Re: [liberationtech] Are you using 2-step verification? (Survey)

2015-01-29 Thread Greg Norcie
You migth want to take a look at a study I worked on while interning at
PARC that looked at this issue in detail:

(PDF warning)

A Comparative Usability Study of Two-Factor Authentication
http://www.norcie.com/papers/2fUSEC.pdf
--
Greg Norcie (gnor...@indiana.edu)
PhD Student, Security Informatics
Indiana University

On 1/27/15 9:33 PM, Robert Guerra wrote:
 Are you using 2-step verification? If so, a colleague is conducting a survey 
 for you to complete :-) Details are below...
 
 Thanks in advance!
 
 regards
 
 Robert
 
 --
 Robert Guerra
 Phone: +1 416-893-0377 
 Twitter: twitter.com/netfreedom 
 Email: rgue...@privaterra.org
 PGP Keys : https://keybase.io/rguerra
 
 Are you using 2-step verification? (Survey)
 http://www.securityskeptic.com/2015/01/are-you-using-2-step-verification-survey.html
 
 Passwords play roles in many security incidents. Phishing attacks often seek 
 to collect a target's login information for online banking, corporate or 
 private email, network login, auction or social media sites. In these and 
 other attacks, attackers benefit from how we rely only on a password to 
 access an account or prove our identity.
 
 2-step verification is a more secure form of proving your identity (who you 
 are) than just passwords. In most 2-step verification systems, you register a 
 trusted device with an online banking service, blog, or social media 
 provider: this device is typically your mobile phone. When you log in to that 
 service or social media, you verify your identity by entering both your 
 password and a verification code that's sent to your trusted device (again, 
 most often your mobile phone). By adding this second step, someone who learns 
 your password for your online banking service, etc., can't impersonate your 
 or access your accounts unless he also has your trusted device. 2-step 
 verification is a good defense against stolen passwords. 
 
 The purpose of this post - and the embedded survey - is to learn whether 
 2-step verification is popular, and where people are using it. A secondary 
 purpose is to raise awareness of 2-step-verification so that more people will 
 be encouraged to use it.
 
 Please take a few minutes to answer the six (6) questions. Share the survey 
 with your colleagues, friends and family members, especially those who are 
 not overly technical. The more responses, the better!
 
  Thanks in advance for your help. I hope to share results by 15 February.
 
 
-- 
Liberationtech is public  archives are searchable on Google. Violations of 
list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
compa...@stanford.edu.


[liberationtech] Fwd: Call for Applications (April 3 deadline) - NATO Emerging Leaders Working Group

2014-03-29 Thread Greg Norcie



 Original Message 
Subject:Call for Applications (April 3 deadline) - NATO Emerging
Leaders Working Group
Date:   Sat, 29 Mar 2014 19:47:45 -0400
 

 
 
 The Atlantic Council is excited to announce that it is accepting 
 applications for a working group of exceptional emerging leaders
 (ages 25-35) from across the NATO Alliance to recommend concrete
 proposals that support a renewed Trans-Atlantic Bond. NATO Secretary
 General Anders Fogh Rasmussen announced the working group today to
 seek input from emerging leaders in the run-up to the NATO Summit in
 Wales this September and has asked the Atlantic Council to facilitate
 this unique international and nonpartisan initiative.
 
 Following a competitive and merit-based application process, fifteen 
 emerging leaders from NATO member countries will travel to the 
 Atlantic Council’s Toward a Europe Whole and Free conference on
 April 29-May 1 in Washington, DC to meet senior leaders and begin
 drafting recommendations; to NATO HQ in Brussels this June to
 present recommendations to Alliance leaders; and – tentatively – to
 the NATO Summit in Wales this September. Members will have an
 opportunity to shape the discussions at and in the run-up to the 2014
 NATO Summit and build a lasting community of peers committed to
 supporting a strong Trans-Atlantic bond for the twenty-first century.
 Applicants may include elected officials, business leaders,
 journalists, legislative staff, military personnel and veterans,
 community leaders, policy experts, government officials, and other
 professionals working in a field of relevance to the Trans-Atlantic
 bond whose leadership experience, professional expertise, and direct
 role in influencing policy and public opinion position them to
 contribute substantively to the working group and provide innovative
 recommendations.
 
 Please note: •   Participants who have attended past Young
 Atlanticist Summits (in Chicago, Lisbon, Bucharest, Istanbul, and
 Prague) are not eligible to apply. •   Members will have unique
 opportunities to travel and meet exceptional peers and Alliance
 leaders and should expect to participate fully in the events
 mentioned above in 2014 (the April 29-May 1 conference in DC, early
 June conference in Brussels, and tentatively planned Wales Summit
 which is scheduled for the week of September 5).
 
 The deadline to apply is April 3, 2014. To learn more and apply, 
 please visit 
 http://www.atlanticcouncil.org/programs/young-atlanticist-program/nato-emerging-leaders-working-group.


 
If you have any questions, please contact Director of the Atlantic
 Council's Young Atlanticist Program, Jonathan Silverthorne, at 
 jsilvertho...@atlanticcouncil.org 
 mailto:jsilvertho...@atlanticcouncil.org
 
 
 ___ FellowsCareers
 mailing list fellowscare...@listserv.aaas.org
 mailto:fellowscare...@listserv.aaas.org 
 http://listserv.aaas.org/mailman/listinfo/fellowscareers 
 ___ The Fellows Careers
 listserv is intended to provide a free forum for exchange of career
 information among current and former AAAS Fellows only. AAAS does not
 monitor, sanction, or endorse the content of information exchanged
 through the listserv, except when posted by AAAS Fellowships staff
 acting in a professional capacity. Opinions or points of view
 expressed in a listserv message are those of the author and do not
 necessarily reflect those of AAAS or the Science amp; Technology
 Policy Fellowships Department.



-- 
Liberationtech is public  archives are searchable on Google. Violations of 
list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
compa...@stanford.edu.


Re: [liberationtech] 15 years later, why can't Johnny still not encrypt?

