Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - kmfkewm

Pages: 1 ... 189 190 [191] 192 193 ... 249
2851
Off topic / Re: What do Americans think of Great Britain?
« on: May 16, 2012, 01:19 pm »
I think that Great Britain is worse than USA in several aspects. Surveillance obsessed, the media is full of extremely blatant propaganda, etc. GB takes these things even further than the USA does. I don't get quite the same Christian fundamentalist vibe from GB as I do from the USA though, and GB seems less hell bent on transforming the entire world to be in line with its moral crusades, although that is probably largely because USA works ultra over time at that.

I see GB as a modern era fascist police state and the USA as a modernized, slightly watered down Christian version of radical Islamic countries.

2852
Security / Re: $10,000 is trigger for US financial institutions
« on: May 16, 2012, 08:42 am »
A thread asking this question was locked on the grounds that it would reveal information that only vendors need to know

http://dkn255hz262ypmii.onion/index.php?topic=23271.0

The point of this post is to point out that it is stupid to lock such a thread for many reasons, one being that the information is pretty much common knowledge.

2853
Security / Re: Bitcoin Funded Debit Cards (Forbes)
« on: May 16, 2012, 08:41 am »
There are still numerous underground bitcoin loadable debit cards and I think some more mainstream ones too. If they require ID who cares, you can get a fake ID and utility bill and have the card shipped to some random address that you put on each.

2854
Security / $10,000 is trigger for US financial institutions
« on: May 16, 2012, 08:26 am »
anything  $10,000 and over requires a  report to be filed

keeping information like this exclusive to your secret vendors forum that is undoubtedly as infiltrated by LE as the entire public forum is just silly, you can look this shit up on Google stop keeping information from people. If a vendors packaging method can't stand being known by LE then that vendor is fucked up the ass because LE can order from them in the first place. Security by obscurity is stupid and its counter productive and its insane to think that LE can't get an account on the vendors only page considering vendor accounts are up for sale, you are just keeping this information from everyone else.

SR gets more an more restrictive by the day, how can an Agorist free market forum be so damn strict and quick to stifle conversations

2855
Security / Re: GPG, do i need it?
« on: May 13, 2012, 01:53 pm »
Quote
Certainly quantum computers are a possibility -- that is one reason what AES was designed with 256-bit keys. The idea was that Schorr's algorithm calls for a quantum computer to essentially halve the key size in bits, so that a 128-bit key becomes effectively as hard to crack as a 64-bit. Applying the same logic to a 256-bit key, yields an effective strength of 128-bits, which is still infeasible to break, at least currently.

You are confusing Shors and Grovers algorithm. Shors algorithms is for cracking vulnerable asymmetric encryption algorithms, it is able to do so extremely quickly with a sufficient amount of qubits. Grovers algorithm is for cutting symmetric algorithm key strength in half, making 128 bit encryption as strong as 64 bit, and 256 as strong as 128. Using 256 bit symmetric algorithms is considered quantum resistant, an RSA key with comparable quantum resistance would be too big to fit on most hard disks according to one paper I read on the subject.

2856
Security / Re: GPG, do i need it?
« on: May 13, 2012, 01:50 pm »
At the moment GPG is secure, but quantum computing is coming and they will be able to break our current level of cryptography.  It's just like WEPs implementation of the RC4 cipher was secure for a while or the ages(literally ages ago when Rome was an empire) old Cesar cipher was very secure. Start reading into GPG and learn how to beef up your key size and use better hashes that SHA1.

[cryptography like all of computer security is a cat and mouse game, you figure out how to secure something better then they figure out how to attack your new method and vice versa]

Barring some unforeseen breakthrough, realistically, I don't think quantum computing is going to be a real threat for at least a few decades. Even then, its use is primarily going to be restricted to intelligence agencies -- I can't see law enforcement using such technology any time soon. If and when quantum cryptography becomes a reality, then the real danger is going to be to the economic infrastructure, as all classical methods of protecting data will essentially be broken.

I don't see anything on the horizon until much closer to mid-century.

