- cypherpunks@lists.ogf.org

02 Jun '14

https://www.youtube.com/watch?v=I-xxzOwr7I4 So, snowden says the invasion of irak was launched on 'false premises' but he doesn't know if the government was lying or there were 'mistakes of intelligence'. Yeah right. Poor souls they didn't know what they were doing...

1 0

Re: Our nameless project.
by davidroman96 01 Jun '14

01 Jun '14

On 01/06/14 01:19, Bill Stewart wrote: > At 10:15 AM 5/31/2014, davidroman96 wrote: >> We know that the sources ips generally are dropped, this is the only >> problem that we have. >> But if multiple hosts can use the same ip how the connection can be >> traced? Only the ISP have the information, the receiver don't know >> anything a part from the content of the packet. > > That's part of the problem - > the receiver doesn't know anything, even the contents of the packet, > because any good ISP will drop the packets instead of allowing the > sender to send them. > If you can find a collection of bad ISPs who can send forged-source > packets to each other > across the public Internet, maybe you have some chance, > but that kind of bad ISP is also a target for spy agencies and for > criminals. > > > Normally, UDP is fine, but it isn't TCP. > A popular thing for UDP applications to do is to reinvent TCP badly. > If you need to do TCP things, and only have UDP for some reason, > you can reinvent most of TCP well, but only if you understand it well. > The UDP versions of Bittorrent, for instance, were written by people who > not only understood TCP and UDP well, but experimented a lot with scale. > > A very good ISP will not only drop forged-source packets, > they'll hunt down the sender and kill it. > Somebody mentioned Netflow - many large ISPs record that level of > information, > with the source and destination IP addresses, port numbers, protocol, > and router information, > and sometimes also link-layer addresses if the link layer uses them. > If you sent a packet from 192.9.200.1, your ISP will probably drop it > at the originating router, > and will log an error message that says it dropped that on your access > line, > and if it sees a lot of them, they'll go check out why. > If you use a small ISP that doesn't bother checking for forged source > addresses, > they'll be using a larger ISP for long-haul connections that will notice. > > We know that ISP have the 100% of information, but the idea was to give less information to the receiver. Even yet I couldn't find any transparent ISP, seems that all ISPs are trolls xD, maybe pirateISP are more transparent¿?...

4 5

Our nameless project.
by davidroman96 31 May '14

31 May '14

I want to present an idea to improve anonymity and privacy on the intrernet that me and my companion are building. How it works: To improve anonymity, the diferent hosts are connected with groups of multiple hosts that comunicate each other spoofing the source ip and broadcasting the messages that have to be sent to some host. With this method the reciever don't know who want to download X file and if the NSA or FBI get the logs of the reciever they can not use it for trace the origin. The sender don't know who have X file because they have sent a broadcast request for download a file and will recieve the file with spoofed ip, is 99% anonnymous, the only problem is that the ISP can always know if you are using this program. For the cryptography we use SHA-3 (keccak) for hashing, AES, ECDSA and the better algorithms and methods that we know (we are only amateur cryptologists). With cryptography is easy to protect data against the ISP MitM but it's more dificult to send private messages to a single person. For this reason the topology for the network is of isolated groups with their own private key for the members, obviously a group can be public. Of course a group of 2 people is useless because there are not anonymity xD Bigger groups, more entropy, more anonimity. For the "POC" we are using UDP. UDP only can send small packets of ~64kb, therefore, it can be used for a chat but is too slow to download big files. We have sacrified speed to increase anonymity and privacity. We have "tested" it in a small group of people and for this reason we can not say if it works or not, but in theory it works! And that is the idea :) , what do you think? PD:Sorry for my english :P

7 12

Curious Intellectual Property Food-for-thought: "Live-forever Pingers"
by jim bell 31 May '14

