Re: [liberationtech] Is spideroak really zero-knowledge?

2013-08-13 Thread Percy Alpha
@Tony, The secret that keeps your data accessible to you alone is your SpiderOak password, which is never transmitted to SpiderOak in its original form. https://spideroak.com/engineering_matters -- Liberationtech is a public list whose archives are searchable on Google. Violations of list

Re: [liberationtech] Can JavaScript cryptography be trusted? (was: In defense of client-side encryption)

2013-08-13 Thread Nadim Kobeissi
Quickly adding my blog post on the matter to this thread. Would love to hear discussion regarding it: http://log.nadim.cc/?p=33 NK On 2013-08-13, at 1:58 AM, Tony Arcieri basc...@gmail.com wrote: On Mon, Aug 12, 2013 at 3:07 PM, Ali-Reza Anghaie a...@packetknife.com wrote: I'm sorry but

Re: [liberationtech] Is spideroak really zero-knowledge?

2013-08-13 Thread Tony Arcieri
On Mon, Aug 12, 2013 at 11:02 PM, Percy Alpha percyal...@gmail.com wrote: @Tony, The secret that keeps your data accessible to you alone is your SpiderOak password, which is never transmitted to SpiderOak in its original form. https://spideroak.com/engineering_matters Again, they seem to be

Re: [liberationtech] Lavabit, Silent Circle both shut down

2013-08-13 Thread Ralph Holz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Arjen, May I ask what Swiss providers would you recommend? (disclaimer: I am normally very hesitant to 'advertise' for specific companies since as a consultant I do my very best to remain independent from having any interest in procurement

Re: [liberationtech] Does anyone know a celebrity who feels strongly about privacy issues?

2013-08-13 Thread Michael Rogers
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 12/08/13 21:32, Francisco Ruiz wrote: So, here's my question. Does any one know of a celebrity who cares enough about computer security to be persuaded to take one minute of his/her time to read a hash before a camera? I'd like to second

Re: [liberationtech] Does anyone know a celebrity who feels strongly about privacy issues?

2013-08-13 Thread David Miller
Maybe the celebrity could read the binary sequence of a compiled program, and the user could take dictation into a simple command line script? On 13 August 2013 10:37, Michael Rogers mich...@briarproject.org wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 12/08/13 21:32, Francisco

Re: [liberationtech] Is spideroak really zero-knowledge?

2013-08-13 Thread elijah
On 08/13/2013 12:32 AM, Tony Arcieri wrote: On Mon, Aug 12, 2013 at 11:02 PM, Percy Alpha percyal...@gmail.com mailto:percyal...@gmail.com wrote: @Tony, The secret that keeps your data accessible to you alone is your SpiderOak password, which is never transmitted to SpiderOak

Re: [liberationtech] Lavabit, Silent Circle both shut down

2013-08-13 Thread taxakis
Hi guys: Safe and secure are relevant. But, Arjen is absolutely right, Switzerland is at the moment the best place to have your materials hosted. It's also the place where Silent Circle looks at. And one where Wikileaks is hosted. Some on this list still have doubts, even about Switzerland.

Re: [liberationtech] Petition Google over banning Servers on Google Fiber?

2013-08-13 Thread KheOps
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all, On Tue, Aug 13, 2013 at 01:24:07AM +0200, Moritz Bartl wrote: Thank you EFF for the well-written reminder: https://www.eff.org/deeplinks/2013/08/google-fiber-continues-awful-isp-tradition-banning-servers [...] We should petition Google

[liberationtech] Swiss VPNs (was: Re: Lavabit, Silent Circle both shut down)

2013-08-13 Thread Moritz Bartl
On 13.08.2013 10:51, Ralph Holz wrote: SwissVPN provides some nice VPN services but it is not the only VPN provider I use. They log for 6 months and say they will respond to requests under Swiss law. I would be surprised if other Swiss providers wouldn't do the same, but I am very happy to

Re: [liberationtech] Swiss VPNs (was: Re: Lavabit, Silent Circle both shut down)

2013-08-13 Thread taxakis
Oligarchs and privacy advocates have something in common. If you got a better place, please name it. And by the by, forget Germany, it may not have data retention (for now), but it does have 50,000 American troops, a refurbished Bad Aibling with all newly trained German personnel, and a huge

Re: [liberationtech] Swiss VPNs

2013-08-13 Thread Moritz Bartl
On 13.08.2013 14:20, taxakis wrote: Oligarchs and privacy advocates have something in common. If you got a better place, please name it. I don't. I still believe we should stop being naive and promote Iceland or Switzerland, just because we think they offer better privacy. In general, just

Re: [liberationtech] Is spideroak really zero-knowledge?

