zmanian

Wonders if this is Shadowbrokers...

Secret URL for deleting your Yahoo account.

https://edit.yahoo.com/config/delete_user

This is substantially worse than PRISM which operates on individual targeted persons and the upstream Verizon, AT&T program which collects plaintext over the public Internet.

This involved bulk search of data past the decryption layer.

This should forever taint Marissa Meyer's reputation. Failure to save Yahoo is understandable. Disregard for user privacy and safety at this scale is unforgivable.

If you want to learn more or participate, checkout http://oaklandprivacy.org/

Governor Brown signed a massive civil forfeiture reform for California today.

https://www.aclunc.org/news/gov-brown-signs-historic-bill-re...

Why is this enterprise only?

I can't think of anywhere that blocks Signal but doesn't block Tor.

I think the OWS developers would probably be more interested in a system that can conceal metadata from the Signal server rather than pure network surveillance.

Yeah endpoint security is generally worse on all desktop operating systems than iOS and Signal isn't intended to solve that problem.

One could run Signal Desktop on their Chromebook for a similar level of endpoint security to iOS.

"Use Signal. Use Tor."

I know a number of people how have had success with syncing but you may want to post your logs in Github or thumbs up if you are dup of https://github.com/WhisperSystems/Signal-Desktop/issues/909

While the Grugq argues[0] persuasively, that avoiding disclosure was a legitimate strategy. It seems unrealistic to argue that the NSA wanted to avoid more scrutiny in their moment of political weakness in the months after the Snowden revelations.

[0]https://medium.com/@thegrugq/mind-games-international-champi...

I highly recommend the Princeton book and associated video lectures as a place to get started. It does a great job of framing things in the context of the wider fields of cryptography and distribute systems research.

http://bitcoinbook.cs.princeton.edu/

I would very much like to see someone built out the transcript validation application of atomic broadcast rather than a distributed ledger version.

That's disappointing :-(

This is a cool implementation of this idea.

Proof of work is probably an acceptable solution for proof of concept but anonymous consensus isn't needed for for collaborative document editing.

I'm still thinking if this use cases needs timestamping or atomic broadcast.If timestamping is sufficient, Google's new roughtime protocol would do the job well. Otherwise you need a proper atomic broadcast algorithim like RAFT, Tendermint, Honeybadger etc.

Great work.

Just intended to point out this is a great example of the general applicability of crytocurrency inspired research.

This is awfully similar to Ben Laurie's good ideas about how to run a distributed time stamping service for a cryptocurrency. http://www.links.org/files/distributed-currency.pdf

Great to see these ideas used for general security applications.

Okay, here is what I think this is

- It is a straight forward combination of two forms of encryption from pairing cryptography world. Identity Based Encryption and Threshold Encryption.

- In Identity based encryption, your public key and private key is generated by an identity provider based on an identity string provided to it. This allows encrypting messages to party that hasn't yet recieved the keys. This work has been around for ages.

- Milagro proposes to distribute the trusted third party by having multiple identity providers. The public key and private key are formed from a threshold encryption/ decryption procedure.

Guardtime is set of tooling around a FIPS 140 timestamping appliance. Systems on the network submit hashes of their logs to the time stamping. Assuming the appliance remains secure, you can go back in the event of compromise and prove that your logs are unaltered up to a certain point.

It's amazing that they seem to have built a $50 -$100 million dollar business here.

I like these counter arguments

The US govt has already weakened these incentives because of the decision not to prosecute Petraeus.

The US govt should not have strong incentives against revealing widespread human rights abuse like full-take surveillance of entire countries.

Reasons it would be in the interests of the US govt to pardon Snowden:

- It would decrease Snowden's celebrity for him to return from exile.

- It would remove incentives for Snowden to constantly amplify inconsistent/ hypocritical behavior of the US govt.

- It would improve the optics for the tech industry for working more closely with government.

Reasons it would be against Us govt interests.

- It would make the intelligence community feel hurt/ sad.

Virgil seems to be willfully ignorant. Tor needs greater political support in the West because of second crypto wars. Tor also needs more funding that is available for work on privacy and anonymity to support use cases like Securedrop. Too much of Tor's current funding is tied to censorship resistance applications of Tor.

The CMU attack required setting up a very large number of malicious relays on the Tor network.

It was bad that Tor didn't notice the large number of new relays joining the network but greater vigilance is being shown.

Tor is effective against many threat models and yet many attacks are known. Further work is required.

I remember Ed Kemmet saying that NUMA optimizations are patent encumbered and presumably licensed. Probably part of the reason this is closed source.

I fully admit this line of thinking hasn't completely solidified for me.

But empirically the iOS ecosystem is demonstrating that there is a close source ecosystem with better security properties than the open source one. Security advances the same virtues of user self determination as open source does.

As consumers we don't face very good choices right now.

When you buy an iPhone, you don't own it. You are a sharecropper on Apple's OS license.

If you buy an Android with an unlockable bootloader, you own it. But if attacked, the adversary owns the device.

It's a shitty situation but it's hard not to recommend iOS to most users.

Bamford's expertise in espionage is pretty similar.

There seem to be two plausible explanations for the Shadow Brokers release.

1. The doctrine of the US govt in cyberwar is proportionate response. This is either preemption or escalation on behalf of Russia. This assumes the attribution of Russia for Democratic political hacks are accurate.

2. This is further activity by whomever leaked the ANT catalog to Applebaum.

The Shadow Brokers are going to be difficult to attribute technically. Attribution is based more on your theory about what's happening the Russian covert escalation.

I suspect many people will migrate to electron instead of web apps. APIs for USB and Bluetooth and the isolation offered by Chrome apps have no equivalent in extensions / web apps