Re: [liberationtech] Teach privacy at Mozilla?
I live in SF and I'd be down. Let me know what date. -j On Sun, Feb 1, 2015 at 5:56 PM, Yosem Companys compa...@stanford.edu wrote: From: Rhona Mahony rmah...@stanford.edu via cryptopa...@lists.stanford.edu Hey, the Privacy Team at Mozilla would like our help with a CryptoParty! They would like it on a weekday, from 5 pm to 7 pm -or- 6 pm to 8 pm. I'd be happy to drive fellow teachers from Palo Alto and environs up to Mozilla's beautiful building on the Embarcadero in San Francisco. Who is free on a weekday evening? Who thinks this opportunity sounds like fun? ~~Rhona -- Rhona Mahony Teaching privacy: wildbee.org/cryptoparty.html Stickers, etc.: redbubble.com/people/mishki Blog: wildbee.org Key: wildbee.org/pgp-key -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Detekt
I'm on vacation at the moment and it's going to take some time to analyze Detekt, but there are a number of problems with the software so far that need help and possibly a write-up or two. Most of it makes me think, something doesn't smell right here. Here are some random thoughts after a first pass through the code. No guarantee of accuracy here, and consider these open to discussion. 1. It's a strings-based signature approach that lends itself to serious false positives. AV software has been detected as a false positive many times and Claudio suggests disabling AV software when running this (this seems, um, bad.) See things like: https://github.com/botherder/detekt/blob/master/rules/finfisher.yar Many of the rules / signatures appear in other software. 2. The signatures are based on older copies of the RAT tools, which means newer copies will (probably) be able to evade detection. This is mentioned in the readme. 3. Instead of a well tested piece of software, what we have is an activist press gambit. I feel that this software creates a flurry of press for activist groups and shouldn't have been released, to anyone, until it was solidly tested. It's just a hair above beta software at the moment. 4. It's reliant on an accurate view of the process table from the admin's perspective to detect thigns. If the malware hides it's process, this scanner will fail. Unsure if this sort of hiding is possible in the RATs identified here, but it's a concern. Maybe it should use the volatitlity psx plugin? https://volatility.googlecode.com/svnct=rccd=1/trunk/volatility/plugins/malware/psxview.py 5. Is something better than nothing? Probably, but the shitstorm of false positives introduced by this tool will make it just confusing enough to not trust it. There is much too much uncertainty here. -j On Sat, Nov 22, 2014 at 12:03 PM, Andy Isaacson a...@hexapodia.org wrote: On Thu, Nov 20, 2014 at 02:02:24PM -0500, AntiTree wrote: I don't see what this would do that an AV wouldn't. Of the samples I've reviewed, most (all?) have been detected by AV. On the contrary, Claudio has documented several RATs and other surveillance malwares used by repressive governments that are not detected by AV. https://twitter.com/botherder/status/535944272047267840 This makes sense; HackingTeam (or whatever other shady malware vendor) is going to test against the tools that are currently used. As Claudio explains elsewhere in recent tweets, the point of Detekt is not to build a long-lasting tool that will detect government malware going forward; the point is to provide a tool *today* that people who are compromised *today* can use to learn that fact. -andy -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Iranian and Twitter's Dick Costolo
Uh, as far as I know Twitter did not have per-country restrictions on 2FA. Perhaps this is because of limited SMS support, but Twitter did not restrict 2FA per-country. -j On Sun, Sep 28, 2014 at 4:33 AM, Nariman Gharib nariman...@gmail.com wrote: Hi, This week, Dick constolo did a good job which, he spoke with Iran foreign minister on the phone and sent tweet to Hassan Rouhani about unblocking Twitter In Iran. Today, Iranian Twitter users have launched a new campaign and asking, D.constolo to add Iran to Twitter country list for 2step verification and more security for users inside Iran. more: https://twitter.com/ListenToUs/status/516186457527300096 Thanks Nariman @Listentous -- PGP: 084F 95C0 BD1B B15A 129C 90DB A539 6393 6999 CBB6 -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Time validation for 2-step verification codes