2014-01-15 Thread Greg Norcie
The Symposium on Usable Security is an entire conference dedicated to
the subject. They have their proceedings all available on their website:

http://cups.cs.cmu.edu/soups/2013/program.html



- Greg

On 1/15/14, 5:23 AM, Anders Thoresson wrote:
 Hi all!
 
 When doing research on email encryption and why it's still not
 widely used, I've read Alma Whittens Why Johnny Can’t Encrypt: A
 Usability Evaluation of PGP 5.0 [1] from '99. I wonder if anyone
 knows of similar but more recent usability studies on encryption
 software?
 
 Comparing the findings made by Whittens and compare them to the
 software available today, not much seems to have happened. But does
 the conclusion still holds, that a lack of mass-adoption of email
 encryption is due to problematic UX – or are there other reasons
 that today are seen as more important?
 
 [1] –
 https://www.usenix.org/legacy/events/sec99/full_papers/whitten/whitten.ps

  Best regards, Anders Thoresson Freelance reporter 
 and...@thoresson.net http://anders.thoresson.se 
 http://www.dn.se/blogg/teknikbloggen http://twitter.com/thoresson
 
 
 
-- 
Liberationtech is public  archives are searchable on Google. Violations of 
list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
compa...@stanford.edu.


Re: [liberationtech] Sociological studies of covert mass-surveillance organisations

2013-08-31 Thread Greg Norcie
This isn't exactly what you're looking for, but an alleged anonymous TSA 
screener started a blog. I think that some of the details, such as the 
fact that they allegedly have acronyms for bogus bag checks designed to 
inconvenience passengers who are difficult speaks volumes.



http://boingboing.net/2012/12/21/anonymous-tsa-insider-blog.html

- Greg

On 8/31/13 2:14 AM, Luis Felipe R. Murillo wrote:

On 08/30/2013 01:54 PM, Yosem Companys wrote:

From: Caspar Bowden li...@casparbowden.net

  I realize this is an improbable request (I think), but is anyone aware of
any Surveillance Studies research on the organisations conducting *
covert/secret* mass-surveillance (a securitocracy)

many thanks any pointers



I am not particularly familiar with this literature, but I know of a few
pointers.

This seminar in Brazil brought together researchers studying
surveillance and social control. They had three panels of interest
('Internet and Surveillance', 'New Technologies of Surveillance', and
'Institutional Surveillance'):

http://www2.pucpr.br/ssscla/

These two references are central in the debate (so Caspar must be super
familiar with them):

- Foucault, Michel. Discipline and Punish (redefining the debate on
the nature of power and the nature of state power):

http://www.foucault.info/documents/disciplineandpunish/foucault.disciplineandpunish.panopticism.html

- Deleuze, Gilles. Society of Control (updating Foucault's treatment
of surveillance to the contemporary 'society of control'):

http://www.nadir.org/nadir/archiv/netzkritik/societyofcontrol.html

best!
luisfelipe.


--
Liberationtech is a public list whose archives are searchable on Google. 
Violations of list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
compa...@stanford.edu.


Re: [liberationtech] Piratebrowser?

2013-08-11 Thread Greg Norcie

IMHO, it seems like a needless duplication of effort.

Tor alone is pretty good at circumvention. It has a couple flaws - it's 
slower than a simple VPN, and obtaining bridges can be a bit of a 
challenge if you're in a regime that's actively blocking access.


But the Pirate Browser doesn't seem to attempt to solve either of these 
issues.


-Greg

On 8/11/13 10:14 AM, Ben Laurie wrote:

On 11 August 2013 03:39, Griffin Boyce griffinbo...@gmail.com wrote:

On 08/11/2013 12:51 AM, Tom Ritter wrote:

Some other random stats for the curious.

Tor v0.2.3.25 (git-17c24b3118224d65)
Vidalia 0.2.21 (QT 4.8.1)

# Configured for speed
ExcludeSingleHopRelays 0
EnforceDistinctSubnets 0
AllowSingleHopCircuits 1

# Exclude countries that might have blocks
ExcludeExitNodes {dk},{ie},{gb},{nl},{be},{it},{cn},{ir},{fi},{no}

#Selected user prefs
user_pref(browser.startup.homepage, http://6kkgg7nth3sbuuwd.onion;);
user_pref(general.useragent.override, PB0.6b Mozilla/5.0 (Windows
NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0);

-tom

   It's pretty surprising that the Pirate Bay went this route.  I have a
hard time believing that it isn't just some kind of publicity stunt.
They also released the browser as an exe when the site doesn't use
SSL/https. Which is kind of an interesting choice, considering their
stated desire to target Iran (of all places).

   About a year ago, I wrote a quick Chrome plugin for torrenters to
bypass the common DNS blocks on TPB and similar sites.

In the UK I thought blocks were IP-based, hence this piece of
amusement: https://www.openrightsgroup.org/blog/2013/sky-torrentfreak-blocking.


Users from the
UK and the Netherlands (both places where they have a large userbase)
had recently been blocked from accessing TPB.  I have a hard time
believing that Iran represents more than a negligible number of possible
Pirate Bay users.  It could be a scheme to get more of their users to
use privacy-protecting techniques, but a guide might have more of an
effect there.  If their only goal is to bypass censorship of this one
site, there are easier methods that are just as effective.  The plugin I
made was trivial to write and it wouldn't be difficult for the pirate
bay to do something similar (quite a few plugins exist already, and it
wouldn't be hard to just pick one to promote).

~Griffin

--
Cypherpunks write code not flame wars. --Jurre van Bergen
#Foucault / PGP: 0xAE792C97 / OTR: sa...@jabber.ccc.de

My posts, while frequently amusing, are not representative of the thoughts of 
my employer.

--
Liberationtech is a public list whose archives are searchable on Google. 
Violations of list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
compa...@stanford.edu.


--
Liberationtech is a public list whose archives are searchable on Google. 
Violations of list guidelines will get you moderated: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, 
change to digest, or change password by emailing moderator at 
compa...@stanford.edu.


