Slashdot Mirror

Ask Jim Bell.

Propaganda operators, domestic and foreign both I suspect.

https://cryptome.org/2012/07/g...

It's probably their job, so don't take it too personally. This particular troll likes to provoke people into responding in the hopes that they don't change the comment title, effectively hijacking the karma bonus and increasing their visibility.

Here's some recommended reading about the methods these parasites use. They're a lot easier to ignore once you understand them.

You mentioned the Wikipedia article "Web of trust". It acknowledges that getting your key signed for the first time is impractical for many.

And yet people are able to get X.509 certs signed, and we even have things like LetsEncrypt. The evidence suggests getting signatures isn't really all that hard, since 100.0% of the websites that implement HTTPS somehow managed to do it.

So why stop at 1? The only people who come out ahead by us having single point of failure, are the attackers. I think we should move from a pro-attack to a pro-defense strategy, though I guess we should let the people at NSA, FSB, Chinese government and the Mafia weigh in on this before we make any hasty decisions.

I linked to the WoT article to inspire/remind people to think about the robustness of multiple parties attesting to an identity instead of just one, as well as how you decide how much to trust any one given CA. (Which is something nobody does today.)

What if one of the many signatures expires?

What if one of the many certifiers disagrees with the others, due to malice or mistake?

The WoT beats the living shit out of what we're doing today. It degrades gradually and more slowly when faced with simple failures, and it requires conspiracies (instead of someone coercing one single party) to undermine it. Perhaps that's why we don't use it: because it would be more secure, inconveniently too secure when you need to spy on someone. Or perhaps it's because people want to pretend that your confidence is either 0% or 100%, in spite of the fact that nothing ever really works like that.

But that doesn't help you build a robust set of paths through the web of trust to users on the other side of the planet unless several people who attended the same key signing party also routinely travel internationally to key signing parties in other countries

Actually some people do that (an international path through the WoT isn't that uncommon) but you're right that what happens today in PGP's WoT often isn't enough, and it really wouldn't be enough for everyone.

But I wasn't suggesting that the faceless companies that you currently fully trust (hey someone, remind me: why?), have to be left out and replaced by amateurs, as somehow turned out to be the case with PGP. If we implemented the web's PK like PGP did it, then you could still have your cert signed by Verisign and LetsEncrypt and Comodo and your neighbor and your bank and state government and those people you lifted pints with at the conference bar. Sure beats having a single point of failure. Imagine your LetsEncrypt signature expired then. Imagine Comodo fucked up again. Imagine your own government told Verisign to lie or your neighbor was trying to MitM you. Instead of these being disasters where thousands of people have to scramble to minimize downtime, it would be a minor nuisance, detected quickly ("hey, one of these CAs disagrees with all the others..."), and with reputation ramifications.

The catch is that we'd have to start valuing defense more than attack.

Whoa - the fifty cent armies are out in force for this one! 100+ idiotic posts arguing back & forth about TRUMP!!!!!11!!!! All posted by the same two astroturfers, using augmented trolling software to circumvent Slashdot's antispam features.

Nice topic dilution, gentlemen - well done!
https://cryptome.org/2012/07/g...

BTW: does anyone know the name of the software tool(s) used by these astroturfers?

Meet Me at Your Riser [2013] is a purely aesthetic Phillip Glassy video presentation by Deborah Natsios, who with John Young runs the successful CRYPTOME.ORG website.

The insinuation is, the practice is not relegated to willing participants such as AT&T, it may well include other carriers whose fiber has been secretly split in the 'telecom risers' that ascend throughout the building. Are Young/Natsios insinuating this from theory or an anonymous tip? You may as well ask how licks to the center of a Tootsie Pop.

CRYPTOME.ORG is a spooky and funny place... since 1996 it has provided a continuous stream of articles, whistle-blows and odd bits for the intelligence community, even serving as a pre-Wikileaks leaks site. Its regular visitors most surely include spooks of the world, that is, the 'top brass' that are not terrified of surfing into things beyond their own cubicle secrecy level. John Young has managed to maintain a playful counterpoint to the stern countenance (serious face) of the State intelligence profession and tugs on the community and keeps them coming back for more, or so he says, looking at his logs. He doxxed them before 'dox' was a word, blew the cover on deep state telecom interception and NSA Charter violations (no one listened of course) and has embarked on other projects as amateur sleuth. His post-9/11 Ground Zero photo collection is hi res and second to none.

Over the years he has dropped interesting tidbits with 'A Sends...' (Anonymous)... his PGP key is ludicrously long... and some of the tips appearing on his site have had the stamp of foreign state actors. Of course he posts it without personal bias and you can bet some true limited hangouts and pissing contests have been published on Cryptome to get them 'out there'. For $100 he offers the entire collection of hosted files to date. A great gift for Santa Spook.

"The Security Data Science Colloquium brought the competitors together to focus on one of the biggest challenges", that being Microsoft Windows running on Intel hardware and the dangers of running your computing infrastructure on a monoculture.

The Gentleperson's Guide To Forum Spies has been around for a while but it's still worth a read. Not that I'm saying any of this is actually happening. Just something to keep in mind.

Assange is one of those rate people that, the more you find out about him the more loathsome he becomes.

Just read the court documents, the Guardian and New Statesman articles about him and watch the documentary I linked to. Literally everyone he convinced to trust him has turned against him.

He even shafted Manning

http://cryptome.org/0001/wikil...

A sends via PGPboard, 17 July 2010:

The recent limited financial disclosure from the Wau Holland Foundation has revealed that no European donor funds have been spent in the provision of a legal team for PFC Manning; in detention for passing documents to WIKILEAKS.