Guru

Quantum computing is a reality today, it is just a question of how many qubits can they stabilize. They were at 128 last I checked. Once they get into the thousands they can start pwning GPG. I hear that they will likely be able to make a significant amount of progress in a relatively short amount of time, and that the rate of stabilized qubits will rapidly increase. There is a quantum resistant asymmetric encryption technique that seems to be getting a lot of attention recently called multivariate public key cryptography. Using larger key sizes increases the number os stabilized qubits required, but that wont matter when they start exponentially increasing the number of qubits they can stabilize.

2857
Very small amounts are rarely intercepted. Letters are far safer than packages, and smaller packages are far safer than larger packages. Customs and USPI are not looking as hard at things that are clearly not large shipments of drugs or money or bombs. Sending slower helps a lot as well, packages are scrutinized to an extent that correlates positively with shipping speed and package weight. At the extreme safety levels for each of these, interceptions that are not based on intelligence are extremely rare, even in places like Australia. This might change to an extent as customs and USPI learn more about swarming, they have already recognized that traffickers intentionally break shipments up into tiny groups of less weight to increase the chance of getting large amounts through customs, so they might try to catch that more. But they are probably also limited by the amount of the mail, if a letter doesn't stick out at all from the average type, and dogs can't hit on what is inside of it or it is perfectly vacuum sealed with no trace contamination, I think they will have a hell of a time to detect it when it is in its initial inspection to know that they want to do more time consuming testing on it. 

2858
Security / Re: Anonymity and Privacy, not the same thing
« on: May 13, 2012, 01:16 pm »
nothing past your router will see the MAC

2859
Security / Re: Anonymity and Privacy, not the same thing
« on: May 13, 2012, 12:45 pm »
.onion is encrypted client to server so exit nodes can not spy on plaintext.

2860
Security / Re: GPG for Ubuntu
« on: May 13, 2012, 12:43 pm »
here is what I have so far, it only does key generation though. I had it all finished and then my VM fucked up and I had to start over and this is how far back I am done (minus nice formatting too). Will finish it again  though, I just wanted to play with TK.

Code: [Select]
require 'tk'
require 'open3'
require 'securerandom'


root = TkRoot.new do 
minsize(600,700)
maxsize(600,700)
end

root.title = "Ruby GPG"


notebook = Tk::Tile::Notebook.new(root) do
  place('height' => 700, 'width' => 600, 'x' => 0, 'y' => 0)
end





frame_one = TkFrame.new(notebook)
frame_two = TkFrame.new(notebook)
frame_three = TkFrame.new(notebook)


notebook.add frame_one, :text => 'Generate Keys'
notebook.add frame_two, :text => 'Manage Contacts'
notebook.add frame_three, :text => 'Encryption / Decryption Operations'



perform_operation_button = TkButton.new(frame_three) do
  text "Generate Account"
  borderwidth 2
  state "normal"
  font TkFont.new('10')
  foreground  "black"
  background "grey"
  activebackground "#bfb7ae"
  relief      "groove"
  command (proc {generate_key_pair})
  place('x' => 0, 'y' => 0)
end

@@crypto_io = TkText.new(frame_three) do
self.exportselection = false
self.borderwidth = 0
self.background = "grey"
place('height'=> 350,'width' => 600,'x' => 0, 'y' => 327)
end


@@operation_selection = TkListbox.new(frame_three) do
self.selectmode = "browse"
self.selectbackground = "#c7b6b8"
self.background = "grey"
insert 0, "Decryption", "Asymmetric Encryption", "Symmetric Encryption", "Sign", "Verify Signature"
place('height'=> 80,'width' => 200,'x' => 75, 'y' => 100)               
end

@@operation_selection.selection_set 0

@@embed_key_fingerprints_selection = TkListbox.new(frame_three) do
self.exportselection = false
self.selectmode = "browse"
self.selectbackground = "#c7b6b8"
self.background = "grey"
insert 0, "Show recipient key", "Hide recipient key"
               
end

@@embed_key_fingerprints_selection.selection_set 0




@@pseudonym_entry = TkEntry.new(frame_one) do
     place('height'=> 25,'width' => 250,'x' => 50, 'y' => 155)
     self.value = "Pseudonym"
end
@@pseudonym_entry.background = "grey"


