The Tor Project is Hiring a Developer for OONI!

https://www.buzzfeed.com/shee

https://www.buzzfeed.com/sheerafrenkel/everything-you-ever-wanted-to-kn…
Everything You Ever Wanted to Know About How ISIS Uses The Internet
They talk on Telegram and send viruses to their enemies. BuzzFeed News’ Sheera Frenkel looks at how ISIS members and sympathizers around the world use the internet to grow their global network.
Sheera Frenkel

> Here’s an example of a conversation on a private ISIS channel on the messaging app Telegram on a recent Sunday afternoon:
>
> “brother r u use VPN for site?”
> “no brother, that is shit. use tor.”
> “tor is creation of CIA. avoid tor.”
> “so use vpn?”
> “lol, no there is something else”
>
> These sorts of exchanges appear daily on Telegram,

If I am reading the article correctly, this snippet was shown to the reporter by Dlishad Othman "a cybersecurity engineer with the ISC Project".

I wish the reporter had pointed out that if this pair of 4 Watt bulbs is a typical example of ISIS recruits, that (non)-governmental(?) entity must not be so cyber-capable after all.

Two more recent Buzzfeed News articles of interest to Tor users:

https://www.buzzfeed.com/hamzashaban/manhattan-district-attorney-wants-…
Manhattan District Attorney Wants To Put An End To Apple’s Default Encryption
Law enforcement officials continue to push for a new law that would ban secure communications in the interest of national security.
Hamza Shaban

> ...
> Cyrus Vance, the District Attorney of New York County and one of the most vocal opponents of robust consumer encryption, believes lawmakers shouldn’t wait for potential encryption cases to wind their way through the courts. Instead, with urgency, he is lobbying members of Congress to support legislation that would force tech companies to maintain the ability to decrypt the data of their consumers on demand, with a judge’s approval.

IOW, Cy Vance Jr seeks to outlaw end-to-end encryption, which would outlaw Tor, GPG, and many other good things. The less dire alternative on offer from the USG: "persuade" vendors to make strong cryptography too hard for ordinary people to use on their personal devices:

https://www.buzzfeed.com/hamzashaban/why-googles-encryption-choices-mat…
Why Google’s Encryption Choices Matter
Allo, Google’s new messaging app, offers end-to-end encryption — but not by default.
Hamza Shaban

> Default settings matter.
>
> This truth of consumer technology brings significance to Google’s decision, announced Wednesday during its annual I/O developer conference, to offer end-to-end encryption through its new messaging app, Allo. But unlike WhatsApp or Apple’s iMessage, if you want the protection it offers you’ll have to turn it on.
>
> Through an optional “incognito” mode, Allo encrypts communications in such a way that not even Google can access the contents of the messages you send. Only intended recipients can read correspondence when its end-to-end encrypted. For the majority of people, built-in settings are the ones most often used. That’s why Google’s decision to add end-to-end encryption as an option in Allo — but not enable it by default — is disconcerting to some technologists.

I say again: the change to

I say again: the change to Rule 41b which will take effect in December unless the US Congress acts, will directly affect Tor users all over the world:

https://www.aclu.org/blog/washington-markup/governments-hacking-powers-…
The Government’s Hacking Powers Are About to Grow Exponentially
Neema Singh Guliani, ACLU Legislative Counsel
19 May 2016

> Federal agents may soon be able to remotely hack into hundreds or even millions of computers across the country — with a single warrant. And Congress has to act by December 1 to stop this incredible power grab.
> ...
> The rule change would allow the government to obtain a search warrant to remotely hack a computer in cases involving certain internet crimes, or when the location of the computer is being masked electronically (for example, when a person uses a virtual private network or a privacy-protective service like Tor). Judges would be permitted to authorize these searches within and outside their district — as an exception to the general rule that judges may only issues warrants within their jurisdiction. This could allow the government to hack into millions of computers across the country, without proper judicial oversight.

