Re: [liberationtech] Thank You
Thanks for your work, Yosem. -Andreas Am 24.02.2017 um 01:46 schrieb Yosem Companys: > Dear List Subscribers, > > As of today, I have ceased to be a moderator of all Stanford Liberationtech > lists. > > I feel like Superman when he loses his powers, except I hope the ending is > more like this: https://www.youtube.com/watch?v=jUORL-bvwA0. > > Just kidding. :) > > On a more serious note, I want to thank all of you for a wonderful 9 years > of discussions about Liberationtech issues. > > I also want to thank you all for the arguing and jousting and name calling > and... No, seriously, you were all great. I rarely had to step in to > moderate. > > Although I know some disagreed with my moderation style of letting every > message through and only permanently moderating those who were extremely > disruptive, I feel proud that the list always tried to ensure unfettered > freedom of expression. > > We now have approximately 4K members from around the world working to make > the world a better place. > > I am not leaving, so this is not goodbye. It's more like, "see you later." > I'll now be a regular member and as such be able to participate much more > freely in discussions than I was able to do when I was a moderator. > > Take care, everyone, and keep up the good fight to protect pro-democracy > activists fighting against authoritarian regimes. > > Best, > Yosem > > > -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Question about Windows 10
Dear Peter, You do still have the possibility to use two different systems, e.g. Linux/OSX for important data and Windows for the rest. If this is no solution for you then you can just stay with Windows 8; ignore the "feeling" that you need to upgrade. "Never change a running system." Kinds, Andreas On 24.06.2016 07:31, Peter Chin wrote: > Hello folks, > > I need some advice about upgrading to Windows 10. My laptop is running > Windows 8 and I need to do the free upgrade to Win 10 because I have a lot of > applications that run on Windows and I feel it is time to upgrade to the > newest Windows O.S. But I really don't want my personal data collected in > Windows 10 either. > > I recently read that Microsoft could be releasing data controls that actually > allow privacy > (http://www.ghacks.net/2016/02/11/microsoft-promises-to-implement-full-windows-10-data-tracking-controls/) > but I'm not holding my breath. If I upgrade to Windows 10, what can I do to > control personal privacy? I heard that the Enterprise version of Windows 10 > would let me have more privacy and not collect my data. > > How are you all dealing with upgrading to Windows 10 so that you can still > control your own personal data? Thanks for your thoughts. > > > Peter Chin > (in Vancouver, Canada) > > > > > -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
[liberationtech] Trainees for SIN
Hey guys, we are currently looking for trainees and volunteers for our Strategic Intellegence Network in TOR: http://4iahqcjrtmxwofr6.onion/ If you are interested in joining our team please write a mail with your to noergelpi...@riseup.net or ironsold...@safe-mail.net Thank you! -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Coursera to join censor club by blocking Iran IP space
Coursera says its not them, its an US export regulation. And this is related to all sanctioned countries, including Syria, Sudan and Cuba, not only Iran. I don't think that Coursera decided to do this by itself. Stanford University also offers Coursera courses btw. Andreas Source: http://blog.coursera.org/post/74891215298/update-on-course-accessibility-for-students-in-cuba -Original Message- From: Nima Fatemi n...@redteam.io Sender: liberationtech-boun...@lists.stanford.edu Date: Thu, 30 Jan 2014 09:22:33 To: liberationtech@lists.stanford.edu Reply-To: liberationtech liberationtech@lists.stanford.edu Subject: [liberationtech] Coursera to join censor club by blocking Iran IP space -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] Assange message to CCC sabotaged
Felix von Leitner says that is's not like that, check his blog at blog.fefe.de :) -Original Message- From: Richard Brooks r...@acm.org Sender: liberationtech-boun...@lists.stanford.edu Date: Tue, 31 Dec 2013 09:54:56 To: liberationtechliberationtech@lists.stanford.edu Reply-To: liberationtech liberationtech@lists.stanford.edu Subject: [liberationtech] Assange message to CCC sabotaged The Sueddeutsche Zeitung seems to think his speech was disrupted as a type of feminist protest http://sz.de/1.1853271 -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is public archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] what to install on a secure communication device
Why not also JonDonym? The problem with TOR for productivity is its bandwith. There are also some pretty good commercial services. Andreas --Originalnachricht-- Von: Eugen Leitl Absender: liberationtech-boun...@lists.stanford.edu An: cypherpu...@cpunks.org An: Liberation Technologies An: zs-...@zerostate.is Antwort an: liberationtech Betreff: [liberationtech] what to install on a secure communication device Gesendet: 31. Aug. 2013 10:47 I'm looking to build a list for reasonably secure (no snake oil) ways to communicate (search, store, etc.). My ad hoc list so far is: Pidgin/OTR cables Jitsi Tor YaCy RetroShare TorChat Tahoe LAFS GnuNet No doubt I'm missing a lot. Any further suggestions? -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu. -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu.
Re: [liberationtech] In his own words: Confessions of a cyber warrior
Eugen Leitl: Grimes: How many exploits does your unit have access to? Cyber warrior: Literally tens of thousands -- it's more than that. We have tens of thousands of ready-to-use bugs in single applications, single operating systems. Grimes: Is most of it zero-days? Cyber warrior: It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface. Tens of thousands zero-days; that sounds like totally shit. That guy seems to be a script kiddie poser, nothing more. Are there any real hackers that can issue a competent statement to that? Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Cryptocat: Translation Volunteers Needed
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi Nadim, I could translate the german version of Cryptocat, please send me the notes. Greets, Andreas -BEGIN PGP SIGNATURE- iQEcBAEBCgAGBQJRnmc6AAoJEL1atOfcpCabrPYH/RmVcW4VIixvxnj95Gs9XH/o 3rXT3ryRKa5eba1VakSKS4DlXz/wVWjd6FW1G47dutCAYHrxpzX2avR9T/NSYyhD Os95tTyO1Do+e1/UXzkK9IVof/TaqQRoRL0OvNSYqRZM3LVAjRc5KYQx/ALq1lwC ueGZPMtdNqBd8OnQJqRVcgfyRhYfaK+2FWLbdZ4HPiJYaLs3aZIgJRgnfKKxR+lg RiwBsfuJJjx9pedFJIp7Zic6qBbY37mkWhiJ8T0CYiTSX2wzva0yfF7a5tlaFRA+ ypOEvto2bIeFXKDSUiNRU3KfemYT8lOYZZSwIdczBRS0TXkW5Sy159REO+jQyBU= =GOFq -END PGP SIGNATURE- -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Frei PiratenPartei
I am a Member of the Piraten in Germany. Let me answer with a question. Do you really think a party like that has a chance in the USA? Diese Nachricht wurde Ihnen von meinem BlackBerry® von 11 gesendet. Bestellen Sie diesen Service unter www.1und1.de. -Original Message- From: Andrés Leopoldo Pacheco Sanfuentes alps6...@gmail.com Sender: liberationtech-boun...@lists.stanford.edu Date: Thu, 16 May 2013 17:11:48 To: liberationtechliberationtech@lists.stanford.edu Reply-To: a...@acm.org, liberationtech liberationtech@lists.stanford.edu Subject: [liberationtech] Frei PiratenPartei -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Encrypted smartphone addressbook/contact list?