Re: [liberationtech] Internships available at leading Palo Alto tech startup

2013-02-22 Thread Greg Norcie
Unpaid internships are illegal actually. Unless receiving course credit
from a university  - then they're just morally unsound :)

--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 2/22/13 10:16 AM, Q. Parker wrote:
 A list enumerating some items which make this post objectionable:
 
 1) Unpaid internships are wrong on a number of levels.
 
 2) This is data-mining/graph analysis for spam.
 
 3) Quirky should be a qualification for employment only for clinical trials.
 
 4) The only thing this work will liberate is the will to live from 
 fresh-faced recent grads.
 
 All in all, I'd rather bag groceries than work for a company that posts an ad 
 like this
 (and here, no less).
 
 Quirkily,
 Q.
 
 On Thu, Feb 21, 2013 at 06:43:38PM -0800, Hamdan Azhar wrote:
 Please forward widely!

 ---
 INTERNSHIPS AVAILABLE AT LEADING SILICON VALLEY STARTUP

 GraphScience - a Palo Alto based venture-backed startup focusing on
 predictive behavioral analytics in social networks - is offering
 internships for college students and recent graduates. Interns will play a
 valuable role in building the leading social advertising platform on
 Facebook.

 Our clients are major Fortune 500 retailers and we're looking for quirky,
 creative, self-motivated individuals who would thrive in a fast-paced
 environment. Internships are unpaid and last for at least 3 months.

 Interested? Email us your resume, your favorite ice cream flavor, and the
 name of the last book you read.

 CONTACT: Hamdan Azhar, Lead Data Scientist, ham...@graphscience.com
 
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] Internships available at leading Palo Alto tech startup

2013-02-22 Thread Greg Norcie
Sorry, my bad, I totally missed that.

--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 2/22/13 5:00 PM, Scott Elcomb wrote:
 On Fri, Feb 22, 2013 at 4:55 PM, Greg Norcie g...@norcie.com wrote:
 While I agree the OP probably should have gone to libtech-jobs, are they
 actually saying they aren't paying? While they didn't mention payment in
 the OP, they didn't say it was unpaid either. The graphscience site
 lists some internships in with their other hiring opportunities.
 
 OP mentioned it in the initial post:
 
 Our clients are major Fortune 500 retailers and we're looking for
 quirky, creative, self-motivated individuals who would thrive in a
 fast-paced environment. Internships are unpaid and last for at least 3
 months.
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] The Privacy Book, by James Black, PhD?

2013-02-14 Thread Greg Norcie
Good ideas should speak for themselves.

Some of the most knowledgeable people working on PETS  don't have PhDs
(or sometimes, lack degrees completely.)

Anyone who stresses the PhD in order to imply their ideas are somehow
better than others gets an eyebrow raise from me. (And that's coming
from a doctoral student :) )

Also, either that's a fake name, or this James Black hasn't even
published anything of note on the subject. Either way, he's using an
appeal to authority, which doesn't sit well with me.

Furthermore, I don't like the business model. Why doesn't he put the
book up for free, and offer avenues for people to send him donations if
they liked it?

Those who would pirate the book will pirate it anyways, and those who
might not have paid might download it, read it, then decide to donate.

The fact that he didn't consider this as a business model also gives me
pause.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 2/14/13 5:11 PM, Lee Fisher wrote:
 Does anyone have any opinions about the advise in this book? Thanks.
 
 https://www.awxcnx.de/privacybook.htm
 
 snip
 The Privacy Book: The Essential Guide To Living Anonymously
 
 CONTENTS
 CHAPTER 1 – INTRODUCTION
 CHAPTER II – ANONYMOUS  ENCRYPTED EMAIL
 CHAPTER III – ANONYMOUS  ENCRYPTED INTERNET
 CHAPTER IV – COMPUTER  INTERNET SECURITY
 CHAPTER V – GHOST PHONES
 CHAPTER VI – GHOST INTERNET CONNECTION
 CHAPTER VII – DOMAINS, WEBHOSTING,  ECOMMERCE
 CHAPTER VIII – ANONYMOUS  PRIVATE EMONEY
 CHAPTER IX – DATA ENCRYPTION
 CHAPTER X – FAKE IDS  SCAMS
 CHAPTER XI – REAL WORLD ANONYMITY
 CHAPTER XII – CONCLUSION
 REFERENCE LIST
 
 Author:James Black, PhD
 Over 300 pages, high quality, PDF or ePub
 
 The price of the eBook will be pegged to the price of gold.
 
 Pecunix and Liberty Reserve: 0.5 grams of Gold.
 Bitcoins: Equal to 0.5 grams of Gold.
 Euros, Swiss Francs and U.S. Dollars Equal to 0.5 grams of Gold.
 
 Delivery Method: Email (PDF or ePub)
 
 Payment options will be discussed via email. Preferred Payment Options:
 Pecunix, Liberty Reserve and Bitcoin. Negotiable with other payment
 methods.
 
 To purchase the book feel free to contact the autor by the text form
 below. Please add your email address for a reply.
 snip
 -- 
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


[liberationtech] Super Bowl Power Outage: Possible SCADA intrusion?

2013-02-03 Thread Greg Norcie
It's admittedly a wild theory, but it was the first thing that came to
mind. After the game I googled, and came across this gem:

Michael Burns, a spokesman for Entergy Services, the local utility,
said that his company’s distribution and transmission feeders that serve
the Superdome were never interrupted. Power did not go out elsewhere in
the city. 

http://www.nytimes.com/2013/02/04/sports/football/power-outage-in-superdome-delays-super-bowl.html

As many on this list may know, SCADA vulnerabilities are rampant in the
US power grid. And Stuxnet was targeted at SCADA systems overseas.

Now, there's admittedly no evidence, so this is just idle speculation on
my part, but I'd be surprised if I was the only one musing along these
lines, and thought it might be interesting to start a thread about the
possibility.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] Skype Open Letter: CALL FOR SIGNATORIES

2013-01-22 Thread Greg Norcie
You can add my name.

Greg Norcie - PhD Student, Privacy Researcher

--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 1/16/13 11:58 AM, Nadim Kobeissi wrote:
 Dear Privacy Advocates and Internet Freedom Activists,
 
 I call on you to review the following draft for our Open Letter to Skype
 and present your name or the name of your organization as signatories:
 
 http://www.skypeopenletter.com/draft/
 
 The letter will be released soon. Feedback is also welcome.
 