31 May '14

Some people debate whether 'intellectual property' (such as patents) should exist. The standard for patenting is said to be: An invention, to be patentable, should be "new, useful, and unobvious to those skilled in the art". A month ago, when it became obvious that finding Air Malaysia Flight 370 could be difficult, the 30-day limit of the electronic pingers got me to thinking. Why? Instead of pinging for 30 days, why not have them ping increasingly slowly, so that the pinger would last 'forever'. Considered discretely, let it ping at the normal rate for 1 week, at half the rate for the next week, at quarter the rate for the subsequent rate, etc. Or, have a continuous equivalent of this, a ping-rate which slows to approximate this rate over time. This kind of pinger would 'never' run out. Should this idea be patentable? Is it new? I haven't heard of it. Is it useful? It is now clear why it would be useful...now!!! Is it 'un-obvious'? Well, despite the fact that I just thought of it a month ago, and I had never heard it proposed before, I wonder why it shouldn't be called 'obvious'. If anything, I think it's amazing that it hasn't been implemented before. People who work in aeronautics and electronics are smart and imaginative...at least I thought they were...until now? It should also be possible to include in the ping, information (transmitted by pulse-position information) about the last lat/lon received by the aircraft. Jim Bell

3 3

Re: NSL's [was TrueCrypt]
by grarpamp 30 May '14

30 May '14

On Fri, May 30, 2014 at 2:52 PM, Cathal Garvey <cathalgarvey(a)cathalgarvey.me> wrote: > The problem as I see it is that those who have chosen to battle NSLs on > constitutional grounds have undermined their own assertion of > constitutional right by keeping the NSLs secret while they await their > day in court. > > If you believe you have a constitutional right not to be bullied by > secret police and being forced to keep that a secret, then you should > just come out and say what's happening. That way, the highly political > court that's going to try to indict you anyway will at least have to > operate under public scrutiny and criticism. All true. And it's not as if the penalty, even if considered criminal, would be anything more than trivial [1]. Further, if you are a business owner who is judged against - personally, you are your own employer so nobody can fire you. - business license pulled, liquidate and sell it back to yourself. A jury would likely "you're here for publishing this? Lol, go home." The actual risk seems rather low. I'd do it just for the fame. [1] Feel free to supply links to US code. > Of course, the rational thing to do is to keep quiet and do as > instructed by the stasi Only if you are certain you will win 'soon'. History shows waiting yields a long hard bloody road. > or to flee the country to somewhere that > recognises amnesty from history's largest and best armed superpower. > Good luck with the latter. The US isn't doing so hot right now in the world reputation dept, so your odds of washing up on anyones shore and being welcomed to stay for protesting your dissatifaction, are probably approaching good.

1 0

Truecrypt tinfoil hat testing
by NullDev 30 May '14

30 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 With exquisite timing, I bought a new external HDD yesterday (28.05.14) and set about encrypting it with TrueCrypt. I installed via the terminal as I'm on Linux, ie: wget http://www.truecrypt.org/download/truecrypt-7.1a-linux-x64.tar.gz I extracted it, and encrypted my drive. The TrueCrypt website was looking it's normal self at that point: I referred to it a few times during the encryption. However, no sooner had it finished at about 4pm UK time yesterday, I received the first email from someone on the list about Truecrypt pulling the plug. Their site had been changed to the one we see today, recommending we switch to an alternative like, ahem, something as fabulously secure as Bitlocker. Ironic timing, huh? So, I have what was possibly the last download of a version 7.1a tarball before everything went titsup, and if you read what The Register said about Truecrypt's V.7.2 being corrupted/infected/backdoored here: http://www.theregister.co.uk/2014/05/28/truecrypt_hack/ Then theoretically I have something to wonder about. However, it would appear that the date, checksum and verification are ok on what I downloaded. It *seems* clean. It would be interesting to see if it's in anyone's scope to compare the source code with other versions of 7.1a for Linux: it's beyond mine, apologies. If anyone wants me to send them the tarball I'll be happy to oblige. Let me know if I can be of assistance. Best, NullDev -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTh5c/AAoJELavgB137JPDHEsIAI2Dt4qVnWZb4FUxUOZBN4cs WfXXofFRodZ0e1yK/IxmrwShp/d9eNJdBx/aGuERoAQ1jlLjRNsyfmzpF7zJMYsb PD/uS2ZiXXP8UjbWNAEBOhrBV1dPGSj86twpsVXMFuBrzbKZHMmWKHxp9cNpwMLQ WbPIqVaDGVb4V5d/yyFPk9/uELReIQKobML6hzGgxlWRc5XH/9403YcSc0iMe0bp oSpOd69hRddvLssX76TUxbyS1k+hc2+zXxsaxqd8lS3J7F6YRzZHTRD/BEqTva8Y OseOVwYGBX+kEUeXEh13yzsHao9RR6DFEhZL7yVAJb88GQvMgT6f+4IO6TJcJ8A= =P4+W -----END PGP SIGNATURE-----