How about AIO Solutions like Blackberry? Diese Nachricht wurde Ihnen von meinem BlackBerry® von 11 gesendet. Bestellen Sie diesen Service unter www.1und1.de. -Original Message- From: Bernard Tyers - ei8fdb ei8...@ei8fdb.org Sender: liberationtech-boun...@lists.stanford.edu Date: Mon, 6 May 2013 20:03:49 To: liberationtech Liberation Tech Mailing Listliberationtech@lists.stanford.edu Reply-To: liberationtech liberationtech@lists.stanford.edu Subject: [liberationtech] Encrypted smartphone addressbook/contact list? -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello all, Has anyone come across an encrypted address book / contact list application for smartphone devices? Thanks in advance, Bernard - -- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJRh/6VAAoJENsz1IO7MIrrJ2gIALoQw++tXReu4Ej4m9wEJX2o Q9O+SG3xdShBYDBadGc+dCY7lluLTRaGXbTAY4Bx+jSZrr17JB2AZwaBNFnDYdjb FyrnYurmtqGspFOg4pDx4ocm2br+cNaJQ4a+OvzFWkfzIIzq8TCg+5QXJndK/t48 PjZzPjgFrPc91Yeurj0bhunpCUM0FOB1rntrPCNYRDEybfioa9tVE/M9Cdvr1D4N Gpyq1N147JNVtWzUEx5Zx5Y4USrcgJ6fmMCBD1YMxtZ//brK7KU7yJFlNIcgf5aJ An/q94FQTYOU/+E6rXYZkjd2JV/pA9LBsmelTGmIIayUlmEEhlJ1eWrxHjzvAmo= =7EGU -END PGP SIGNATURE- -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] BlackBerry and CALEA-II
Griffin Boyce: Jacob Appelbaum ja...@appelbaum.net wrote: When people ask how secure BBIM is - I suppose we can now cite RIM's official documentation on the topic - without a BES server, it's encrypted with a key that is embedded in all handsets. This was critical in the London Riots case back in 2011. As most people on this list know, building in the ability to decrypt *some* users means that they can decrypt *all* users. Which is basically what happened [1]. Surely someone has already extracted this Triple DES 168-bit key, right? Yep, though you may not even need it if you use another Blackberry device (and not, say, a laptop). A Blackberry device can spoof the PIN of another and read all of its messages. It's been a bit of a controversial topic for a few years now, as you might imagine. BBM is perhaps *slightly* more secure than plain email or SMS, but users aren't protected in case of government interest or vindictive exes. best, Griffin Boyce [1] http://www.guardian.co.uk/uk/2011/aug/15/mi5-social-messaging-riot-organisers-police Blackberry secures the connection if other firms want to get your data. If the government wants it then you should better use open source encrypted Hardware. I have been a BB user for years, but there are some mail accounts that are only used on my Laptop, not on the BB. Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Secure, inexpensive hosting of activist sites
Hisham: Hi all, Activists whose sites come under attack struggle to find cheap solutions to keep their websites safely guarded. Many of them are looking for secure, inexpensive hosting. I've come across many such cases, from Senegal, to Zambia to Egypt to Morocco. Some of them ask for temporary hosting to be able to stay online until they can stand on their feet again. I'd be grateful if someone could help with this one. Are there secure and inexpensive solutions out there? Best, -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech Hetzner Germany is pretty good. We use it since years and never had problems with it. Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] how spammers work, was: You are awesome, Treat yourself to a love one
Thank you, I just didn't know that this list is public, I never had spam on my other libtech/drones account. Andreas Diese Nachricht wurde Ihnen von meinem BlackBerry® von 11 gesendet. Bestellen Sie diesen Service unter www.1und1.de. -Original Message- From: M. Fioretti mfiore...@nexaima.net Sender: liberationtech-boun...@lists.stanford.edu Date: Sun, 31 Mar 2013 11:47:31 To: liberationtech@lists.stanford.edu Reply-To: M. Fioretti mfiore...@nexaima.net, liberationtech liberationtech@lists.stanford.edu Subject: [liberationtech] how spammers work, was: You are awesome, Treat yourself to a love one On Sun, Mar 31, 2013 09:21:13 AM +, Andreas Bader wrote: How could that happen?? This Email Adress is existing since a week or two and is only used for trusted contacts and Libtech/Drones List! From: mark ! write2ma...@gmail.com To: andreas.ba...@nachtpult.de How could that happen? In the same, totally unsurprising ways in which always happen to everybody who takes the same measures as you (no offense meant, really, just a technical explanation!). It happened in one of these two ways (there may be others, but these are by far the easiest and most likely): 1) one of your trusted contacts got infected by a spamming virus who sent spam to all the addresses in his list. And the list itself to other spambots. 2) (much more efficient) robots that automatically (**): - search online for mailing list archives and find pages like: https://mailman.stanford.edu/pipermail/liberationtech/ - download from such pages the downloadable version of each monthly archive, eg: https://mailman.stanford.edu/pipermail/liberationtech/2013-March.txt - extract and reformat from those files, in one fell swoop, all the strings that are trivial to recognize as email addresses, eg: From andreas.bader at nachtpult.de Wed Mar 20 09:40:35 2013 (that's the first occurrence at line 30740, there are others) I can write a shell script that does all this in less time than it took me to write this explanation. So nothing unusual or surprising, really. And this story of yours (again, no offense at all meant!!!) is a perfect example of why and how many address protection measures like yours are completely useless. Point 2 above proves that this list didn't make all it could have done to hide your address, but Point 1 proves that it really doesn't matter. HTH, Marco http://mfioretti.com (**) your address is online, in equally recognizable form, also in all the single message pages, eg https://mailman.stanford.edu/pipermail/liberationtech/2013-March/007938.html, but why should a spammer download them all, when everything is in the text format montly archive? -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] New session starting for Stanford's online crypto course
Steve Weis: A new session of Dan Boneh's free online crypto course is starting today: https://www.coursera.org/course/crypto Thanks, started it =) Seems to be for amateurs, but I will see. -Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] A tool for encrypted laptops
Hi all - at the risk of shilling, my company has released an Open Source tool called You'll Never Take Me Alive. If your encrypted laptop has its screen locked, and is plugged into power or ethernet, the tool will hibernate your laptop if either of those plugs are removed. So if you run out for lunch, or leave it unattended (but plugged in) at starbucks, and someone grabs your laptop and runs, it'll hibernate to try to thwart memory attacks to retrieve the disk encryption key. Not foolproof, but something simple and easy. It the moment it only supports Bitlocker, but support for Truecrypt is coming[0]. If you have suggestions - add them to the github issues page. https://isecpartners.com/news-events/news/2013/march/yontma.aspx https://github.com/iSECPartners/yontma -tom Great Idea, solves a huge problem with the hack of SEDs. But Windows itself is a big security hole, why don't you offer this for Linux? When I encrypt my Laptop with Bitlocker and Yontma, then I have a half Open Source secured Laptop.. -Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] skype
