- NANOG - lists.nanog.org

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 09 Sep '13

09 Sep '13

----- Forwarded message from Gregory Perry <Gregory.Perry(a)govirtual.tv> ----- Date: Sat, 7 Sep 2013 21:14:47 +0000 From: Gregory Perry <Gregory.Perry(a)govirtual.tv> To: Phillip Hallam-Baker <hallam(a)gmail.com> Cc: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com>, ianG <iang(a)iang.org> Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" On 09/07/2013 05:03 PM, Phillip Hallam-Baker wrote: Good theory only the CA industry tried very hard to deploy and was prevented from doing so because Randy Bush abused his position as DNSEXT chair to prevent modification of the spec to meet the deployment requirements in .com. DNSSEC would have deployed in 2003 with the DNS ATLAS upgrade had the IETF followed the clear consensus of the DNSEXT working group and approved the OPT-IN proposal. The code was written and ready to deploy. I told the IESG and the IAB that the VeriSign position was no bluff and that if OPT-IN did not get approved there would be no deployment in .com. A business is not going to spend $100million on deployment of a feature that has no proven market demand when the same job can be done for $5 million with only minor changes. And this is exactly why there is no real security on the Internet. Because the IETF and standards committees and working groups are all in reality political fiefdoms and technological monopolies aimed at lining the pockets of a select few companies deemed "worthy" of authenticating user documentation for purposes of establishing online credibility. There is no reason for any of this, and I would once again cite to Bitcoin as an example of how an entire secure online currency standard can be created and maintained in a decentralized fashion without the need for complex hierarchies of quasi-political commercial interests. Encrypting SMTP is trivial, it's all about the standard to make it happen. Encrypting IPv6 was initially a mandatory part of the spec, but then it somehow became discretionary. The nuts and bolts of strong crypto have been around for decades, but the IETF and related standards "powers to be" are more interested in creating a global police state than guaranteeing some semblance of confidential and privacy for Internet users. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

Google support contact
by s 09 Sep '13

09 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 can someone from the Google support team please contact me off list -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSLSqeAAoJEENc8MKW+7m4xXsH/2jfHIEDJ3kKZvbkSQp2mE3s VcPm/l8qmQ89Olmu8kNmGPcBbnjn/EIu42OnuE3GHwsgyJ06KM5aiacL8X2YAVSn EmJXZvfWQMQqpWV+yaadbRr3EwEkGnh0T/dYx2edpY5M9ggltTdUjVzgHRwSmeH1 9/WheIY/rnzxDh5wFascJi+sPuHr9sga4M4jGsX6+uA/wVh9bwk3kDoyb71MXG9R UzaDnq3/AL5bS4pOt6Skl67f6NK0gwEx93Jbtgei7OpKWb9NKI/qL+vcRvlaEWp9 cIdofWBMF2eQG7nt2d1Nsl/vwG4bkBrAdFJyxIlDHs/ykkNXoGaMR/hxixFA0Q0= =5C5x -----END PGP SIGNATURE-----

1 0

Re: Internet Surveillance and Boomerang Routing: A Call for Canadian Network Sovereignty
by Paul Ferguson 08 Sep '13

08 Sep '13

Actually Roland is right when he says: > If folks are unhappy with the current state of affairs, they ought to concentrate on writing laws, not code. Randy is being his usual self and playing devils advocate, which is fine, but doesn't move the ball (or is simply self-serving). In any event, we *all* need to raise our game, because we are not as clever as we think we are. - ferg On 9/8/2013 1:12 AM, Dobbins, Roland wrote: > On Sep 8, 2013, at 2:58 PM, Randy Bush wrote: > >> >cool. then i presume you will continue to run using rc4 and rsa 1024. > The point is that no matter what crypto algorithms are developed and implemented, it's generally trivial for authorized (for whatever value of 'authorized' applies in a given situation) entities to obviate them by simply compromising the endpoints under color of law, if nothing else. > > If folks are unhappy with the current state of affairs, they ought to concentrate on writing laws, not code. -- Paul Ferguson Vice President, Threat Intelligence Internet Identity, Tacoma, Washington USA IID --> "Connect and Collaborate" --> www.internetidentity.com

1 0

Re: Caution! Don't attempt the Postini to Google Apps transition
by Larry Sheldon 08 Sep '13

08 Sep '13

On 9/8/2013 2:38 PM, Anurag Bhatia wrote: > Hi Matthew > > > Interesting experience. > >> first into a black hole, and then bouncing with permanent failures. > > > What you mean by permanent failures? Can you share error you saw in bounce > report? > RFC 2505 Anti-Spam Recommendations February 1999 > > > 1.6. SMTP Return Codes > > SMTP has several classes of Return Codes, see [1] for a discussion: > > o 5xx > is a Permanent Negative Completion reply (Fatal Error) and > results in the mail transfer being terminated and the mail > returned to sender. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 08 Sep '13