 Thank you,
 NK
 
 
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] Tragic News: Aaron Swartz commits suicide

2013-01-12 Thread Greg Norcie
I really respect Aaron's work, and don't mean to detract from it.

But perhaps we can use this to talk about the issue of depression in the
technology community? (Especially academia - we are, after all on  a
Stanford run email list)

I have several friends in academia who suffer from depression. I am
known  for being a good listening IRL, and I've offered to be there for
many of them.

You know what depressed ME?

All of them remain oblivious the others exist - because they all believe
that publicly acknowledging their mental illness will kill their chances
for tenure and/or prestigious industry research jobs, and have sworn me
to secrecy. These friends come from multiple universities/companies - it
is not a problem endemic to one place.

Depression kills more people than terrorism, DUI, heart disease, breast
cancer - more than so many popular causes.

Again - I do not in any way, shape, or form intend to detract from
Alex's contributions. He was a great inspiration to me, and I greatly
respect his contributions to us all.

But I think that by opening a conversation about mental illness, we can
help more people than debating about JSTOR, and do not want to see this
opportunity lost.

We could remove the stigma from talking about mental illness in academia
today, if we chose. And maybe we could save someone thinking of making
the choice Aaron made.

Personally, I dislike the term suicide. I prefer the wording
died of depression - to emphasize that depression is as much as a
disease as any other.

In closing... I offer my condolences to Aaron's surviving family, and
hope we can use this moment to achieve some sort of silver lining to an
extremely dark cloud.

RIP Aaron.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 1/12/13 3:35 AM, Yosem Companys wrote:
 This is a tragic loss and a terrible blow to the liberationtech community.
 
 Yosem
 
 
 
 http://tech.mit.edu/V132/N61/swartz.html
 
 Aaron Swartz commits suicide
 
 Web Update
 
 By Anne Cai
 NEWS EDITOR; UPDATED AT 2:15 A.M. 1/12/13
 
 Computer activist Aaron H. Swartz committed suicide in New York City
 yesterday, Jan. 11, according to his uncle, Michael Wolf, in a comment
 to The Tech. Swartz was 26.
 
 “The tragic and heartbreaking information you received is,
 regrettably, true,” confirmed Swartz’ attorney, Elliot R. Peters of
 Kecker and Van Nest, in an email to The Tech.
 
 Swartz was indicted in July 2011 by a federal grand jury for allegedly
 mass downloading documents from the JSTOR online journal archive with
 the intent to distribute them. He subsequently moved to Brooklyn, New
 York, where he then worked for Avaaz Foundation, a nonprofit “global
 web movement to bring people-powered politics to decision-making
 everywhere.” Swartz appeared in court on Sept. 24, 2012 and pleaded
 not guilty.
 
 The accomplished Swartz co-authored the now widely-used RSS 1.0
 specification at age 14, was one of the three co-owners of the popular
 social news site Reddit, and completed a fellowship at Harvard’s
 Ethics Center Lab on Institutional Corruption. In 2010, he founded
 DemandProgress.org, a “campaign against the Internet censorship bills
 SOPA/PIPA.”
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

[liberationtech] Facebook Allows You to Pay $1 to Message Anyone

2012-12-22 Thread Greg Norcie
Hi all,

I just read this article about Facebook's recent change to messages:
http://www.pcworld.com/article/2022925/facebooks-1-message-test-opens-inboxes-to-strangers.html

The gist is that you can pay a dollar to make sure your message is
delivered:
In the test, users can pay $1 to make sure their messages land in the
Inbox, rather than the Other section. Facebook thinks this could be the
best way to deliver important messages from non-friends while keeping
spam out of the Inbox.

I was wondering whether anyone else thinks this change could be a
violation of Facebook's FTC settlement? I am not a lawyer, but I know
several policy wonks are on here, so I thought I'd seek a second opinion.

Recall that according to their 2011 settlement, Facebook is required to
obtain consumers' affirmative express consent before enacting changes
that override their privacy preferences
(http://www.ftc.gov/opa/2011/11/privacysettlement.shtm)

Facebook's previous privacy interface allowed users to specify who could
send them messages. For example, a user could have specified that only
their friends could message them.

The new interface offers two options:

1.) Basic Filtering: Mostly just friends and people you know
2.) Strict Filtering: Mostly just friends - you may miss messages from
other people you know

(Screenshot: http://imgur.com/EZSBq)

If a user, prior to this change, had made their settings such that only
friends could message them, this change makes it such that ANYONE
(including strangers) to pay to message them.

Couldn't this be construed as enacting changes that override privacy
preferences without affirmative express consent, and thus a violation of
the 2011 settlement?
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] issilentcircleopensourceyet.com

2012-11-06 Thread Greg Norcie
Nadim

I understand your position, but actions like this website won't help
your cause.

Can you understand how actions like setting up this web site might be
viewed as a way to call attention to oneself, rather than champion the
(respectable) ideals of the open source movement?
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 11/6/12 1:53 PM, Nadim Kobeissi wrote:
 Ali,
 The issue is trust. Security software verifiability should not have to
 depend on Silent Circle (or who they hire to audit, for example Veracode.)
 
 
 NK
 
 
 On Tue, Nov 6, 2012 at 1:51 PM, Ali-Reza Anghaie a...@packetknife.com
 mailto:a...@packetknife.com wrote:
 
 Nobody would dispute that - that's not quite the same thing as FOSS
 default positions or some of the other criticisms.
 
 For example, I'd contend a paid Veracode audit would in all
 likelihood be better than any typical FOSS audit. Had they done that
 (heck, they might have but I doubt it) and still announced the
 intent of opening the codebase - I wager that would not have stopped
 the criticism.
 
 It appears to be a deep-seeded cultural divide more than any of the
 other factors combined.
 
 -Al
 
 
 
 On Tue, Nov 6, 2012 at 1:43 PM, Yosem Companys
 compa...@stanford.edu mailto:compa...@stanford.edu wrote:
 
 Security audits are always important, especially when people's
 lives are at risk.
 