Anthony Papillion: On 03/22/2013 05:23 AM, Joseph Lorenzo Hall wrote: On 3/21/13 9:36 PM, Michael Carbone wrote: Anyone looked into the reports that Skype leaks your IP address? Apparently you do not have to interact with the person whose location you are interested in to be able to get their IP address. I think this is (still) the vulnerability Kieth Ross and his team at NYU-Poly found a few years ago... last I talked to him this particular flaw was still exploitable and hadn't been fixed: That is definitely true. Basically, you can get the IP address the account last logged in from. Do a search for 'Skype Resolver' and you'll find a bunch of services that do this. Here's one: http://www.anonware.net/index.php?page=resolver Put in the Skype username. If it fails, try again as it sometimes messes up the first time. Apparently, Microsoft has not fixed this yet. Is this the same Script Kiddie Hack that was available for IQC a few years ago? Don't you think that will solve itself? Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] skype
Anthony Papillion: On 03/22/2013 02:21 PM, Andreas Bader wrote: Anthony Papillion: On 03/22/2013 05:23 AM, Joseph Lorenzo Hall wrote: On 3/21/13 9:36 PM, Michael Carbone wrote: Anyone looked into the reports that Skype leaks your IP address? Apparently you do not have to interact with the person whose location you are interested in to be able to get their IP address. I think this is (still) the vulnerability Kieth Ross and his team at NYU-Poly found a few years ago... last I talked to him this particular flaw was still exploitable and hadn't been fixed: That is definitely true. Basically, you can get the IP address the account last logged in from. Do a search for 'Skype Resolver' and you'll find a bunch of services that do this. Here's one: http://www.anonware.net/index.php?page=resolver Put in the Skype username. If it fails, try again as it sometimes messes up the first time. Apparently, Microsoft has not fixed this yet. Is this the same Script Kiddie Hack that was available for IQC a few years ago? Don't you think that will solve itself? Possibly. I've not read up on the details of it yet. But, regardless, it does show that Skype leaks information that could be used in an attack. How did it solve itself with ICQ? I will say it in an easy way: ICQ realized that they fucked up and fixed it. Don't know how, but they got it. But that happened 3 or 4 years before now. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] skype
Anthony Papillion: On 03/22/2013 03:25 PM, Joseph Lorenzo Hall wrote: On 3/22/13 3:21 PM, Andreas Bader wrote: Is this the same Script Kiddie Hack that was available for IQC a few years ago? Don't you think that will solve itself? Not familiar with that hack... This one essentially omits a few steps of the Skype client handshake and the IP address is sent to the attacker without any notice to the target Skype user. This is one reason I only keep skype on when I'm using it and then make sure VPN before launching it. One thing to note is that this 'hack' gives the *last* IP that the user logged in from (which, of course, might be the current IP if the user is currently logged in). The user doesn't have to be logged in for it to work. I just resolved mine and it gave me my IP address but I haven't been logged on in two days. Anthony -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech Here in Europe IPs mostly change every 24h. Some need more time. If you are quick enough the IP change is no problem. Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] skype
Louis Suárez-Potts: One is tempted to suggest using other than Skype. Alternatives exist, and these are secure, at least according to their claims. As well, Skype's code is not transparent, in the way that other, open source, applications' are. louis What alternative do you exactly mean? I know some of them running under Linux, but I rarely know people using them. On 13-03-20, at 22:39 , Eric S Johnson cra...@oneotaslopes.org wrote: Dear LibTechers, When Microsoft applied in 2009 for a patent on “recording agents” to surveil peer-to-peer communications, it was assumed they were talking about something they might implement in Skype. Skype in 2010 started rearchitecting its use of supernodes “to improve reliability.” MS stated in 2012 that the re-engineering is “to improve the user experience.” The recent report in the Russian media that MS can trigger individual users’ Skype instances to establish session-specific encryption key exchange not with “the other end” but with intermediate nodes (thus making possible inline surveillance of Skype communications—presumably VoIP, since MS already stores Skype IM sessions “for 30 days”)—dovetails nicely with suspicions that MS is making (or has made) Skype lawful-intercept-friendly. But wouldn’t the above evolution require changes in the Skype client, too? Does anyone know of any work to identify whether it’s possible to say “if you keep your Skype client below version 4.4 [for instance], any newer capability to remotely trigger individually-targeted surveillance-by-intermediate-node isn’t (as) there”? Best, Eric -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
[liberationtech] NATO defines Cyberwar
Remember the Cyberwar discussion we had some weeks ago? Now the NATO official defines the Cyberwar: http://ccdcoe.org/249.html Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Satellite phones for Rohingya in Burma
Heather: Hi all, For those that aren't aware, 800,000 Rohingya Muslim people in Burma are being cut off from communication as the military and government try to drive them out of the country. Over 100,000 are being starved to death in concentration camps, the rest are driven into boats which neighbouring countries are refusing to allow to land. There have been two large scale massacres as well, one in June, one in October. Our contacts have been saying for weeks there is another massacre planned for the end of March, but even if there weren't, they are living in houses made of straw and plastic bags with no food or medical aid and the rains are coming. This is a full scale genocide supported by the current Burma/Myanmar government. Media and aid groups are blocked and the people are jailed just for having a TV, they have no phones. More information, check out over 100 pages of links here http://topsy.com/s/georgiebc+Rohingya?window=a the #Rohingya tag on Twitter or google. We have a way to hopefully get some journalists in to document war crimes. We need satellite phones for the Rohingya people as well, as many as possible, donated would be great. If anyone has any ideas for a good phone source it would be appreciated. All the best, Heather Marsh So if you say that there's possibly a massacre the next few weeks, we should advise the media and journalists of this situation, so that at least it would be reported. So we have a basis for a war crime accusation. I personally think the the biggest fear of a regime like that is a world watching them. Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Designing the best network infrastructure for a Human Rights NGO