We all remember the recent emails requesting $50,000 in donations in order to hire, and fly a legal team out to Kuwait. As we speak no legal team has been provided, and no attorney provided by Wikileaks has made contact with the JAG office in Kuwait.

In addition to this, the Wau Holland financial release confirmed that there were sufficient funds available to provide immediate assistance to PFC Manning, and that they would have no objection in disbursing the funding such an initiative.

http://cryptome.org/0003/wikil...

8 December 2010

Immediately following Bradley's arrest in late June 2010, the whistle-blower website Wikileaks publicly solicited donations specifically for Bradley's legal defense expenses. In July 2010, Wikileaks pledged to contribute a "substantial amount" towards Bradley's legal defense costs. Since Bradley's selection of David Coombs as his civilian defense attorney in August 2010, the Bradley Manning Support Network has unsuccessfully attempted to facilitate the pledged Wikileaks contribution.

"We understand the difficult situation Wikileaks currently faces as the world's governments conspire to extinguish the whistle-blower website," explained Jeff Paterson, Bradley Manning Support Network steering committee member and project director of Courage to Resist (couragetoresist.org). "However, in order to meet Bradley Manning's legal defense needs, we're forced to clarify that Wikileaks has not yet made a contribution towards this effort. We certainly welcome any contribution from Wikileaks, but we need to inform our supporters that it may not be forthcoming and that their continued contributions and support are crucial."

http://www.wired.com/threatlev...

WikiLeaks has finally made good on a months-old pledge to contribute financially to the defense of 23-year-old Bradley Manning, according to a group raising money for the imprisoned Army private suspected of providing WikiLeaks its most important U.S. releases.

But the sum, $15,100, is less than half the $50,000 WikiLeaks originally promised. It's also less than the group pledged in December, when WikiLeaks spokesman Kristinn Hrafnsson said WikiLeaks would immediately transfer $20,000 to Manning's defense fund.

...

WikiLeaks highlighted Manning's plight after his arrest, writing on Twitter, "We do not know if Mr. Manning is our source, but the U.S. military is claiming he is so we will defend [him]." In a fundraising e-mail last June, the organization said it needed more donations in part because it was "flying a legal team to Kuwait," where Manning was being held. "Any financial contributions will be of IMMEDIATE assistance." The group subsequently promised to send $50,000 to the Bradley Manning Support Network.

But while salaries were paid out to founder Julian Assange and other WikiLeaks members, the promised support to Manning failed to materialize. Assange recently received about $88,000 in retroactive salary for his work with WikiLeaks in 2010. He also recently signed a $1.5 million book deal to publish his memoir.

Loraine Reitman, a m

Assange is one of those rate people that, the more you find out about him the more loathsome he becomes.

Just read the court documents, the Guardian and New Statesman articles about him and watch the documentary I linked to. Literally everyone he convinced to trust him has turned against him.

He even shafted Manning

http://cryptome.org/0001/wikil...

A sends via PGPboard, 17 July 2010:

The recent limited financial disclosure from the Wau Holland Foundation has revealed that no European donor funds have been spent in the provision of a legal team for PFC Manning; in detention for passing documents to WIKILEAKS.

We all remember the recent emails requesting $50,000 in donations in order to hire, and fly a legal team out to Kuwait. As we speak no legal team has been provided, and no attorney provided by Wikileaks has made contact with the JAG office in Kuwait.

In addition to this, the Wau Holland financial release confirmed that there were sufficient funds available to provide immediate assistance to PFC Manning, and that they would have no objection in disbursing the funding such an initiative.

http://cryptome.org/0003/wikil...

8 December 2010

Immediately following Bradley's arrest in late June 2010, the whistle-blower website Wikileaks publicly solicited donations specifically for Bradley's legal defense expenses. In July 2010, Wikileaks pledged to contribute a "substantial amount" towards Bradley's legal defense costs. Since Bradley's selection of David Coombs as his civilian defense attorney in August 2010, the Bradley Manning Support Network has unsuccessfully attempted to facilitate the pledged Wikileaks contribution.

"We understand the difficult situation Wikileaks currently faces as the world's governments conspire to extinguish the whistle-blower website," explained Jeff Paterson, Bradley Manning Support Network steering committee member and project director of Courage to Resist (couragetoresist.org). "However, in order to meet Bradley Manning's legal defense needs, we're forced to clarify that Wikileaks has not yet made a contribution towards this effort. We certainly welcome any contribution from Wikileaks, but we need to inform our supporters that it may not be forthcoming and that their continued contributions and support are crucial."

http://www.wired.com/threatlev...

WikiLeaks has finally made good on a months-old pledge to contribute financially to the defense of 23-year-old Bradley Manning, according to a group raising money for the imprisoned Army private suspected of providing WikiLeaks its most important U.S. releases.

But the sum, $15,100, is less than half the $50,000 WikiLeaks originally promised. It's also less than the group pledged in December, when WikiLeaks spokesman Kristinn Hrafnsson said WikiLeaks would immediately transfer $20,000 to Manning's defense fund.

...

WikiLeaks highlighted Manning's plight after his arrest, writing on Twitter, "We do not know if Mr. Manning is our source, but the U.S. military is claiming he is so we will defend [him]." In a fundraising e-mail last June, the organization said it needed more donations in part because it was "flying a legal team to Kuwait," where Manning was being held. "Any financial contributions will be of IMMEDIATE assistance." The group subsequently promised to send $50,000 to the Bradley Manning Support Network.

But while salaries were paid out to founder Julian Assange and other WikiLeaks members, the promised support to Manning failed to materialize. Assange recently received about $88,000 in retroactive salary for his work with WikiLeaks in 2010. He also recently signed a $1.5 million book deal to publish his memoir.

