June 1993 - cypherpunks-legacy

Re: Encrypting Cypherpunks mailing list postings
by dmandl＠lehman.com 09 Jun '93

09 Jun '93

From: crunch(a)netcom.com (John Draper) > Mikes response to the ideas of encrypting the Cypherpunks mailing list... > > >I was (thinking?) of distributing a common secret key to > >people > >who we know are not spooks, and who would be interested in the cypherpunk's > >cause. > > I think it MAY be possible to write a perl program that would take the > incoming mail encrypted with a single common public key for Cypherpunk > mailing list mail, than would decrypt it internally, then for each > person in the mailing list, using their public keys, encrypt each > message for the individual recipients, and mail them out. But this is a PUBLIC LIST. Our readers from the NSA/FBI/CIA will get the messages along with everyone else--encrypted with their keys, of course, so no spies can read them! I just don't think any of this makes sense for a list this large and this open. Anyone can subscribe. For smaller circles of friends who know and trust one another, it would be more useful. BTW, wouldn't this all be easier using the "multiple recipients" feature of PGP anyway? This is exactly the kind of thing it was designed for: Server gets message, server multiply-encrypts to all subscribers, server distributes message the same way it does now. But again, I think this is pointless on a list like this. > The ravers can really use something like this to keep the Full Moon Raves > location a secret and known ONLY to those dedicated ravers that want to > attend. Yup. Agreed. This is exactly the kind of group that should be using PGP in this way. I do think that it would be a good idea to make an active effort to distribute and certify keys. This will also help to promote the use of encryption, which should be one of our main goals. Also: Making a sub-list of people who are "known not to be spooks," on a list like this, is dangerous. Would be nice if we could really do it, but there would almost certainly be agents getting included in the sub-list, as well as exclusions of folks who aren't agents. --Dave.

1 0

ComputerWorld article on Clipper/Capstone
by fergp＠sytex.com 09 Jun '93

09 Jun '93

ComputerWorld June 7, 1993 Vol. 27, No. 23 page 21 Fed officials pan ban of old encryption specs by Gary H. Anthes Gaithersburg, MD Federal officials responsible for shaping information security policy said last week that legislation mandating use of the government's recently proposed encryption technology -- and banning the use of older but popular techniques -- is neither wise nor legal. In April, the White House said it intended to establish as a federal standard an approach to encryption called "key-escrow." This method would require that the keys needed to unlock a coded conversation be kept by government-approved agencies and retrieved only for court-ordered wiretaps. Dubbed "Clipper" for voice communications and "Capstone" for data, the approach is intended to balance the conflicting objectives of users -- who demand absolute security and privacy -- and law enforcement agencies, which are looking for a legal "backdoor" into coded criminal communications. Protecting rights to privacy But the idea has been challenged by civil libertarians who fear abuses by a technologically empowered Big Brother, and by some users, especially those such as banks that have made large investments in cryptography based on the older Data Encryption Standard (DES), which some fear could be banned by the government. Protesters so far include the Computer and Business Equipment Manufacturers Association, Information Technology Association of America, Computer Professionals for Social Responsibility, Electronic Frontier Foundation, Business Software Alliance, Software Publishers Association and Information Systems Security Association. Raymond Kammer, acting director of the National Institute of Standards and Technology (NIST), acknowledged that a ban on existing techniques would be considered. "But my personal opinion is, I can't see doing anything that would take away any freedoms we now enjoy," Kammer said. "We tried to come up with a technique that would not require legislation," said Clint Brooks, advisor to the director of the National Security Agency, which developed and now strongly supports the key-escrow approach. Brooks predicted it would be years before criminal use of DES would be wide-spread enough to present obstacles to law enforcement agencies, which cannot crack DES codes. "Let's wait and see if legislation is needed," he said. While the majority of those attending a public hearing at the NIST last week spoke out against the government's proposal, a few strongly defended it saying criticisms are either misdirected or deal with fixable flaws. Donald Alvarez, national defense science and engineering graduate fellow at Princeton University, outlined six ways that Clipper could be breached but finished by saying, "I definitely believe it is possible to address the needs of both [users and law enforcers], even with the Clipper and Capstone chip sets." 8<---------- End of Article ------------- In a small, corner-page, footnote box on the same page -- "Keyed up In a statement filed with the Computer System and Privacy Advisory Board, Citicorp raised the following concerns about Clipper: o The private sector was not adequately consulted. o The algorithm used in Clipper/Capstone is not compatible with other commonly used encryption methods and will only cause costly disruptions for businesses. o The algorithm -- which is to be secret but will be examined by a handful of government-chosen experts -- "will undergo inadequate scrutiny and hurried review." o The databases and access systems associated with Clipper may be flawed and insecure." Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

