- cypherpunks@lists.ogf.org

SHA-7 crypto patented by Italian Postal Service
by Fabio Pietrosanti (naif) 20 Mar '14

20 Mar '14

LOL - LOL - LOL - LOL - LOL On italian government "innovation portal" it has been published a patent by the "Italian Postal Service" of SHA-7 : "The encryption SHA-7 allows to generate a unique “message digest” " LOL reading on http://italiainnovatori.gov.it/en/innovations/sha-7-2/ -naif

3 2

MH370 in hangar at Diego Garcia, detainees already rendered
by Anonymous Remailer (austria) 19 Mar '14

19 Mar '14

The flight was hijacked by a non secured flightplan upload to the flight management system. It was then flown to Diego Garcia, where the passengers were disembarked by force, the selectees from the passenger list are in one of the US navy brig ships anchored since 9/11 at Diego Garcia, "chatting" with CIA interrogators. Disposition of the other detainees passengers NOT known at the present. The statement released by the malaysian gov is false. They know where the detainees are. The adsb xmissions aboard the 777 are handled by an older subsystem and are NOT so easily silenced from the cockpit. By the same token the flight management system flight plan upload capability aboard boeing planes has been shown to be insecure and vunerable by security researchers since the B737. The worst part of all is that the "simulators" for the FMS are a windows based program that is linked with the libraries either representing the windows environment of the simulator OR thet are linked with the "production" libraries to produce the FMS firmware for use on the aircraft itself. Thing about programming in a windows environment? ALL the fucking calls are unique to the Microsoft windows environment and NOT portable at all to other runtime environments, UNLESS that runtime is windows based.. say like windows mobile(big flop) or a proposed hypothetical environment I am going to call Windows PLANE. Windows PLANE would have inherited the same crappy programming environment that caused the US Navy to do an abrupt 180 turnaround prom putting its firecontrol and navigation systems under control of windows after a near disaster in the mid alantic caused by windows domain failuresa Windows PLANE would have all the same flaws as the crappy laptop you like to lug around Fucking Boeing, all of those windows development asshats that did this need killin' for putting their personal profit ahead of the lives of millions who fly.

11 18

telesnowden selected excerpts
by coderman 19 Mar '14

19 Mar '14

a few things i found interesting, per http://blog.inside.com/blog/2014/3/10/edward-snowden-sxsw-full-transcriptio… (better script and transcode?) --- emphasis on attacks against crypto systems by targeting the random number generator(s): "typically it is the random number generators that are attacked as opposed to the encryption algorithms" "... encryption does work.... a basic protection[,] it is a defense against the dark arts for the digital realm. This is something we all need to be not only implementing but actively researching and improving on an academic level. The grad students of today and tomorrow need to keep today's threat on online to inform tomorrows. We need all those brilliant Belgian cryptographers to go alright we know that these encryption algorithms we are using today work typically it is the random number generators that are attacked as opposed to the encryption algorithms themselves. How can we make them ____ how can we test them? This is _____ it is not going to go away tomorrow, but it is the steps we take today. The moral commitment. The philosophical commitment, the commercial commitment to protect and enforce our liberties through technical standards to allow us to reclaim the open and trusted." --- "By doing end to end encryption you force what they are called ... global passive adversaries to go for the end points that is the... computers. And the result of that is a constitutional, more carefully overseeing sort of intelligence gathering model. Where if they want to gather somebody's communications they have to target them specifically. They can't just target everybody all the time and then when they want to read your stuff they go back in a time machine and say what did they say you know in 2006. They can't pitch exploits in every computer in the world without getting caught. That is the value of end to end encryption and that is what we need to be thinking about." the targeted attacks under a different authorization and more restrict controls? would like details on "constraints" and "authorizations" and specific projectnames. :) ---- "The NSA the sort of global mass surveillance that is occurring in all of these countries. Not just the US it is important to remember that this is a global issue. They are setting fire to the future of the internet." this is a global problem. somehow, with decades of growth nurtured and shaped and guided along flawed trajectories, we looked around and found everyone and everything bathed in surveillance and privacy invasion, myriad motives across state/corporate/professional boundaries coopted in blissful or willful ignorance as was chosen. --- "Let me embrace thee, sour adversity, for wise men say it is the wisest course." - William Shakespeare