Loraine Reitman, a m

AC re I'm not really sure what the uproar over killer drones are.

Think of it terms of US mil success in Vietnam.
Remove the refugees to camps and try and win the hearts and minds of people kept in camps.
The rest of a nation becomes an autonomous drone patrolled free fire zone.

All the good people are in camps. Only bad people move around outside camps and the autonomous drones will find them all.
A new look Second Boer War idea to sweep a country bare of everything that could give sustenance to bad people using autonomous drones rather than risking troops.

US directive 3000.09 has some of the thinking from the US about autonomous weapon systems https://cryptome.org/dodi/dodd...

Quick to unlock, yes.

There is a real risk of "gelatin fingers". There are many videos, and some reliable newspaper stories, of people replicating fingerprints very successfully with gelatin or even Play-Doh. The approach was well documented in2002, at https://cryptome.org/gummy.htm .

The Evan Doorbell tapes offer quite a treasure trove of stories, techniques, and sounds from those days.

The Esquire article probably did more harm to phreaking than anything else, IMO. Captain Crunch made a bold claim that three phreakers with blue boxes could take down the Bell System by stacking connections. Among the Evan Doorbell tapes, there are some examples of how stacking worked, and its limitations. Only a few two-wire tandem switches were actually stackable; the four-wire switches that handled the lion's share of long-distance traffic were not. Also, each extra link added also increased the noise floor to the point that signalling tones could only go so far. Evan Doorbell, in his own discussion of stacking, said that about 24 links or so was the most he could count on any of his tapes of stacks.

Crunch's hypothetical "three phreakers" might have been able to busy out a few minor trunk groups, but take down the Bell System? Not likely. Nonetheless, claims like that had to light a fire under the security department's butts.

Though it didn't come out until decades later, AT&T was no stranger to mass surveillance; their Project Greenstar system, deployed in 1964, which was meant to catch phreakers committing toll fraud. It monitored random trunks for out-of-place occurrences of 2600 Hz, and would then start recording the call in question. Ma Bell was concerned enough about its legality that it was kept top secret and never mentioned in phone fraud trials.

The _NSAKEY was discovered in Windows NT 4 in August 1999 by Andrew Fernandes of Cryptonym. It could be confirmed and reset by any hacker with a copy of NT. I did cleared mine and most of my tech colleagues did the same

https://en.wikipedia.org/wiki/...

Gates was interviews by BBC news and flout out denied its existence.

https://cryptome.org/nsakey-ms...

Most biometric scanners have poor resolution and are easily defeated with very modest resources. MythBusters did a very good episode about the ease of replicating fingerprints, and found recent scanners that could be defeated by copying a fingerprint on a laser printer and simply moistening the printout. There was also an infamous paper, available at https://cryptome.org/gummy.htm, describing more sophisticated approaches with the image transferred to gelatiin. That has never been refuted since its original publication. American police, and many security groups worldwide, collect large libraries of fingerprints that can be copied wholesale for just such intrusion.

Fingerprint scanners, which are the most common biometric device, remain quite vulnerable to targeted breakin. Fingerprints may be a handy access option, but they can't be considered robust security.

It doesn't. But there IS stuff on Slashdot that qualifies, although IMHO there's not a lot. But if you browse at -1 as I always do, you'll see it.

Arguably, the moderation system here already takes care of the problem. Users who aren't logged in won't see much if any hate speech; it almost never makes it higher than +3, and if it does then it drops below that threshold pretty quickly. So they actually have to drill down to find it - it's not immediately obvious. Users who ARE logged in are unlikely to see it if they browse at +1 or higher, (again, unless they drill down), because most of it is posted by AC's whose comments start at 0. People who browse at lower than +1 soon know what to expect and can determine if they want to see that stuff or not.

Godwin time: Mein Kampf is still available for anyone to read, but it isn't unexpectedly waved in front of anyone's face - people have to seek it out. Hate speech on Slashdot is similar to that. And this kind of speech SHOULDN'T be banned; we need to maintain an ongoing awareness that those attitudes exist and are actively shaping our world. People should be able to easily avoid most of it if they so desire, but hiding it entirely and driving it totally underground is dangerous.

Spot on, in all respects.

There's sometimes a hate-speech reply at the very front of every article here, you can sometimes see it when you view an article right after it gets posted. When there are very few replies. There haven't been any recently, but there was a time (recently) when every article had one at the very beginning.

It's usually a single-line message "gay faggots" or "gay n*ggers" or about cows. "You are all cows. Cows go moo". That sort of thing.

(There hasn't been any recently, so perhaps it was either a) a paid poster during to the elections, or b) Slashdot has a better filter.

Since it's always always a first post, I suspect it's a bot. Since some of it is complete nonsense (cows? really?), I suspect it's an anchor for forum sliding.

1) The bot ensures that the post is first, and the text ensures that it gets modded down.
2) If something appears in the discussion that the owner wants to suppress, they log in and post a reply to the invisible first post.
3) We see the reply (at +2), but not the first post. The text to be suppressed is now slipped further down the page.

As a corollary to #3 above, the poster might have several accounts and post a fake argument about spelling or grammar. It all seems above-board and legit, but the interesting bits get pushed down the page, hopefully below the fold.

And finally, I read an analysis online (with links and references) that estimated that the *maximum* number of white supremacists in the US is less than 50,000, and most of those are passive. The article (which I can't find right now) notes that only 200 people showed up at a KKK national meet. It estimates that there are less than 1000 people across the US who are the stereotypical "Banshee" style member, who actively perform hate crimes against other races.

Their exploits get amplified by the media, so we see the problem as bigger than it is.

(Am I wrong? Let's have some links.)

I think most of the hate speech comes from teens and young adults looking to rile people up. I don't think there's really a lot of white supremacy activity going on in the US any more.