@@password_entry1 = TkEntry.new(frame_one) do
     show '*'
     place('height'=> 25,'width' => 250,'x' => 50, 'y' => 185) 
     self.value = "starslol"
end
@@password_entry1.background = "grey"


@@password_entry2 = TkEntry.new(frame_one) do
     show '*'
     place('height'=> 25,'width' => 250,'x' => 50, 'y' => 215)
     self.value = "password"
end

@@password_entry2.background = "grey"

@@email_entry = TkEntry.new(frame_one) do
     place('height'=> 25,'width' => 250,'x' => 50, 'y' => 240)
     self.value = "valid format potentially made up E-mail"
     
end

@@email_entry.background = "grey"





generate_keys_button = TkButton.new(frame_one) do
  text "Generate Key pair"
  borderwidth 2
  state "normal"
  font TkFont.new('10')
  foreground  "black"
  background "grey"
  activebackground "#bfb7ae"
  relief      "groove"
  command (proc {generate_key_pair})
  place('x' => 80, 'y' => 275)
end





@@key_type = TkListbox.new(frame_one) do
self.selectmode = "browse"
self.selectbackground = "#c7b6b8"
self.background = "grey"
insert 0, "RSA and RSA", "DSA and El-Gamal"
place('height'=> 80,'width' => 200,'x' => 340, 'y' => 240)               
end

@@key_type.selection_set 0

@@key_strength = TkListbox.new(frame_one) do
self.exportselection = false
self.selectmode = "browse"
self.selectbackground = "#c7b6b8"
self.background = "grey"
insert 0, "1024", "2048", "3072", "4096"
place('height'=> 80,'width' => 200,'x' => 340, 'y' => 155)               
end

@@key_strength.selection_set 3



key_generation_explanation = TkText.new(frame_one) do
self.exportselection = false
self.borderwidth = 0
self.background = "grey"
place('height'=> 150,'width' => 600,'x' => 0, 'y' => 0)



self.value = "
To generate a new key you are required to provide the following information. You may choose between RSA/RSA and DSA/ElGamal, both are secure. You also can select a key size. The larger the key size, the more securely encrypted messages sent to you will be 1,024 is not considered to be secure for much longer. 2,046 is the minimum suggested key  size, however 4,096 bit keys offer significantly more protection from some realistic attacks. The number of qubits required to break susceptilble asymmetric algorithms grows with the number or bits in the key. After you have filled out the relevant information, click the generate keypair button to begin the process of key generation. "

end


key_generation_explanation.state = "disabled"

@@finished_key = TkText.new(frame_one) do
self.exportselection = false
self.borderwidth = 0
self.background = "grey"
place('height'=> 350,'width' => 600,'x' => 0, 'y' => 327)
end


def generate_key_pair

if @@password_entry1.value != @@password_entry2.value then

passwords_must_match = Tk.messageBox(
  'type'    => "ok", 
  'icon'    => "warning",
  'title'   => "Warning!",
  'message' => "The provided passwords do not match!"
)

else if @@pseudonym_entry.value.length < 5 then

pseudonym_too_short = Tk.messageBox(
  'type'    => "ok", 
  'icon'    => "warning",
  'title'   => "Warning!",
  'message' => "The GPG base engine requires your pseudonym to be at least five characters long"
)
elsif @@password_entry1.value.length < 7 then

password_too_short = Tk.messageBox(
  'type'    => "ok", 
  'icon'    => "warning",
  'title'   => "Warning!",
  'message' => "Your password must be at least eight characters long"
)
elsif not @@email_entry.value.to_s.include?("@") then
invalid_email = Tk.messageBox(
  'type'    => "ok", 
  'icon'    => "warning",
  'title'   => "Warning!",
  'message' => "This does not appear to be a valid E-mail address (gpg enforced)"
)
else

starting = `gpg --list-keys`.bytesize

stdin, stderr = Open3.popen3('gpg --gen-key --batch')



entropy_explanation = Tk.messageBox(
  'type'    => "ok", 
  'icon'    => "info",
  'title'   => "Entropy Gathering Is Required",
  'message' => "You must gather entropy to generate your key. Do so by typing randomly into the text box that will pop up momentarily. Gathering sufficient entropy may take a very long time on virtual machines, and depending on the key size selected."
)