I don't know where you're getting your information from, but I audited Google's 2FA when I worked at Twitter. The attack scenario that is described here is simply not possible without the endpoint being owned. Code replay is not possible. Once a code is accepted, it cannot be used again to log in. The SMS attack is substantially more likely, but you can disable SMS codes in preferences. You should not use SMS at all if you can avoid it. Additionally, in order to get past 2FA, the attacker would have to have the user's password. All of this points to some sort of remote access tool or keylogger being active on the activist's machine. -j On Wed, Aug 27, 2014 at 10:08 AM, Nadim Kobeissi nadim@nadim.computer wrote: The two-step verification used by Google is based on the TOTP protocol [1] which is the open standard for this sort of thing. To answer your questions Amin: 1. Tokens last 60 seconds according to the TOTP standard. 2. Your journalist friends would be very well-advised to use an app [2] instead of SMS codes. By using an authenticator app, they will be able to obtain codes without using SMS and even with their phone completely not connected to a network. [1] http://tools.ietf.org/html/rfc6238 [2] https://support.google.com/accounts/answer/1066447?hl=en On Wed, Aug 27, 2014 at 11:29 AM, Amin Sabeti aminsab...@gmail.com wrote: Hi, Recently, a bunch of Iranian journalists/ activists have been targeted by Iranian hackers. Some of them said their 2-step verification was active during the attack but hacker could reuse the code that sent by Google via SMS and passed 2-step verification! I was wonder to know if some folks here know the validation time for the 2-step verification code that users receive through SMS not the app. Cheers, Amin -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] self signing certs by default
On Sat, Mar 15, 2014 at 5:27 AM, carlo von lynX l...@time.to.get.psyced.org wrote: On Fri, Mar 14, 2014 at 04:45:01PM -0500, John Adams wrote: Granted, it provides a low level of encryption for clients but it does not provide Non-repudiability to those users, opening them up to MitM attacks. It is inappropriate to say opening up to MitM if the alternative is plain-text HTTP which can be MitM'd by anyone anytime. Inappropriate? What part of false sense of security over HTTPS are you missing here? If the goal is to secure the connection and then you trust self-signed certs or trust anyone to create any cert for anyone, you've failed. While you're correct in saying that plaintext HTTP can be MiTM'd by anyone, HTTPS with no CA to verify whom the other side is is exactly the same problem and it turns what would normally be a trusted, strong connection into a easily MitM'd one. I think my characterization here is completely appropriate. CAs are there to introduce parties that do not trust each other. Without the CA or an alternate trust system, you're sunk. Noone has suggested that the user should be given the impression that an opportunistic https connection is safe: Were I a browser vendor I would not show any lock icon at all when using this mode of https operation, Perhaps a congratulations, this connection's security is a complete and utter falsehood icon is better here. What we need from web browsers is: - a way to accept self-signed certs silently Insanity. - do not show a lock, operate as if it was plain-text HTTP Now you're telling the truth. - implement pinning as with Certificate Patrol add-on, so at least we get to enjoy TOFU Ok, if there is first-time-trust, that's acceptable, but it begs the question, for how long do we trust this pin? - generate self-signed certs for any plain-text website and upgrade to TLS/DHE by default You are confusing protocols. Maybe we should give these self-signed certs a standard CA name, like using * as the name for the CA. *facepalm* -john -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] New IT security measures underway
On Mon, Feb 3, 2014 at 3:43 AM, Rich Kulawiec r...@gsp.org wrote: On Fri, Jan 31, 2014 at 09:01:06AM -0800, Yosem Companys quoted: One of these mandates includes having employees with Windows XP laptops and desktops migrate to Windows 7 Enterprise or Ultimate, or Windows 8 Pro or Enterprise, by April 8. Employees will be able to download the latest Microsoft software for free under a new campus-wide license obtained in November 2013. Let's stop right there. If this entire initiative was actually about security in any way, shape or form, then this paragraph would not be present. Closed-source software cannot be secured, and changing from one insecure version of Windows to another is merely an expensive, time-consuming exercise that achieves nothing of significance. Disclaimer: I can't stand windows and I've nearly banned it from work place. Reality: You don't understand business nor threat modeling. Microsoft is, unfortunately, the backbone of most