Note that I did *not* say that there was no predjudice or bias, only that there is no lynching, cross burning, and such. Blacks can be around anywhere in the country without fearing for their life due to the color of their skin.

The US press and wider US intelligence community knew what the US gov and mil did to people who stayed, faced the US courts or thought they had press or gov protection.
https://cryptome.org/2013-info...

Re "prevent spying both with outside signals"
Most nations are aware of efforts like the 'Vienna Spy Stations Summer Series"
https://cryptome.org/2015/08/S...
https://cryptome.org/2015/08/S...

Re "prevent spying both with outside signals"
Most nations are aware of efforts like the 'Vienna Spy Stations Summer Series"
https://cryptome.org/2015/08/S...
https://cryptome.org/2015/08/S...

Incoming Video and Still evidence of Child Grooming

https://cryptome.org/2016/10/U...

This is why Ecuador and not the US or UK cut him off.

Look who is making the first moves, the US and UK.
Trying to stop real coverage by taking the tools of the trade away from journalists and whistleblowers.
What could no be done in US courts to whistleblowers is now been done to the messengers globally.
https://cryptome.org/2013-info...
The tyrannical and chilling side is now out in the open.

The huge worry for the US is a generation of empowered whistleblowers with access. Staff cant use any of the official chain of command to get legal issues to the authorities.
Whistleblowers https://cryptome.org/2013-info... Staff know what happens after people raise internal mil/gov/contractor legal questions within the US.
A walk out to the press is the only still protected way to get the message out. Physically handing over material so no digital trail exists if both sides are cell phone aware when making the exchange. The press now finally know not to network any of material handed over or when drafting their reports.
The US constitution and laws are very protective when reporting mil, gov and contractor issues. Legal issues cant be protected behind color of law secrecy clauses, findings, letters.
So the US gov now has to review all past clearances and profile who might have walked out in bulk to the waiting US press. Or use the buddy system to double the size of big gov. Or secure the lobbyists, consultants, friends, think tank staff, lawyers, "dual" citizens from access.
All that has huge political funding and party access issues so its better to blame the some other nation rather than try to secure the US gov.

Re "What exactly will the government prevent?"
The idea is to stop what happened in France with networking.
https://en.wikipedia.org/wiki/...
"... in 1986, French university students coordinated a national strike using Minitel, demonstrating an early use of digital communication devices for participatory technopolitical ends."
Re 'It's difficult to stop mobs although the police can arrive in force before the mob swells in size and commitment."
The US view is to find and stop the charismatic or photogenic leadership before any mob can ever form.
Re "We've seen that sort of policing before, in Ireland."
The UK had total mastery of all communication within Ireland and a good overview of all political/funding/hardware support from the USA.
https://cryptome.org/jya/gchq-...
Once into any nations phone networks, prediction becomes easy.
The tracking of individuals would break into any cell structure and allow then protected informants to rise up the ranks.

Whistleblowers faced few options within the USA. https://cryptome.org/2013-info...

Why must so many geeks be filthy bigots? Every article is littered with racist and otherwise bigoted garbage. It's a shame that Slashdot is morphing into Stormfront.

It's an anchor for forum sliding.

They use bots to get these comments in at the very top, knowing that they'll be voted down to -1.

Then when an inconvenient or embarrassing discussion happens that they want to bury, they log into another account and respond to their own topmost comment, and log into further accounts to upvote the new comment.

The end result is that the inconvenient or embarrassing discussion gets pushed down the page.

They know that few people read past the first couple of comment blocks, so they use this technique to adjust the conversation to their own benefit.

Check out Correct The Record for info, and note that HRC spent $1 million on these sorts of techniques.

The contractors and brands that give to state and federal politicians? That ensure top paying local security, think tank, educational, mil and gov jobs stay in fly over states.
Or the whistleblowing that exposed torture, collect it all domestic spying or rubber stamp foreign collection thats really a cover for funding total domestic collection for decades.
https://cryptome.org/2013-info...
Freedom of the press or party political donations? Think of the local contractor jobs, all the new 2 person teams now in work to support domestic collection.
A statement to the world about this generations privacy or contractors giving more donations?
Donations vs privacy and working encryption for the first time ever.
Donations.

Point to a real technology and describe an actual scenario where the Russian military benefits, and then explain how the Russian benefit A) is a serious NATO concern, and B) wasn't going to happen anyway sooner rather than later.

Challenge accepted.

You're misdirecting the reader away from the important point. It's #17 in the Rules of disinformation.

The real point is that corporate cash flowed to the politician in return for favours.

A lot of the analysis of HRC as SoS shows that these decisions benefited companies while at the same time made the country less safe (by enriching and/or strengthening a potential enemy), did not benefit the people of the US in any way, and gave Hillary more cash to work with.

The point was cash => politician => favors, not the details of any one deal.

Which was the actual point.

Stop the Bullshit.

We need tor. Tor needs developers. Tor needs developers, which work together.
The best case for any agency is when the developers distrust each other and work against each other.
Whatever Appelbaum did or did not do, it's not in our interest, that this stops the work for tor.

Read this: https://cryptome.org/2012/07/g...
Really read this. This list contains some of the things you're seeing here. How to disturb groups and prevent them from working efficicently, how to get them to fight each other instead of fighting their enemy.

Keep your personal conflicts personal and continue to work against the threats we're facing.

65535 @ December 21, 2013 4:38 AM

https://www.schneier.com/blog/...

@ Jackson

Your concern about the Cryptome report does raise serious questions. When carefully read the Cryptome report touches on the subject of finger printing TOR users via a BT backdoor.