selected_algorithms = @@key_type.curselection
selected_key_strength = @@key_strength.curselection

key_type = "RSA" and subkey_type = "RSA" if selected_algorithms[0].to_i == 0
key_type = "DSA" and subkey_type = "ELG-E" if selected_algorithms[0].to_i == 1

puts key_type

key_strength = "1024" if selected_key_strength[0].to_i == 0
key_strength = "2046" if selected_key_strength[0].to_i == 1
key_strength = "3072" if selected_key_strength[0].to_i == 2
key_strength = "4096" if selected_key_strength[0].to_i == 3

puts key_strength


stdin.puts("Key-Type: #{key_type}")
stdin.puts("Key-Length: #{key_strength}")
stdin.puts("Subkey-Type: #{subkey_type}")
stdin.puts("Subkey-Length: #{key_strength}")
stdin.puts("Name-Real: #{@@pseudonym_entry}")
stdin.puts("Name-Email: #{@@email_entry.value.to_s}")
stdin.puts("Expire-Date: 0")
stdin.puts("Passphrase: #{@@password_entry1.value}")
stdin.puts("%commit")

entropy_input_window = TkToplevel.new do
self.title = "gather entropy"
self.height = 500
self.width = 500
end
 


entropy_input = TkText.new(entropy_input_window) do
self.background = "#e3dede"
place('height'=> 500,'width' => 500,'x' => 0, 'y' => 0)
end

gather_entropy = Thread.new do #this may be insecure way of piping randomness to the GPG engine depending on how they have implemented entropy accumulation
until `gpg --list-keys`.bytesize > starting do
stdin.puts("entropy_input.value")
entropy_input.value = ""
sleep(10)
end

entropy_input_window.destroy

done = Tk.messageBox(
  'type'    => "ok", 
  'icon'    => "info",
  'title'   => "Key Generated!",
  'message' => "Your key has finished generating!"
)

@@finished_key.value = `gpg -a --export #{@@pseudonym_entry.value}`.to_s
end



end

end



end


Tk.mainloop

2861
Security / Re: Anonymity and Privacy, not the same thing
« on: May 13, 2012, 12:15 pm »
I see the thread about VPNs died after I posted the snippet from and a link to the security basics article at HackBB's wiki. Guess you guys had your fill of talking VPNs by the time I showed up. Anyway, I wanted to repeat something from that article that I believe the majority of us are guilty of mixing up, anonymity and privacy. Most people's first reaction is they are the same or only marginally different, that was mine. But it really helps to know there is a difference when you are playing such a game as this one we are playing. The author of the security basics paper brought it to my attention that I had not fully respected the difference between anonymity and privacy. Tor is for anonymity, as you may have heard. Hiding the source and destination of data within tor is what it does well. Hiding the data, or giving you good privacy, is not what it does well. VPNs are the opposite in they provide excellent privacy, but not so good anonymity.

The reason I started a new thread for this is because I'm hoping some of the resident geeks will have something to say about this. I'd love to learn more about the different tools available to us for increasing both anonymity and privacy. Just by reading that one little part that made me aware of how different the two are, several things made more sense to me right away. For instance, I had been told to steer clear of using a VPN with tor, unless I knew what I was doing and fully understood the implications of mixing the two tools. That didn't make much sense at the time, but now it makes plenty of sense. It was surprising to me how just failing to give those two words equal yet opposite weight would doom you from the start. Some of us don't feel like the chances we take are too hardcore, but some of us can't afford any fuck ups. That's the biggest reason why I started a new thread. I know there is someone who needs to hear this, but they missed it yesterday.

Anybody got anything add? I seriously would love to hear it.