world-wide business. There are a host of applications from finance, to statistical modeling, HR planning and otherwise that only run on Windows. You can't easily kill it off. When and if we manage to kill it off, attackers will move to the new thing (say. Mac OS) and focus efforts there. So, for the users that must run Windows on a daily basis, they're electing to offer free upgrades. Good on them. The older versions (such as XP) are reaching end of life for support (and security support) and potentially will become a source of indefinite zero-days. Calling this action meaningless due to your implicit bias against commercial software and windows is a fallacy. Properly implemented, it will result in a reduction of the overall threat to the University. Unfortunately, their implementation process isn't very good. I don't agree with the open-ended nature of their solution. Relying on the users to upgrade themselves means generally that the upgrade will never occur. A compliance-enforcing approach, such as those used in the Cisco and Juniper VPN clients would be better. For example, You have 30 days to upgrade to Windows 7 or VPN and 802.1X will block you from joining our network is much better than Go secure yourselves, we'll be over here Additionally, your statement of: Closed-Source software cannot be secured -- I prefer open source software but I disagree that it cannot completely be secured. It depends only on the motivation, financial resources, and merit of the company attempting to secure said software. Just because you don't happen to get a look at the source code doesn't make this a definitive statement. There are numerous examples of commercial software being immensely hard to defeat. -john -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] 49 Page NSA analysis of Tor
On Oct 5, 2013, at 12:17 AM, Andy Isaacson a...@hexapodia.org wrote: I wonder if tor.eff.org has any referer logs from 2006 showing inbound traffic from http://wiki.gchq/ or similar. .gchq isn't an Internet TLD, so That's doubtful. -j -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] 49 Page NSA analysis of Tor
Ah, point taken. Referrer leak would be very interesting to research here. -j On Sat, Oct 5, 2013 at 1:25 PM, Andy Isaacson a...@hexapodia.org wrote: On Sat, Oct 05, 2013 at 04:36:27PM +0100, Ximin Luo wrote: On 05/10/13 16:31, John Adams wrote: On Oct 5, 2013, at 12:17 AM, Andy Isaacson a...@hexapodia.org wrote: I wonder if tor.eff.org has any referer logs from 2006 showing inbound traffic from http://wiki.gchq/ or similar. .gchq isn't an Internet TLD, so That's doubtful. Intranet DNS. If they've been sloppy in blanking their referrers, then yes this would show up. Yep, I was specifically referring to Referer: headers. I know I've worked at places with an internal wiki, with revealing page titles, with outbound links to our competitor's webpages. *Hopefully* NSA/GCHQ are more clueful than that, but I wouldn't put anything past them at this point. -andy -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] iPhone5S Fingerprint and 5th amendment
Has Apple released specs on the operation of the fingerprint system? I.e. Can it be configured to use both a pin and a fingerprint? -j On Tue, Sep 10, 2013 at 2:34 PM, Percy Alpha percyal...@gmail.com wrote: I know that users can be forced to handover digital card and written down passcode to decrypt data while memorized passcode is mostly safe from subpena and court orders. As iPhone5S uses fingerprint to lock the device, could users be forced to unlock their iPhone5S? As police can legally collect fingerprint in most cases, could they use the fingerprint in the database to unblock the device and decrypt data? Percy Alpha(PGP https://en.greatfire.org/contact#alt) GreatFire.org Team -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Feds put heat on Web firms for master encryption keys
The reason why Twitter, Google, and other companies went to RC4 is because of issues with AES. The CBC and known IV attacks permitted BEAST to occur. RC4 was the safest way out. Even then, RC4 can be broken. In short, no one on the Internet is running SSL in a way that cannot be broken. Although, we have to be careful about use of the word 'broken' here. Broken means: There is a known attack against the cipher, which, given enough time, may work against your target. https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what As an industry, we need to move to AES/GCM and TLS1.2 as soon as possible, but, for many people, the current level of security is adequate. -j On Thu, Jul 25, 2013 at 1:26 PM, Florian Weimer f...