- cypherpunks@lists.ogf.org

Unraveling NSA's TURBULENCE Programs
by coderman 20 Sep '14

20 Sep '14

https://robert.sesek.com/2014/9/unraveling_nsa_s_turbulence_programs.html ''' The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed. Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is an attempt to do so, using leaked and declassified documents... '''

2 1

Russia moves date when personal data law came into force to 1st Jan 2015
by Anton Nesterov 20 Sep '14

20 Sep '14

Today Duma have passed in first reading bill which moves date when personal data law came into force from 1st Sep 2016 to 1st Jan 2015. Original law forbid storing any personal data of Russian users outside of Russia. "We need to speed up the law, it's not a secret that personal data is the object of attention of criminals and special services of Western countries." — says one of the authors, Alexandr Yushenko from Communists party. "And maybe we need to forbid all that social networks, as in Iran? Let everyone involved in amateur, go to the cinema, museums. They sit alone in that networks, or acquaint with somebody, and then follows sexual promiscuity. It's indeed dangerous, you just say an extra word — and then claim on you in court!" — says Vitaliy Zolochevsky, member of LDPR party. 438 votes for, 0 against, 0 abstained. Bill http://asozd2.duma.gov.ru/main.nsf/%28Spravka%29?OpenAgent&RN=596277-6&02 Voting results http://vote.duma.gov.ru/vote/87314 Report http://rublacklist.net/8662/ (in Russian) Another one http://www.rosbalt.ru/main/2014/09/19/1317343.html (in Russian) -- https://komachi.github.io GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

1 0

More on the tor scam
by Juan 19 Sep '14

19 Sep '14

So, whatever happened to this? "Black Hat Cancels Presentation on Cracking Tor" http://www.pcmag.com/article2/0,2817,2461204,00.asp http://freedomhacker.net/tor-project-fixing-vulnerability-that-could-expose… Why was the talk cancelled? Did that happen in the Western Cesspool where 'freedom of speech' is oh so fucking sacred? And what about this 'vulnerability'? Isn't tor oh so amaazing that even the NSA can't track tor users...except that's a stupid lie?

6 6

Apple says ending unlocking practice for LEA/users with ios8
by grarpamp 19 Sep '14

19 Sep '14

Apple will no longer unlock most iPhones, iPads for police, even with search warrants http://www.washingtonpost.com/business/technology/2014/09/17/2612af58-3ed2-…

3 4

compiling bleep
by Randolph 19 Sep '14

19 Sep '14

Hi Grarpamp, the point was that I would not use bleep messenger from bittorrent, as it is not open source. Others like the one you did a research on might be worth for further testings, either by the binaries or - you seem to be keen on to - compile it yourself. I cannot help you with compile firefloo messenger on linux or windows, as I have not done this yet. Why don' t you test the binaries? The source and the binaries might not be machting from hash, because if you know source projects, the source might be corrected on one or two files even when the binaries have been build. So better build the software from source and use your own binaries. I would suggest to build the crypto core first, which is spot-on. Regards 1) I guess you use windows. 2a) download the source from either the download files https://sourceforge.net/projects/spot-on/files/Version%200.11/ File: Spot-On.d.tar.gz 2b) or use the SVN url to be current: https://sourceforge.net/p/spot-on/code/HEAD/tree/ svn checkout svn://svn.code.sf.net/p/spot-on/code/ spot-on-code 3) install Qt.io Use Version 5.3.1 Qt 5.3.2 for Windows 32-bit (MinGW 4.8.2, OpenGL, 737 MB) http://download.qt-project.org/official_releases/qt/5.3/5.3.2/qt-opensource… configure it correctly 4a) use the comand line app from Qt and here you use these commands: https://sourceforge.net/p/spot-on/code/HEAD/tree/branches/0.12/Documentatio… Linux: qmake -o Makefile spot-on.pro Return make 4b) or use better the creator app from Qt. this is very convenient, so I describe this way further: Load the file "spot-on.win.qt5.pro" with the Creator. It is the .pro file for the kernel. Under windows it also loads the spot-on-gui.win.qt5.pro, which is the .pro file for the gui. (Under linux you might need to pic up both and compile both). 5) click the green forward icon to compile the pro file (for release and pro-gui), in the Creator. the compile runs and shows the app. 6.) Enter password, generate keys and connect to the project server in Neighbours tab: tulip.cloud.tilaa.com 4710 7) Ask a friend to do the same or to use the binaries: exchange keys, and chat. Done. All is encrypted and you never need to exchange keys. Hope this helps to use Qt. It is very easy. Regards 2014-09-19 13:37 GMT+02:00 grarpamp <grarpamp(a)gmail.com>: > If you are able to compile a binary > No, do not send it to me, send it to the list.