drone_guinness1 borgnet: ...end users using Linux :-D (good one) so you say that android users aren't end users? -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Designing the best network infrastructure for a Human Rights NGO
anonymous2...@nym.hush.com: Thanks, yes I also have seen young and old people use linux but I've also seen hundreds of people trained to use it and as soonas they have to update a package in Linux, get confused and reach for a windows machine. The NGO in a box stuff is ok but not what I am asking about at all, I'm speaking about a network for a Western NGO with significant operations and exposure from high-level threats and on the ground in 3rd world countries. In that case you should contact a microsoft advoser, he will help you to build your secure infrastructure basing on MS. If you ask the people here what they would use then you get the answers you get right now. You sound like you want security in a corporate structure. Andreas -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at compa...@stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] About private networks (Was Re: NYT covers China cyberthreat)
On 22/02/13 03:53, Charles Zeitler wrote: On Thu, Feb 21, 2013 at 8:10 AM, Eugen Leitl eu...@leitl.org wrote: On Wed, Feb 20, 2013 at 09:03:06PM -0600, Charles Zeitler wrote: http://en.wikipedia.org/wiki/Quantum_cryptography Doesn't really work. Essentially, this is expensive snake oil. so, it's been tried, eh? can you post a link? charles zeitler We had this discussion some time ago. You can have a look at this article: http://online.wsj.com/article/SB10001424052702304203604577396282717616136.html The problem is that you have no insight in military research, therefore you can not assess how far the different intellegence agencys and the military is in this area. Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
On 02/12/2013 12:46 AM, Rich Kulawiec wrote: On Mon, Feb 11, 2013 at 05:54:19PM +0100, Andreas Bader wrote: Don't you think that e.g. DSL (Damn Small Linux) has less code than Android? I don't know. While I'm somewhat familiar with DSL, I don't use Android and know very little about it. I just did a little searching and see various figures cited for both, but nothing that seems to be recent/comprehensive/accurate. I suspect that my reaction to both, though, would be too many. ;-) DSL has a size of 50 MB, Puppy is also small. Chrome OS seems to be much bigger (maybe Jake can tell us details). I think that if you compile your own small kernel and kick out all the needless stuff you can create a much smaller (and more secure?) kernel. I mean you can't simplify that by saying This System is the most secure if you mean this system is the smallest.. You're right. We can't. But if we accept as a starting premise that to a first approximation the number of security holes is roughly proportional to the size of the system -- and that usually seems to be true -- then smaller is probably better. So why not create a own OS that is really small because of its security? Chrome OS is small because it's cheap. If you were right then Android was the most secure system. Aren't there any Android viruses? RedHat seems to have less security holes than Chrome OS. I think you have to achieve a good compromise between security and simplicity. I don't think so: I think the best way to achieve security IS simplicity. That's why, for example, I suggest having *no* update mechanism other than a complete reinstall of everything -- or more likely, a 1-for-1 swap of the readonly device holding the OS. If there is no update mechanism, then it can't be broken. It can't be used to feed in malware. It can't be used to figure out who's running the OS. It doesn't exist, so all of the possible things that could go wrong with it don't exist either. I contend that this is simpler than trying to build one and then solve all the problems that its existence creates. Chrome OS is not an OS optimized for security. An OS optimized for security is an own OS. What if users want to use stuff like FDE, PGP, different certificates, all the software you use for secure information and communication. They depend on Google. They have to release it and allow you to use it on their OS. And we have to respect that, because it is a requirement for their working security. Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
On 02/12/2013 06:41 PM, Brian Conley wrote: A good alternative for what use cases? The problem I find with flat statements such as something like that would be a good alternative to ChromeOS for activists is that it fails to address what uses its providing a good alternative for. IE you fail to demonstrate the threat model based on real use cases. Which is not to say you are wrong, I simply want to ask for clarification as to your intended meaning. eg: Would it be a good alternative for activists already using Google Apps (as Nathan at the beginning of this thread suggested Chromebooks might be?)? Yes, you can use all Google Apps in the Chrome Browser. And I think that there are not many activists that use only Google Apps for communication and information. Would it be a good alternative for media activists who need to be able to edit video and photo content of actions or documentation of human rights violations? I am sure that I can edit photo and video better on my Ubuntu Workstation than on a Chromebook. Would it be a good alternative for activists who intend to disseminate updates, reports, and propaganda via Facebook and other social networks? In that case chromebooks would be possible, but only if you work only online. And the telecommunication infrastructure is not everywhere that great like in Europe and USA. I certainly have no idea. These are serious questions, not intended to be sarcastic or confrontational. I'd really like to know for what real-world uses its deemed this or any other super small OS would be good solutions for activists. Certainly for hacktivists, hackers, and users only engaged in online communications I'm sure these are great solutions, but I hope you can detail more how a DSL or Liberte Linux provide good solutions to the multifaceted needs/use cases of activists. If you want ONE solution for all these cases I'd prefer something like Ubuntu, Debian or Open Suse. They have the best (free) support for users and are pretty stable. Also they are pretty good configurable and expandable (Design- and Videoediting-Software, easy TOR usage, different Browsers etc.). I don't think that lots of those people want to use a Terminal OS with Lynx to Browse, but I am sure that they also want no Toy Touch OS with quick access to the newest Angry Birds game. Those systems are facebook and twitter machines, optimized for modern socializing. But not really secure. Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
