- cypherpunks@lists.ogf.org

Re: You need to update your Flattr account
by coderman 08 Jul '14

08 Jul '14

thank you Linus, for responding constructively and with patience to my rude assumptions. i am replying to cpunks too, as this is in the general interest and my apology to you should be public. i have two questions: On Mon, Jul 7, 2014 at 12:29 AM, Linus Olsson <linus(a)flattr.com> wrote: > ... We would love to not need to do the KYC if it where possible. But we can not risk going to jail for it. It's enough that one of us is there already :( is this related to the lack of KYC? i had heard of some processors getting "strong arm'ed" by their parent banks into particular KYC requirements, but never to the extent that jail time was used to push KYC reform in a vendor or processor. > On bitcoins or crypto currency are that a niche market that is so small that moving over to something like that would topple Flattr over night. Proved by the minuscule usage when we supported it. Maybe they will be more widely adopted in 3-5 years and that we could do something with them then. If we still are around. And yes the people that created the bitcoin processor we used, BIPS probably where rather incompetent. Never the less did we get the stats we needed to decide it was not for us. it does sounds like the problem is with BIPS and presentation. BTC is quite successful in many circumstances, and i hope that you don't let a bad experience with a bad processor forever taint your perspective. why did you pick BIPS instead of another? (the bank you're using?) best regards, and apologies for my rudeness,

1 0

US enhanced airport security checks target electronics
by coderman 08 Jul '14

08 Jul '14

http://www.bbc.co.uk/news/world-us-canada-28185149 """ US enhanced airport security checks target electronics in latest stretch for Total Information Awareness - not by the BBC 6 July 2014 Last updated at 28:45 GMT Frustrated by technically savvy privacy extremists using encryption to protect confidentiality of their data, the United States is preparing a particularly clever ruse to rummage through your digital detritus. The US announced new security measures last week, apparently in response to a terror threat, but gave hints that multiple privacy enhancing technology conferences occurring this summer were of the utmost interest. Analysts say the changes have been couched in a conceit made to appear to be in response to intelligence that Islamic militants in Syria and Yemen developing bombs that could evade airport security. "It's really clever if you think about it.", one anonymous expert on the wiki explained. "First, they put the real terrorists on notice, adding to operational paranoia. But second, they get to enable every device crossing the border at their discretion with minimal concern!" When asked for comment, the National Security Agency replied they could 'neither confirm nor deny any knowledge of "mobile phones"'. [EDITORS' NOTE: The NSA asked us to use scare quotes and not normal quotes, yet in a brave show of defiance we stood up for our readership and refused. "" Take that NSA! With Love, The Editors.] "During the security examination, officers may also ask that owners power up some devices, including cell phones," it said. "All devices must be fully unlocked and past any full disk encryption authentication to properly test the battery." "Powerless devices will not be permitted on board the aircraft. The traveller may also undergo additional screening once the device is powered on and keyed up to be sure it is working correctly in CUSTOMS." Reuters news agency reported that officials had singled out mobile phones made by Apple and Samsung for extra checks. Apparently these devices are most often used by developers and other privacy extremists. More as this story develops. Back to you, Tom.

4 4

The Ex-Google Hacker Taking on the World’s Spy Agencies
by Eugen Leitl 08 Jul '14