1 0

Bittorrent Bleep
by Александр 19 Sep '14

19 Sep '14

http://blog.bittorrent.com/2014/09/17/bittorrent-bleep-alpha-goes-public-in…

5 5

killing RC4 in Chrome
by coderman 19 Sep '14

19 Sep '14

https://twitter.com/grittygrease/status/512328703938797568 <grittygrease> Are you planning on dropping RC4 support in Chrome anytime soon? <sleevi_> Not until I can work with @mikewest to get our mixed content detection improved and get @__apf__ on board for more sec-ui :)

6 7

Re: Re: [cryptography] Email encryption for the wider public
by stef 18 Sep '14

18 Sep '14

On Thu, Sep 18, 2014 at 09:06:53AM +0200, Henry Augustus Chamberlain wrote: > currently able to use email encryption at all! I think both concerns > are fair, and both are worth trying to solve. let me summarize (and ask you to reread and understand) grapamps response to you: email is dead. -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

2 1

Re: Re: [cryptography] Email encryption for the wider public
by stef 18 Sep '14

18 Sep '14

On Thu, Sep 18, 2014 at 11:13:04AM +0200, Krisztián Pintér wrote: > On Thu, Sep 18, 2014 at 10:57 AM, stef <s(a)ctrlc.hu> wrote: > > let me summarize (and ask you to reread and understand) grapamps response to > > you: email is dead. > > email is not dead, it is a zombie that walks around for at least 20 > years. i like your analogy :) is there a non-zero probability that zombie analogies are the opposite to car analogies? -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

2 2

Re: [tor-talk] wake up tor devs
by grarpamp 17 Sep '14

17 Sep '14

On Wed, Sep 17, 2014 at 5:04 PM, <BM-2cUqBqHFVDHuY34ZcpL3PNgkpLUEEer8ev(a)bitmessage.ch> wrote: > Why is Tor wasting time in implementing secure hidden services? Why not > copy from here if they are doing it right: > > Tor I2P > Cell Message > Circuit Tunnel > ... > > Why not distributed directory authorities and hardcoded? > Why not secure tunnels independent of guards? > Or does Tor want to remain less secure? Yes, there should be more comparative analysis of approaches amongst all the current networks. Create a dedicated group that publishes such things on a darknet wiki. Hold not just project specific meetups as is done today, but genuine summits amongst all such projects that puts their specific projects aside and determines what models might best suit the next 10-20 years. Determine whether the community is too chained by legacy project/product entrenchment to adopt new better approaches that have come up in research since they themselves started their own projects. Find any worthy new techniques and peel off interested developers into new projects. Try to ensure that big well known projects aren't soaking up all the fanfare/funds when equally valid small projects, or new projects would benefit the world the same or more than the gorilla in the room. For example, there seems some merit in filling your internode links with chaff padding up to the bandwidth limit you configure in order to mask both when and how much you are communicating. But it does not seem any project is doing that? Perhaps because chaff transmission/management/security models are not well developed. Or just the 'woah, bandwidth' reaction, which in reality of the simplest design only affects you and what bw you were willing to purchase or experience anyway (as when operating under a non-chaff network with a given/high utilisation condition). Another example... there was, or is, at least one group accepting funds and then running some of the various overlays equally at once... tor, i2p, freenet, cjdns, mailmix. Take some time to step back and see what together you can do with the big picture in all areas... research, development, operations, marketing.

1 0