Who would dare to read the

Who would dare to read the following article except under cover of Tor?

medium.com
The Pentagon’s secret pre-crime program to know your thoughts, predict your future
US military contractors are mining social media to influence your ‘cognitive behavior’ when you get angry at the state
Nafeez Ahmed
1 Feb 2016

> The US Department of Defense (DoD) wants contractors to mine your social media posts to develop new ways for the US government to infer what you’re really thinking and feeling — and to predict what you’ll do next.
>
> Pentagon documents released over the last few months identify ongoing classified research in this area that the federal government plans to expand, by investing millions more dollars.
>
> The unclassified documents, which call on external scientists, institutions and companies to submit proposals for research projects, not only catalogue how far US military capabilities have come, but also reveal the Pentagon’s goals: building the US intelligence community’s capacity to forecast population behavior at home and abroad, especially groups involved in political activism.
> ...

Do I detect a sudden chilling sensation?

One more striking example of

One more striking example of why everyone needs to use Tor as much as possible:

https://www.eff.org/deeplinks/2016/05/when-surveillance-chills-speech-n…
Surveillance Chills Speech—As New Studies Show—And Free Association Suffers
Karen Gullo
19 May 2016

> ... Government surveillance has that chilling effect—on our activities, choices and communications—and carries serious consequences. We argue in our lawsuit First Unitarian Church of Los Angeles, et al v. NSA that the government’s collection of phone records violates the First Amendment rights of our clients—churches and civil and human rights organizations—by discouraging members and constituents from associating and communicating with them for fear of being spied on.
> ...
> The Wikipedia study, to be published in an upcoming issue of the Berkeley Technology Law Journal, found a dramatic fall in monthly traffic to Wikipedia articles about terror groups and their techniques after the June 2013 disclosures of the NSA PRISM surveillance program by whistleblower Edward Snowden. The study looked at 48 Wikipedia articles that contained terrorism-related keywords tracked by the Department of Homeland Security, such as “suicide attack” and “dirty bomb.”
>
> Article views dropped 30 percent after June 2013, which supports “the existence of an immediate and substantial chilling effect,” wrote author Jonathon Penney. He also found that monthly views continued to fall, suggesting that the chilling effects of NSA surveillance are long term. The study, he says, has “implications for the health of democratic deliberation among citizens” and the broader health of society.

The correct solution is of course not to stop reading uncensored in order to learn things you need to know for your own safety, but to use Tor.

> These studies provide evidence of what we have long argued—our freedom to read what we choose online and communicate and associate with others privately is profoundly affected by the prospect of the government looking over our shoulder. It’s changed our behavior, whether that means not commenting on a Facebook post about terrorism, avoiding a Wikipedia page, or steering clear of certain organizations.

Exactly!

What Cy Vance and James Comey really want is to ensure that governments (or rather their AI governance bots) to make all the big decisions about the lives of individual citizens. God forbid citizens should think for themselves, much less decide how they want their own lives to unfold!

Was following links from

Was following links from this fine piece by two senior ACLU staffers:

Power Loves the Dark
Matthew Harwood, Senior Writer/Editor, ACLU
& Jay Stanley, Senior Policy Analyst, ACLU Speech, Privacy & Technology Project
19 May 2016

> In December 2015, the Journal of the American Statistical Association published a study that brought joy to the predictive crime-fighting industry. The study’s researchers concluded that a predictive policing algorithm outperformed human analysts in indicating where crime would occur, which in turn led to real crime reductions after officers were dispatched to the flagged areas. Only one problem: five of the seven authors held PredPol stock, and two were co-founders of the company. On its website, PredPol identifies the research as a “UCLA study,” but only because PredPol co-founder Jeffery Brantingham is an anthropology professor there.

What critic of "lying with statistics" could resist reading a bit of marketing fluff published (by ASA, even) as an "independent academic study" [sic]? Unfortunately got this response from the third party server:

> client IP is blocked because: More than 100 sessions created in 5 minutes
> Blocked IPs: ***

Censoring PredPol *propadanda*! Houda thunkit?