@deneb.enyo.de wrote: Google also declined to disclose whether it had received requests for encryption keys. But a spokesperson said the company has never handed over keys to the government, Surely they have provided hard disk images containing key material to aid government investigations related to themselves or their employees? Certainly, the key material wouldn't be the focus of the data sharing in such cases, but saying that it never happened is a bit of a stretch. But this pressure finally explains why Google would prefer ephemeral DH (for perfect forward secrecy) with RC4 over AES without it: https://www.imperialviolet.org/2011/11/22/forwardsecret.html https://www.imperialviolet.org/2012/03/02/ieecdhe.html This didn't make much sense at the time because is by far weakest-looking cipher in wide use. But if Google faced demands to disclose the private keys used by their TLS servers to enable passive eavesdropping, switching on perfect forward secrecy might counteract these demands. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Designing Fairness for DMCA
We call this The trust and safety departments at most major companies. It already exists. You're getting wrapped up in a technical implementation which would normally be handled by large teams. The level of integration you describe is more than just a simplistic database table. Additionally, your order of operations doesn't match the DMCA workflow that is required by law. Have a look at this helpful infographic and rethink the flow.. http://www.mediabistro.com/appnewser/files/2012/02/infographic-dmca-process1.png -j On Tue, Jul 16, 2013 at 12:47 PM, riptidetemp...@tormail.org wrote: Hello, I'm @RiptideTempora on Twitter. My background is in web development. The other day I postulated a system for handling DMCA takedown notices on an individual website level that would tip the scales in favor of the users (whom are, as far as I can tell, currently shafted by the current iterations of U.S. legislation). The full text can be found here: http://pastebin.com/0uG85vna The process would go something like this: 1. Someone sends a DMCA Takedown Notice 2. A new database entry in `dmca_takedowns` is created with the entire email (with full headers) 3. All infringing material are linked in the database to that takedown notice which adds a message saying A DMCA Takedown notice has been filed for this [article/video/song/whatever]. 4. All authors of the content are notified of the DMCA request by internal message and by email of the DMCA Takedown Notice, which will include the phone numbers and email addresses for ACLU, NLG, et al. should they wish to file a counter-notice (which will also be public if sent to us, by adding an entry to `dmca_counternotice` which is linked to the notice ID) 5. A public index of pending (and resolved) DMCA Takedown Notices will be main- tained which include the full emails and all affected content 6. The maximum amount of time legally permitted (designated $lead) will elapse to allow the original authors ample time to organize a counter-notice 7. If no counter-notice is filed after $lead we will either amend or disable the public availability of the content. The `dmca_takedown` entry will be marked as Taken Down 8. If a counter-notice is filed, we will disable the content after $lead days and mark the `dmca_takedown` entry as Counter-notice filed to comply with [my understanding of the law], then wait 14 days for the filer to respond to file a lawsuit (during which time we will be in contact with the authors who filed counter-notice). 9. If after 14 days no lawsuit was filed, the takedown notice will be marked as 14 days expired without lawsuit and the content will remain visible (but still be indexed on a separate page for failed DMCA Takedowns) 10. If we receive notification that a lawsuit has been filed, we disable access to the material and mark it as Lawsuit Pending In total, I anticipate 3 pages consisting of 2 lists, 2 list, and 1 list respectively: 1. The front page will list: A. New DMCA Takedown Notices B. Counter-notice Filed 2. There will be a taken down page for the sake of transparency A. Successful takedowns B. Content disabled, pending the outcome of a lawsuit 3. There will be a failed page that lists unsuccessful takedown requests for the sake of transparency I'd like to know if such a system would be legally viable or if it would incur additional risks for a website that implemented such a system; and further, what adjustments could be made to make this design more robust under the current legal and political climates around copyright law? Thank you for your time, ~RT -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] One time pad Management system?
Uh. S/key is a one time pad system that came out over 20 years ago and is open source. Sent from my iPhone On Jul 11, 2013, at 8:36 PM, Andy Isaacson a...@hexapodia.org wrote: On Thu, Jul 11, 2013 at 08:12:32PM -0500, Paul Elliott wrote: Are there any practical one time pad management systems out there, GPLed for GNU/Linux? I don't know of any but would be interested to learn of one. Is anyone working on one? I started sketching some design ideas a few months ago, but decided to write a filesystem instead. If not, does anyone want to start? I hope so! I'll contribute to design thinking if someone does start. I'm oversubscribed now, though, so I can't lead. -andy -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] NSA is very likely storing all encrypted communications it is intercepting
ECHDE_RSA offers an excellent degree of protection against after the fact analysis if and only if the private key is disclosed (or captured.) If the the privkey is unavailable, NSA can always go after the session keys -- capture of communications is actually made easier in these cases when sites use SSL Keep-alive and Session resumption. It makes things much harder for them, though. The session key is always weaker than the RSA or DH exchange. -j On Fri, Jun 21, 2013 at 8:14 AM, Joseph Lorenzo Hall j...@cdt.org wrote: Am I off in thinking that this is a good time to push more web properties to use forwardly secret SSL key exchange (like Google does with ECDHE_RSA)? best, Joe On Fri Jun 21 08:32:46 2013, Eugen Leitl wrote: http://www.forbes.com/sites/andygreenberg/2013/06/20/leaked-nsa-doc-says-it-can-collect-and-keep-your-encrypted-data-as-long-as-it-takes-to-crack-it/ Leaked NSA Doc Says It Can Collect And Keep Your Encrypted Data As Long As It Takes To Crack It If you use privacy tools, according to the apparent logic of the National Security Agency, it doesn’t much matter if you’re a foreigner or an American: Your communications are subject to an extra dose of surveillance. Since 29-year-old systems administrator Edward Snowden began leaking secret documentation of the NSA’s broad surveillance programs, the agency has reassured Americans that it doesn’t indiscriminately collect their data without a warrant, and that what it does collect is deleted after five years. But according to a document signed by U.S. Attorney General Eric Holder and published Thursday by the Guardian, it seems the NSA is allowed to make ambiguous exceptions for a laundry list of data it gathers from Internet and phone companies. One of those exceptions applies specifically to encrypted information, allowing it to gather the data regardless of its U.S. or foreign origin and to hold it for as long as it takes to crack the data’s privacy protections. The agency can collect and indefinitely keep any information gathered for “cryptanalytic, traffic analysis, or signal exploitation purposes,” according to the leaked “minimization procedures” meant to restrict NSA surveillance of Americans. ”Such communications can be retained for a period sufficient to allow thorough exploitation and to permit access to data that are, or are reasonably believed likely to become, relevant to a future foreign intelligence requirement,” the procedures read. And one measure of that data’s relevance to foreign intelligence? The simple fact that the data is encrypted and that the NSA wants to crack it may be enough to let the agency keep it indefinitely. “In the context of cryptanalytic effort, maintenance of technical data bases requires retention of all communications that are enciphered or reasonably believed to contain secret meaning,” the criteria for the exception reads. “Sufficient duration [for retaining the data] may consist of any period of time during which encrypted material is subject to, or of use in, cryptanalysis.” That encryption exception is just one of many outlined in the document, which also allows NSA to give the FBI and other law enforcement any data from an American if it contains “significant foreign intelligence” information or information about a crime that has been or is about to be committed. Americans’ data can also be held if it’s “involved in the unauthorized disclosure of national security information” or necessary to “assess a communications security vulnerability.” Other “inadvertently acquired” data on Americans can be retained up to five years before being deleted. “Basically we’re in a situation where, if the NSA’s filters for distinguishing between domestic and foreign information stink, it gives them carte blanche to review those communications for evidence of crimes that are unrelated to espionage and terrorism,” says Kevin Bankston, a director of the Free Expression Project at the Center For Democracy and Technology. “If they don’t know where you are, they assume you’re not a US person. The default is that your communicatons are unprotected.” All of those exceptions seem to counter recent statements made by NSA and FBI officials who have argued that any collection of Americans’ data they perform is strictly limited by the Foreign Intelligence Surveillance Act (FISA) Court, a special judiciary body assigned to oversea the National Security Agency. “We get great oversight by all branches of government,” NSA director Alexander said in an on-stage interview at the Aspen Institute last year. “You know I must have been bad when I was a kid. We get supervised by the Defense Departmnet, the Justice Department the White House, by Congress… and by the [FISA] Court. So all branches of government can see that what we’re doing is correct.” But the
Re: [liberationtech] Identi.ca, Diaspora, and Friendica are more secure alternatives to Facebook.
scarcasm I'm completely certain that these small, poorly funded projects have hired massive security teams (as the major social networks do) and provide a safe alternative to Facebook or Twitter. /scarcasm On Mon, Jun 17, 2013 at 4:13 PM, Yosem Companys compa...@stanford.eduwrote: Slate makes mistake of calling them more secure. YC http://www.slate.com/blogs/future_tense/2013/06/17/identi_ca_diaspora_and_friendica_are_more_secure_alternatives_to_facebook.html How to Block the NSA From Your Friends List By April Glaser and Libby Reinish Posted Monday, June 17, 2013, at 11:12 AM If you don't trust this guy with your data, there are other social-networking options After recent revelations of NSA spying, it’s difficult to trust large Internet corporations like Facebook to host our online social networks. Facebook is one of nine companies tied to PRISM––perhaps the largest government surveillance effort in world history. Even before this story broke, many social media addicts had lost trust in the company. Maybe now they’ll finally start thinking seriously about leaving the social network giant. Luckily, there are other options, ones that are less vulnerable to government spying and offer users more control over their personal data. But will mass migration from Facebook actually happen? According to a Pew study released weeks before news of PRISM broke, teenagers are disenchanted with Facebook. They're moving to other platforms, like Snapchat and (Facebook owned) Instagram, the study reports. This is the way a social network dies—people sign up for multiple platforms before gradually realizing that one has become vacant or uninteresting. Myspace, for instance, took years to drop off the map. By 2006 Myspace reached 100 million users, making it the most popular social network in the United States. But by 2008, Facebook had reached twice that number, less than two years after allowing anyone older than 13 to join the network. Benjamin Mako Hill, a fellow at the Berkman Center for Internet and Society, thinks Facebook's ability to connect people and bind them to the social network is overrated to begin with. Facebook didn't exist, what, 10 years ago,” he says, and in 10 years, he thinks, “a company called Facebook will exist, but will it occupy the same space in our culture? That's certainly not something I'm willing to take for granted. Teens may be turning to Instagram and Snapchat, but those services don’t offer the deeper levels of social networking that Facebook users are accustomed to, with photo albums, event invites, fan pages, and connections to old friends. Ultimately, teens may be smart not to consolidate all of their social networking on one platform—but Instagram, Snapchat, and some other new flavors of the month all use centralized servers that are incredibly easy to spy on. But there are other places to go. For years, the free software movement has been developing and using social networks designed with user privacy in mind. Unlike Facebook, these social networks are not hosted by a single entity's privately owned servers but rather by volunteers across the world that share server space in order to maintain a decentralized, robust network. When a company like Facebook hosts the data of more than 1 billion users, it's not hard for the government to simply ask for permission to access that data, conveniently stored all in one place. Gabriella Coleman, a professor of scientific and technological literacy at McGill University, points out that companies like Facebook would be collecting data on individuals regardless of government requests. That's how the vast majority of free online social networks make money; they use data mining to sell targeted, contextual ads. In some ways,” she says, “that's the source of the problem, the fact that we've just given up all of our data in return for free services. Community-hosted, decentralized social media, on the other hand, allow people to maintain ownership of their data. These platforms use a principle called “federation” to connect a vast network of servers to one another. If the NSA wants to collect the data of all the users on a decentralized network, it has to contend with a large number of disparate server owners who could be anywhere in the world, a much more complicated task than issuing a single subpoena or hacking into a centralized server. There's a resiliency to having data spread across multiple sites; that's the way the web was intended to work, and we need to bring that back,” says Christopher Webber, the founder of MediaGoblin, a federated, free software replacement for YouTube, Flickr, SoundCloud, and other media hosting services. Other projects, like Identi.ca (which is similar to Twitter), Diaspora, and Friendica are replacements for conventional social media networks, and they work. The number of users on federated networks is hard to
Re: [liberationtech] Opt out of Prism
My bad, I thought you were the author of the page. In any event, I hadn't seen the EFF SSD page and had been cautioned by EFF staffers about recommending tools. Their approach is vastly better (albeit more verbose) than just raw recommendations of products. They go into full explanations of what the tools can and cannot provide. -j On Wed, Jun 12, 2013 at 11:13 AM, Andrea St and...@gmail.com wrote: Dear friends about John Adams, i just copied the title of the website. No more, no less. 2013/6/12 Guido Witmond gu...@witmond.nl On 12-06-13 19:21, John Adams wrote: I like that you're promoting free and open tools, but your title is misleading. You offer people false hope here. By listing the tools and not listing what level of security they offer, people will assume they can just switch and be protected. This is one of the reasons why the EFF does not recommend tools. The issues associated with each tool are myriad and vast. What's sad is that the media picked up on this, amplifying the false hope you offer. A+ for effort, though. Although I can agree that many of these tools do not offer (significant) protection against unwanted data gathering. It's good that such a list comes to the attention of the people who are worried about their privacy. Even with false hope, a society without hope is doomed... I hope some people will take time to switch to some tools and spread that knowledge further. Guido. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/**mailman/listinfo/**liberationtechhttps://mailman.stanford.edu/mailman/listinfo/liberationtech -- Andrea Stroppa http://huffingtonpost.com/andrea-stroppa @andst7 -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] SECDEV: The internet in Syria: down, but not out
However, according to SecDev cyber analysts, a damaged cable alone should not have caused the Border Gateway Protocols (BGP) routes for netblocks to be withdrawn. Rather, the fact that these routes disappeared suggests that the regime ordered the disconnect for reasons that are unknown. Analysts have previously speculated that internet shutdowns have been used to prevent communications amongst rebel groups. Alternatively, the shutdown could have been used to install new monitoring equipment. It's nearly comical how cyber activists don't know how routing works. In BGP, when a link goes away, the route is withdrawn. That's how it works. If there was a fiber cut, intentional or unintentional, the route to the AS that contained the netblock becomes unavailable and peers for that AS switch to secondary routes, if they exist. If the failed link was the sole uplink (or uplinks) to the AS in which the netblocks in question resided in, then the route is withdrawn because there are no peers capable of routing to the AS. This would be an entirely different story if they'd replaced withdrawn with null routed', because that indicates an administrative change to the routing policy. Alternatively, the shutdown could have been used to install new monitoring equipment. Citation needed. If you wanted to monitor an active, high bandwidth connection, you would not have to disconnect the network for a sustained amount of time. Ever hear of a span port or an optical splitter? Entering the network and copying all traffic to another port is a seamless operation. I know there's problems in Syria and I know that their government disconnects the network, but get the facts straight. -j -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] My SXSW exposé in the Washington Post!
