it. Nor followed games, so the controversy is new to me. But not the issues involved, which are prevalent online and off. Particularly in testosterone-rich enterprises like military, spies, armaments, sports, weapons, ideology, religion, education, society, civilization, humanity, existence itself. In all of these, the stronger violently dominate the weaker and do so with the psychotic belief that this is the way it should be, natural. In war and peace, in human exploitation of animal and earthly domains, in climate degradation, in force-feeding "democracy," in cruel treatment of women's bodies and neglect of children, in just about every aspect of torturous "advancements in civilized peoples" in the course of inventing and applying ever greater and more vicious ways to kill, maim, starve and over-populate earthlings by male rape in all guises of wargames. Games are a reflection of the this much greater conceit of male dominance in all institutions, all of them, even those which spout diversity and affirmative action and grant minimal access to privileged male sanctuaries -- no matter the skin color, ethnicity, faith, location on earth. It is argued that male aggression inherent and can at best be somewhat controlled by law and social compact. That is a comfortable apologia by male supremacists in law and social compacts dominated by them with intellectual and economic arrogance. All institutions measure accomplishment by male-derived standards to tip the balance in favor of those rigged games. GameGate is too limited in scope, so much that it should be seen as a male-dominated diversion, a game, to avoid addressing the origin and sustaining influence of male way of thinking, doing, making, competing, surviving, by lying, cheating, killing, ruling in all aspects of existence, simulated in games, trained for in games, monetized by games designers and producers, applauded and lauded in halls of power and control, in prizes and awards, in cemetaries and statues, in art and science, in accumulation concentration and monopolization of wealth. No game this larger world, this wargame of "ballsy" potentates in military, policy, spying, media, sports, taxation, playing obsessively the "law of men enforced by lawmen." At 12:10 PM 10/25/2014, you wrote: >Hello >John, what do you think about GamerGate? > >cheers, >George.

13 15

Re: [Cryptography] Best internet crypto clock: hmmmmm...
by Lodewijk andré de la porte 01 Nov '14

01 Nov '14

2014-11-01 22:48 GMT+01:00 Tom Mitchell <mitch(a)niftyegg.com>: > On Fri, Oct 31, 2014 at 11:51 PM, grarpamp <grarpamp(a)gmail.com> wrote: > >> On Fri, Oct 31, 2014 at 2:57 PM, Dave Horsfall <dave(a)horsfall.org> wrote: >> > On Fri, 31 Oct 2014, Harald Hanche-Olsen wrote: >> > >> >> Are you perhaps thinking of the so-called EURion constellation? >> > ... > >> http://www.secretservice.gov/know_your_money.shtml >> >> Quality counterfeiters of US notes don't care what > > > One of the driving forces to the changes in currency around > the globe was angst and some evidence of nation level > counterfeiting. Some small number of folk still have first > hand knowledge of currency attacks in WW2 and how effective > (or not) these attacks were. Good accounts are sparse and > like other secrets seem to still be closely held. > > I know that the local farmers market and flea market vendors in > this area are very cautious about $20 bills that are apparently > color printer and color copier produced. > > I did see some mumble about N. Korea and very high > end intaglio printing about the same time the US and other > nations started changing methods and designs. A secretive > well funded organization or government can do a lot to > produce counterfeit money. A decade or two earlier a lot of > effort was spent on durability. > I was about to mumble a tune about SuperDollars and ww2 currency devaluation attacks! They never really worked, or turned feasible, because delivery is quite hard and printing currency is quite expensive. It goes without saying that the secret service can use OCR > readers in multiple locations and track each and every printed > bill. If their audits detect an interesting level I can see the next > revision of design getting released into the cycle and aggressive > audited shredder action for the previous. > They hopefully do. But this is a crypto forum, right? So we can do better than just making hard-to-produce bills. We can produce an actual signature scheme! Using any crypto-currency but accepting double spends until an online check with central authority (blockchain is just a slow and decentralized central authority) can be done is probably really quite good. Optionally TPM's can put the central authority in your pocket, or in your bill! Too bad government sucks at technology.

1 0

Re: https://facebookcorewwwi.onion/
by Ryan Carboni 01 Nov '14

01 Nov '14

It probably will cost $1 billion to brute force an 80-bit address in a year. What website is actually worth that much? Not even impersonating facebook is worth that much, if you limit the value of the Tor address to the value of the Tor connections to it. The total value of the Tor network is probably no where near $10 billion (mostly CP and darknets though).

1 0