(BTW, the claimed "100 sessions" figure didn't change to "101" when I tried a second time, so it's probably completely bogus.)

Truly, the USG has gone off

Truly, the USG has gone off the rails:

http://sputniknews.com
Developer of Online Anonymity Tool Tor Flees US to Escape FBI ‘Harassment’
Mandel Ngan
18 May 2016

> The Federal Bureau of Investigations may be looking to break into Tor, the Internet browser that hides user’s locations, by trying to subpoena one of Tor’s primary software developers, and instead of complying, she has fled the country.
>
> The FBI wants the cryptographer, who goes by Isis Agora Lovecruft, to testify in a criminal hacking investigation, but privacy advocates — as well as Lovecruft herself — believe the Bureau will attempt to coerce her into helping them crack the system.
>
> The Electronic Frontier Foundation (EFF), the leading nonprofit organization defending electronic civil liberties, has also taken on the case.
>
> “The FBI needs to open up and tell Isis what it is they want before she can decide if she will meet with them,” EFF Senior Staff Attorney Nate Cardozo told Sputnik. “They've said she isn't under investigation, but there are still too many unanswered questions. Isis has a right to know what's going on instead of playing this strange guessing game as she's pursued by federal agents.”

Perilous times indeed.

Off-topic but crypto: GCM

Off-topic but crypto:

GCM Nonce problems
https://eprint.iacr.org/2016/475

Remember when Medium hosted

Remember when Medium hosted the Sarawak Report, a detailed, sourced, well-researched expose of political corruption in Malaysia?

Predictably, the government blocked access to Medium.com. And they didn't stop there. You can no doubt guess their next move:

https://www.techdirt.com/
Free Speech
Mike Masnick
19 May 2016

> the government [of Malaysia] is now pushing a new law that gives the MCMC much more power to silence criticism online. And a big part of this is removing the intermediary liability protections that service providers have. This is a topic that we've discussed an awful lot -- especially with regards to things like Section 230 of the CDA in the US, which makes websites immune from liability for actions of their users. Many people try to attack these protections, claiming that they're just protecting big companies, but they're actually very much about protecting the public's ability to speak freely -- and the situation in Malaysia is a perfect example.
>
> Without strong intermediary liability protections, websites will now have very strong incentive to immediately block or take down any content that might displease the government, for fear that leaving it up will lead to legal consequences. This is also why we're so concerned about the recent lawsuits in France claiming that Twitter, Facebook and YouTube didn't take down offensive comments fast enough. Expecting service providers to police and monitor content is a path to widespread censorship.
>
> In Malaysia, a coalition of civil society/public interest groups are fighting back against this new law, and trying to spread the word about its possible impact.

Damn straight. It's all of them against all of us, and we all need to fight back.

it is cool

OT but maybe very good news:

OT but maybe very good news: a big problem (agreed?) for Tails developers is that the PRNG may not be able to gather enough entropy for strong cryptography soon after you boot from a DVD. The following development is clearly big news--- could it possibly help?

http://www.theregister.co.uk/2016/05/18/boffins_achieve_breakthrough_in…
Boffins achieve 'breakthrough' in random number generation
New method could make it harder for hackers in the future
Katyanna Quach
18 May 2016

> University of Texas computer science professor David Zuckerman and PhD student Eshan Chattopadhyay have found that a "high-quality" random number could be generated by combining two "low-quality" random sources... The new method makes it harder for hackers, as it requires less computational power to spew out random numbers of higher quality. Their paper has caught the attention of other academics worldwide who have described the research as "pulse-quickening" and "a breakthrough in theoretical computer science."

https://threatpost.com/academics-make-theoretical-breakthrough-in-rando…
Academics Make Theoretical Breakthrough in Random Number Generation
Michael Mimoso
May 17, 2016