On Fri, Mar 15, 2013 at 1:08 PM, Shava Nerad shav...@gmail.com wrote: Technically, that's a different conference -- SXSW/I is a separate event that doesn't even run the same dates, last time I went (though they overlapped). It is all the same conference, That's why I have a platinum badge that gives me access to all three parts of the same conference. They have always overlapped. It means you get to go to the films and music and run your trip longer. ;) No access to music unless you've paid for music or platinum badges, but yeah. However, SXSW/I isn't just douchebaggery. It just includes a great deal of it. Go re-read what you just wrote. You get pretty much what you want out of it. The past attendees vote in whatever panels they want to be presented, so it's a popularity contest in social media every year. You're discussing the panelpicker process which doesn't work that way. Sure, there is outside voting, but extreme levels of oversight from SXSW itself. Please see http://panelpicker.sxsw.com/faq Every year it gets more gamy and gamified. But there is essentially a big marketing conference, a game industry conference, and a smaller public interest internet conference at the same venue -- with the disclaimer I haven't been for ages but I've watched the reports. Somewhat, it doesn't exactly work as you've described, though. There is a single, SXSW conference. The interactive portion takes place mostly at the Austin Convention center, the Game industry conference takes place at a different venue (Palmer Events Center), and the so-called public interest panels and talks take place at the ACC and other hotels nearby depending on the panel and available space. It's cool to go and it's cool to say it's completely past it's prime and useless to go. It seems to me that anyone who went could make their own conference for any agenda they arrived with. Then you balance that against how you feel about the Minority Report marketing feels to you and so on -- but frankly, although for those who are in the nonprofit world this may feel excessive, to those in the commercial world this is normal to relaxed. If this is a window into how the other half lives maybe we should get out of the ivory tower more often? There's much in this paragraph that comes of as tin-foil hat levels of paranoia, but I won't address them. Instead, I often wonder if non-profits used more metrics and got their business acumen together if more things would get done. There is so much reliance on hearsay and gut instinct that everything comes across as poorly planned. There's also the overwhelming reliance to assume that any sort of tracking is 100% evil. You'd complain if people who didn't pay took your (paid) seat at that EFF panel you wanted to go watch as well. The level of fraud that happens at SXSW used to be very high -- they had to incorporate RFID into badges and QR codes and a database to ensure people weren't stealing $1500 badges. I don't agree entirely with the technologies used but I do agree with people not being able to forge the badges. -j -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Safe app like Dropbox?
I have never had a problem with creating images via hdiutil, setting them to AES-256, and then using them on dropbox. Additionally, if dropbox is breaking files, file a bug report. I've met with their team multiple times and they're certainly willing to fix things like this. -j On Sun, Jan 6, 2013 at 6:24 PM, Griffin Boyce griffinbo...@gmail.comwrote: On Sun, Jan 6, 2013 at 9:11 PM, Kelvin Quee (魏有豪) kel...@quee.org wrote: Being paranoid is probably a good thing on this list but spreading falsehoods OR unverified claims is something that we all should not do. Kelvin Quee (魏有豪) +65 9177 3635 Dropbox has broken every single truecrypt container I've ever uploaded, without exception. I'm not paranoid of Dropbox -- quite the contrary, I'm a very happy user. ~Griffin -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Safe app like Dropbox?
On Sun, Jan 6, 2013 at 1:47 PM, Jacob Appelbaum ja...@appelbaum.net wrote: I generally agree that the data should be encrypted, though I think it should also be authenticated and integrity checked before it is actually used. If this level of paranoia is relevant to you, then maintain multiple offline SHA, MD5, and other checksum formats before use. It would be trivial to script this outside of Dropbox's scope. I also think most disk images are not actually that difficult to brute force - I was involved in a project to perform FileVault bruteforcing accelerated by an FPGA a few years ago. With a modern GPU, I think things are pretty slanted toward the attacker. Saying that it's possible to break all encryption, all the time, is a non-answer and doesn't address practical uses of cryptography. It also creates an environment of fear for casual users. In the case of pure AES (and not putting reliance on flaws in the implementation of systems like Filevault), a reasonable attack on the algorithm still doesn't exist. (see: http://www.schneier.com/blog/archives/2012/03/can_the_nsa_bre.html) What the user needs to do is to measure acceptable risk and weigh that against the encryption system being used. It's also relevant to know the validity of the information and the required amount of time it takes to break the file. If you said 'meet me here next week' and it takes three weeks to break AES-256, then I don't really care if you find out where I was weeks ago. In this - I rather like what I've read about SpiderOak but I haven't seen a totally free implementation of the client or the server side... I haven't looked at it, but I'd like to. -john -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Safe app like Dropbox?
Why don't you just get around the problem entirely and use Dropbox's storage for encrypted disk images? If you have data sufficiently encrypted, it doesn't matter how it's stored. -j On Sun, Jan 6, 2013 at 12:49 AM, Jerzy Łogiewa jerz...@interia.eu wrote: Hello! Dropbox is completely convenient, but source is closed and I do not really want storing my data on their server. What other app exist? Anything truly open and support own remote storage, but working as: drop into folder, auto syncro happens on a supported platform? Thanks! -- Jerzy Łogiewa -- jerz...@interia.eu -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