3 4

Re: Timothy C. May:superhacker
by AOLCHTNN＠vax1.tcd.ie 09 Jun '93

09 Jun '93

Why doesn't Tim and anyone else who suspects that they have reached the much-sought status of "superhacker on gov't files not just write to their local friendly federal government office and ask for a copy of their own records? As far as I know, the US freedom of information act allows anyone access to information about them that has been stored by the government. (I'm not a laywer and not even a US resident so don't quote me on any of this; but then I'm not charging legal fees either.) Of course any interesting information they've got is likely to be classified, but at least you'll find out whether any such information is stored on the files. Of course, requesting your own government file is likely to draw attention to yourself, so it's probably best not to do so unless you're sure that they already know that you know-that-they-know-something. Yours becoming increasingly paranoid by the minute, Antoin O Lachtnain, Trinity College, Dublin (Colaiste na Trinoide, Baile Atha Cliath)

1 0

Re: CERT
by Clark Reynard 09 Jun '93

09 Jun '93

Marc Horowitz <marc(a)GZA.COM> writes: >>> From: Clark Reynard <clark(a)metal.psu.edu> >> Excepting the Morris Worm, can you name a SINGLE Computer Emergency >> which CERT has halted? It is simply an organization to keep the >> crypto-fascists wired into the net. >My experience with them in the past has been as a clearinghouse for >users to report security-related bugs to vendors, and for vendors to >provide fixed back to users. They've done an admirable job at this; >the major complaint is that they are too slow. They also help >distribute tools like COPS to validate unix workstation security. Granted. However, as you say, they are terribly slow and inefficient even at this. While I read CERT adisories and clippings, it is rare that I discover anything which could be called 'news.' >They are a proactive organization, not a reactive organization, so >it's meaningless to ask what "Computer Emergencies" CERT has "halted". Perhaps, then, their name is inappropriate. The term "Computer" seems to imply they are involved with computers. This is true. However, "Emergency," when modified by "Computer," seems to indicate that they are involved in some way with "Computer Emergencies," whatever this means. When combined with "Response," the previous terms seem to imply that they are intended to "Respond" to "Computer Emergencies," which, as you say, they don't do. They ought to change their name, or find some computer emergencies to which to respond. >I think that calling them "crypto-fascists" is at best an unsupported >smear, and at worst slanderous. A quibble: I believe you mean 'libellous.' They are crypto-fascists; that is to say, they are 'hidden' fascists. (However, I'll grant that calling them fascists is probably not productive, however amusing it may be.) [Peter Honeyman's comments deleted.] >I agree with Peter. If CERT is beginning to overstep its bounds. >perhaps someone should make a calm, rational complaint. I shall do so. Don't worry, I won't call them crypto-fascists. I shall forward it when I send it. ---- Robert W. F. Clark Stop the Clipper Chip rclark(a)nyx.cs.du.edu Proposal! clark(a)metal.psu.edu

1 0

Encrypting Cypherpunks mailing list postings
by crunch＠netcom.com 09 Jun '93

09 Jun '93

Mikes response to the ideas of encrypting the Cypherpunks mailing list... >We're not. I was very tired and was using my other, much smaller, brain to >think with. ;^) I was (thinking?) of distributing a common secret key to people >who we know are not spooks, and who would be interested in the cypherpunk's >cause. I think it MAY be possible to write a perl program that would take the incoming mail encrypted with a single common public key for Cypherpunk mailing list mail, than would decrypt it internally, then for each person in the mailing list, using their public keys, encrypt each message for the individual recipients, and mail them out. Naturally this would be SLOWER THAN MOLASSIS!! But it would be worth a try to see how it works. Lets talk about it at the upcoming Cypherpunks meeting. The ravers can really use something like this to keep the Full Moon Raves location a secret and known ONLY to those dedicated ravers that want to attend. As far as the Cypherpunks mailing list goes, it may not be appropriate to encrypt to the group ALL the time, but SOME messages might be worthy of encryption.

