- cypherpunks@lists.ogf.org

Some History
by Ryan Carboni 14 Aug '14

14 Aug '14

http://www.yak.net/surfpunk/issues/0105 >The FBI and the Justice Department say the initiative would > >not expand their power, but would ensure access to the type of > >communications they have been entitled to tap for years. > > > This is totally bogus. > > The FBI has never had the right to watch computer programs > execute. Now that computer programs are being written as > distributed systems, what was originally written to be an > internal subroutine call can look like a message over the > phone system. > > The FBI never had the right to bug corporate conference rooms. > Now that companies are using videoconferencing, a private > corporate conference could look like a phone call. > > Etc. > > This needs to be fought. > > - Carl > > >

1 0

Ukraine passed the bill about sanctions in first reading, it give power to close media, websites, and more
by Anton Nesterov 14 Aug '14

14 Aug '14

It includes many types of sanctions, but most interesting is that ones: 9) the prohibition or restriction of the retransmission of television and radio channels; 10) the prohibition to use radio frequency resource of Ukraine; 11) the restriction or termination of the media or other information activities, including those in the Internet; 12) the restriction or prohibition of production or distribution of printed materials and other information materials; 24) the prohibition of political parties, movements and other civil society associations and foundations; So if that bill will be passed, National Security and Defense Council can ban any foreign media, website, foundation, movement, printed material, etc. without court. http://osvita.mediasapiens.ua/material/33612 news report (in Ukrainian) http://w1.c1.rada.gov.ua/pls/zweb2/webproc4_1?pf3511=51915 text (in Ukrainian)