 On Tue, Nov 6, 2012 at 10:37 AM, Nadim Kobeissi na...@nadim.cc
 mailto:na...@nadim.cc wrote:
 
 Hi Ali,
 There is no agenda, and there needn't be one if you are to
 critique security software. No need to be so aggressive.
 My qualms against Silent Circle are detailed
 here: http://log.nadim.cc/?p=89
 
 
 NK
 
 
 
 On Tue, Nov 6, 2012 at 1:34 PM, Ali-Reza Anghaie
 a...@packetknife.com mailto:a...@packetknife.com wrote:
 
 Seriously - what's your agenda?
 
 Where are the domains for the other tens of providers
 who charge arms and legs based on closed protocols even?
 
 What's the nit with Silent Circle specifically? Because
 they're accessible? Because it's easier to use? Because
 the founders have good track records of standing up to
 Government too?
 
 Being absolutist about everything isn't helping anyone
 who ~needs~ it - it's a privilege of the haves that we
 can have these conversations over and over again.
 
 Shouldn't we have taken the fight to carriers, Apple
 iOS TCs, etc. harder and longer ago? And why do we keep
 expecting private entities to fight our Government
 battles for us? It's a losing proposition and increases
 the costs-per-individual to untenable levels when we mix
 absolutely all their enterprise with civil liberty issues.
 
 There has got to be a better way than this ridiculous
 trolling and bickering. Someone? Anyone?
 
 Again, seriously, what's the agenda against Silent
 Circle specifically?
 
 -Ali
 
 
 
 On Tue, Nov 6, 2012 at 1:20 PM, Nadim Kobeissi
 na...@nadim.cc mailto:na...@nadim.cc wrote:
 
 http://issilentcircleopensourceyet.com/
 
 NK
 
 --
 Unsubscribe, change to digest, or change password
 at:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 
 
 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 
 
 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 
 
 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 
 
 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 
 
 
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] Bitcoin and The Public Function of Money

2012-11-05 Thread Greg Norcie
The personal (computer) is political :)
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 11/5/12 1:21 PM, Yosem Companys wrote:
 They go hand in hand.  Can't have philosophy without practices... ;)
 
 On Mon, Nov 5, 2012 at 10:12 AM, Dmytri Kleiner d...@trick.ca wrote:
 Hey Yosem, pretty sure the thread has run its course at this point. But in
 any case we can't get the tech part right if we don't get the liberation
 part right.

 The user stories for liberation tech must certainly derive from visions of
 liberation, or?

 Especially when the tech in question is economic in nature, such as Bitcoin.

 And economics is a technology every but as much as cryptography.







 --
 Dmytri Kleiner

 Yosem Companys compa...@stanford.edu wrote:
 Just a little nudge to get folks back on the liberationtech discussion.
 While I (and probably others) find the discussion on this thread
 interesting, it appears to lack the necessary technology component to be
 deemed liberationtech.

 Thanks all,

 Yosem

 On Mon, Nov 5, 2012 at 4:15 AM, André Rebentisch tabe...@gmail.com wrote:

 Am 05.11.2012 11:19, schrieb Jacob Appelbaum:
 It isn't a straw man. Free trade is a nonsense phrase - free? Free for
 you? For me? Unencumbered by state taxes as it crosses a border? How
 does that trade happen? When I create something of value - have I done
 it in a vacuum?
 Free trade relates to tariffs and  (import/export) quota, in other
 words overcoming geographical market segmentation.

 Best,
 André

 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech



 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] Large amounts of spam

2012-10-31 Thread Greg Norcie
Maybe I'm paranoid, but I wonder if this is an effort to disrupt the
list (as opposed to the usual economic incentives associated w/ spam.)
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 10/30/12 8:09 PM, Yosem Companys wrote:
 I've placed the list under emergency moderation, so I will have to
 approve every message individually before it gets delivered.  Hopefully,
 this will stop the spam.
 
 On Tue, Oct 30, 2012 at 4:32 PM, Nadim Kobeissi na...@nadim.cc
 mailto:na...@nadim.cc wrote:
 
 This mailing list has a spam problem (I'm receiving nude photo
 attachments now.) Admins: Please address!
 
 Thank you,
 NK
 
 --
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 
 
 
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] Large amounts of spam

2012-10-31 Thread Greg Norcie
I used to do anti-phishing training for a start up.

Spammers aren't dumb.

They probably realize

1.) People in academia trust other academics
2.) People from Stanford have more disposable income than the average
mailing list recipient.

:)

--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 10/31/12 6:50 PM, Bernard Tyers - ei8fdb wrote:
 At a risk of receiving the mentioned spam myself (thankfully my
 mail provider also seems to be killing the spam before it gets to
 me), and at risk of offering another evidence-less possible
 scenario -
 
 There was recently a valid e-mail account that was somehow used
 to send spam to the list. It's quite conceivable that account is
 some way connected/has provided the beginning point.
 
 Or like the person from Stanford mentioned maybe the spam is
 targeting a number of Stanford lists
 
 On 31 Oct 2012, at 22:41, Yosem Companys wrote:
 
 Maybe. But the site was already mirrored for a while prior to
 the archives being made public.  So I think that's unlikely.
 
 On Wed, Oct 31, 2012 at 3:39 PM, Andrew Lewis m...@andrewlew.is
 wrote:
 Maybe someone is simply scrapping the archives for the sender
 address?
 
 
 On Oct 31, 2012, at 6:36 PM, Sarah Watts wrote:
 
 I am one of the...people it got; my email address was
 suddenly subscribed to more than thirty lists (Twenty maybe)
 none of which I subscribed to.
 
 I contacted someone...and have yet to do the second thing
 they suggested.
 
 -S
 
 On 10/31/12, S Vivek vivek...@stanford.edu wrote:
 Greg: This seems to be happening in other lists at
 Stanford, and so I won't be worried of a concerted effort
 against the libtech listserv.  We are working on it, and I
 hope that we'll be able to handle it soon.
 