2013-08-13 Thread Patrick Baxter
They've also been working on an open source version of their client and server software called crypton (https://crypton.io/) It implements the protocol originally listed on their site as Elijah pointed out with the wayback machine. On Tue, Aug 13, 2013 at 2:52 AM, elijah eli...@riseup.net wrote:

Re: [liberationtech] From Snowden's email provider. NSL???

2013-08-13 Thread Reed Black
On Sun, Aug 11, 2013 at 4:46 AM, Michael Rogers mich...@briarproject.org wrote: The app store can't substitute a different binary (no developer signing key), users can verify that the app was what the developer produced (via pulling the binary and checking the hash), and advanced users can

[liberationtech] Snowden: Unencrypted Journalist-Source Communications Unforgivably Reckless

2013-08-13 Thread Nadim Kobeissi
Hey LibTech, In a recently published interview with the New York Times, Edward Snowden called unencrypted communications between journalists and sources unforgivably reckless: I was surprised to realize that there were people in news organizations who didn’t recognize any unencrypted message

Re: [liberationtech] Does anyone know a celebrity who feels strongly about privacy issues?

2013-08-13 Thread Lina Srivastava
So not sure this is taking the discussion in a direction useful to this list, but a thought-- celebrities are not likely to be available to do something like this -- i.e., a series of readings on youtube videos -- unless the videos were connected to a high-profile campaign, a film/documentary, or

Re: [liberationtech] Snowden: Unencrypted Journalist-Source Communications Unforgivably Reckless

2013-08-13 Thread Amaelle G
Hi Nadim all, Le 13 août 2013 à 18:00, Nadim Kobeissi na...@nadim.cc a écrit : http://www.nytimes.com/2013/08/18/magazine/snowden-maass-transcript.html I hope sending this along will be useful for journalists on this list as well as for those who need extra material to help them convince

Re: [liberationtech] Snowden: Unencrypted Journalist-Source Communications Unforgivably Reckless

2013-08-13 Thread James S. Tyre
The passage Nadim highlights is of course quite appropriate for this list. But for those who have some extra time (it's very long) the whole article is worth reading. -- James S. Tyre Law Offices of James S. Tyre 10736 Jefferson Blvd., #512 Culver City, CA 90230-4969

[liberationtech] verifying SSL certs (was Re: In defense of client-side encryption (Guido Witmond)

2013-08-13 Thread Andy Isaacson
On Mon, Aug 12, 2013 at 11:10:39AM +0200, Guido Witmond wrote: There is another problem. You rely on HTTPS. Here is the 64000 dollar question: Q._What is the CA-certificate for your banks' website?_ I ask that question to anyone who claims to be security conscious. No one has given me

[liberationtech] Internet Policy Observatory: Call for Proposals

2013-08-13 Thread Collin Anderson
Libtech -- This might be promising for the academics and researchers amongst us. http://cgcsblog.asc.upenn.edu/2013/07/31/internet-policy-observatory-call-for-proposals/ Internet Policy Observatory: Call for Proposals The Center for Global Communication Studies (CGCS) at the Annenberg School

Re: [liberationtech] Snowden: Unencrypted Journalist-Source Communications Unforgivably Reckless

2013-08-13 Thread Micah Lee
On 08/13/2013 09:00 AM, Nadim Kobeissi wrote: I hope sending this along will be useful for journalists on this list as well as for those who need extra material to help them convince their journalist friends to adopt privacy-preserving practices. As usual, I'll take the opportunity to again

Re: [liberationtech] Lavabit, Silent Circle both shut down

2013-08-13 Thread Arjen Kamphuis
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 08/13/2013 10:51 AM, Ralph Holz wrote: That's the company I use, too - and ultimately the reason I am asking because Chris Soghoian once told me that they log the connections. This seems to be supported by this inquiry made in 2011:

[liberationtech] Zwiebelfreunde take over popular onion.to Tor gateway

2013-08-13 Thread Moritz Bartl
Hi Libtechies, I hope you don't mind me putting this press release here. Please spread if you like it. -- # Zwiebelfreunde take over popular onion.to Tor gateway (Dresden, 13.8.2013) The non-profit organization Zwiebelfreunde

[liberationtech] ICANN and WHOIS reform...