1 1

Shipment Interdiction
by bluelotus＠openmailbox.org 14 Aug '14

14 Aug '14

The package was not interdicted to Sarasota, Florida. It was interdicted from Sarasota, Florida. Three times! Where is it now? I purchased a Toshiba Portege R205 from an Ebay seller. I needed an ultraportable laptop pre2008 as explained in: http://www.reddit.com/r/privacy/comments/2cu80z/former_m15_officer_and_whis… I commuted 11 hours to Sarasota, Florida to personally pick up the laptop. Prior computers I purchased from Ebay and retailers were indicted, implanted and infected. See http://www.reddit.com/r/techsupport/comments/2a24sh/removing_bulldozer_impl… That night, I disassembled, air gapped, reassembled my laptop. I glued four screws on the back to attempt to prevent it from being disassembled and implanted. That night, hackers broke into my hotel room while I was sleeping. They drilled out the glued screws, implanted, physically damaged the keyboard and infected. On Saturday, July 19, 2014, I dropped off my Toshiba, along with an interdicted and tampered Fedora CD, infected flashdrive and an infected raspberry pi to a FedEx authorized reseller in downtown Sarasota. FedEx's policy is not to notify the shipper and the recipient of the redirection. I asked Michael how recipients are allowed to change the address without the consent or knowledge of the shipper. I explained that when I was the recipient and wanted to change the address, FedEx instructed me to ask the shipper to change the address. Michael explained that I had not placed restrictions on my account to prevent the shipping address from being redirected. Michael instructed me to ask the Revenue Department to do so. I asked an employee for the number of the Revenue Department. Employee refused to look up the number and misrepresented the Revenue Department did not have a direct phone number. Instead, the employee transferred me. The Revenue Department employee did not know their direct phone number. I hung up. I called back 800-463-3339 and again asked for the Revenue Department's telephone number. I was finally given 800-622-1147. I asked an employee in the Revenue Department to transfer me to a supervisor. However, I was transferred to Bobby in Customers Relations. I asked Bobby to transfer me to a supervisor in the Revenue Department. Bobby misrepresented that she is a supervisor in the Revenue Department. I asked Bobbie for her contact information in the event that I needed to contact her again. Bobbie misrepresented her contact information is BRIFTOC. Bobby failed to give her ID number. I asked Bobby why I was not offered restriction options when I set up my account. Nor was I notified of restrictions options there after until today. Bobby did not give an answer. I asked Bobby to place restrictions on my account prohibiting redirecting the shipping address without my knowledge and consent. I asked Bobby to escalate my complaint. Bobby wanted me to write a letter to FedEx. There is no point spending the time and money on my prepaid phone to call Fedex, if I have to write a letter, print it out and mail it. I insisted Bobby write up a complaint. Bobby did not give me a case number. I asked Bobby to email or fax the complaint to me. Bobby said she could not email or fax. Interdiction #2: Michael informed me that morning the package was being returned to me because the recipient had not picked it up at the FedEx location in Beaverton, Oregon. The hackers' timing was perfect. Since I am being hacked in real time, the hackers knew that I logged into my FedEx account. FedEx holds packages for pick up for five business days. Yet, FedEx held the package much longer. All of a sudden, FedEx is returning it to shipper. I had departed Sarasota, FL. Returning it to Sarasota, FL would have placed the package at risk. FedEx should notify shippers and recipients before packages are being returned to shipper. Michael promised to have the package delivered to the initial address. Michael left a voicemail confirming that the package was being redirected to the initial address. Interdiction #3: I did not know Coderman's phone number so I gave my phone number on the ground shipping label. On August 5, 2014, I received an automated voicemail that the package will be delivered tomorrow, that a signature is required and a recommendation to chose the option hold for pick up. I had not requested a signature. Nor did the tracking information display that a signature was required. A signature requirement can be used as an alibi to return a package to the shipper if the recipient is not home and does not make arrangements to sign for the package. I tried to reach Bobby but Carolyn ID 921550 did not even try to transfer me to Bobby. Customer Relations' direct telephone number should be given to customers. Supervisors should be able to give out extension numbers. Instead Carolyn transferred me to a female employee in El Paso. It took her a while to read the notes on my account to find out who Bobby is. Bobby had left for the day. I asked to speak to a supervisor. She told me supervisors left for the day. I asked what the supervisors' hours are. She refused to tell me. She told me a signature was not required. Interdiction #4: She informed me the package was being returned to FedEx Office in Beaverton, Oregon. Again, I asked to speak to a supervisor. She transferred me to Carlos ID 892831. Carlos confirmed that signature was not required and that package was being returned to FedEx Office in Beaverton, Oregon. Carlos could not explain why the package was redirected again to FedEx Office. I asked how the redirections were being requested. Carlos explained the recipient went on FedEx's website. I argued that the recipient had not requested redirections. Carlos argued no one else would know the tracking number and recipient's contact information. I requested an investigation on the identity of the person performing the redirections. I asked Carlos how the shipment was again redirected without my knowledge or consent. I explained to Carlos that Bobby had placed restrictions on my account prohibiting redirection. Carlos explained that Bobby does not place restrictions on accounts. That Bobby could only forward my request for restrictions. I should never have been transferred to Bobby. when I argued with Bobby that she was not the appropriate employee to be transferred to, Bobby should have transferred me to an employee who can place restrictions. I complained to Carlos that shippers and recipients should be notified when shipments are redirected. The next day, August 6, 2014, I received email notification that the package was delivered to FedEx Office in Beaverton, OR. I asked to speak to Bobbie, Michael and Carlos. They were not available. An employee told me the package was delivered to the initial address. Was it? I emailed Coderman several times and am waiting for his reply. FedEx should have a fax number or an email address to forward complaints to. Instead, FedEx merely offers an online form to fill out. The form has a size restriction. I could not copy and paste this complaint into its form. On August 6, 2014, I mailed a complaint requesting FedEx to email or fax their investigation, confirmation that restrictions has been placed on my account and to waive the shipping fee. To date, FedEx has not responded.

3 2

[Cryptography] miniLock seems pretty interesting
by Eugen Leitl 13 Aug '14

13 Aug '14

----- Forwarded message from Eric Mill <eric(a)konklone.com> ----- Date: Mon, 21 Jul 2014 09:48:32 -0400 From: Eric Mill <eric(a)konklone.com> To: "cryptography(a)metzdowd.com List" <cryptography(a)metzdowd.com> Subject: [Cryptography] miniLock seems pretty interesting Message-ID: <CANBOYLVg=Dndusthy82zbksDwyVupdHU9BaSL1mE6199FbvmYQ(a)mail.gmail.com> I saw this announced at HOPE X this weekend: http://minilock.io/ It uses curve25519 <http://cr.yp.to/ecdh.html>, which requires much smaller keys (32 or 64 bits) to ensure security -- and so it basically just demands a strong passphrase from the user from which can be derived a strong private key. The developer has a video <http://vimeo.com/101237413> and slides <http://minilock.io/files/HOPEX.pdf> to go along with it, and in general focused his energy on persuading the audience that JavaScript crypto is a necessary and achievable part of the future. -- Eric -- konklone.com | @konklone <https://twitter.com/konklone> _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

4 5

A post-spy world
by John Young 13 Aug '14

13 Aug '14

"We are moving toward a post-spy world, according to the guy that runs the CIA's venture capital arm." <http://t.co/5eYfbRYU8k>http://www.defenseone.com/technology/2014/08/10-ways-make-internet-safe-cyb…

6 6

DropItLike
by coderman 13 Aug '14

13 Aug '14

https://github.com/mozilla/DropItLike

3 2

SSL cert expired for cpunks.org
by Alfie John 13 Aug '14

13 Aug '14

Hi guys, In case it was missed, the cert for cpunks.org expired last month. If money is the only reason it wasn't renewed, contact me off list and I'll happily pay for it. Alfie -- Alfie John alfiej(a)fastmail.fm

2 1

Re: cypherpunks Digest, Vol 14, Issue 12
by Ryan Carboni 12 Aug '14

12 Aug '14

> > So if that bill will be passed, National Security and Defense Council > can ban any foreign media, website, foundation, movement, printed > material, etc. without court. > Syria was under martial law... for several decades prior to their civil war. But than again... for a few years, Lincoln was a dictator, going so far to even free the slaves amid disapproval from his cabinet. On Tue, Aug 12, 2014 at 9:00 AM, <cypherpunks-request(a)cpunks.org> wrote: > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. Re: cypherpunks Digest, Vol 14, Issue 11 (Andrew White) > 2. Re: Update your Tors - Tor security advisory: "relay early" > traffic confirmation attack (Juan) > 3. A post-spy world (John Young) > 4. Re: Update your Tors - Tor security advisory: "relay early" > traffic confirmation attack (rysiek) > 5. SnakeoilMailbox? (rysiek) > 6. Ukraine passed the bill about sanctions in first reading, it > give power to close media, websites, and more (Anton Nesterov) > 7. Re: [cryptography] A post-spy world (Ryan Carboni) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Aug 2014 09:37:53 -0700 > From: Andrew White <invalidheader(a)gmail.com> > To: cypherpunks(a)cpunks.org > Subject: Re: cypherpunks Digest, Vol 14, Issue 11 > Message-ID: > <CA+gYD=_VsQqV4_tGwjQ0NdV4np_afTETU4= > bpsKQ6iFqcELCwQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > > > > > > Message: 2 > > Date: Mon, 11 Aug 2014 08:42:20 +1000 > > From: "James A. Donald" <jamesd(a)echeque.com> > > To: cypherpunks(a)cpunks.org > > Subject: Ripple's consensus algorithm. > > Message-ID: <53E7F54C.80805(a)echeque.com> > > Content-Type: text/plain; charset=UTF-8; format=flowed > > > > Bitcoin's consensus algorithm is weight of computing power, which is OK > > as long as weight of computing power aligns with interest in bitcoin > > being a useful currency. > > > > Weight of stake would be better, but so far I am unaware of any > > satisfactory proposals for weight of stake. > > > > > This is called "proof of stake" not weight of stake and is different from > Ripple's consensus process. > > > > > Ripples consensus algorithm is weight of club members, and the process > > for getting into the club is opaque, as are the interests and incentives > > of the existing club members. > > > > This doesn't really describe how Ripple works. Ripple relies on the > agreement of 80% or more of validator nodes per gateway to verify if a > transaction took place or not. I write more about this in > http://rippleinvestmentguide.com/ > > > > > > I would suppose one gets into the club if no existing member blackballs > > you, which would be fine if there is already sufficient diversity of > > interests within the club. > > > > Only if 80% of the networks validator nodes do that which is in practice > not likely to happen on a large enough scale. > > > > > > It is not obvious to me how well the ripple consensus algorithm would > > work in the event of substantial conflicts between club members, or bad > > behavior by club members, or bad things happening to the network. > > > > Has it been analyzed for performance in the event of bad behavior by > > some club members? > > > > I'll ping David Schwartz one of the co-inventors about this question. >

2 1

SnakeoilMailbox?
by rysiek 12 Aug '14

12 Aug '14

Hi there, so, this got sent my way: http://securemailbox.com/ It rings several of stef-defined bells for snakeoil, but maybe I don't see something? Anybody any info on this? -- Pozdr rysiek

1 0

Update your Tors - Tor security advisory: "relay early" traffic confirmation attack
by coderman 11 Aug '14

11 Aug '14

https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-… [see also release notes per below] ''' On July 4 2014 we found a group of relays that we assume were trying to deanonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks. The attacking relays joined the network on January 30 2014, and we removed them from the network on July 4. While we don't know when they started doing the attack, users who operated or accessed hidden services from early February through July 4 should assume they were affected. . . . Relays should upgrade to a recent Tor release (0.2.4.23 or 0.2.5.6-alpha), to close the particular protocol vulnerability the attackers used — but remember that preventing traffic confirmation in general remains an open research problem. Clients that upgrade (once new Tor Browser releases are ready) will take another step towards limiting the number of entry guards that are in a position to see their traffic, thus reducing the damage from future attacks like this one. Hidden service operators should consider changing the location of their hidden service.

5 8