08 Jul '14

http://www.wired.com/2014/07/morgan-marquis-boire-first-look-media/ The Ex-Google Hacker Taking on the World’s Spy Agencies BY ANDY GREENBERG 07.08.14 | 6:30 AM | PERMALINK Ariel Zambelich/WIRED During his last six years working as an elite security researcher for Google, the hacker known as Morgan Mayhem spent his nights and weekends hunting down the malware used to spy on vulnerable targets like human rights activists and political dissidents. His new job tasks him with defending a different endangered species: American national security journalists. For the last month, 34-year-old Morgan Marquis-Boire has been the director of security for First Look Media, the journalism startup founded by Glenn Greenwald and Laura Poitras. The website has become the most prolific publisher of NSA leaker Edward Snowden’s remaining secrets. Marquis-Boire’s daunting task is to safeguard those documents, and the communications of reporters who have perhaps the press’ most adversarial relationships with Western intelligence agencies. Beyond protecting Snowden’s favorite journalists, Marquis-Boire sees his decision to leave Google for First Look as a chance to focus full-time on the problem of protecting reporters and activists as a whole, groups he sees as some of the most sensitive targets for governments globally. “I look at the risk posed to individuals in the real world,” says Marquis-Boire, an imposing, often black-clad New Zealander with earrings, dreadlocks, and a taste for death metal. “In human rights and journalism, the consequences of communications being compromised are imprisonment, physical violence, and even death. These types of users need security assistance in a very real sense.” Marquis-Boire already has distinguished himself as a relentless counter-surveillance researcher and a vocal critic of the companies that have created an industry hawking spyware to governments. In 2012, he and researchers at the University of Toronto’s Citizen Lab were the first to identify Finfisher, a stealthy collection of spying tools sold by the British firm Gamma Group that they eventually tracked to command-and-control servers in 25 countries. Later that year he helped trace how a piece of software sold by the Italian firm Hacking Team was used by the government of the United Arab Emirates to spy on a political dissident beaten by thugs. Just last month he revealed new findings that showed how that company’s tools have evolved to target iPhones, Android devices and other mobile targets. And in early 2013 Marquis-Boire and Citizen Lab researchers mapped the spread of surveillance and censorship tools sold by the Palo Alto, California firm Blue Coat to 61 countries, including Iran. In the detective work required to pin those stealthy spying incidents on repressive governments and Western companies, Marquis-Boire is “extraordinarily talented,” says Ron Deibert, a professor of political science at the University of Toronto and Citizen Lab’s director. ”There are some people who are phenomenally adept at forensics, who have an intuitive sense of how to make connections through different pieces of evidence,” he says. “Morgan has those skills…But what I very much appreciate about him is his passion for human rights.” A Cypherpunk In The Newsroom First Look and Marquis-Boire aren’t saying much about exactly what he’ll do at the closely-watched new media startup. But Marquis-Boire says he was convinced early in their recruitment meetings that First Look will treat security as a central tenet. (More about First Look’s plans in the video below.) The job also presents a challenge worthy of leaving his high profile position at Google: Protecting the communications between non-technical reporters and their highly-sensitive sources in a post-WikiLeaks and -Snowden era where they’re both increasingly targeted by spooks. Marquis-Boire hints that he’s already researching security vulnerabilities that affect journalists, and working with several companies to release security fixes to their services in the next couple of months. Brian Sweeney, First Look’s head of technology operations, says Marquis-Boire’s work likely will extend into research designed to protect reporters beyond the company’s firewall. “The idea that all digital citizens, including and especially journalists, have access to data privacy is something that we strongly believe in,” says Sweeney. Marquis-Boire, the son of two literature professors at the University of Auckland, got started with security experimentation as a teenager in the New Zealand hacker scene under the handle “headhntr.” After starting college at Auckland, he and a group of friends wrote an article for the university magazine about breaking into the school’s website to take over the server that ran it. On another occasion he was called into a local telecom’s office and “given a stern talking to about using their services