- cypherpunks@lists.ogf.org

anonymous remailer whitelisting
by Riad S. Wahby 20 Jan '14

20 Jan '14

I received an anonymous request to expand the whitelist for remailers. Requester: thank you for keeping me honest! I have updated the list. -=rsw

1 1

Try to remember... (Was: AHEM! ...) (fwd)
by J.A. Terranson 20 Jan '14

20 Jan '14

(Came back due to deprecated A/Q - the "lesson" is not feeding trolls, good behaviour, etc.) > seems every crop of new cypherpunks has to learn this lesson. [1] Try to remember the kind of September When life was slow, and oh, so mellow. Try to remember the kind of September When grass was green, and grain was Yellow. Try to remember the kind of September When you were a tender and callow Fellow[2]. Try to remember, and if you remember, then follow... //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another. [1] Taken completely out of context from the Very Off-Broadway "The Fantasticks" - a show which was expected to run for a few weeks and then enter eternal obscurity. [2] The original lyric has no capitalization of "Fellow". Those who can, will draw the correct inference.

1 0

Cypherpunks is NOT a safe place for fools
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

To whom it may concern: Cypherpunks is NOT a safe place for fools. People have gone to prison for years on here for making very foolish statements and taking foolish actions. You DONT know you are chatting with(Hi agent Gordon!) Others are agent provocateur(s) posing as something else(social activists(and reporting to the FBI/NSA etc)) be afraid be very afraid

4 4

training grounds and basic training for cypherpunks
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

can the millenials get a clue? methinks maybe not but as there may be one or two of them who are NOT soft in the head I invite those to read http://borg.uu3.net/ldetweil/medusa/detweiler.html , where freedom of speech comes in conflict with the tradegy of the commons, there were indeed a lot of valuable lessons learned from detweilers actions and those in opposition to same. perhaps some millenials can get a clue about killfiles(course you take a chance of missing the creation of memes and subsequent modification of same and cypherpunks is ALL about memes.) While the whole snowden affair is most certainly interesting, cypherpunks do things anonymously and pseudoanonymously, we have been embedded in some of the largest government agencies as well as some of the largest and smallest corps. Thing is for all the NDA and loyalty oaths you cant tell when someone comes over to the darkside quietly nowaday especially if they were always using tor to browse anyway and that of course in and of itself will come to be regarded as suspicious Just as using PGP was always suspicious too few using it.. and a LOT of those on insecure platforms. All the recent meme introduction both signal and noise memes have resulted in some interesting side discussions about censorship vs moderation which I suspect is what the postings were intended to produce. anon

1 0

Welcome to the Asylum!
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

Hi All, I would add its NOT just a mailing list, it IS instead an insane asylum and experiment in social darwinism where reputation capitol has replaced wealth in the currency of the group. just my .02

8 12

Fwd: [tor-talk] giving up pseudonymity after collecting experiences with pseudonymous project development
by coderman 20 Jan '14

20 Jan '14

i find these kinds of experiments fascinating and would love to see more of them! ---------- Forwarded message ---------- From: Patrick Schleizer <adrelanos(a)riseup.net> Date: Sat, Jan 18, 2014 at 5:09 AM Subject: [tor-talk] giving up pseudonymity after collecting experiences with pseudonymous project development You may have noticed that I, previously known only known under the pseudonym adrelanos, decided to give up my pseudonymity. It was an interesting experience to pseudonymously maintain a Linux distribution (Whonix). I've learned a lot during these ~ 2 years. I didn't have too bad luck in the lottery of life and are won a citizenship, which is at low risk compared to less lucky ones. Living in a country, where pseudonymity for this kind of activity isn't crucial. Fortunately, according to latest press, neither the US nor Germany are killing their own citizen for criticizing "the system". That is, the mass surveillance police state, the military industrial complex, the system of economy, that needs exponential growth to prevent imploding. And so it doesn't become even worse, and better for the less lucky ones, it is important to speak out in public and to take action. Staying pseudonymous for such a long time became more and more a burden. For me, it is not healthy for psychology. When pseudonymously working a a project, you cannot tell anyone about it and they're wondering with what you never tell much. You need to constantly second guess every tiny action. Concentrate on not messing up. Also you'll never know if you already messed up and if "they" already know who you are. You only need to mess up once, and you're always linked to that project. Lucky me, I wasn't forced to stay pseudonymous for ever. I am looking forward to continue contributing to the awesome Free (as in freedom) Software community. Being no longer pseudonymous allows me to speak at conferences, to attend key singing parties, to meet up with other developers, to voice chat with other developers, to chat on IRC without fear of leaking too much information, to be less paranoid, sometimes even running searches in clearnet if that is more convenient, and so forth.

4 4

"Blackphone" said to be "a super-secure nsa-proof"
by Jim Bell 20 Jan '14

20 Jan '14

http://www.yahoo.com/tech/startup-launching-a-super-secure-nsa-proof-735110… Fears over NSA spying have prompted people around the world to think about security differently, whether it be petitioning for companies to better secure their data or changing the information they share online. In particular, security around smartphones has been of great concern, as people increasingly surf the Web, make calls and send messages from their mobile devices. An international group of privacy enthusiasts has come together to create Blackphone, a smartphone that claims it will help to better protect your information. Mashable writes that Blackphone is the brainchild of Silent Circle and Geekosphere, with participation from big players in the fight for information privacy and computer security. Phil Zimmermann, creator of data encryption protocol PGP (Pretty Good Privacy), is one of the minds behind the device. “Blackphone provides users with everything they need to ensure privacy and control of their communications, along with all the other high-end smartphone features they have come to expect,” Zimmerman said, according to Mashable. [ Right Click: Kiwi lifestyle tracker to free people from their smartphones ] The operating system is a custom build of Android OS called PrivatOS, designed for improved security. Silent Circle’s CEO Mike Janke says the project will be open source, as will the PrivatOS operating system. The phone likely won’t have the most outstanding specs, but the team says that’s because privacy is the top concern. No specific details have been given about the phone yet (although some of the code has been posted to GitHub). The companies say they’ll be unveiling it properly at Mobile World Congress in Barcelona beginning Feb. 24. Even with very little information about the device currently available, some media outlets are suggesting that the phone could be “NSA-proof.” That’s a tall order, especially in light of a story from The New York Times claiming that the NSA has implanted software in nearly 100,000 computers to create backdoor radio access. For more information on Blackphone, visit its website at https://www.blackphone.ch.

9 12

Cari Machet
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

I've been watching this shit throwing match between Troy and Cari for the last few days and, let me just say, both of you need to GROW THE FUCK UP. I don't give a rats ass if Cari is a 'real Indian' or just some crazy bitch pretending to be one and I don't give a fuck if Troy is offended by her pretending. This list is NOT the place for this bullshit. Get a room and fuck it out or just take it off-list but keep us the hell out of it.

14 28

bespoke boot and runtime configuration [was Re: Debian System and /dev/random]
by coderman 20 Jan '14

20 Jan '14

On Sun, Jan 19, 2014 at 4:57 PM, coderman <coderman(a)gmail.com> wrote: > .... > since 2004 building my own rngd, my own FDE bootloader, my own > mandatory entropy health watchdog service, VIA Padlock enabled processors only. FDE was loop-aes. init enforces mtrngd[0] at boot in conservative configuration. if in key mode without networking, failure of XSTORE at any time causes mtrngd to exit non zero then halt. for normal operation defaults to sync, shutdown -h in 60 seconds. cypherpunks may write code, but sharing with anyone and everyone never the bargain ;) 0. mtrngd - high performance entropy daemon for XSTORE https://peertech.org/dist/mtrngd-0.7-2007.tgz see also https://peertech.org/archives/viarng/ --- custom kernel, initramfs, initrd, install.tgz builds produced bootable ISO mastered with per-image unique entropy mixed at boot using custom pre-boot auth that launches desired OS once encrypted root volume is mounted. the FDE boot process at the time (~2005) worked like this: # first some settings / defaults export keydir=/janus/keys export addir=/janus/active-domain export logfile=/var/log/start.log export klogfile=/janus/active-domain/system.log export tmpmntdir=/mnt/tmp export aes_mode="AES256" # note that message and log calls assume console; e.g. dialog --msgbox # define some common tasks; note that we're single user here (no race) gen_tmpname () { uuid=`cat /proc/sys/kernel/random/uuid` echo "/tmp/.${uuid}.tmp" } LBL_LENGTH=53 get_idlabel () { dev="$1" part=`echo $dev | sed 's/.*\///'` num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` tmpf=$(gen_tmpname) dd if=$dev of=$tmpf bs=1 count=$LBL_LENGTH grep IDLABEL $tmpf 1>/dev/null 2>/dev/null if (( $? != 0 )); then rm -f $tmpf return 1 fi rm -f $tmpf cat $tmpf | sed 's/^IDLABEL=//' } list_usb_storage_devs () { l "begin list_usb_storage_devs" done=0 timeout=4 while (( $done == 0 )); do if [ -f /dev/makedevs.sh ]; then l "invoking makedevs.sh" /dev/makedevs.sh 1>/dev/null 2>/dev/null fi sleep 1 ccount=0 devs=$(ls /dev/sd* | grep '[0-9]') for dname in $devs; do l "testing device $dname for readable" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "$dname is readable" ccount=`expr $ccount + 1` fi done if (( $ccount > 0 )); then done=1 fi timeout=`expr $timeout - 1` if (( $timeout == 0 )); then done=1 fi done devs=$(ls /dev/sd* | grep '[0-9]') for dname in $devs; do l "testing device $dname for readable" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "$dname is readable" echo $dname fi done } get_usb_dev_fstype () { l "begin get_usb_dev_fstype" if [ -z "$1" ]; then return 1 fi dname="$1" l "verifying readability for $dname" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? != 0 )); then l "$dname is not readable" return 2 fi if [ ! -d $tmpmntdir ]; then l "creating non existant temp dir $tmpmntdir" mkdir $tmpmntdir 1>/dev/null 2>/dev/null fi umount $tmpmntdir 1>/dev/null 2>/dev/null ismnted=0 mount $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? != 0 )); then sleep 3 mount $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? != 0 )); then fstypes="xfs ext2 ext3 reiserfs vfat ntfs msdos iso9660 romfs usbfs" for fst in $fstypes; do if (( $ismnted == 0 )); then l "attempting mount -t $fst $dname $tmpmntdir" mount -t $fst $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "mounted $dname" ismnted=1 fi fi done if (( $ismnted == 0 )); then l "unable to mount $dname at $tmpmntdir" return 3 fi fi fi fstype=$(mount -l | grep $dname | sed 's/.