- cypherpunks@lists.ogf.org

Re: [cryptome] State Hash (see SPHINCS: practical stateless hash-based signatures)
by coderman 09 Oct '14

09 Oct '14

On 10/8/14, Aftermath <aftermath.thegreat(a)gmail.com> wrote: > english is such a funny language perhaps the best language to be funny, ;P strong post-quantum signatures certainly celestial; a bit big, but hey... head of class! avoids NTRU concerns. still no NTRU-Prime. i suppose if i pester djb for minimal privacy by default (httpS://*..cr.yp.to/) i can't also beg for post-quantum schemes and NEON acceleration for all ciphers and signatures. *grin* best regards,

1 0

Revocable Anonymity is Anonymity like Clipper Chip Protection - that is to say, it is not. [was: Another Tor is Possible, Kane/Ksec]
by coderman 07 Oct '14

07 Oct '14

On 10/7/14, Nick Mathewson <nickm(a)alum.mit.edu> wrote: > ... > What's saddest: You didn't explain why you think it's broken. "Revocable Anonymity" is a farce and distraction; Skipjack Clipper Clip[0] equivalent in every sense to the non-starter of "key escrow" and "government / lawful access mandated backdoors". all backdoors, no matter how well intentioned, lead straight to hell.[1] best regards, 0. "The Clipper chip was a chipset that was developed and promoted by the United States National Security Agency as an encryption device, with a built-in backdoor, intended to be adopted by telecommunications companies for voice transmission." - https://en.wikipedia.org/wiki/Clipper_chip 1. "The Athens Affair - How some extremely smart hackers pulled off the most audacious cell-network break-in ever" - http://spectrum.ieee.org/telecom/security/the-athens-affair

1 0

Radical-safest TLDs in 2014
by rysiek 07 Oct '14

07 Oct '14

Well, since we had a nice thread about radical-safest TLDs in 2007, why not ask the same question about present day? Now, I know .onion is the "TLD of choice" of sorts, but if hypothetically I were to register a domain for a project that would help people circumvent Internet censorship and monitoring (so, potentially interesting for the copyright enforcing LEAs too), which TLD should I choose for a "clearternet" version of the website? Please note: I'm not asking about *hosting*, just mere TLD for the domain. -- Pozdr rysiek

6 7

Retired NSA Technical Director Explains Snowden Docs
by John Young 06 Oct '14

06 Oct '14

Retired NSA Technical Director Explains Snowden Docs http://www.alexaobrien.com/secondsight/wb/binney.html Best account yet of the Snowden releases by a technically capable person. Eventually, perhaps, the other 96% will receive similar public disclosure to fully inform beyond opportunistic journalism.

6 8

Projects developed anonymously [was: goldbug, ref: btc]
by grarpamp 06 Oct '14

06 Oct '14

On Wed, Sep 24, 2014 at 3:38 AM, Fabio Pietrosanti (naif) <lists(a)infosecurity.ch> wrote: > The only way such "suspicious" projects will have to recover is by being > transparent on who they are, who pay them, what's their goal ;) There's nothing wrong with anonymous development itself, provided it meets high standards expected of crypto related applications. Goldbug and friends blackballed themselves with their actions, topic dodging speech, and non-reproducible binaries. Doubtful anyone will bother looking at their code given that. Satoshi did anonymous well regarding bitcoin. I2P had some anonymous large contributors I think. Truecrypt's anonymity had some mixed results (given the situation with their binaries). What other projects have been largely anonymous? Now that we have anonymous networks, it's likely that many more anonymous projects will appear that do pass muster.