It is a little bit more complicated than that. VPNs are far worse than Tor for some sorts of privacy. The primary difference between Tor and a VPN is that with Tor far more people see your exit traffic. Some of those people log unencrypted exit traffic  to spy on exit traffic for various reasons. With a VPN your exit traffic is concentrated often to a single point, and rarely more than a few. If this single point is not spied on then nobody is spying on any of the traffic. However, if someone is spying on that point then 100% of the unencrypted exit traffic is compromised by that attacker. Tor decreases the amount of information that any one attacker can intercept by increasing exposure to many nodes, although VPNs generally say they wont spy on exit traffic they are much more likely to be forced to by a court order and to comply with the court order. VPNs in most countries that don't deal with abuse traffic get shut down pretty quickly, and if its serious enough Abuse that the feds care they will spy on it at the VPNs data centers in many cases. Often times it is the upstream hosting provider who doesn't tolerate abuse traffic even if the police don't get involved. So in theory a VPN can offer much better privacy than Tor can by restricting all traffic to a single point that they protect from being spied on, and in some places this might even work like in Russia or other countries with providers who can ignore or delay foreign complaints, but generally almost all VPN services offer stronger privacy than Tor does only to people who are not breaking any laws, and worse privacy by far (100% of exit traffic intercepted by your primary attacker) to anyone who is breaking the law.

VPNs also offer anonymity to various degrees, although most of them only to a very minimal extent. If you use a single VPN solution you automatically leak the small list of entry nodes you could be using, and you leak that you are someone who uses the VPN service. Different corporate structures seem to add strength to some VPN services claims of anonymity, instead of getting a court order to force a single company to hand over records they can use a split corporate structure with each node run in a different jurisdiction its own. Some services manage to offer pretty good protection from law enforcement, there are specialized cyber crime server hosts in countries like Russia that resist abuse complaints very well. In the end Tor and VPN services are both defeated by the same primary attack, entry/exit traffic correlation, and in either case it is only a matter of time for a dedicated attacker to be able to deanonymize a target, especially if they target a lot of people.  Tor does protect from a significant number of attacks that VPNs do not protect from though, and Tor is widely considered to be substantially superior to VPNs, but there are case studies where targets using VPNs proved untraceable to FBI (although there are many case studies where people using VPN services were traced), however there are no examples of Tor ever having a user deanonymized by LE. The person who uses Tor and gets a bad entry:exit on their first circuit to SR is going to be screwed faster than someone who gets a VPN that isn't currently being worked on by LE.

But don't take this to be an endorsement for VPNs , Tor is the clear winner. When it comes to more VPN type technology people seem to think JAP is the role model (and it has certainly received more technical scrutiny from the academic anonymity community than any other anonymity VPN service has) , they have a nice arrangement where node operators sign legally binding contracts saying they will not spy on traffic content or store headers or content without a valid court order in their jurisdiction forcing them to do so, and then they chain these nodes together into two or three hop international cascades often in countries without data retention laws. And that is great for the amount of time it takes LE to produce valid court orders on the path back to you (or even leak frogging potentially). Tor is great until you rotate to a new entry node that is pwnt by someone who can watch traffic arrive at your destination.

2862
Feature requests / Re: Lotteries
« on: May 12, 2012, 02:58 pm »
The only problem with lottos is that it's an easy way to scam. A vendor can just make a new shill account and claim that it won as to keep all the proceeds without giving out the prizes.

I think a system like Anarcho47 uses should be in place (where he has numbered tickets and picks the winning numbers before the start of the lotto and posts them in an unedited thread in PGP encryption)

That is easily gamed too , he could still select the winning ticket. There are hashing systems that can be used to do a secure lottery where nobody can cheat, including the person running it.

2863
first, sorry brothers for my gibberish - it's 5 AM and I can't sleep.

LOVE this thread !!!

A few years ago, they busted some guy - perhaps a dealer or something?  -  By using his smart phone to listen in on conversations even when the phone was not in use - the trick was to always remove the battery - also good for keeping your GPS location to yourself.

I sent these links to my brother who I told about a year or two ago that "they" can listen and know what you are typing as every key on your keyboard has it's own, unique sound.

(no tin-foil hat)


Cheers/

Wait, are you saying that they can just hack into the microphone in the phone at any point and listen to it in real time? That's fucking scary if that's true.

They can do a lot more scary things than that.

2864
Security / Re: GPG for Ubuntu
« on: May 12, 2012, 12:12 pm »
here is the GPG command line info from OVDB. All a GUI does is build up the command from user inputs (ie: clicking buttons) and then sends it to the GPG CLI and process the output / displays some of it to the user in a visual widget like a text box. I think it is much nicer to just learn the commands, but I need to practice programming this sort of GUI anyway so figured what the hell :P.