On 02/11/2013 04:15 PM, Rich Kulawiec wrote: On Mon, Feb 11, 2013 at 12:54:27AM +0700, Uncle Zzzen wrote: Obviously systems are too complex for most people to really figure out what's exactly running on their computer, and modern systems (from smart phones to unity) make it harder and harder for users (even power users) to peek under the hood. Agreed. Further, complexity == insecurity. The way that you build secure systems isn't by adding code: it's by taking as much away as you possibly can, by stripping them down to the absolute minimum required to accomplish the required computing tasks. Why? Because we don't know how to write secure code. Therefore, to a first approximation, the less code is in play, the better chance we have. (That's an unhappy statement, but I really do think the last 10, 20, 30 years bear it out. Even when we think we've written secure code...we probably haven't. Timely example: Lucky Thirteen: Breaking the TLS and DTLS Record Protocols http://www.isg.rhul.ac.uk/tls/ In that case, the code is insecure because the spec is insecure. Oops.) So if I were trying to design a secure operating system and application environment for liberationtech, I would do several things that are, depending on how you look at them, either a radical departure or a return to a time when simplicity was recognized as a virtue. 1. Abandon the idea that a full-blown general-purpose operating system is required. It's not. Start with something that's fairly lean and which has a focus on security (e.g., OpenBSD) and start figuring out what can be stripped out of it (based on target devices and application environment). This includes not just the kernel, but *everything*: if there isn't a need for the C compiler in the target environment, then it shouldn't be there. Neither should /usr/include. Or the applicable man pages. Ruthlessly strip out every file, every line of code that isn't needed. 2. Abandon all-singing all-dancing applications. They're enormous. They use massive code bases which in turn use massive libraries. And to borrow from the quoted passage above, they make it harder to peek under the hood. So: no GUI. Don't tell me it can't be done -- I've done it. Anyone who can use Thunderbird can use mutt, for example. And given the enormous reduction in attack surface as well as required system resources, this effort should go as far as possible. 3. Abandon the idea of application installation, updates, etc. These mechanisms present an attack surface. So don't have them, period. Make the entire distribution, OS and applications, one monolithic self-contained entity. No app downloads. No updates. No choices. (Of course this is additional motivation to make it as small as possible.) You want a new version? Then you get a new version, in its entirety. 4. Onboard bidirectional default-deny firewall. Make the user explicitly authorize any/all traffic in either direction. Scream like hell when something is trying to get in, and just as loudly when something is trying to get out. 5. Design to run off read-only media. Thus (as an adjunct to 3) the way that you upgrade is to replace that media. Design to use external media for storage so that nothing is ever present on the system itself. What I have in mind is something small enough to fit the entire distribution on a 64M USB stick/memory card or smaller. Yes, this approach presents some problems of its own. I know. I could spend the next hundred lines enumerating just the obvious ones. But it also solves (or at least makes credible attempts at solving) a different set of problems that I think are more important. And I think it has a fighting chance of reducing the code base and thus the attack surfaces to a tractable size. Maybe. Possibly. On a good day. Don't you think that e.g. DSL (Damn Small Linux) has less code than Android? I mean you can't simplify that by saying This System is the most secure if you mean this system is the smallest.. I think you have to achieve a good compromise between security and simplicity. Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Cryptography super-group creates unbreakable encryption
On 02/07/2013 04:42 AM, Nadim Kobeissi wrote: Actual headline. http://www.extremetech.com/mobile/147714-cryptography-super-group-creates-unbreakable-encryption-designed-for-mass-market NK Notionally there is no unbreakable encryption. Practically there is a unbreakable encryption (AES, SHA-3); our standarts are more than adequate. The risk with encryptions is more the possibility of a hardware hack. Or a bad guy beating the shit out of you with a 5 Dollar Wrench until you tell him the password. In real life no one will use a super computer to break our hardcore encrypted harddrives. Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Cryptography super-group creates unbreakable encryption
On 02/07/2013 11:58 AM, Jens Christian Hillerup wrote: On Thu, Feb 7, 2013 at 11:41 AM, Andreas Bader noergelpi...@hotmail.de wrote: Notionally there is no unbreakable encryption. Practically there is a unbreakable encryption (AES, SHA-3); our standarts are more than adequate. The risk with encryptions is more the possibility of a hardware hack. Or a bad guy beating the shit out of you with a 5 Dollar Wrench until you tell him the password. In real life no one will use a super computer to break our hardcore encrypted harddrives. I think Nadim was being sarcastic. I'm also eager to see what comes from this. I too think it's rather odd that these supposedly respectable cryptographers are so blatantly ignoring Kirchoff's principle. Quickly skimmed the article; it seems that you have to trust them to *actually* encrypt your stuff on your phone before storing it on their servers. As with so many others, it'd behoove them to put their code where their mouths are; I don't mind them making money off of this, but at least they should stop leveraging their big names in the industry to get a lot of media attention around them selling snake-oil. JC -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech Didn't get it, sorry. I always forget that you can have humor in such a serious world. :-) Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
On 02/06/2013 07:28 AM, Nathan of Guardian wrote: On 02/06/2013 01:22 PM, Ali-Reza Anghaie wrote: How can projects like Privly play into it? Carrying a Tor Router along with you or building one on-site. None of the operational matters will ever be squarely addressed by one platform but it all can be decision-treed out nicely. You could also use Orbot with wifi-tether on Android phone. It can transparent proxy all the wifi hotspot traffic over Tor. +n -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech Why don't you use an old thinkpad or something with Linux, you have the same price like a Chromebook but more control over the system. And you don't depend on the 3G and Wifi net. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