> Two University of Texas academics have made what some experts believe is a breakthrough in random number generation that could have longstanding implications for cryptography and computer security...“We show that if you have two low-quality random sources—lower quality sources are much easier to come by—two sources that are independent and have no correlations between them, you can combine them in a way to produce a high-quality random number,” Zuckerman said. “People have been trying to do this for quite some time. Previous methods required the low-quality sources to be not that low, but more moderately high quality.
> ...
> In fact, academics worldwide have taken notice. Oded Goldreich, a professor of computer science at the Weizmann Institute of Science in Israel, called it a fantastic result. “It would have been great to see any explicit two-source extractor for min-entropy rate below one half, let alone one that beats Bourgain’s rate of 0.499,” Goldreich said on the Weizmann website. “Handling any constant min-entropy rate would have been a feast (see A Challenge from the mid-1980s), and going beyond that would have justified a night-long party.”

(Bourgain is a Fields Medalist, so beating his bound is pretty impressive. Goldreich is a well known expert in academic cryptography.)

The articles link to the paper and a followup paper from another researcher.

At times, apparent trolling,

At times, apparent trolling, astroturfing, or other malicious manipulations of social media (possibly sponsored by hostile governments) have become a problem in this blog. An interesting new study from Gary King's group at Harvard claims to uncover 488 million posts by (Chinese government sponsored) "fifty centers":

http://www.theregister.co.uk/2016/05/20/china_caught_astroturfing_polit…
China caught astroturfing social networks
Harvard study blames state groups for 488m comments
Shaun Nichols
20 May 2016

> ... "We estimate that the government fabricates and posts about 488 million social media comments a year. In contrast to prior claims, we show that the Chinese regime's strategy is to avoid arguing with skeptics of the party and the government, and to not even discuss controversial issues," say report authors Gary King, Jennifer Pan, and Margaret Roberts. "We infer that the goal of this massive secretive operation is instead to regularly distract the public and change the subject, as most of the these posts involve cheerleading for China, the revolutionary history of the Communist Party, or other symbols of the regime."

One surprising conclusion:

> ... The researchers believe that the 50 cent Party members are not actually employed full-time to target online discussions, but rather engage in the activities outside of their day-jobs as employees in other government organizations. The findings, the study concludes, contradict previously-held notions that online censorship in China is conducted directly through targeting and removing content that is critical of the state. Rather, the researchers find, the government is using more subtle tactics to undermine those who would criticize its policies. "Distraction is a clever and useful strategy in information control, in that an argument in almost any human discussion is rarely an effective way to put an end to an opposing argument," the researchers note. "Letting an argument die, or changing the subject, usually works much better than picking an argument and getting someone's back up (as new parents recognize fast).

Gary King is the author of the well known R package "Zelig", and has been a tireless champion of Bayesian statistics in the social sciences. One of his earlier papers studied the infamous "hanging chads".

(This comment is not a malicious attempt to "change the subject", and I feel it is not OT in this blog generally, I think, but it is OT in this thread. Wish TP offered a weekly open comment post like Bruce Schneier's "squid" posts.)

https://www.thestranger.com
Judge Who Authorized Police Search of Seattle Privacy Activists Wasn't Told They Operate Tor Network
Ansel Herz
8 Apr 2016

http://www.theregister.co.uk/2016/05/25/seattle_suehawks/
Seattle Suehawks: Smart meter hush-up launched because, er ... terrorism
Security through obscurity, amirite?
Shaun Nichols
25 May 2016

http://www.theregister.co.uk/2016/05/27/phil_mocek_seattle_smart_meters/
As US court bans smart meter blueprints from public, sysadmin tells of fight for security info
He wanted records – and got sued instead amid terror fears
Shaun Nichols
27 May 2016

The Tor Project is Hiring a Developer for OONI!

What’s OONI?

Why join OONI?

Becoming an OONI-tarian