Quote
DISCLAIMER:

Some of these have been edited and may be missing some posts. I didn't get everyones nyms so if you know a post is yours and want attributation, post that it is. It's not much but its what i got right now on my thumb. I'll dig around for more later. Peace and much love, OVDB survivors..

"N30M3: This is cross platform. These commands are meant for being typed into a terminal. It really is very easy to use GPG this way and I prefer doing it this way to using any GUI solution.

To clear sign a message, so the message is displayed with a signature, type the following:

echo 'Message to sign here' | gpg --clearsign

hit enter and you will be asked for your passphrase. After providing your passphrase, it will print the signed message

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Message to sign here
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk7Oi6AACgkQZU8eyBD0KgmoHACffnfJAVsStRRBWUStd/0GeEwY
QWUAnA2IcQeZp7MWgsRKs6jyJO743NLC
=TqKf
-----END PGP SIGNATURE-----

To verify a signature type the following:

gpg --verify | cat -v

hit enter and a blank line is printed. Paste the message you would like to verify directly here, and hit ctrl-d. The signature will now be verified.

To asymmetrically encrypt a message type the following

gpg -e -a | cat -v

hit enter, and you will be asked for the user ID to encrypt the message to. Here you can enter either the E-mail, name or user ID of the recipient. This is why it is important for people to use the same name on their key as they use on forums, so vendors can simply type the name in here. People who use different key names than forum names should seriously just be ignored because they are fucking annoying. Anyway, enter the user information of everyone you want to encrypt your message to, hitting the enter key after each name. You can enter as many user IDs as you like.

after you have entered every nym you would like to encrypt the message to, hit enter again without adding an additional nym. A blank line will be printed. Now type the message you would like to encrypt on this blank line.

When you are done typing the message to encrypt, hit ctrl-d and the ciphertext of your message will be printed

To symmetrically encrypt a message type the following

gpg -c -a | cat -v

type the symmetric password you would like to encrypt the message with. You will need to do this two times to verify the password.

After typing the password twice, a blank line will be printed. Type the message you want to symmetrically encrypt here, followed by hitting ctrl-d. The ciphertext of your message will be printed.

To decrypt a message type the following

gpg -d | cat -v

a blank line is returned. Paste the ciphertext of the message you would like to decrypt. You should immediately be asked to enter your passphrase. After typing your passphrase and hitting enter hit ctrl-d to display the plaintext of the message. If the message was signed with a private key that correlates with a public key you have on your keyring, the message will be authenticated automatically.


important note: you should prepend the signature command with a space so that you don't save the plaintext of what you sign in your terminal history. Adding a space prior to a terminal command makes it so that it is not saved in the history. Does not work on FreeBSD (tested on 7.1 and 8.1)"

2865
Security / Re: GPG for Ubuntu
« on: May 12, 2012, 12:03 pm »
It was not intentional to loose seahorse, from what I understand. It was that fucking unity bullshit that fractured the fuck out of gnome. Now, all sorts of previously useful shit, like seahorse, won't work. Ubuntu is absolute shit right now. I don't have the bandwidth to grab 10.04 or I would. I'm stuck with 11.1 and god damn I hate it. I've been a linux user all my computing life. I have never been a windows user besides having the occasional windows dual boot for playing games. Though lots of geeks talk shit about ubuntu, I really liked it and have been using it for almost 8 years. I used Slackware previous to that. The first time I did a sudo apt-get install I was hooked on Ubuntu, night and day from Slack where everything had to be built. Though Slack now has a thing called slapt-get iirc, that works like apt-get. Anyway, Ubuntu just made shit too easy to not love it. Now, it's fucking trash. They seriously fucked up a great distro and from what I can tell, they don't plan on doing away with unity or going back to what everybody loved, what made them blow up to begin with. I find it ironic that Ubuntu, the distro that even with it's name claims that community is the most important part of your OS selection, gives not a single fuck that all but 3 people hate what they have done to it with unity. Ubuntu, you had a nice run, but I can't wait to get shed of the stupid new you.

You might like mint, it's like how Ubuntu used to be but even better. Ubuntu is complete shit now. Every distro it gets worse too. 

Pages: 1 ... 189 190 [191] 192 193 ... 249