1 0

cyberwarfare by lawyers
by Cari Machet 19 Mar '14

19 Mar '14

'The Jerusalem Post recently interviewed Col. Sharon Afek, formerly deputy head of the IDF's legal division, who wrote a 149-page treatise on cyber warfare law - the first treatise of that comprehensiveness by a military lawyer of his rank and stature.' http://www.jpost.com/Defense/Analysis-How-Israel-is-dealing-with-cyber-warf… 'Many are also asking more strongly than ever: "Is international law still relevant?" Afek, who views his treatise also as a "bridge" between the pre- and post-cyber world of war, answers with a resounding "yes," but then goes further to try to resolve some of the questions of how and where it applies. One debate in the new wild west of cyberwarfare law is between two schools of thought about where to draw the line of which cyber operations should be declared illegal under international law.' http://www.jpost.com/Features/Front-Lines/A-revolution-in-war-339962 -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

7 9

Re: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi
by Aaron Zauner 19 Mar '14

19 Mar '14

cates From Trust, Stores References: <5328EE7F.9070503(a)azet.org> <5328F7FC.5060802(a)iang.org> In-Reply-To: <5328F7FC.5060802(a)iang.org> X-Enigmail-Version: 1.2.3 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig2D2852BFD85FEBF952C9CE4C" Cc: cpunks <cypherpunks(a)cpunks.org> X-BeenThere: cypherpunks(a)cpunks.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: The Cypherpunks Mailing List <cypherpunks.cpunks.org> List-Unsubscribe: <https://cpunks.org/mailman/options/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=unsubscribe> List-Archive: <http://cpunks.org/pipermail/cypherpunks/> List-Post: <mailto:cypherpunks@cpunks.org> List-Help: <mailto:cypherpunks-request@cpunks.org?subject=help> List-Subscribe: <https://cpunks.org/mailman/listinfo/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=subscribe> X-List-Received-Date: Wed, 19 Mar 2014 03:52:41 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Ian, ianG wrote: > Nice! Now, if they could package up a plugin or a new root list such > that we could write in 2 lines what busy sysadms had to do, I'd say it > would make a great recommendation. >=20 > What I'm trying to get away from is the notion that we should put a > simply list in the doc and say "oh, and strip these out! You know > how, vi is your friend..." Yea. That won't work at all, there's no clear authority [sic!] on who can decide a CA is not trustworthy. Experience has to show that, and in that case a lot of the big CAs will fail an evaluation. If you ask me, it's pretty easy, my list of trusted CAs is empty. Automated generation of lists of CAs that are simply unused is just the first step. I think certificate-transparency is a good way to do that, the rest is basically automation. For example: one can provide chef, puppet, ansible recipies for linux and mac clients, a similar solution for windows and mobile devices should also be doable. Aaron --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJTKRQqAAoJEOTbZJL9ubXVB2cQAMCC6nlPTgUn86bCXi8ny+uk noYKI7XXHq0Hzl/f3Hd67oAXEX9wNh1znSBRYJ3sfSd5dgeyTfhn6NIITjdzqGc1 +1yAmyIn7Q8/+lDgSEPdsTDKFXqiTtQj9iK6t+/Ul6/l34movetvYBBI85f9yO96 4swk7obaqpRqkziVoUt0K2lopYrCxXHK7hVkXmwXgt1UlyccODHy2fWO3QWl8SWw xmrQlCJ+BGuYiV2mNFZe9w5etLwGX7wiR4xpaAHXoYZL6Kt2f//fmdb+pWnq8lE/ /NxmAQlDboPBB39uPhhsUtbrwOUS/4ZFqiA3tUSgcYZMGxYPWoUkkJpuccpWhYMf psaWrZmhz0CoL9FPiKngscv9DNAMIHfOOa0Ynku4RfBvO2Q/4F1JrW4epwCJuQiK kxKDjD2+pQ/UdIlIWSdylskaVZV+qsKWBa+4oBbGQYz9DXLgYwaPh7p6QzRcZGvA sP3p6t+aluUqCtc11cgiKfCfLs8uezTNQUYrrlu4E1G3IXkMPMmSOuheiwu+sRCJ BSlP/ys/FihB6J6EsC4i7AkLK8Ws1vfarCZDdycA++lr63Uoj0LEYv8/nTgg/GNj ZaDmuGO1sBMwEEH0nTyBDk2fJryOFjiGzzdzmEuk7fAWD6tY16mqYUptqlDmphz/ 79u6Uftx8nNa3u099JBL =7ty+ -----END PGP SIGNATURE----- --------------enig2D2852BFD85FEBF952C9CE4C--

2 1

Special Source Operations puzzles
by coderman 19 Mar '14

19 Mar '14

in the SSO overview slide there are three colors: https://peertech.org/files/sso-in-mah-tubes.jpg --- i fancy them as follows: GREEN: legally compelled and gagged plaintext access through service providers, like BLARNEY and PRISM RED: financially motivated secret agreement with "special partners" for filthy lucre. e.g. GTE fiber access. BLUE: unilateral / non-cooperative operations; covert black bag taps. --- if most facilities, like room 641A, are in RED zones, then recent ground breaking improvements in BLUE may be miniaturized and covert taps with selectors and large local cache. alternatively, new capability could be upgrades to the RED facilities where BLUE traffic is conveniently co-processed, cached, and UPSTREAM'ed. paging Top Level Telecom, ;)