On 02/06/2013 04:24 PM, Tom Ritter wrote: Nadim, I'm with you. I'm not sure it's the perfect solution for everyone, but like Nathan said, if you already trust Google, I think it's a good option. On 6 February 2013 07:12, Andreas Bader noergelpi...@hotmail.de wrote: Why don't you use an old thinkpad or something with Linux, you have the same price like a Chromebook but more control over the system. And you don't depend on the 3G and Wifi net. We started with the notion of Linux, and we were attracted to Chromebooks for a bunch of reasons. Going back to Linux loses all the things we were attracted to. - ChromeOS's attack surface is infinitely smaller than with Linux - The architecture of ChromeOS is different from Linux - process separation through SOP, as opposed to no process separation at all - ChromeOS was *designed* to have you logout, and hand the device over to someone else to login, and get no access to your stuff. Extreme Hardware attacks aside, it works pretty well. - ChromeOS's update mechanism is automatic, transparent, and basically foolproof. Having bricked Ubuntu and Gentoo systems, the same is not true of Linux. - Verified Boot, automatic FDE, tamper-resistant hardware Something I'm curious about is, if any less-popular device became popular amoung the activist community - would the government view is as an indicator of interest? Just like they block Tor, would they block Chromebooks? It'd have to get pretty darn popular first though. -tom -- But you can't use it for political activists e.g. in Syria because of its dependence on the internet connection. This fact is authoritative. For Europe and USA and so on it might be a good solution. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
We started with the notion of Linux, and we were attracted to Chromebooks for a bunch of reasons. Going back to Linux loses all the things we were attracted to. - ChromeOS's attack surface is infinitely smaller than with Linux - The architecture of ChromeOS is different from Linux - process separation through SOP, as opposed to no process separation at all - ChromeOS was *designed* to have you logout, and hand the device over to someone else to login, and get no access to your stuff. Extreme Hardware attacks aside, it works pretty well. - ChromeOS's update mechanism is automatic, transparent, and basically foolproof. Having bricked Ubuntu and Gentoo systems, the same is not true of Linux. - Verified Boot, automatic FDE, tamper-resistant hardware I think SL, Debian, Suse or CentOS are not less secure than ChromeOS. And if there is a secure problem then you have enough control to fix the system. I have never bricked my LUKS encrypted Debian System. Running on an old Lenovo X61s. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Chromebooks for Risky Situations?
On 02/06/2013 08:36 PM, Brian Conley wrote: Andreas, Plenty of Syrians do have internet access, and use it on a regular basis. Also, lack of appropriateness for one use-case doesn't necessitate lack of appropriateness across the board. Linux is a great solution for many use cases, but as has been elaborated, quite a terrible one for many others. Brian There was already the case that the Syrians were isolated from the internet. If you base your communication and information on the internet then activism will break down in this scenario. Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Is the Cyberwar beginning?
On 01/31/2013 04:39 PM, Gregory Foster wrote: Thanks for bringing up this subject, Andreas. I'll just add that aggression (cyber-aggression perhaps?) requires actors. And as Andreas points out, on January 27th the Pentagon announced approval of US Cyber Command's expansion from 900 personnel to 4,900 troops and civilians. WaPo (Jan 27) - Pentagon to boost cybersecurity force by Ellen Nakashima: http://www.washingtonpost.com/world/national-security/pentagon-to-boost-cybersecurity-force/2013/01/19/d87d9dc2-5fec-11e2-b05a-605528f6b712_story.html This five-fold expansion of personnel comes in the midst of threatened Defense budget cuts (the sequester) and a draw-down of overseas engagements, which signifies something about its perceived necessity. More importantly, DOD Cyber Command (which is right next door to the NSA and led by the Director of the NSA) is staffing combat mission forces now that DOD has the green light to perform offensive operations across the Internet. There is a difference between covert operations concealed in black budgets (e.g., Stuxnet) and overtly embraced state-sanctioned aggression. Remember that Stuxnet has proven it is quite possible for actions initiated from the information environment to have kinetic effects in physical space (destroying Iran's centrifuges IMO constitutes an act of war). I wonder how the Internet may change as a result of this slow, methodical unfolding. And I do think we're embroiled in something quite different than the hyperbolic language acts that have been occurring since the early 90's. The language acts are precipitating the desired result. Sorry for bringing this up again; but seen from your point of view this sounds like a new cold war. Hope that theres soon something like a convention for disarmament.. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
[liberationtech] Is the Cyberwar beginning?
On 01-29-2013 the website http://www.syrian-martyrs.com/ got hacked. On 01-30-2013 there was a man in the middle attack on GitHub (?). On 01-27-2013 the Pentagon was boosting the Cybersecurity Force. On 01-14-2013 Red October was exposed. And that were only the big incidents in this year. Things like that are accumulating. Are we slipping in the cyberwar experts are warning of since years? I just want to initiate a discussion. Your opinions? Sincerely, Andreas -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Is the Cyberwar beginning?
On 01/31/2013 09:33 AM, Aaron Greenspan wrote: Andres, I don't think so. I also generally don't like the word cyberwar, as (thus far) it's generally been used by reporters who aren't really sure what they're talking about to scare people. I think we have an increase in the number of internet-connected devices, and increase in the reliance of society upon those devices, and a corresponding increase in isolated attacks. Some of them will inevitably be related to each other. Most will not. Aaron Aaron Greenspan CodeX Fellow | Stanford Center for Legal Informatics | http://codex.stanford.edu Founder | PlainSite | http://www.plainsite.org Of course the word cyberwar is generated from boulevard journalists and other badasses. In summary I mean that the hacking attacks from nations worldwide are accumulating. Don't you think that it will go on like that? -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Is the Cyberwar beginning?