as a test lab.” But from the beginning, his interest in hacking was also political: In the late 1990s the kiwi teenager discovered the Cypherpunks Mailing List, a group of cryptographers and radical libertarians bent on foiling government surveillance and empowering individuals with privacy tools. The group eventually would foster projects like the anonymous remailers that relay emails to obscure their senders’ identities, the anonymity software Tor, WikiLeaks, and countless other privacy and encryption projects. “People realized that to actually have free speech, we have to be sure we won’t be monitored or persecuted,” says Marquis-Boire. “The intertwined nature of privacy and free expression was at the core of the cypherpunk movement.” Marquis-Boire and friends soon hosted what he says was the first anonymous remailer server in New Zealand out of a “dingy warehouse apartment with far too many blinking lights and whirring things.” Eventually, he ran five Tor relays, the nodes in the Tor network that bounce users’ traffic to obscure their location. But Marquis-Boire’s first real job in security, penetration-testing banks, power plants, and other clients for a New Zealand auditing firm, was unsatisfying. “I spent a bit of time musing about how much it costs to hire security consultants to do something like a black box [penetration test] of your whole enterprise,” he says. “I wanted to give my skills to the people who really needed them.” “He Has Quite a Hacker Mind” In 2008, Google hired Marquis-Boire in its Zurich, Switzerland office. He was assigned to cybersecurity incident response at the company not long before the biggest known security crisis in its history: the so-called Aurora hacking operation, in which Chinese hackers breached Google’s network for months and stole information that included source code from its servers. Marquis-Boire became an early member of the core team of network defenders assigned to battle the state-sponsored spies trying to eavesdrop on Google’s users. “He has quite a hacker mind,” says Heather Adkins, Google’s manager of information security, “Of everyone I’ve ever hired at Google, I’d put him in the top one percent of technical capability.” When the Arab Spring began a year later, human rights activists like those at Citizen Lab who had seen Marquis-Boire’s presentations on state-sponsored hacking began seeking his help analyzing attacks on vulnerable groups across the Middle East. As revolutions and political unrest blossomed from Tunisia to Egypt to Libya to Syria, his detective work became nearly a full-time job. “There have been a lot of books not read and canceled vacations,” he says. In the meantime, Google’s Adkins adds, Marquis-Boire frequently uncovered weaknesses in the company’s defenses for users—and he’s been just as focused on locking out the NSA as China’s People’s Liberation Army. In the wake of revelations from Snowden’s leaks that the NSA spied on unencrypted Google data moving between the company’s data centers, Marquis-Boire was one of the first at the company to push for encryption not only of the company’s internal data transfers, but also the exchange of emails between Gmail and other providers. That pressure led Google earlier this month to start publicly naming which email services do and don’t allow for that encryption in a bid to pressure other companies to safeguard users’ privacy. Marquis-Boire’s focus turned to protecting journalists in particular earlier this year, when he and other Googlers released research in March showing that 21 out of the 25 top media organizations in the world had been targeted in digital attacks that were likely the work of state-sponsored hackers. The same month, he joined a technical advisory group for the Freedom of the Press Foundation, which counts Glenn Greenwald, Laura Poitras and Edward Snowden as members of its board. “If you can’t protect your privacy and that of your sources, it’s debatable whether you can actually practice journalism in the traditional sense,” he says. That notion represents a shift from the cypherpunk views of Marquis-Boire’s youth. Once, cypherpunks were mainly interested in seizing privacy for themselves. Now, he says, that’s no longer enough. “When we discovered that we could create private and anonymous communications with math, that was super cool,” he says. “But then after a while I think it dawned on us as a movement that the only conversations you could have with those tools were with other cypherpunks.” “Now it’s been thrust into our faces that the people practicing adversarial journalism and exposing human right abuses are the real-world targets of precisely the kind of thing that the cypherpunk movement was trying to protect against,” says Marquis-Boire. “It’s become apparent we need to provide privacy to those who need it, not just to ourselves.” Tags: Edward Snowden, First Look Media, NSA, Security