1 0

dhcpd dhclient-script shell security
by grarpamp 06 Oct '14

06 Oct '14

> @ioerror says: > Has anyone written a captive portal aware, privilege separated, uid > zero free, security focused dhcp client in a type safe language? One could write/compile the script in any language, use sudo within or change the perms and/or syscall uid checks for read-writing the tap, 67/68 port binding, ifconfig, route, etc to permit any arbitrary uid, and run it all in a jail. Some capabilities already exist in OS's today. Portal awareness would be a different scope. Tails or OpenBSD might be interested, as would anyone really, in particular if the protocol sends arbitrary data/commands, which the client/script then fails to lint and passes out to exec/params... Also from twitter: http://www.codelabs.ch/adhcp/

2 1

first factorization of RSA-2048?
by coderman 06 Oct '14

06 Oct '14

"Prize: 700ml 18-year scotch. Topic: first factorization of RSA-2048. My bet: quantum algorithms. Antoine Joux's bet: non-quantum algorithms." - https://twitter.com/hashbreaker/status/494867301435318273 what origin scotch? if i am going to play for keeps, i want to know my skewing is cost effective... ;P best regards,

2 1

This Friday, 10-Oct-2014 - New York Film Fest Will World Premiere Laura Poitras’ Edward Snowden Docu ‘CITIZENFOUR’
by coderman 06 Oct '14

06 Oct '14

will John or another distinguished agitator be present to report and convey for this fine event? http://deadline.com/2014/09/new-york-film-fest-will-world-premiere-laura-po… """ New York Film Festival director Kent Jones said today that the Film Society of Lincoln Center has added the world premiere of Laura Poitras’ CITIZENFOUR to its Main Slate lineup. The presentation will run Friday, October 10 at 6 PM at Alice Tully Hall. Poitras will also participate in a free HBO Directors Dialogues the following day at 4 PM, at the Walter Reade Theater. The film, from RADiUS in association with Participant Media and HBO Documentary Films, opens theatrically October 24. According to the festival: In January 2013, Poitras was several years into the making of a film about abuses of national security in post-9/11 America when she started receiving encrypted e-mails from someone identifying himself as “citizen four,” who was ready to blow the whistle on the massive covert surveillance programs run by the NSA and other intelligence agencies. In June 2013, she and reporter Glenn Greenwald flew to Hong Kong for the first of many meetings with the man who turned out to be Snowden. She brought her camera with her. The film that resulted from this series of tense encounters is absolutely sui generis in the history of cinema: a 100% real-life thriller unfolding minute by minute before our eyes. """

1 0

Mu [was: How worse is the Shellshock bash bug than Heartbleed?]
by coderman 05 Oct '14

05 Oct '14

On 9/30/14, Georgi Guninski <guninski(a)guninski.com> wrote: > ... > I find this _much_ worse than the passive Heartbleed. > > How worse is the shellshock bash bug than Heartbleed? a simplistic "shellshock worse than heartbleed" is mis-characterization of the situation. first, this presents a vulnerability without context, by itself. in the real world, we care about vulnerability with respect to exploitation. usually many vulnerabilities are leveraged together in exploitation of notoriety. in the sense of best practice and conservative security posture, heartbleed could be worse by far. a strongly keyed, defense in depth surreptitiously bypassed via bleeding. e.g. bleed UDP DTLS VPN to access internal network, bleed intranet HTTPS for admin credentials to critical infrastructure services. the ability to send things to a bash shell, even restricted shell, even constrained behind application layers, was always seen as bad practice for security conscious configurations - insiders get shell, not untrusted inputs. last but not least, this is all bullshit speculation; risk is a perspective and shellshock or heartbleed is better or worse depending on what you're looking at. best regards, P.S. #langsec asked how long you earth humans will be exchanging risky bits with strangers. i channeled djb and bet on "Forever!". [c.f. http://cr.yp.to/talks/2014.07.10/slides-djb-20140710-a4.pdf "Making sure software stays insecure"]

2 6

properly timing FOIPA for best results [was: 1977 Justice Dept. Report on CIA (was: Rockefeller Commission Report)]
by coderman 05 Oct '14

05 Oct '14

as per, On 10/3/14, Gregory Foster <gfoster(a)entersection.org> wrote: >> "... it was standard procedure >> not to notify the object of a criminal investigation (think John Gotti) >> once it is completed and requested under FOIA. i have been pondering the question of when is the most effective time to file a FOIPA. presumably this would be after the statute of limitations, plus some delay, to ensure that completed/discarded investigations are included in the scope of the disclosure. does anyone have guidance on this timing? perhaps 6-8 years after initially coming under scrutiny? best regards,

2 1