Thank you for that conclusion! But I think you forgot one important thing: This conflicts must all together culminate in something. What will that be? The only parts that the war on piracy has are hacking offenses like the Anonymous Operations. But I don't think that you can compare that with Cyber War Stuff like Stuxnet and Red October. There is also the question from which instant of time the Cyberwar is a war. Is there kind of a Geneva Convention for Cyber Attacks? The Nations can do everything they want, the only barrier is the budget (i.E. Stuxnet). War on piracy is more like a civil war (in my opinion!). On 01/31/2013 12:55 PM, A.Cammozzo wrote: Hello Andreas, thank you for your call for discussion. Consider that cyberwar or netwar is coming since 1993 [1]... But what kind of war are we expecting? What metaphor should we use to describe the increasing belligerency on the net? Surely not a war fought by the military following a declaration according to formal protocols of the Hague Convention! I think we could consider two different metaphors of the latent form of confrontation we are observing: (1) the pirate-like war fought by the privateer, private person or company authorized by a government, making profit from prize money or bounties. Off metaphor, the Data Privateer has the freedom to take advantage from data gathered in commerce raiding or guerre de course activities, being under explicit or implicit government immunity. Can we find clues or evidence for this kind of entities? Think for instance of government agencies spying on their own citizens, sometimes acting in grey zones un-encoded by laws, and their contractors. (2) Cyberwar as a vector of Data Colonialism. Considering the Cyberspace a territory is a mistake, but following Luciano Floridi Infosphere [2] concept, it is the part of a wider environment. In this context the net is a sort of space-like opportunity where states do confront not in terms of sovereignty, but with their ability to access to all kind of data resources available, even if protected by other state's laws. This war is part of the global political and economic effort to control data as raw material and sell data exploitation infrastructures. To achieve this goal, states must show a twofold ability: to offend, stealing and destroying data and data infrastructures; and to defend, an essential element to maintain a tutelary power on their citizens (data protection) and a political and economic power on countries unable to autonomously develop the same abilities. Of course these two metaphors do overlap some times. This kind of collateral warfare has been going on for years. Sincerely, Alberto [1] Arquilla, John, and David Ronfeldt. Cyberwar is coming!. Comparative Strategy 12, no. 2 (1993): 141-165. p.28: netwar represents a new entry on the spectrum of conflict that spans economic, political, and social as well as military forms of “war.” In contrast to economic wars that target the production and distribution of goods, and political wars that aim at the leadership and institutions of a government, netwars would be distinguished by their targeting of information and communications. [2] Floridi, L., 2007. A Look into the Future Impact of ICT on Our Lives. The Information Society, 23(1), p.59-64. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Mega
On 01/23/2013 03:41 AM, Alex Comninos wrote: Cracking tool milks weakness to reveal some Mega passwords Dotcom's Mega aids crackers by sending password hashes in plain-text e-mail. Really! http://arstechnica.com/security/2013/01/cracking-tool-milks-weakness-to-reveal-some-mega-passwords/ o_0 -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech Mega seems also to have an exploitable bug for email spaming. A lot of bloggers report this. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Mega
On 01/23/2013 01:40 PM, bbrewer wrote: Andreas Bader noergelpi...@hotmail.de wrote: Mega seems also to have an exploitable bug for email spaming. A lot of bloggers report this. All the money in the world, and still, so many listed problems on this new service. Malicious intent, or just complete rush to give the finger to the authorities? I guess the 2nd one. But the great thing with kim dot com is the way how he gives the finger to the authorities. The good thing is that he's at least not the biggest ***hole in the world of IT. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Mega
On 01/21/2013 08:42 PM, Randolph D. wrote: the secure alternative is htp://retroshare.sf.net http://retroshare.sf.net without payment, without google chrome sponsoring, without central servers. a full alternative. 2013/1/21 Sam de Silva s...@media.com.au mailto:s...@media.com.au Hi there, I wonder if there's any feedback from this list on Kim Dotcom's Mega project - www.mega.co.nz http://www.mega.co.nz Can it be the secure alternative to Dropbox? Best, Sam -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech Retroshare is great, but not an alternative. Retroshare is torrent software with PGP encryption, and Mega is a one click hoster. Of course you can never trust a company like Mega with your personal data, but if you encrypt them then it should be no problem. I hope that there's soon a software like cloudfogger, but for Mega. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Fwd: [Crypto Stick News] Vulnerabilities of Self-Encrypted SSDs
On 01/14/2013 06:23 PM, André Rebentisch wrote: fyi, André Original-Nachricht Betreff: [Crypto Stick News] Vulnerabilities of Self-Encrypted SSDs Datum:Mon, 14 Jan 2013 17:14:51 +0100 Von: n...@crypto-stick.com Antwort an: webmas...@crypto-stick.com, n...@crypto-stick.com An: n...@crypto-stick.com Researchers found vulnerabilities of self-encrypted SSDs. From the abstract: Self-encrypting drives (SEDs), such as Intel's SSD 320 and 520 series, are widely believed to be a fast and secure alternative to software-based solutions like TrueCrypt and BitLocker. [...] In this sense, hardware-based full disk encryption (FDE) is as insecure as software-based FDE. We also show that (2) there exists a new class of attacks that is specific to hardware-based FDE [Full Disk Encryption]. Roughly speaking, the idea of these attacks is to move an SED from one machine to another without cutting power, i.e., by replugging the data cable only. [...] Some machines are arguably more vulnerable when using SEDs. Watch the videos... [1] This article: http://www.crypto-stick.com/node/74 [1] https://www1.cs.fau.de/sed -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech Here is a german speech from the 29C3 in Hamburg, Germany, where the problems of SEDs are also mentioned: Unsecure SEDs Youtube http://www.youtube.com/watch?feature=player_embeddedv=IzE2SKVP-MQ#%21 -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Safe app like Dropbox?
You can unsubscribe from this list by following the instructions from the bottom of this mail. On 01/07/2013 06:38 PM, Margaret Silver wrote: I am trying to unsubscribe. I never wanted to be on this list. Please unsubscribe me. My email has been hacked. Thank you On Mon, Jan 7, 2013 at 12:32 PM, Jacob Appelbaum ja...@appelbaum.net mailto:ja...@appelbaum.net wrote: Jerzy ?ogiewa: Hm Jake, can you tell more about this? Was this data publish? It was a talk we gave at the 23rd CCC Congress: http://code.google.com/p/vilefault/ http://arstechnica.com/apple/2006/12/6436/ All the best, Jacob -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Professor Margaret Silver RN M.Ed., NP Director RN to BS ASCEND Programs Hudson Valley, Garden City, Sayville and Manhattan Adelphi University School of Nursing Garden City, New York 11530 sil...@adelphi.edu mailto:sil...@adelphi.edu phone 516-877-4521 fax 516-877-4558 -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] North Korea Cracks Down Knowledge Smugglers
On 01/04/2013 09:56 PM, Nadim Kobeissi wrote: I would like to share this truly fascinating article: http://www.salon.com/2012/12/31/north_korea_cracks_down_on_knowledge_smugglers/ From the article: “We must extend the fight against the enemy’s ideological and cultural infiltration,” Kim said in an October speech at the headquarters of his immensely powerful internal security service. Kim, who became North Korea’s supreme leader after the death of his father a year ago, called upon his vast security network to “ruthlessly crush those hostile elements.” Seeing this idea of knowledge smugglers accepted so openly by the North Korean government really justifies a private train of thought I've been considering for a year. I think no matter how hard we try, we keep underestimating just how powerful culture can be in determining foreign politics — and just how important the television and radio were, and the Internet is now, in communicating this culture. This, of course, is likely why so many political entities are interested in liberation technology. This is amazing stuff and I hope you'll read the article. NK -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech Maybe the time of radiocommunication will come in North Korea? Including radio encryption methodes like enigma in the 3rd Reich. Good to know that the North Korean military can't decode cyphers like that as long as the rest of the world doesn't sell their knowledge.. =) -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] Travel with notebook habit
On 12/28/2012 12:46 PM, Maxim Kammerer wrote: On Fri, Dec 28, 2012 at 10:49 AM, Julian Oliver jul...@julianoliver.com wrote: I've been extensively questioned at the border on a few occassions over the years /because/ my laptops don't have a Desktop as such, no icons either. Both my arms were grabbed at the Australian border as I reached to type 'firefox' in a terminal, to start the browser in an attempt to show them a normal looking environment. I think that in such a discussion, it is necessary to distinguish between border guards wanting to look at your data, and border guards wanting to make sure that your laptop is not a bomb (given the limited training they receive on the subject). The situation that you describe looks more like the latter than the former (although clearly there might be omitted details). For the case of Border guards that want to have a look at your data there's an article from schneier: http://www.schneier.com/blog/archives/2008/05/crossing_border.html You can also use a normal (fake | Windows) OS on your standart HDD and a hidden OS on a mSATA SSD, you can use a 16 GB disk with a small and encryted Ubuntu distribution. If you set the boot standart to your standart HDD then you have a good chance to get through the control. Another possibility is to combine this with a hidden truecrypt container, no one can force you to write down a password to a container that is probably not even existing. You can't prove that. If this is to complicated for you, you can still install a OS on a small USB stick. Or a SDHC card. It's not that expensive and if you have an USB stick fixed at your keyring I think no one will notice. The most secure thing would be a Live CD and a hidden container on an USB / SDHC device. So they can't infiltrate a system that is not even installed (backtrack and stuff have truecrypt onboard) and they can't force you to open that hidden container (because you only know if there is a container when you hit the right password. When nobody performs a hardware hack on your SATA or something then nothing can happen. If they keep your notebook for some minutes | hours | days then you should examine it before use.. It's also helpful to check the md5 checksum of the boot partition; you can have a virus / keylogger in there. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
Re: [liberationtech] SECDEV: Report on Syrian internet shutdown -III
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 11/30/2012 04:06 PM, Rafal Rohozinski wrote: Sorry folks, a bit of Google dyslexia… here is the proper public link for the brief report. Nothing really new here except for the fact that we were tracking withdrawal of routes as far back as the 22nd. Also, we've gotten pretty good a geo-locating individual netblocks, and IP range allocation. if the central shutdown continues, I imagine that in rebel held areas or maybe an attempt to start creating their own route announcements viaVSAT based connections or possibly by creating direct wireless links in border areas so will be on the lookout for new announcements that don't come from STE. https://docs.google.com/open?id=0B4_SBxiVQGUOQUVSaHFjS0hlVFk We also run a Facebook page that provides more real-time reporting. It can be found here: https://www.facebook.com/Syrian.DS We use Facebook because our principal stakeholders are Syrians, and in this conflict, Facebook rules as a means of reaching the largest stakeholder audience… Rafal On Nov 30, 2012, at 3:51 AM, Cameran Ashraf chash...@ucla.edu wrote: Hi Rafal, The link you provided didn't work. Could you send me a copy of the report? Thanks, Cameran -- Ph.D. student Department of Geography University of California, Los Angeles Quoting Rafal Rohozinski r.rohozin...@psiphon.ca: As this list strips PDF's - you can down load the report from here: https://docs.google.com/open?id=0B4ox3LYQcooBVUlfMkUzZUJmTTQ Rafal On Nov 29, 2012, at 10:47 PM, Rafal Rohozinski r.rohozin...@psiphon.ca wrote: Dear colleagues, Please find attached a Flash Note from SecDev produced by our Syria operations group, on today's shutdown of the internet in Syria. This shutdown has coincided with heavy fighting around Damascus airport and the reported seizure of key military facilities by rebels. In the past, the Syrian regime has shut off communications prior to offensives, and this may have been the case today. Alternatively, the shutdown may be related to rebel gains, and the regime’s desire to limit communication of these events. Due to foreign media restrictions in Syria, many use social media to communicate with one another and with the international community about events in the conflict, rendering this shutdown a critical development in the ongoing crisis. These Digital Security Reports are produced as part of an ongoing activity executed by The SecDev Foundation, called the Syria Digital Security Project. It seeks to improve the online safety and security of the Syrian people and to enhance the free flow of information in Syria. To this end, it provides information, analysis, tools and resources dedicated to enhancing digital safety and openness in Syria. The project is administered by The SecDev Foundation, a Canadian not-for-profit organization, with funding from granting bodies in North America. You may find additional coverage of these events in articles posted by Wired and Computerworld. We welcome your feedback. Syria_Flash-note_29Nov2012.pdf Rafal -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech The Google Docs page seems to be down. Do you have a mirror? -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQEcBAEBAgAGBQJQuOHpAAoJEObc4k/NwwSo1zsIALpH3U3H26mKjpBD0yVhqkXC Ut9EoCP5iIOGhMn40LZAqD+dL2eGjFCGBcvVXlxSLgH3xSLSeaQymcD0jTMjd297 rpfC5IUa330qJJiolyG626LTngkMtgAo7mRGA130FCY/c6PVxQS7AXCBxmOoeVk3 OCu35vnWuwXc+mFPCX/e7CcXUenbZwZMMmEIdHdCRh5gbZqPqlOekdt4EHV6jDol vloxzodhpTUquejfvIPpQN6t8d9Z/V1Tm8XiYaWRNIivbRVZjYiPX4O4DtRorlrd aBbDZmR+X5usfOG3Q1eJe2LgJ3JCb51X5Ze/3NQposmglkfytTg5cuvL5Qsj43g= =BRmx -END PGP SIGNATURE- -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