*type //' | sed 's/ .*//') if [[ "$fstype" == "" ]]; then l "unable to get fstype for $dname" return 4 fi echo $fstype l "got $fstype for mounted volume $dname" umount $tmpmntdir 1>/dev/null 2>/dev/null return 0 } ## keystore management ## a "keystore" stored on USB or microSD carried always on person ## id.txt is an ascii nickname, keys.dat loop-aes encrypted file backed volume ## and finally keys.gpg the disk encryption key wrapped with passphrase. list_keystores () { l "begin list_keystores" if [ -z "$1" ]; then return 1 fi basekeydir="$1" domains="" ddirs=`ls -1dF $basekeydir/* 2>/dev/null | grep '/$'` for dir in $ddirs; do dname=`basename $dir` domains="$domains $dname" done echo $domains return 0 } select_keystore () { l "begin select_keystore" if [ -z "$1" ]; then return 1 fi basekeydir="$1" domains="" ddirs=`ls -1F $basekeydir/` for dir in $ddirs; do if [ -d $dir ]; then dname=`basename $dir` domains="$domains $dname" fi done # MRP NOT IMPLEMENTED YET... return 0 } mount_keystore () { l "begin mount_keystore" if [ -z "$1" ]; then return 1 fi if [ -z "$2" ]; then return 1 fi domkeydir="$1" mntpoint="$2" name=`basename $domkeydir` ld=$(locate_free_loopdev) if [ -z "$ld" ]; then return 2 fi idfile="${domkeydir}/id.txt" if [ -f "${domkeydir}/keys.dat" ]; then keyfile="${domkeydir}/keys.dat" open=1 else if [ -f "${domkeydir}/keys.gpg" ]; then keyfile="${domkeydir}/keys.gpg" open=0 else d "Invalid key store" return 3 fi fi fsfile="${domkeydir}/fs.enc" if [ ! -f $fsfile ]; then d "Invalid key store" return 4 fi if (( $open == 1 )); then cat $keyfile | losetup -p 0 -e $aes_mode $ld $fsfile if (( $? != 0 )); then d "Could not configure keys for loop device." return 1 fi else gpgerrf=/tmp/.gpg_err done=0 while (( $done == 0 )); do d "Loading keystore $name" gpg --decrypt $keyfile 2>$gpgerrf | losetup -p 0 -e $aes_mode $ld $fsfile if (( $? != 0 )); then sleep 2 else done=1 fi done fi mount -t ext2 $ld $mntpoint 1>/dev/null 2>/dev/null if (( $? != 0 )); then losetup -d $ld 1>/dev/null 2>/dev/null return 1 fi echo "$ld" >&2 return 0 } ### the main initialization sequence main () { l "begin main" # args? d "Initializing ..." doinit # set run mode janusmode="default" grep JANUS_TARGET /proc/cmdline >/dev/null 2>&1 if (( $? == 0 )); then janusmode=`cat /proc/cmdline | sed 's/.* JANUS_TARGET=//' | sed 's/ .*//'` fi export janusmode grep VERBOSE /proc/cmdline >/dev/null 2>&1 if (( $? == 0 )); then export VERBOSE=true fi done=0 while (( $done == 0 )); do udevs=$(list_usb_storage_devs) if [ -z "$udevs" ]; then d "No USB storage devices found. Please insert one and press enter:" read sleep 5 else done=1 fi done if [ ! -d $keydir ]; then mkdir -p $keydir 1>/dev/null 2>/dev/null else umount $keydir 1>/dev/null 2>/dev/null fi chmod 700 $keydir 1>/dev/null 2>/dev/null unset xfsdevs unset odevs xfscount=0 for udev in $udevs; do fstype=$(get_usb_dev_fstype $udev) if [ -z "$fstype" ]; then odevs="$odevs ${udev}=none" else if [[ "$fstype" == "xfs" ]]; then xfsdevs="$xfsdevs $udev" xfscount=`expr $xfscount + 1` else odevs="$odevs ${udev}=${fstype}" fi fi done prompt_mkxfs=0 if (( $xfscount == 0 )); then e "No secure key storage domains found on USB devices!" return 2 fi if (( $xfscount > 1 )); then d "Currently only one USB device is supported." d "Please leave only a single secret USB key storage device and try again." noclear sleep 2 return 3 fi mount -t xfs $xfsdevs $keydir 1>/dev/null 2>/dev/null if (( $? != 0 )); then d "Unable to mount key storage" sleep 2 return 3 fi if [ ! -d $addir ]; then mkdir -p $addir 1>/dev/null 2>/dev/null fi chmod 700 $addir 1>/dev/null 2>/dev/null domains=$(list_keystores $keydir) if [ -z "$domains" ]; then e "No secure key storage domains found!" else l "selecting domain from set :${domains}:" dc=0 for domain in $domains; do dc=`expr $dc + 1` done if (( $dc > 1 )); then select_keystore $keydir 2>/tmp/.res if (( $? != 0 )); then d "Error selecting domain." sleep 2 return 5 fi adomain=$(cat /tmp/.res) else adomain=$domains fi mount_keystore $keydir/$adomain $addir 2>/tmp/.res if (( $? != 0 )); then d "Error selecting domain." sleep 2 return 5 fi cldev=`cat /tmp/.res` fi touch $klogfile do_disks_boot l "completed boot menu, assuming restart" if [[ "$VERBOSE" == "true" ]]; then sleep 5 fi return 0 } # execute main then exit l "entering main" doinit exec /sbin/init ### last but not least, modern linux makes this much easier (yay GUID!) ### otherwise shitty hacks required... get_part_keyfile () { l "begin get_part_keyfile" part=$1 num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` pdi="/proc/ide/${drv}/identify" if [ ! -f $pdi ]; then case $drv in 'sda') busno="001" ;; 'sdb') busno="002" ;; 'sdc') busno="003" ;; 'sdd') busno="004" ;; 'sde') busno="005" ;; 'sdf') busno="006" ;; *) busno="NOT_FOUND" esac uname=`lsusb | grep "Bus $busno" | grep "Device 002" | sed 's/ .*Device 002: ID ....:.... //' | sed 's/[^a-zA-Z0-9]/_/g' | head -1` pdi=/tmp/.tmp_pdi echo "$uname" > $pdi if [[ "$uname" == "" ]]; then l "No disk identifier found for partition $part at expected $pdi" return 1 fi fi did=`gpg --print-md sha512 $pdi 2>/dev/null | sed 's/.*://' | sed 's/ //g'` did=`echo $did | sed 's/ //g'` kf="${addir}/${did}.${num}" l "associated $kf to device $part" echo $kf return 0 } get_label_keyfile () { l "begin get_label_keyfile" part=$1 num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` lid=$(get_idlabel $drv) if (( $? != 0 )); then l "unable to locate label for $drv" return 1 fi kf="${addir}/${lid}.${num}" l "matched $kf to device $part" echo $kf return 0 } ## last but not least, the specifics of how the loop-aes mount and pivot done do_boot_enc_part () { l "begin do_boot_env_part" part=$1 kf=$(get_part_keyfile $part) lkf=$(get_label_keyfile $part) if [ -f $lkf ]; then kf="$lkf" fi ld=$(locate_free_loopdev) if [ -z "$ld" ]; then l "Unable to locate free loop device." return 1 fi pdev="/dev/${part}" cat $kf | losetup -p 0 -e $aes_mode $ld $pdev if (( $? != 0 )); then l "Unable to setup loop $ld for $pdev with keyfile $kf" return 1 fi mpoint="/mnt/${part}" if [ ! -d $mpoint ]; then mkdir -p $mpoint fi l "attempting to mount $part at $mpoint using loop device $ld" mount -t xfs -w $ld $mpoint if (( $? != 0 )); then l "Unable to mount XFS partition at $mpoint" losetup -d $ld return 1 fi # actual umount and pivot root l "cd $mpoint" cd $mpoint cdir=`pwd` l "unmounting filesystems before pivot_root in $cdir" l "umount $addir" umount $addir l "losetup -d $cldev" losetup -d $cldev l "umount $keydir" umount $keydir if [ ! -d initrd ]; then l "mkdir initrd" mkdir initrd fi l "umount /proc/bus/usb" umount /proc/bus/usb l "umount /proc" umount /proc #if [ ! -f etc/save-fstab ]; then # cp etc/fstab etc/save-fstab #fi #cat etc/fstab | grep -v '^.dev.hd' | grep -v '^#' > /tmp/.sf #echo "$pdev / xfs defaults 0 1" > etc/fstab #cat /tmp/.sf >> etc/fstab l "privot root filesystem onto target volume" pivot_root . ./initrd l "executing init..." exec /sbin/init # will never hit here l "ERROR: init could not be executed?" sleep 5 l "aborting exec..." return 1 } do_boot_norm_part () { l "begin do_boot_norm_part" part=$1 mpoint="/mnt/${part}" if [ ! -d $mpoint ]; then mkdir -p $mpoint fi l "attempting to mount $part at $mpoint" mount -w /dev/$part $mpoint if (( $? != 0 )); then l "Unable to mount partition at $mpoint" return 1 fi # actual umount and pivot root l "cd $mpoint" cd $mpoint cdir=`pwd` l "unmounting filesystems before pivot_root in $cdir" l "umount $addir" umount $addir l "losetup -d $cldev" losetup -d $cldev l "umount $keydir" umount $keydir if [ ! -d initrd ]; then l "mkdir initrd" mkdir initrd fi l "umount /proc/bus/usb" umount /proc/bus/usb #MRP l "umount /proc" #umount /proc l "pivot root filesystem onto target volume" pivot_root . ./initrd l "executing init from $cdir ..." exec /sbin/init # will never hit here l "ERROR: init could not be executed?" sleep 5 l "aborting exec..." return 1 } do_disks_boot () { l "begin do_disks_boot" argf=/tmp/.args echo "--title \"Boot Encrypted Operating System\" " > $argf echo "--menu \"Select the OS to boot:\" " >> $argf echo "18 70 10" >> $argf /dev/makedevs.sh 1>/dev/null 2>/dev/null drives=`cat /proc/partitions | grep ' hd[a-z][0-9]' | sed 's/.* hd/hd/' | sort` sdrives=`cat /proc/partitions | grep ' sd[a-z][0-9]' | sed 's/.* sd/sd/' | grep -v sda1 | sort` count=0 for part in $drives $sdrives; do kf=$(get_part_keyfile $part) lkf=$(get_label_keyfile $part) if [ -f $lkf ]; then kf="$lkf" fi l "$part expects $kf" if [ -f $kf ]; then count=`expr $count + 1` allkfs="${allkfs} part${part}:${kf}" cnf="${kf}.alias" cname=`cat $cnf` if [[ "$cname" == "" ]]; then cname=$part fi psize=`fdisk -l /dev/$part 2>/dev/null | grep Disk | sed s'/.*: //' | sed 's/,.*//'` echo "\"Boot $cname\" \"Boot into encrypted $psize partition $part\" " >> $argf l "found encrypted bootable $cname on $part" else l "non encrypted $part , no $kf found" if [[ "$janusmode" == "adv" ]]; then psize=`fdisk -l /dev/$part 2>/dev/null | grep Disk | sed s'/.*: //' | sed 's/,.*//'` echo "\"Exec $part\" \"Boot into UNencrypted public partition\" " >> $argf fi fi done echo "Exit \"Reboot into a different target\" " >> $argf dodispmenu=0 if [[ "$janusmode" == "adv" ]]; then dodispmenu=1 fi if (( $count > 1 )); then dodispmenu=1 fi if (( $dodispmenu )); then dialog --file $argf --output-fd 2 2> /tmp/.res if (( $? != 0 )); then l "unable to launch dialog prompt" return 2 fi dispn=$(cat /tmp/.res) selection=`echo ${dispn}` else if (( $count == 0 )); then selection="Exit" dispmsg "No operating systems found..." else selection="Boot $cname" fi fi l "do_disks_mount selection: $selection" case $selection in Boot*) for ckf in $allkfs; do kf=`echo $ckf | sed 's/.*://'` part=`echo $ckf | sed 's/:.*//' | sed 's/part//'` cnf="${kf}.alias" cname=`cat $cnf` if [[ "$cname" == "" ]]; then cname=$part fi tn=`echo $selection | sed 's/Boot //'` if [[ "$tn" == "$cname" ]]; then ddev=$part fi done do_boot_enc_part $ddev return $? ;; Exec*) tn=`echo $selection | sed 's/Exec //'` do_boot_norm_part $tn ;; *) return 1 esac return 0 }

1 1

request for transcript / presentation: "Random Number Generation, Revisited"
by coderman 20 Jan '14

20 Jan '14

RWC going on, and at http://realworldcrypto.wordpress.com/program/ Session 11: Crypto Applications II 2:00pm Yevgeniy Dodis | New York University Random Number Generation, Revisited

1 0