 Vivek
 
 
 = Program on Liberation Technology, Stanford
 University http://liberationtechnology.stanford.edu
 
 C 149 Encina Hall 616 Serra St. Stanford, CA 94305
 
 Phone: 1-801-784-8357, that is 1-801-S Vivek's!
 
 Blog: http://viveks.info
 
 
 
 On Wed, Oct 31, 2012 at 1:34 PM, Andy Isaacson
 a...@hexapodia.org wrote:
 
 On Tue, Oct 30, 2012 at 07:32:18PM -0400, Nadim Kobeissi
 wrote:
 This mailing list has a spam problem (I'm receiving
 nude photo
 attachments
 now.) Admins: Please address!
 
 Hmmm, I'm not seeing this problem; I'm subscribed to
 liberationtech on a bog-standard linux + postfix
 installation and I save every message delivered before I
 run spam filtering, and I don't see anything 
 porn-spam-related in my all-mail archive.
 
 Care to share one of the spam messages (headers + body
 text only, I don't need any more nude photos thnx)?
 Offlist is bettter I suppose.
 
 -andy -- Unsubscribe, change to digest, or change
 password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech



 
--
 Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 -- Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 -- Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 -- Bernard / bluboxthief /
 ei8fdb
 
 IO91XM / www.ei8fdb.org
 
 -- Unsubscribe, change to digest, or change password at:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] CryptoParty Handbook

2012-10-07 Thread Greg Norcie
I think this is a great project.

But I do think that a manual is a stopgap measure - it would also be
great if we worked towards making these tools usable enough that they
didn't need a manual.

If we can make an iPod so easy enough for our grandparents to use, we
should be able to do the same with Tor, PGP, etc. It will be a long,
arduous process, but I think it can be done.

Usable security it not an oxymoron :)
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 10/4/12 5:13 PM, Andrew Mallis wrote:
 
 FYI
 
 This 392 page, Creative Commons licensed handbook is designed to help
 those with no prior experience to protect their basic human right to
 Privacy in networked, digital domains. By covering a broad array of
 topics and use contexts it is written to help anyone wishing to
 understand and then quickly mitigate many kinds of vulnerability using
 free, open-source tools. Most importantly however this handbook is
 intended as a reference for use during Crypto Parties.
 
 
 PDF available for download and more info:
 
 https://cryptoparty.org/wiki/CryptoPartyHandbook
 
 
 
 *Andrew Mallis*
 #ows Tech Ops http://www.nycga.net/groups/tech | FGA
 http://wiki.occupy.net/wiki/Federated_General_Assembly | Occupy
 Directory http://directory.occupy.net
 
 
 
 --
 Unsubscribe, change to digest, or change password at: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
--
Unsubscribe, change to digest, or change password at: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech


Re: [liberationtech] archives public

2012-08-11 Thread Greg Norcie
There is what should be, and there is reality.

Any mailing list that allows anyone to subscribe is effectively public -
some malicious actor will always siphon off posts, regardless of laws,
list policies, or basic social norms.

Making claims that a list is private is dangerous and gives a false
sense of security IMHO.

I say we keep the list as it is - no automated archive. And if there is
a technical measure to indicate to ethical bots not to archive, we set
that up. But I feel strongly that we should _not_ make any claims that
the list is private. We should state something like While LibTech
attempts to limit crawling by robots, this list is open to anyone, and
thus, is for all intents and purposes, public.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 8/11/12 3:58 PM, André Rebentisch wrote:
 Am 10.08.2012 06:40, schrieb Brian Conley:
 I agree with you generally Jillian, but perhaps the list guidelines
 should be changed to simply make the archives public?
 
 I respectfully disagree, I experienced it as dangerous to have open ML
 archives. In Germany I would clearly advise list admins against unless
 it is a newsletter. I have been through this.
 a) case of noticetakedown action: Most list admins have no process how
 to delete individual posts from the archives. If you don't respond in
 time you get into trouble. You never get enough time to respond when
 your opponents are malicious.
 b) several emails per year from individuals kindly asking you to remove
 posts from the archives of an inactive list you didn't even know.
 c) google indexing, which promotes a) and b) cases
 
 A  ML usually implies an expectation about the audience and a customary
 agreement how to share submissions. If you subscribe to a mailing list
 w/o open archives your are not supposed to make them available.
 
 Here an example: RMS once had a discussion with Zimbabwe supporters on
 an IGF internet governance list where he expressed quite frank and
 opinionated views about the nature of the Mugabe government. Because
 it was an open list with open archives (but limited subscribers) the
 conversation ended up indexed by Google. RMS did not bother that he
 endangered his African discussion partners by inciting them to answer
 his flame bait. Did participants to a ML gave their prior consent to
 leave a totalitarian trace? Google indexing makes the discussion
 partners uneven, because (email surveillance aside) certain parties
 cannot express their views within the group.
 
 Google indexing of open archive ML leaves a trace that anyone without
 advanced knowledge, access or technology could exploit.  You type the
 email of a student from Zimbabwe and you find a discussion where he
 responds to a critic of the Mugabe government. Not relevant for us, we
 enjoy free speech, but it may become quite dangerous for this person, in
 particular, if the nature of the regime was correctly described. I am
 disgusted by the information wants to be free cynicism in these scenarios.
 
 Best,
 André
 ___
 liberationtech mailing list
 liberationtech@lists.stanford.edu
 
 Should you need to change your subscription options, please go to:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 If you would like to receive a daily digest, click yes (once you click 
 above) next to would you like to receive list mail batched in a daily 
 digest?
 
 You will need the user name and password you receive from the list moderator 
 in monthly reminders. You may ask for a reminder here: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 Should you need immediate assistance, please contact the list moderator.
 
 Please don't forget to follow us on http://twitter.com/#!/Liberationtech
 
___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech


Re: [liberationtech] archives public

2012-08-11 Thread Greg Norcie
I am not suggesting legalizing murder

I am suggesting placing prominent signs in an area where many murders
occur :)

These signs could warn people to take reasonable precautions such as
avoiding travel at night, and dialing 911 to report suspicious persons,
and possibly choosing to obtain a concealed carry permit.