1 0

Re: [tor-talk] washingtonpost.com: In NSA-intercepted data, those not targeted far outnumber the foreigners who are
by grarpamp 07 Jul '14

07 Jul '14

>>> ... >> Or, there could be a "secret society" that largely runs NH & wants better privacy? >> ... On Sun, Jul 6, 2014 at 7:03 PM, C B <cb736(a)yahoo.com> wrote: > ... > It is easier to do things here because it is a small state. > New Hampshire has the largest state legislative body in the country, and pays them $100/year (plus mileage). But our state motto is "Live Free or Die" and we take it seriously http://freestateproject.org/

1 0

Disk Firmware Data Exfiltration Backdoor / NSA IRATEMONK
by grarpamp 07 Jul '14

07 Jul '14

http://s3.eurecom.fr/docs/acsac13_zaddach.pdf http://s3.eurecom.fr/~zaddach/docs/Recon14_HDD.pdf http://s3.eurecom.fr/publications.html Always interesting when public, and presumably secret, research are lined up beside each other (recon slides).

3 2

Re: You need to update your Flattr account
by Odinn Cyberguerrilla 07 Jul '14

07 Jul '14

> Hi! > > Thanks for the kind words and constructional thoughts. sure, anytime > > I guess you are trying to say that there are some EU countries where KYC > would not be needed? More to the point, you shouldn't be efforting to comply with any such shit law. You should be migrating off your web-based platform and doing what others are pursuing - decentralized systems. General Conceptual Examples ~ bitcoin/bitcoin, OpenBazaar, Mastercoin's decentralized exchange, recently launched. > If that is the case you could be correct I can't > really say. Never the less is there no payment system that does not > operate on a EU wide set of rules. Well there is the USA. And China. But then you have TISA, are you going to comply with that too? > If you have any other information > please share it instead of just being rude. We would love to not need to > do the KYC if it where possible. But we can not risk going to jail for it. > It's enough that one of us is there already :( Fail > > On bitcoins or crypto currency are that a niche market that is so small > that moving over to something like that would topple Flattr over night. > Proved by the minuscule usage when we supported it. Maybe they will be > more widely adopted in 3-5 years and that we could do something with them > then. If we still are around. And yes the people that created the bitcoin > processor we used, BIPS probably where rather incompetent. Never the less > did we get the stats we needed to decide it was not for us. Fail > > Linus, from his phone. > >> On 7 jul 2014, at 08:27, coderman <coderman(a)gmail.com> wrote: >> >> On Mon, Jul 7, 2014 at 8:06 AM, Odinn Cyberguerrilla >> <odinn.cyberguerrilla(a)riseup.net> wrote: >>> ... there are alternatives for the users so (use of some >>> decentralized virtual currency options) wouldn't necessitate what you >>> are >>> proposing even in countries where you might be faced with it. Flattr >>> is >>> wrong. Flattr is fail. >> >> >> sounds like they are also incompetent: >> """ >> 4. Flattr has abandoned Bitcoin funding because of “technical issues”. >> Can you be more specific? What was the exact problem? Was Bitcoin used >> at all ? >> >> The payment provider had a window of payment of 15 minutes, too many >> transactions did not arrive during this time and gave us way to many >> technical issues and admin overhead. Not to say unhappy customers. >> Bitcoin was used, but it was just a few % of the money added to the >> system each month. Meaning the problems it caused could not be >> justified economically. >> """ >

2 1

Re: You need to update your Flattr account
by Odinn Cyberguerrilla 07 Jul '14

07 Jul '14

Please kindly screw off with your KYC garbage. It is not true that it is necessary EU-wide as a result of whatever payment system you have adopted. Secondly, there are alternatives for the users so (use of some decentralized virtual currency options) wouldn't necessitate what you are proposing even in countries where you might be faced with it. Flattr is wrong. Flattr is fail. I will not be updating the account nor agreeing to its new terms. Flattr is now being ridiculous. Goodbye. -Odinn cc: cypherpunks > ***************************************** > Hi AnonyOdinn > ***************************************** > > As we are changing payment providers your account needs to be updated. > Before July 15th, 2014 you need to: > > - Update your account details and agree to our new terms: > https://flattr.com/settings > > If not your account will be disabled after the 15th of July. > > You can read our new terms at https://flattr.com/terms > You can read more about this on our blog, > http://blog.flattr.net/2014/05/time-to-update-your-account/ > We also answered the most common questions, > http://blog.flattr.net/2014/07/4-questions-about-flattr-mangopay/ > > Kind regards > The people at Flattr >