5 6

NSL's [was TrueCrypt]
by grarpamp 30 May '14

30 May '14

> Have NSLs held up in court against the First Amendment? > It's already constitutional that freedom of speech cannot be prevented > except to prevent immediate, tangible harm to others. > If you want > to challenge them, publish one on your blog and say "sue me, let's see what > the supreme court says". This above is exactly one of the key issues. Either - You have the right to speak freely under the 1st, or you don't. - NSL's are 4th compliant warrants, or common orders/subpoenas, having all been reviewed and issued by a judge having jurisdiction, subject to challenge, etc... or they aren't. - The FISA court is a proper court established, operating and regulated under the judicial branch, beholden to the Supreme, or it isn't. Some say: You do, they're toilet paper, it's legislative or executive. With thousands of letters issued there are similarly many chances to challenge it, yet so far it seems only a few have started on the direct route and everyone else seems too chicken. That ratio could really be improved. [For the schemers, and though not really a proper stand up fight, there are probably even a few dual citizens who have received them who could just as happily relocate back home offshore and publish (if not fight) from there. You at least retain the first person perspective that way.] https://en.wikipedia.org/wiki/National_Security_Letter http://www.law.cornell.edu/wex/first_amendment http://www.law.cornell.edu/wex/fourth_amendment https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillan… https://en.wikipedia.org/wiki/Patriot_Act

2 1

Re: [cryptome] Hector Sabu Monseur Sentencing Transcript
by shelley＠misanthropia.info 29 May '14

29 May '14

On Tue, May 27, 2014, at 11:59 AM, John Young wrote: > Held today, 11AM. So one script-kiddie, pig-kissing snitch managed to help thwart "hundreds" of "cyber attacks" (translation: /b/tard summer crew, stupid enough to still use LOIC), while the NSA's whole Stasi-on-steroids spying infrastructure couldn't find one needle in that haystack of all our calls and emails? Well, isn't that special...

4 4

Re: is truecrypt dead?
by shelley＠misanthropia.info 29 May '14

29 May '14

Krebs has put a post about it: http://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secu… excerpt: "Doubters soon questioned whether the redirect was a hoax or the result of the TrueCrypt site being hacked. But a cursory review of the site’s historic hosting, WHOIS and DNS records shows no substantive changes recently. What’s more, the last version of TrueCrypt uploaded to the site on May 27 (still available at this link) shows that the key used to sign the executable installer file is the same one that was used to sign the program back in January 2014 (hat tip to @runasand and @pyllyukko). Taken together, these two facts suggest that the message is legitimate, and that TrueCrypt is officially being retired. That was the same conclusion reached by Matthew Green, a cryptographer and research professor at the Johns Hopkins University Information Security Institute and a longtime skeptic of TrueCrypt — which has been developed for the past 10 years by a team of anonymous coders who appear to have worked diligently to keep their identities hidden. “I think the TrueCrypt team did this,” Green said in a phone interview. “They decided to quit and this is their signature way of doing it.”

1 0

Harvard and MIT Students Launch ‘NSA-Proof’ Email Service | Betabeat
by J.R. Jones 27 May '14

27 May '14

Have you guys seen this? What say ye? http://betabeat.com/2014/05/harvard-and-mit-students-launch-nsa-proof-email…

11 18