I don't think these signs would normalize murders. My own undergrad
used to post flyers in areas where muggings occured, and this didn't
make me think it was OK to mug people - it made me take a bus or a cab,
rather than walk through those areas late at night.

Also, we have a means to stop CCTV - privacy legislation. For example,
if London (CCTV champion of the world) changed their laws, the use of
CCTV could be eliminated very easily.

There is no easy fix to stop malicious individuals and/or intelligence
agencies from siphoning off posts. The intelligence agencies of the
world all have pretty much free reign to spy on the communications of
the rest of the world. Some of the less human rights respecting ones spy
on their own people as well :)

You talk about how terrible it is that these privacy violations are
occurring - and I emphatically agree, 100%.

Where we differ is that I think that it is better to warn people about
their lack of privacy, and perhaps help them avoid making a dangerous
disclosure, rather than pay lip service to some ill-defined idea like
normalization while some poor souls posts something that could get
them arrested or killed.

I value human lives over ideas, especially when those ideas aren't
backed with data. Can you show me proof that people's privacy attitudes
change when exposed to privacy warnings in the manner you fear will
happen? (If not - hey - potential study idea up for grabs :) )
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 8/11/12 4:20 PM, André Rebentisch wrote:
 Am 12.08.2012 01:03, schrieb Greg Norcie:
 There is what should be, and there is reality.

 Any mailing list that allows anyone to subscribe is effectively public -
 some malicious actor will always siphon off posts, regardless of laws,
 list policies, or basic social norms.
 
 Radicalising realism, why do societies sanction murder if all people
 have to die anyway? ;-)
 
 But seriously, in the context of camera surveillance: Analogue argument,
 you are in public space, everyone could watch you at the streets, why
 bother camera surveillance? Shouldn't a citizen expect to be recorded on
 tape? etc.
 
 I am all for worst case expectations but often it's a human slippery
 slope that we tend make these views normative and as a result promote
 practices that make things worse and discourage higher ambitions and
 standards.
 
 Best,
 André
 ___
 liberationtech mailing list
 liberationtech@lists.stanford.edu
 
 Should you need to change your subscription options, please go to:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 If you would like to receive a daily digest, click yes (once you click 
 above) next to would you like to receive list mail batched in a daily 
 digest?
 
 You will need the user name and password you receive from the list moderator 
 in monthly reminders. You may ask for a reminder here: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 Should you need immediate assistance, please contact the list moderator.
 
 Please don't forget to follow us on http://twitter.com/#!/Liberationtech
 
___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech

Re: [liberationtech] archives public

2012-08-10 Thread Greg Norcie
Yes.

I think I was unnecessarily harsh in my own initial reply.

We simply cannot presuppose knowledge of a system. Security nonexperts
have different mental models.

Can we solve every security issue? No. And this is one that
unfortunately, can't be solved without user education.

However, if there's a way to tell robots not to archive this list, I
think it should be undertaken. Corporations and other private business
entities will always respond to the letter (not the spirit) of the law
(/rules/W3C standards)
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635


On 8/9/12 9:40 PM, Brian Conley wrote:
 I agree with you generally Jillian, but perhaps the list guidelines
 should be changed to simply make the archives public?
 
 In the interest of simplicity and transparency to users, this is
 probably the best solution. Currently individuals who are more
 knowledgeable have more access, while those who are less knowledgeable
 may have incorrect assumptions about the safety/security of the content
 of their emails to the list.
 
 This is starting to feel a bit like the crux of that cryptocat
  conversation, no?
 
 On Thu, Aug 9, 2012 at 3:03 PM, Jillian C. York jilliancy...@gmail.com
 mailto:jilliancy...@gmail.com wrote:
 
 Folks, *anyone can join the list*.  I assume you all know that,
 since you all joined once.  Therefore, this seems like a pretty
 silly thing to argue about.
 
 
 On Thu, Aug 9, 2012 at 7:29 AM, Maxim Kammerer m...@dee.su
 mailto:m...@dee.su wrote:
 
 On Thu, Aug 9, 2012 at 4:41 PM, Sam King
 samk...@cs.stanford.edu mailto:samk...@cs.stanford.edu wrote:
  In general, I prefer it when the reply-to is as it is in this
 mailing list.
  When I want to reply to the sender, I hit reply, and when I
 want to reply to
  all, I hit reply all.
 
 Then, after N replies in a row, you have N subscriber emails in To:
 header, which means that user's mail server has to send N identical
 emails (strain on the server, risk of triggering spam filters), list
 server has to filter email to subscribers who are in To: or Cc: (if
 anything goes wrong, they get an email twice), and anyone who
 forwards
 an email from the list unnecessarily exposes subscribers' email
 addresses.
 
  When the reply-to is the list, it becomes more
  annoying to reply just to the sender.
 
 Any decent mail client has a “Reply to Sender” button — no idea why
 GMail doesn't (or I didn't look hard enough).
 
 --
 Maxim Kammerer
 Liberté Linux: http://dee.su/liberte
 ___
 liberationtech mailing list
 liberationtech@lists.stanford.edu
 mailto:liberationtech@lists.stanford.edu
 
 Should you need to change your subscription options, please go to:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 If you would like to receive a daily digest, click yes (once
 you click above) next to would you like to receive list mail
 batched in a daily digest?
 
 You will need the user name and password you receive from the
 list moderator in monthly reminders. You may ask for a reminder
 here: https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 Should you need immediate assistance, please contact the list
 moderator.
 
 Please don't forget to follow us on
 http://twitter.com/#!/Liberationtech
 
 
 
 
 -- 
 *+1-857-891-4244 tel:%2B1-857-891-4244 |**jilliancyork.com
 http://jilliancyork.com/ | @jilliancyork *
 
 We must not be afraid of dreaming the seemingly impossible if we
 want the seemingly impossible to become a reality - /Vaclav Havel/
 
 
 
 
 ___
 liberationtech mailing list
 liberationtech@lists.stanford.edu
 mailto:liberationtech@lists.stanford.edu
 
 Should you need to change your subscription options, please go to:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 If you would like to receive a daily digest, click yes (once you
 click above) next to would you like to receive list mail batched in
 a daily digest?
 