2013-08-13 Thread Joseph Lorenzo Hall
Hi all, I didn't see any individuals or orgs from libtech comment to ICANN on the recent report to reform WHOIS. I wanted to put this on your collective radar if it's of interest to you. TL;DR: ICANN is working on reforming WHOIS, and their Experts' Working Group has come up with a pretty bad

Re: [liberationtech] Does anyone know a celebrity who feels strongly about privacy issues?

2013-08-13 Thread Francisco Ruiz
Hi Kyle, don't take it so hard. I asked this question so _everybody_ who'd like to try the celebrity video trick would be able to collect a few likely candidates. Likely others will beat me to it. On Mon, Aug 12, 2013 at 7:29 PM, Kyle Maxwell ky...@xwell.org wrote: I didn't know LibTech had

Re: [liberationtech] Does anyone know a celebrity who feels strongly about privacy issues?

2013-08-13 Thread Francisco Ruiz
Hi Guido, This looks very interesting, but I have trouble understanding it. Can you give me a sample URL where this is being shown in action? Many thanks. On Mon, Aug 12, 2013 at 4:34 PM, Guido Witmond gu...@witmond.nl wrote: Dear professor Ruiz. The real issue is to create an *easy* way

Re: [liberationtech] [Dewayne-Net] Are Hackers the Next Bogeyman Used to Scare Americans Into Giving Up More Rights?

2013-08-13 Thread Bernard Tyers - ei8fdb
Haven't hackers always been portrayed in a way to scare people? * If it's not dDoSing script kiddies, its zombie network owning Latvian mafias.. If this *is* the case, how can General Alexander go to Blackhat 2013 and say (paraphrasing) we (CIA) use the same tools as you do. Help us protect

[liberationtech] Speculation as to what the US government ordered Lavabit to do?

2013-08-13 Thread Joseph Lorenzo Hall
I don't think I've seen educated speculation here about what the court order that Lavabit received actually ordered them to do. Here is my own guess and I'm wondering if people have thoughts. First, from an interview with Ladar Levison ( http://possibility.com/LavabitArchitecture.html ) it seems

Re: [liberationtech] In defense of client-side encryption

2013-08-13 Thread Francisco Ruiz
Hi Steve. I want to thank you for taking your time to help me. Your comments are awesome. May I follow up with some short questions, right after some of your comments? Many thanks in advance. On Mon, Aug 12, 2013 at 7:18 PM, Steve Weis stevew...@gmail.com wrote: Francisco, you assume that all

Re: [liberationtech] Speculation as to what the US government ordered Lavabit to do?

2013-08-13 Thread Moritz Bartl
On 13.08.2013 23:54, Joseph Lorenzo Hall wrote: This is all to say that I suspect the government's order requested ongoing access to the private key(s) in memory for some subset of Lavabit users, such that they could ask in the future for the encrypted contents of those users' accounts and

Re: [liberationtech] Is spideroak really zero-knowledge?

2013-08-13 Thread Percy Alpha
Oh. Yes. I definitely remember reading User Authentication Process a few weeks ago. That's why I feel like they implement the zero-knowledge psw proof. Why did they take it down? NSA on the move already? Percy Alpha(PGP https://en.greatfire.org/contact#alt) GreatFire.org Team On Tue, Aug 13,

[liberationtech] Passlok's broken security model

2013-08-13 Thread Steve Weis
Hi Francisco. I split this off into a new thread, since it touches on some points on why the security model for Passlok is broken. Comments inline... On Tue, Aug 13, 2013 at 2:54 PM, Francisco Ruiz r...@iit.edu wrote: 1. Unicode: wget returned escaped Unicode characters. Chrome saved output