2 2

BlackHat2014: Deanonymize Tor for $3000
by grarpamp 07 Jul '14

07 Jul '14

You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget Alexander Volynkin / Michael McCord [...] Looking for the IP address of a Tor user? Not a problem. Trying to uncover the location of a Hidden Service? Done. We know because we tested it, in the wild... In this talk, we demonstrate how the distributed nature, combined with newly discovered shortcomings in design and implementation of the Tor network, can be abused to break Tor anonymity. In our analysis, we've discovered that a persistent adversary with a handful of powerful servers and a couple gigabit links can de-anonymize hundreds of thousands Tor clients and thousands of hidden services within a couple of months. The total investment cost? Just under $3,000. During this talk, we will quickly cover the nature, feasibility, and limitations of possible attacks, and then dive into dozens of successful real-world de-anonymization case studies, ranging from attribution of botnet command and control servers, to drug-trading sites, to users of kiddie porn places. The presentation will conclude with lessons learned and our thoughts on the future of security of distributed anonymity networks.

7 11

Interoperating the DarkNets [was: Tox]
by grarpamp 07 Jul '14

07 Jul '14

>From this thread: https://cpunks.org//pipermail/cypherpunks/2014-July/004957.html On Sun, Jul 6, 2014 at 3:27 PM, Lodewijk andré de la porte <l(a)odewijk.nl> wrote: > 2014-07-06 19:42 GMT+02:00 grarpamp <grarpamp(a)gmail.com>: >> IPv6 > To be honest, too centralized There's nothing centralized about it at all. You generate your own rfc4193 IPv6/48. It's random so still check with other projects to be 100% sure before going live, and there's even an open registry to help with that. The problem is when people like cjdns blindly stake the other whole available even wider fc00::/8 as their own without thinking about interop (well if you actually need the bits that is, but with accepted crypto starting at 128 / 2048, 120 bits is no more valid width than 80. and with the DHT below this native width limitation is moot). > and too arbitrary. > It's odd to declare IP(v6) addresses bullocks that simply. It's in our > systems and in our thinking. The reason to declare IPv6 on a tun interface on your host is so users can run whatever IPv6 enabled app users want to run, on whatever darknet, right now, today. Darknet projects should be coding good darknets, not duplicating existing writing user facing apps for them (browser's, mua's, login's, fileshare's, git's, wiki's, webserver's, etc). > But really, universally unique addresses are just a dream. The only address > I think makes sense is derived off a public key. Any other address should be > network-topology-semantic, not assigned by committee. That way there's real > identity (private-publickey) and real address/location (place dependent or > similar address) An IPv6/48 is big enough to hold every user on every darknet simultaneously. But yes, we cannot arbitrate control central the map from IPv6 addr to user (truly, their darknet internal wide address / PKI key). So DHT... darknet user picks random IPv6 addr as their own key, adds in each of their darknet addresses with sigs over it [1] as values. Now you have the needed interop map. You need to label and rewrite packets to/from each darknet with this scheme, but that is easy part. [1] To be flexible in binding, one darknet per port/range, or one per whole IP. The DHT could hosted over any darknet, or it's own special darknet. > One of these months I will continue work on a paper reg. semantic addressing > and a true IP layer replacement. I feel bad having talked about it for years > now, but life and inexperience haven't really allowed me to make a great > paper out of it. One of these months. The problem with IP stack replacements to something really wide (eg: 512) is you then have to produce a library and beg all the above user apps to link it and handle it... not going to happen. Or write your own apps which takes the whole variety of apps/life on clearnet and crushes it into your few apps... not fun. So replacement = limitation and poor adoption.

1 0

XKeyscore rules - technology utilized
by Nathan Andrew Fain 06 Jul '14

06 Jul '14

Based on the xkeyscore rules does anyone have some idea of the technology being utilized? Looking at the mapreduce::plugin definition I get the impression Hadoop is in use. Hadoop provides a stream interface for Map Reduce functions letting one utilize any program or language of their choosing [1-example]. Can with more knowledge of distributed data technologies confirm this? 1. http://cs.smith.edu/dftwiki/index.php/Hadoop_Tutorial_2.2_--_Running_C++_Pr… see also slide 5: http://cecs.wright.edu/~tkprasad/courses/cs707/ProgrammingHadoop.pdf <quote> cat input | grep | sort | unique -c | cat > output Input | Map | Shuffle & Sort | Reduce | Output </quote>

5 4