 You will need the user name and password you receive from the list
 moderator in monthly reminders. You may ask for a reminder here:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 Should you need immediate assistance, please contact the list moderator.
 
 Please don't forget to follow us on http://twitter.com/#!/Liberationtech
 
 
 
 
 -- 
 
  
 
 Brian Conley
 
 Director, Small World News
 
 http://smallworldnews.tv http://smallworldnews.tv/
 
 m: 646.285.2046
 
 Skype: brianjoelconley
 
 public
 key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0xCEEF938A1DBDD587 
 http://pgp.mit.edu

[liberationtech] Wired's response to Soghoian's criticism of their Cryptocat article

2012-08-08 Thread Greg Norcie
I am interested in what the list thinks of this recent Wired article:
http://www.wired.com/threatlevel/2012/08/security-researchers/all/

I have written a few paragraphs, but I'll sit on them until morning and
see if I am still as unhappy w/ Wired tomorrow morning as I am now
before posting them publicly.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech


Re: [liberationtech] AES-encyrpted telephony in Iran?

2012-06-12 Thread Greg Norcie
Also, regardless of it's technical merits, that price is way too high.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 6/12/12 9:29 PM, Naiz Mudin wrote:
 Ladies  Gentlemen,
 
 I have discovered, by serendipity, an iOS application that is evidently
 also available for Windows Phone and Symbian (soon to be replaced with
 Windows Phone 8). It is called, SafeSession and claims 256-bit AES
 encryption between known and trusted users.
 
 Is this a viable opportunity for an Iranian audience? On iOS market, the
 price is at $299 USD, clearly out of the price range of an Iranian
 economy reeling from the effects of sanctions and out-of-control
 inflation. Can it be migrated, or somehow ported?
 
 The technology intrigues me greatly - as I am a paladin for technology
 that permits open but secure communications between Iranians without
 fear of filtering or government monitoring. But is the cost too high?
 Has the developer not found the right market? Or is it simply not the
 right tool to solve the right problem?
 
 http://safe-session.com/safe_session_voip
 
 Regards,
 
 NaizMudin
 @naizmudin
 
 
 ___
 liberationtech mailing list
 liberationtech@lists.stanford.edu
 
 Should you need to change your subscription options, please go to:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 If you would like to receive a daily digest, click yes (once you click 
 above) next to would you like to receive list mail batched in a daily 
 digest?
 
 You will need the user name and password you receive from the list moderator 
 in monthly reminders. You may ask for a reminder here: 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 Should you need immediate assistance, please contact the list moderator.
 
 Please don't forget to follow us on http://twitter.com/#!/Liberationtech
___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech


Re: [liberationtech] Urgent question

2012-06-04 Thread Greg Norcie
Sam makes a great point.

In general, it is a best practice to assume that anything posted to a
mailing list like this (or any other form of social media) is public,
regardless of any privacy settings.

Even if the list is not indexed by the maintainers, any member could
choose to copy the messages sent to the list, and post them on the
public web.

However, I do believe that this list does not make the subscriber list
publicly available, so if someone wants to sign up and lurk, as long as
they do not post, their identity would not be known to anyone other than
the admins.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 6/4/12 9:12 PM, Sam King wrote:
 ...any privacy you're getting is just security through
 obscurity.  

___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech


Re: [liberationtech] Outside of the list/listmembers is Libtech basically private, or basically public? WAS - Re: Urgent question

2012-06-04 Thread Greg Norcie
Brian,

Yes, I agree that the community believes these things.

The problem is that a malicious actor could sign up for the list and
forward messages posted to it. The admins allow freemail users to
subscribe, so this is a credible attack vector.

While I trust the members of the community would not violate the spirit
of the list, unfortunately we cannot guard against malicious outsiders
while maintaining the open spirit that the list currently has.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 6/4/12 9:49 PM, Brian Conley wrote:
 I believe we have also agreed, generally, as a community, that the
 content here should not be shared broadly outside the list, or consider
 on the record unless you request the consent of the initial poster. I
 hope others will state whether they think this is the case, or not?
 
 I know that the community is online and so not secure but i believe
 it should be considered private to the community as a matter of courtesy.
 
 I hope others will jump in with their thoughts as well!
 
 Brian
___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech


Re: [liberationtech] Privacy-minded search engines?

2012-05-01 Thread Greg Norcie
Privacy Bird was an early attempt at a privacy sensitive search
engine, rendering privacy ratings based on P3P.

Project site:
http://www.privacybird.org/faq.html

Academic article on it's development (apologies for the paywall):
http://dl.acm.org/citation.cfm?doid=1165734.1165735
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635

On 5/1/12 8:39 AM, Okhin wrote:
 On Mon, 30 Apr 2012 23:19:06 -0700 Parker Higgins par...@eff.org
 wrote:
 
 On 4/30/12 3:55 PM, Cyrus Farivar wrote:
 Hey guys,
 
 I'm working on a piece about privacy-minded search engines. I
 know of DuckDuckGo and IXQuick. Any others out there?
 
 seeks-project.info which is an opensourced and P2P searchengines,
 each user can/may set-up it's own node and connect it to peers to
 enhance it's ability to find pertinent results.
 
 OKhin ___ 
 liberationtech mailing list liberationtech@lists.stanford.edu
 
 Should you need to change your subscription options, please go to:
 
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 If you would like to receive a daily digest, click yes (once you
 click above) next to would you like to receive list mail batched
 in a daily digest?
 
 You will need the user name and password you receive from the list
 moderator in monthly reminders. You may ask for a reminder here:
 https://mailman.stanford.edu/mailman/listinfo/liberationtech
 
 Should you need immediate assistance, please contact the list
 moderator.
 
 Please don't forget to follow us on
 http://twitter.com/#!/Liberationtech
___
liberationtech mailing list
liberationtech@lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click yes (once you click above) 
next to would you like to receive list mail batched in a daily digest?

You will need the user name and password you receive from the list moderator in 
monthly reminders. You may ask for a reminder here: 
https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech