Re: Duress PIN, Mixfit and PlugMate

Jan Panteltje wrote:
>> Ch1ffr3punk <[email protected]>wrote:
>>> Ch1ffr3punk wrote:
>>> Jan Panteltje wrote:
>>>>> [email protected] (LucLan)wrote:
>>>>>> In alt.cypherpunks Jan Panteltje <[email protected]> wrote:
>>>>>>> Ch1ffr3punk <[email protected]>wrote:
>>>>>>>> Ch1ffr3punk wrote:
>>>>>>>
>>>>>>>> Do you think that borders guards are that stupid when they search
>>>>>>>> people and see VeraCrypt usage?
>>>>>>>
>>>>>>> And if you use for passwords, NFT tags, hidden in a book etc.,
>>>>>>> US law enforcement has devices to destroy them.
>>>>>>
>>>>>>
>>>>>> Anybody been swallowing micro-sdcards?
>>>>>>
>>>>>>
>>>>> No. Why?
>>>>
>>>> Put you secret messages and data on it,
>>>> swallow it and then pass through customs?
>>>> Make sure you carry a big smartphone with lots of OK stuff
>>>> to distract security?
>>>
>>> Probably a better way would be to carry no devices at all
>>> and only purchase an empty USB stick at arrival, when you
>>> download all your goodies from public repositories and
>>> only need to remember the passphrase you exchanged with
>>> your loved ones.
>>>
>>> That's how MicroCrypt works and additionally you can
>>> receive/transfer files with NymX over the Nym Mixnet,
>>> so that third-parties do not know with whom you do
>>> files transfers.
>>>
>>> https://github.com/Ch1ffr3punk/MicroCrypt
>>> https://github.com/Ch1ffr3punk/NymX
>>>
>>> HTH!
>>>
>> P.S. Prior depature, one can sign-up with https://atomicmail.io/
>> without providing any credentials, so that your loved ones have
>> your email address, when using MicroCrypt.
> 
> 
> //>--
>> https://oc2mx.net
> Interesting,
>   https://oc2mx.net/am.html
> 
> I will be 80 in a few month this year, been on internet since it started, used Win 3.1 and Trumpet Winsock,
> when Billy The Gates said 'internet is not that important'.
>   Bill Gates stated that he saw "little commercial potential for the internet for the next 10 years"
>   during a Comdex trade event in 1994.
>   Additionally, in his 1995 book "The Road Ahead,"
>   he described the internet as a novelty that would eventually be replaced by something better.
> 
> Before that in 1980 we had 'Videotex' (Viditel in the Netherlands where I am now)..
> Have my own website ever since...
>   https://panteltje.nl/index1.html
> Sometimes ran the server at home when I had a fixed IP address (cable) now web hosting outsourced.
> 
> Started using Linux when SLS Linux came, end of MS windows for me.
> 
> Anyways these days US will also want to know about your online activities for a Visa ..
> So not expecting to get a Visa from them, I refused to join CIA many years ago too.
> 
> As to transferring encrypted stuff, there are so many ways...
> With memory things getting smaller and smaller and having more and more capacity,
> hiding something, even in your watch, becomes easier and easier.
> Drones... Radio... Satellite..
> Played with it all.
> 
> Or you can just post your encrypted stuff on Usenet and thousands will read it...
> 
> There is more to it...
> I tramp keeps going maybe after the nukes try Morse and smoke signs?

Your NewsFleX sucks mate.
Today as in the 80s.

Path traversal in the downloader.

Command injection: URLs and group names end up in shell commands executed with popen().

Memory corruption in NNTP, SMTP, and FTP responses: with a line exactly READSIZE long, the terminator is written beyond the buffer.
Crash and possible stack corruption caused by a malicious server. 

HTML parser without size checking: temp_pos grows without checking the buffer limit. 

Insecure credentials: NNTP password saved in clear text and sent via AUTHINFO PASS over a TCP socket without TLS. 

The OTP is cryptographically insecure: it generates the key via rand(), without secure initialization. 
Predictable keys and possible reuse of the pad, so the promised confidentiality is unreliable. 
The filter password uses crypt() with a fixed salt of "P8". 
The hash is easily attackable and the same for identical passwords.

Verdict: I would not use it on the Internet, with real credentials, or on the main system. 
Above all, it should never be run as root, despite the README explicitly recommending it.
For historical testing, only in a dedicated VM, as a non-privileged user, without a shared home and without personal data.