The Crytome report also speculates that major CA's instantly transmits copies of clients SSL/TLS Certificates to the NSA and possibly GCHQ when purchased. This is quite troubling.

I will note that CSO acknowledges that:

'On the issue of the USDOD IP address referenced by the paper's authors, that block of addresses has been used by many firms over the years. It's a valuable piece of IPv4 real-estate that is often enabled internally by an ISP after they've gotten permission from the Defense Information Systems Agency (the part of the USDOD that manages networks and infrastructure).

Just last year, Sprint was using IPs internally from that block for their mobile network. So the fact that BT would be using it too isn't a shock to network engineers who have seen the paper.

'In short, one security expert told CSO, the usage of 30.x.x.x /8 doesn't really imply NSA monitoring at all. In fact, he added, "If you want a non-routable IP that won't break when using it, [the] DOD is your best choice."'

http://www.csoonline.com/artic...

But the Cryptome report goes much farther. It indicates that a simple ping test can detect the backdoor. Next you can telnet into the modem and see the actual configuration and un-hack the device (assuming altering the firmware doesn't violate BT TOS agreement - causing your service to terminated).

http://cryptome.org/2013/12/Fu...

[Cryptome pdf page 39]

"Easy Confirmation

"Step 1.

"Remove Power from the modem and disconnect the telephone line.

"Step 2.

"On your PC (assumed Linux) add an IP address 192.168.1.100 i.e:

#
ifconfig eth0:1 192.168.1.100 up

"Step 3.

"Start to ping 192.168.1.1 from your PC i.e:
#
"ping 192.168.1.1

"Step 4.

"Connect a network cable to LAN1

"Step 5.

"Plug-in the power cable to the modem and wait for about 30 seconds

"for the device to boot, you will then notice:

"64 bytes from 192.168.1.1: icmp_seq=115 ttl=64 time=0.923 ms
"64 bytes from 192.168.1.1: icmp_seq=116 ttl=64 time=0.492 ms
"64 bytes from 192.168.1.1: icmp_seq=117 ttl=64 time=0.514 ms

"You may notice up to ten responses, then it will stop.

"What is happening is the internal Linux kernel boots [inside of the modem], the start up scripts then configure the internal and virtual interfaces and then turn on the hidden firewall at which point the pings stop responding.

"In other words, there is a short window (3-10 seconds) between when the kernel boots and the hidden firewall kicks in.

"You will not be able to detect any other signs of the hidden network without actually logging into the modem, which is explained in the next section."

The second step is telneting into the BT modem/router is show on page 40 to 44. The "un-hack" is on page 45 forward.

Other notable Cryptome pages include:

"All SSL Certificates Compromised in Real-Time" page 22

"Theft of private keys" page 24

"Tor User/Content Discovery" page 26

@ ron41, see TOR discovery from the Cryptome link. There is a fingerprinting method to determine TOR users.

"Covert International Traffic Routing" page 27

"Secure your end-points" page 30

"I'm an American, does this apply to me" page 35

@ *others who care, the paper indicates that NSA is using the very same technique and can discover TOR users (if this is true it is troubling).

65535 @ December 21, 2013 4:38 AM

https://www.schneier.com/blog/...

@ Jackson

Your concern about the Cryptome report does raise serious questions. When carefully read the Cryptome report touches on the subject of finger printing TOR users via a BT backdoor.

The Crytome report also speculates that major CA's instantly transmits copies of clients SSL/TLS Certificates to the NSA and possibly GCHQ when purchased. This is quite troubling.

I will note that CSO acknowledges that:

'On the issue of the USDOD IP address referenced by the paper's authors, that block of addresses has been used by many firms over the years. It's a valuable piece of IPv4 real-estate that is often enabled internally by an ISP after they've gotten permission from the Defense Information Systems Agency (the part of the USDOD that manages networks and infrastructure).

Just last year, Sprint was using IPs internally from that block for their mobile network. So the fact that BT would be using it too isn't a shock to network engineers who have seen the paper.

'In short, one security expert told CSO, the usage of 30.x.x.x /8 doesn't really imply NSA monitoring at all. In fact, he added, "If you want a non-routable IP that won't break when using it, [the] DOD is your best choice."'

http://www.csoonline.com/artic...

But the Cryptome report goes much farther. It indicates that a simple ping test can detect the backdoor. Next you can telnet into the modem and see the actual configuration and un-hack the device (assuming altering the firmware doesn't violate BT TOS agreement - causing your service to terminated).

http://cryptome.org/2013/12/Fu...

[Cryptome pdf page 39]

"Easy Confirmation

"Step 1.

"Remove Power from the modem and disconnect the telephone line.

"Step 2.

"On your PC (assumed Linux) add an IP address 192.168.1.100 i.e:

#
ifconfig eth0:1 192.168.1.100 up

"Step 3.

"Start to ping 192.168.1.1 from your PC i.e:
#
"ping 192.168.1.1

"Step 4.

"Connect a network cable to LAN1

"Step 5.

"Plug-in the power cable to the modem and wait for about 30 seconds

"for the device to boot, you will then notice:

"64 bytes from 192.168.1.1: icmp_seq=115 ttl=64 time=0.923 ms
"64 bytes from 192.168.1.1: icmp_seq=116 ttl=64 time=0.492 ms
"64 bytes from 192.168.1.1: icmp_seq=117 ttl=64 time=0.514 ms

"You may notice up to ten responses, then it will stop.

"What is happening is the internal Linux kernel boots [inside of the modem], the start up scripts then configure the internal and virtual interfaces and then turn on the hidden firewall at which point the pings stop responding.

"In other words, there is a short window (3-10 seconds) between when the kernel boots and the hidden firewall kicks in.

"You will not be able to detect any other signs of the hidden network without actually logging into the modem, which is explained in the next section."

The second step is telneting into the BT modem/router is show on page 40 to 44. The "un-hack" is on page 45 forward.

Other notable Cryptome pages include:

"All SSL Certificates Compromised in Real-Time" page 22

"Theft of private keys" page 24

"Tor User/Content Discovery" page 26

@ ron41, see TOR discovery from the Cryptome link. There is a fingerprinting method to determine TOR users.

"Covert International Traffic Routing" page 27

"Secure your end-points" page 30

"I'm an American, does this apply to me" page 35

@ *others who care, the paper indicates that NSA is using the very same technique and can discover TOR users (if this is true it is troubling).

65535 â December 21, 2013 4:38 AM

https://www.schneier.com/blog/...

@ Jackson

Your concern about the Cryptome report does raise serious questions. When carefully read the Cryptome report touches on the subject of finger printing TOR users via a BT backdoor.

The Crytome report also speculates that major CA's instantly transmits copies of clients SSL/TLS Certificates to the NSA and possibly GCHQ when purchased. This is quite troubling.

I will note that CSO acknowledges that:

'On the issue of the USDOD IP address referenced by the paper's authors, that block of addresses has been used by many firms over the years. It's a valuable piece of IPv4 real-estate that is often enabled internally by an ISP after they've gotten permission from the Defense Information Systems Agency (the part of the USDOD that manages networks and infrastructure).

Just last year, Sprint was using IPs internally from that block for their mobile network. So the fact that BT would be using it too isn't a shock to network engineers who have seen the paper.

'In short, one security expert told CSO, the usage of 30.x.x.x /8 doesn't really imply NSA monitoring at all. In fact, he added, "If you want a non-routable IP that won't break when using it, [the] DOD is your best choice."'

http://www.csoonline.com/artic...

But the Cryptome report goes much farther. It indicates that a simple ping test can detect the backdoor. Next you can telnet into the modem and see the actual configuration and un-hack the device (assuming altering the firmware doesn't violate BT TOS agreement - causing your service to terminated).

http://cryptome.org/2013/12/Fu...

[Cryptome pdf page 39]

"Easy Confirmation

"Step 1.

"Remove Power from the modem and disconnect the telephone line.

"Step 2.

"On your PC (assumed Linux) add an IP address 192.168.1.100 i.e:

#
ifconfig eth0:1 192.168.1.100 up

"Step 3.

"Start to ping 192.168.1.1 from your PC i.e:
#
"ping 192.168.1.1

"Step 4.

"Connect a network cable to LAN1

"Step 5.

"Plug-in the power cable to the modem and wait for about 30 seconds

"for the device to boot, you will then notice:

"64 bytes from 192.168.1.1: icmp_seq=115 ttl=64 time=0.923 ms
"64 bytes from 192.168.1.1: icmp_seq=116 ttl=64 time=0.492 ms
"64 bytes from 192.168.1.1: icmp_seq=117 ttl=64 time=0.514 ms

"You may notice up to ten responses, then it will stop.

"What is happening is the internal Linux kernel boots [inside of the modem], the start up scripts then configure the internal and virtual interfaces and then turn on the hidden firewall at which point the pings stop responding.

"In other words, there is a short window (3-10 seconds) between when the kernel boots and the hidden firewall kicks in.

"You will not be able to detect any other signs of the hidden network without actually logging into the modem, which is explained in the next section."

The second step is telneting into the BT modem/router is show on page 40 to 44. The "un-hack" is on page 45 forward.

Other notable Cryptome pages include:

"All SSL Certificates Compromised in Real-Time" page 22

"Theft of private keys" page 24

"Tor User/Content Discovery" page 26

@ ron41, see TOR discovery from the Cryptome link. There is a fingerprinting method to determine TOR users.

"Covert International Traffic Routing" page 27

"Secure your end-points" page 30

"I'm an American, does this apply to me" page 35

@ *others who care, the paper indicates that NSA is using the very same technique and can discover TOR users (if this is true it is troubling).

65535 â December 21, 2013 4:38 AM

https://www.schneier.com/blog/...

@ Jackson

Your concern about the Cryptome report does raise serious questions. When carefully read the Cryptome report touches on the subject of finger printing TOR users via a BT backdoor.

The Crytome report also speculates that major CA's instantly transmits copies of clients SSL/TLS Certificates to the NSA and possibly GCHQ when purchased. This is quite troubling.

I will note that CSO acknowledges that:

'On the issue of the USDOD IP address referenced by the paper's authors, that block of addresses has been used by many firms over the years. It's a valuable piece of IPv4 real-estate that is often enabled internally by an ISP after they've gotten permission from the Defense Information Systems Agency (the part of the USDOD that manages networks and infrastructure).
Just last year, Sprint was using IPs internally from that block for their mobile network. So the fact that BT would be using it too isn't a shock to network engineers who have seen the paper.

'In short, one security expert told CSO, the usage of 30.x.x.x /8 doesn't really imply NSA monitoring at all. In fact, he added, "If you want a non-routable IP that won't break when using it, [the] DOD is your best choice."'

http://www.csoonline.com/artic...

But the Cryptome report goes much farther. It indicates that a simple ping test can detect the backdoor. Next you can telnet into the modem and see the actual configuration and un-hack the device (assuming altering the firmware doesn't violate BT TOS agreement - causing your service to terminated).

http://cryptome.org/2013/12/Fu...

[Cryptome pdf page 39]

"Easy Confirmation

"Step 1.

"Remove Power from the modem and disconnect the telephone line.

"Step 2.

"On your PC (assumed Linux) add an IP address 192.168.1.100 i.e:

#
ifconfig eth0:1 192.168.1.100 up

"Step 3.

"Start to ping 192.168.1.1 from your PC i.e:
#
"ping 192.168.1.1

"Step 4.

"Connect a network cable to LAN1

"Step 5.

"Plug-in the power cable to the modem and wait for about 30 seconds

"for the device to boot, you will then notice:

"64 bytes from 192.168.1.1: icmp_seq=115 ttl=64 time=0.923 ms
"64 bytes from 192.168.1.1: icmp_seq=116 ttl=64 time=0.492 ms
"64 bytes from 192.168.1.1: icmp_seq=117 ttl=64 time=0.514 ms

"You may notice up to ten responses, then it will stop.

"What is happening is the internal Linux kernel boots [inside of the modem], the start up scripts then configure the internal and virtual interfaces and then turn on the hidden firewall at which point the pings stop responding.

"In other words, there is a short window (3-10 seconds) between when the kernel boots and the hidden firewall kicks in.

"You will not be able to detect any other signs of the hidden network without actually logging into the modem, which is explained in the next section."

The second step is telneting into the BT modem/router is show on page 40 to 44. The "un-hack" is on page 45 forward.

Other notable Cryptome pages include:

"All SSL Certificates Compromised in Real-Time" page 22

"Theft of private keys" page 24

"Tor User/Content Discovery" page 26

@ ron41, see TOR discovery from the Cryptome link. There is a fingerprinting method to determine TOR users.

"Covert International Traffic Routing" page 27

"Secure your end-points" page 30

"I'm an American, does this apply to me" page 35

@ *others who care, the paper indicates that NSA is using the very same technique and can discover TOR users (if this is true it is troubling).

How the Dominance of Microsoft's Products Poses a Risk to Security

Cryptome phrased this nicely a few years ago:

Due to the basic design of the Internet (and other means of communication) there is only the illusion of anonymity, privacy or security on the Internet, the world's greatest and easiest spy machine (aka hacker-breeding-insecurity nirvana) facilitated by user-funded RFID-chipped personal devices toted everywhere all the time to report on exactly what who when where and how citizen-gawkers-hawkers are deliriously fingering their Venn diagram of interests into the gaping maw of aggregators (aka data thieves and their credentialled-trustworthy fronts) fattening the spy contractors' paranoia.

Some more interesting timing: Apparently Jake's last day was two whole weeks ago, May 25th, and he was officially shown the door on the 27th. I'm not sure if it's true or not, but it's certainly interesting.

And the police fingerprints are still good enough to be used to defeat the best fingerprint scanners. There's been no noticeable improvement in the technology since the paper on defeating it was published in 2002.

                https://cryptome.org/gummy.htm

The crack was confirmed by MythBusters in 2011.

                https://www.youtube.com/watch?...

There has been no basic change in the technology. Fingerprint scanners are still trivially beaten.

You are a shill, trying to associate the decades long venerable industry of weather manipulation with "crazy tinfoil hat conspiracies"?
Here's some undeniable video of actual weather engineering.
  Here you are again, on another site, trying to "poison the well". There are several places slight modifications to your gibberish have been posted:
From the link:

you call this ‘weather’?

continue to add immeasurable amounts of MISinformation, rhetoric & fluff, & there you have IT? that’s US? thou shalt not oh forget it. fake weather (censored?), fake money, fake god(s), what’s next? seeing as we (have been told that) came from monkeys, the only possible clue we would have to anything being out of order, we would get from the weather. that, & all the monkeys tipping over/exploding around US.
the search continues;
google.com/search?hl=en&source=hp&q=weather+manipulation
google.com/search?hl=en&source=hp&q=bush+cheney+wolfowitz+rumsfeld+wmd+oil+freemason+blair+obama+weather+authors

meanwhile (as it may take a while longer to finish wrecking this place); the corepirate nazi illuminati

Since shills are out in force, this should be required reading (esp. in election years): The Gentelperson's Guide to Forum Spies.

The apple brief is available here: https://cryptome.org/2016/02/u...

Ted Olson (solicitor general to the United States under Bush) is on-brief.

The good news is the whistleblowing material reached the public and press in full. Whistleblowing material and full public release.
https://cryptome.org/2013-info...

Long term what could happen?
The prospect of Sweden doing a "temporary surrender" to the US and its secret grand jury before returning to Sweden again.
"Julian Assange: where does he go from here?" (September 12, 2015)
http://www.theaustralian.com.a...
"They admit that the grand jury is continuing. "
"Don't lose sight of why the US is out to get Julian Assange "
http://www.theguardian.com/com...
"There are specific risks in Sweden – for example, its fast-track "temporary surrender" extradition agreement it has with the US. "
Revealed: US plans to charge Assange
http://www.smh.com.au/technolo...
"... the existence of a ''temporary surrender'' mechanism that could allow Mr Assange to be extradited from Sweden to the US."

The other history is that of József Mindszenty
"...political asylum by the United States embassy in Budapest, where Mindszenty lived for the next fifteen years"
"Mindszenty lived there for the next 15 years, unable to leave the grounds"

This might be worth a read before selecting transformations. CNSA-Suite-and-Quantum-Computing-FAQ.pdf

Cryptome has an interesting list https://cryptome.org/2013-info...
Note the backgrounds to Daniel Ellsberg, Sibel Edmonds, John Kiriakou, Thomas Drake, J. Kirk Wiebe, William Binney, Edward Snowden.

As to the ".. rendering such Byzantine cover-ups far more likely to fail."
What has failed for the CIA?
United States President's Commission on CIA Activities within the United States in the mid 1970's went fine even after the MKUltra news https://en.wikipedia.org/wiki/...
Doctors and medics get to stay in their professions
CIA medics monitored brutal interrogation tactics (December 12, 2014)
http://www.pbs.org/newshour/ru...
The public will even take in a policy of "Hacked federal files couldn't be encrypted because government computers are too old" (2015/06/16)
http://www.latimes.com/nation/...