08 Sep '13

----- Forwarded message from "Jeffrey I. Schiller" <jis(a)mit.edu> ----- Date: Sat, 7 Sep 2013 19:52:44 -0400 From: "Jeffrey I. Schiller" <jis(a)mit.edu> To: Gregory Perry <Gregory.Perry(a)govirtual.tv> Cc: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com>, Phillip Hallam-Baker <hallam(a)gmail.com>, ianG <iang(a)iang.org> Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" User-Agent: Mutt/1.5.21 (2010-09-15) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sat, Sep 07, 2013 at 09:14:47PM +0000, Gregory Perry wrote: > And this is exactly why there is no real security on the Internet. > Because the IETF and standards committees and working groups are all > in reality political fiefdoms and technological monopolies aimed at > lining the pockets of a select few companies deemed "worthy" of > authenticating user documentation for purposes of establishing > online credibility. > ... > Encrypting IPv6 was initially a mandatory part of the spec, > but then it somehow became discretionary. The nuts and bolts of > strong crypto have been around for decades, but the IETF and related > standards "powers to be" are more interested in creating a global > police state than guaranteeing some semblance of confidential and > privacy for Internet users. I’m sorry, but I cannot let this go unchallenged. I was there, I saw it. For those who don’t know, I was the IESG Security Area Director from 1994 - 2003. (by myself until 1998 after which we had two co-AD’s in the Security Area). During this timeframe we formed the TLS working group, the PGP working group and IPv6 became a Draft Standard. Scott Bradner and I decided that security should be mandatory in IPv6, in the hope that we could drive more adoption. The IETF was (and probably still is) a bunch of hard working individuals who strive to create useful technology for the Internet. In particular IETF contributors are in theory individual contributors and not representatives of their employers. Of course this is the theory and practice is a bit “noisier” but the bulk of participant I worked with were honest hard working individuals. Security fails on the Internet for three important reasons, that have nothing to do with the IETF or the technology per-se (except for point 3). 1. There is little market for “the good stuff”. When people see that they have to provide a password to login, they figure they are safe... In general the consuming public cannot tell the difference between “good stuff” and snake oil. So when presented with a $100 “good” solution or a $10 bunch of snake oil, guess what gets bought. 2. Security is *hard*, it is a negative deliverable. You do not know when you have it, you only know when you have lost it (via compromise). It is therefore hard to show return on investment with security. It is hard to assign a value to something not happening. 2a. Most people don’t really care until they have been personally bitten. A lot of people only purchase a burglar alarm after they have been burglarized. Although people are more security aware today, that is a relatively recent development. 3. As engineers we have totally and completely failed to deliver products that people can use. I point out e-mail encryption as a key example. With today’s solutions you need to understand PK and PKI at some level in order to use it. That is likely requiring a driver to understand the internal combustion engine before they can drive their car. The real world doesn’t work that way. No government conspiracy required. We have seen the enemy and it is... -Jeff _______________________________________________________________________ Jeffrey I. Schiller Information Services and Technology Massachusetts Institute of Technology 77 Massachusetts Avenue Room E17-110A, 32-392 Cambridge, MA 02139-4307 617.910.0259 - Voice jis(a)mit.edu http://jis.qyv.name _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFSK7xM8CBzV/QUlSsRApyUAKCB6GpP/hUHxtOQNGjSB5FDZS8hFACfVec6 pPw4Xvukq3OqPEkmVZKl0c8= =9/UP -----END PGP SIGNATURE----- _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

Caution! Don't attempt the Postini to Google Apps transition
by Matthew Kaufman 08 Sep '13

08 Sep '13

TL; DR: Email won't be delivered, No support I have two domains that I set up with Postini for spam filtering, and I was very happy for years. But Google purchased Postini, and has been increasingly insistent that I migrate to Google Apps. They have a transition process which is supposedly seamless, and which guarantees that mail will continue flowing throughout the transition. In reality, all of my email was offline for 24 hours, first into a black hole, and then bouncing with permanent failures. Calling Google support last night resulted in a long wait to finally talk to someone who told me that Postini support was too busy and who took down my name and number for a call back. Never got a call. This morning I opened a support ticket via the web site, and two hours later got a reply suggesting that it might be my MX records. Never mind that (according to the logs I could see) the mail was still flowing properly to Postini, passing through there to Google, and then being dumped at Google. When I called to escalate, I found a support agent who couldn't find the ticket I had opened via the website, and who then tried to transfer me. In the process, I sat on hold for 30 minutes, then the call was dropped. When I called right back, I went through the same phone tree and authentication process, and reached another agent. When he asked my problem, and I started to describe it, he said "oh, Postini" and then hung up on me. At that point it had been 24 hours, which is too long to have one's inbound email getting permanent failures, and so I've set my MX records to point directly at my own servers and will just live without spam filtering for a while. In the meantime, I strongly encourage anyone else who cares about reliable email delivery to avoid my fate. Matthew Kaufman matthew(a)matthew.at

2 1

The US government has betrayed the Internet. We need to take it back
by Eugen Leitl 08 Sep '13