1 0

Fwd: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi cates From Trust, Stores
by coderman 19 Mar '14

19 Mar '14

Fwd^2: ---------- Forwarded message ---------- From: Aaron Zauner ... Date: Tue, Mar 18, 2014 at 6:10 PM Subject: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi cates From Trust, Stores Recommended reading: https://www2.dcsec.uni-hannover.de/files/fc14_unused_cas.pdf (PDF copypasta with missing characters following): ``` 6 Conclusion In this paper we argued for the removal of CA certi cates that do not sign any certi cates used in HTTPS connections from desktop and browser trust stores. We based our analysis on an Internet-wide dataset of 48 million HTTPS certi cates and compared them to trust stores from all major browser and OS vendors. We were able to identify 140 CA certi cates included in twelve trust stores from all major platforms that are never used for signing certi cates used in HTTPS. Based on these ndings, we suggest to remove or restrict these CA certi cates. Using two months' worth of TLS handshake data from our university network, we con rmed that removing these certi cates from users' trust stores would not result in a single HTTPS warning message. Thus, this action provides a simple and low-cost real-world improvement that users can implement right now to make their HTTPS connections more secure. We are working on creating tools and scripts to automate this process for diﬀerent browsers and operating systems. Our current list of CAs we recommend for removal is a conservative one. It includes all CAs that have never signed a HTTPS certi cate. In future work,we would like to analyze the trade-oﬀ between false positives and the size of the trust store, as well as look into mechanisms to restrict the capabilities of certi cates on the Android platform. ``` Aaron _______________________________________________ Ach mailing list Ach(a)lists.cert.at http://lists.cert.at/cgi-bin/mailman/listinfo/ach

1 0

Blade Runner Mesh Networking
by Griffin Boyce 18 Mar '14

18 Mar '14

So if (spoiler) Deckard's a replicant, and he knows about Rachel's implanted memories right after meeting her, and Gaff knows about Deckard's unicorn dream right after it happens... Does that mean that the replicants are all meshing? ~Griffin

1 0

a prediction market denominated in Bitcoin
by dan＠geer.org 17 Mar '14

17 Mar '14

http://www.siliconrepublic.com/start-ups/item/33411-irish-start-up-launches/ https://www.predictious.com/ Onward, --dan

1 0

Re: Journalists Shill Sources and Secrets
by John Young 17 Mar '14

17 Mar '14

At 09:25 PM 3/16/2014, Cari Machet wrote: wait ... are you saying money corrupts ??? if you are saying that corruption is at hand then how can we trust the supposed human beings behind any of these names ? i mean i think you are saying corruption is at hand but i dont want to assume anything... Assume this promotional creed screed for national security journalism: http://cryptome.org/2014/03/sources-and-secrets-brief.pdf No, media venality is not news. What is worth examining is the long-term exploitation of "national security" as a joint gov-com-edu-org racket to manipulate secretkeeping as a wealth concentration industry. This has been commonplace since the national security state was invented after WW2 and led to need for continuous spying to manufacture enemies and to arm for diddly squat combat against fictious foes by hugely expensive but hardly ever used armaments. Cryptosystems among the black budgetary wastage. In particular cryptosystem popularization (as here and its emulators) as ostensible opposition to the national security racket, begun in the flower-child 60s to flower wildly in the 90s and rise to a kudzu crescendo with Snowden's operation to validate crypto use against illusory enemies within the state, cloaked as usual by the blanket exculpt "to do no harm to national security," then hide behind privileged natsec journalism so dirty and complicit in govenment affairs it needs protection from the public, so merely dribbles dainty tidbits of threats to privacy and to advance the favorite ACLU and EFF lawyerly fund-raising hobgobblin of constitutional violation. FISA Court jiggery-pokery by lawfare warriors indicates that lawyers and judges know diddly about comsec technology but dare not admit it and lose control of the public narrative of threat and protection obligatory in the trillion dollar national security hootenany which compares to organized religion of the medieval era which ruled heaven and earth with fantasticly frightening and pleasuring tales of evil and salvation. Adled journalists are racing to adopt encryption as crusading chain mail raiment, ignorant of how easily it can be penetrated, but no matter, what will really protect the valiant journalists is "constitutional protection," a comedy of conceit and stupidity usually associated with court jesters.

1 0