As far as passible the US seems able to close ranks around its medical, nuclear, chemical, biological contractors and workers but seems to allow issues about signals intelligence, digital files and the policy of torture to exist in the wider press.
Or the results of Operation Paperclip https://en.wikipedia.org/wiki/...
So the US Byzantine cover-ups works. The US press only seems to find a few people every generation on a limited set of topics.

A public timeline can be found in the "Hearings Before The Select Committee To Study Governmental Operations With Respect To Intelligence Activities Of The United States Senate Ninety-four Congress
First Session Volume 5 October 29 And November 6, 1975
The National Security Agency And Fourth Amendment Rights
https://cryptome.org/nsa-4th.h...
".. 1952 acted to reorganize and strengthen communications intelligence activities. He issued in October 1952 .. "
"... The Secretary of Defense, pursuant to the congressional authority delegated to him in section 133(d) of title 10 of the United States Code, acted to establish the National Security Agency. "
MINARET is mentioned a few times.

Whistleblowing https://cryptome.org/2013-info...
A few from within the CIA did speak out on illegal torture. They faced prison for telling the truth about illegal torture, not the full protection of US whistleblowing laws.

I think you're confused.

People who are on our side, whatever side that may be, never rape. If they're charged with rapes, it's due to lying sluts making fake charges due to political motives.
People who are against us however are never faced with false rape accusations. They're rapists, plain and simple. Even if they haven't been charged with rape.

Please keep these matters straight.

Also: It's easy to forget, but remember: rapists look like creepy guys who would jump out of the bushes with a knife. They never look like upstanding members of their community, and they never do things in their professional life that one can admire. Their whole life is dedicated to the pursuit of Rape and General Evil. We've all seen movies and TV shows, right? That's how rapists are in the real world too, because Hollywood is famous for accurate presentations.

Lastly: It's unfair to mention anything about Assange's past, so no mentioning his I am a god to women comments, his womens' brains can't do math comments, the accusations from whistleblowers working with him of misogyny and aggressive sexual behavior, accusations of cyberstalking a teenager before he got famous, his stopping an interview to oggle some pre-teens, or about 50 other things. Let's stick to the issues at hand: What a great hero he is! So kudos to him for his brave evasion of evil injustice!

I think you're confused.

People who are on our side, whatever side that may be, never rape. If they're charged with rapes, it's due to lying sluts making fake charges due to political motives.
People who are against us however are never faced with false rape accusations. They're rapists, plain and simple. Even if they haven't been charged with rape.

Please keep these matters straight.

Also: It's easy to forget, but remember: rapists look like creepy guys who would jump out of the bushes with a knife. They never look like upstanding members of their community, and they never do things in their professional life that one can admire. Their whole life is dedicated to the pursuit of Rape and General Evil. We've all seen movies and TV shows, right? That's how rapists are in the real world too, because Hollywood is famous for accurate presentations.

Lastly: It's unfair to mention anything about Assange's past, so no mentioning his I am a god to women comments, his womens' brains can't do math comments, the accusations from whistleblowers working with him of misogyny and aggressive sexual behavior, accusations of cyberstalking a teenager before he got famous, his stopping an interview to oggle some pre-teens, or about 50 other things. Let's stick to the issues at hand: What a great hero he is! So kudos to him for his brave evasion of evil injustice!

If it is, please inform me so I can avoid jurisdictions that actually make KNOWLEDGE illegal.

How about the US government?

Assassination politics.

http://cryptome.org/ap.htm

Re "I'm sure there are much large potential savings in the defense budget, so why waste our limited time and attention on something so small, proportionally speaking."
The US seems fixated on moving data from satellite to satellite avoiding parts of the world and having to add extensive encryption to its own bespoke satellites. Data flow was the key from Australia, Japan, UK, Slivermine South Africa and other interesting locations.
The NSA and GCHQ seemed to distrust all other methods and hoped to stay ahead of the game buying ever more for the flow of gov/mil data.
The private sector soon learned of this need and set prices to match.
Why the interest? It shows the mind set of the US and UK going back decades vs a Russia or China who could only try to secure their networks or use http://cryptome.org/eyeball/ss...
The High Frontier Broadcast: 02/05/2005 http://www.abc.net.au/4corners...
has a transcript http://www.abc.net.au/4corners... thats suggests some of the US gov spending on communications in the private sector.

For that, NT 3.1 is the most significant Windows release ever imo.

For that, NT 3.51 is the most stable Windows release ever imo that didn't include the NSA_KEY.

There, FTFY...

ref: http://cryptome.org/nsakey-ms-...

My dear friend, you do not understand how these things work.

You work at NSA, you are always using the latest, newest, biggest, baddest, sweetest technology ever devised by men. You literally have computer companies begging you to buy their stuff. For a lot of these people (heck, that may even include me) that is motivation enough.

AND, if you are discreet about it, you can even be privy to potentially very lucrative a lot of state secrets. Or even personal secrets, who knows?. Obviously, if Snowden gave us something, it is the knowledge that NSA is not very good at information compartmentalization...

But here is the kicker: if you ever decide to leave the NSA, for retirement or otherwise, the private sector (at least the US private sector) will greet you with open arms and pay you a sh*tload of money to work as a consultant or senior manager. And we are talking about a SH*TLOAD of money, conflict of interests be damned. You are now one of the big boys, kid, enjoy your (semi-)retirement.

No need to betray US interests, no need to reveal super secret information: you are NSA. You are above the law. Just leave your morals at the door, please.