08 Sep '13

http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-in… The US government has betrayed the Internet. We need to take it back The NSA has undermined a fundamental social contract. We engineers built the Internet – and now we have to fix it Bruce Schneier The Guardian, Thursday 5 September 2013 20.04 BST Internet business cables in California. 'Dismantling the surveillance state won't be easy. But whatever happens, we're going to be breaking new ground.' Photograph: Bob Sacha/Corbis Government and industry have betrayed the Internet, and us. By subverting the Internet at every level to make it a vast, multi-layered and robust surveillance platform, the NSA has undermined a fundamental social contract. The companies that build and manage our Internet infrastructure, the companies that create and sell us our hardware and software, or the companies that host our data: we can no longer trust them to be ethical Internet stewards. This is not the Internet the world needs, or the Internet its creators envisioned. We need to take it back. And by we, I mean the engineering community. Yes, this is primarily a political problem, a policy matter that requires political intervention. But this is also an engineering problem, and there are several things engineers can – and should – do. One, we should expose. If you do not have a security clearance, and if you have not received a National Security Letter, you are not bound by a federal confidentially requirements or a gag order. If you have been contacted by the NSA to subvert a product or protocol, you need to come forward with your story. Your employer obligations don't cover illegal or unethical activity. If you work with classified data and are truly brave, expose what you know. We need whistleblowers. We need to know how exactly how the NSA and other agencies are subverting routers, switches, the Internet backbone, encryption technologies and cloud systems. I already have five stories from people like you, and I've just started collecting. I want 50. There's safety in numbers, and this form of civil disobedience is the moral thing to do. Two, we can design. We need to figure out how to re-engineer the Internet to prevent this kind of wholesale spying. We need new techniques to prevent communications intermediaries from leaking private information. We can make surveillance expensive again. In particular, we need open protocols, open implementations, open systems – these will be harder for the NSA to subvert. The Internet Engineering Task Force, the group that defines the standards that make the Internet run, has a meeting planned for early November in Vancouver. This group needs to dedicate its next meeting to this task. This is an emergency, and demands an emergency response. Three, we can influence governance. I have resisted saying this up to now, and I am saddened to say it, but the US has proved to be an unethical steward of the Internet. The UK is no better. The NSA's actions are legitimizing the Internet abuses by China, Russia, Iran and others. We need to figure out new means of Internet governance, ones that makes it harder for powerful tech countries to monitor everything. For example, we need to demand transparency, oversight, and accountability from our governments and corporations. Unfortunately, this is going play directly into the hands of totalitarian governments that want to control their country's Internet for even more extreme forms of surveillance. We need to figure out how to prevent that, too. We need to avoid the mistakes of the International Telecommunications Union, which has become a forum to legitimize bad government behavior, and create truly international governance that can't be dominated or abused by any one country. Generations from now, when people look back on these early decades of the Internet, I hope they will not be disappointed in us. We can ensure that they don't only if each of us makes this a priority, and engages in the debate. We have a moral duty to do this, and we have no time to lose. Dismantling the surveillance state won't be easy. Has any country that engaged in mass surveillance of its own citizens voluntarily given up that capability? Has any mass surveillance country avoided becoming totalitarian? Whatever happens, we're going to be breaking new ground. Again, the politics of this is a bigger task than the engineering, but the engineering is critical. We need to demand that real technologists be involved in any key government decision making on these issues. We've had enough of lawyers and politicians not fully understanding technology; we need technologists at the table when we build tech policy. To the engineers, I say this: we built the Internet, and some of us have helped to subvert it. Now, those of us who love liberty have to fix it. • Bruce Schneier writes about security, technology, and people. His latest book is Liars and Outliers: Enabling the Trust That Society Needs to Thrive. He is working for the Guardian on other NSA stories

28 49

RE: MTR for Android?
by Keith Medcalf 08 Sep '13

08 Sep '13

Look for TRACEROUTE by SRCGUARDIAN in the Play Store. It needs network access only... Doesn't do TCP but does ICMP and UDP traceroutes and displays ASN as well ...

2 1

AlbertaIX - no longer a Cybera project?
by Mark Leonard 07 Sep '13

07 Sep '13

It seems that AlbertaIX is no longer listed on Cybera's list of projects: http://www.cybera.ca/strategic-projects/ In fact, doing a search on Cybera's site yields a whole bunch of dead links: http://www.cybera.ca/search?q=albertaix Is AlbertaIX no longer part of the Cybera project inventory? Has Cybera pulled official support for AlbertaIX? Are AlbertaIX and Cybera still sharing an address? [1,2] Just curious. [1] http://www.cybera.ca/contact-us/locations/ [2] http://www.canada-companies-info.com/albertaix-6sh9/

5 4

Re: The US government has betrayed the Internet. We need to take it back
by Scott Weeks 07 Sep '13

07 Sep '13

--- sam(a)circlenet.us wrote: From: Sam Moats <sam(a)circlenet.us> There only options are to: Disobey the law, unacceptable in my opinion Close down services, noble but I need to eat and you probably want to keep getting email Compromise your principles and obey the law, the path often choosen. ---------------------------------------- So, there's no choice except to get a 5-gallon bucket of gov't-ky jelly and take it? So many things come to mind on your flag-waving emails, I can't think of what to say first. And believe me, that's not usual... ;-) After a while, you'll become raw and probably change your mind. scott

3 2