1 0

Re: ALERT / My email address is...
by fnerd＠smds.com 09 Jun '93

09 Jun '93

Hi, folks. Just in case at any point in the near or far future, cypherpunks has any extended mail problems, and anyone wants to get in touch with me as a person who was on the cypherpunks list, feel free to send to fnerd(a)smds.com or ...uunet!smds.com!fnerd I know there are hacks to find out who the subscribers are, (or are they plugged?) but I'd just like to publicly say that it's okay to take down my address, whoever you are. What's yours? I think publishing the raw list might be construed as impolite and disrespectful of privacy, but a compilation of willing addressees might be nice. It would be interesting to see how close we could reconstruct the list by skimming private archives and communicating with acquaintances. It would be interesting to have list software that worked the way those exponential-spreading, redundant, church-closing- because-of-snow phone call networks work (i.e., Usenet with even more emphasis on decentralization and redundancy). Also, a virtual archive server on the same model would be cool. -fnerd quote me

6 6

Re: ALERT / My email address is... (fwd)
by J. Michael Diehl 09 Jun '93

09 Jun '93

> On Mon, 7 Jun 1993 22:18:16 -0600 (MDT), "J. Michael Diehl" <mdiehl(a)triton.unm.edu> wrote: > > > > We could set up aliases and distribute a common secret key for the list.... > > How are you going to do this securely? > Just a thought, We're not. I was very tired and was using my other, much smaller, brain to think with. ;^) I was (thinking?) of distributing a common secret key to people who we know are not spooks, and who would be interested in the cypherpunk's cause. This and anonymous remailers would ensure that anyone could say anything with total anonymity, since we would all share secret keys. The problem is, of course, that many people who would otherwise be interested, could not participate in our new clique. ;^( SO, DISREGUARD MY COMMENTS! Plz! +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

anonymous mail
by remail＠tamsun.tamu.edu 09 Jun '93

09 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Deadbeat wrote: > This "coincidence" brings a name to mind. > Rhymes with "turn right." > Starts with S. > What could I be thinking? This is by far the best explanation for the whole soda/penet/CERT problems! Undoubtedly the work of good old Mr. "Rear of the boat; illumination" Dr. Manhattan -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLBVYzN1uahe7Mr5vAQHLlgQArcKYK9yvgXOhRdtt03z1tz3wpaUi/RAE oL1fjvLWJ7PHyK1BObnEhFjfv/JO4DwPqd1EevVDzyV3G/AydKf6GtuNVofDmu4T JlDLx5DFTZQ24xgljaubJ4yOOXgbsNMvziHq5dmwx2boqyXjufq8lXhKgnDQQBEl xH7ooyA7Aaw= =/16r -----END PGP SIGNATURE-----

1 0

Re: CERT
by smb＠research.att.com 09 Jun '93

09 Jun '93

The paranoia is getting out of hand. Let's take this one point by point. I've deleted the poster's name, because this note is just an example; it's not the only such posting. Certainly that may be so.. but in this case they didn't merely tell 'you' with a simple note, instead they did atleast 2 things which really are bothersome and overstepping common 'courtesy' of merely informing 'you': ``You''? Who is ``you''? The CERT note didn't mention any individual. They might not have the information. If they did, it might be because the account was compromised. (That was the case the last time I helped a friend investigate ftp droppings. In that case, though, it was only the ftp account, not the login account, so notifying the owner would not have been damaging. Btw -- remember the recent CERT advisory on bugs in the WUSTL ftpd?) 1) Instead of going directly to the owner of the directory in question or the administator of the host they jumped over 'your' head and went to the domain administrator. I can see going to a site administrator if they had reason to believe the owner of the directory was doing something illegal.. but then again they have no authority to make/enforce/etc any kind of laws. They were just plain out of line. Consider this example (and I'll give them the benefit of doubt here that someone really did complain to them and they aren't on some witchhunt of their own): I am Cert and Mr Von Karman has emailed me to say that a /jet/Enigma-cypher-code directory appears to have illegal software of some kind.. so I send up my email.. not to you.. but to Goldin, the new NASA head that I believe this directory owned by you has illegal software on it. Well that is a good way to put some bad marks on your record even if you do prove it untrue to your boss.. maybe you had just removed the evidence before he checks out your acct.. either way he shuts down your net access for a while..'just to be sure', and look out next time you want a promotion.. can't be to safe.. you might be a security risk! As I said before, they might not know who was involved. Even if they did, and even if the account wasn't compromised, it's the SA's responsibility to investigate. What if a local user is doing un- authorized things? Take this particular case -- they could easily end up being sued for contributing to copyright infringement. They might win -- but defending against a lawsuit is expensive. 2) They didn't check the system out before hand and blatantly said as much.. what kind of service to you is that? my friend met a guy who knows bigfoot..but certainly you don't see me bothering the people who own the land where bigfoot is supposed to live. Check it out? How? Apart from the question of whether or not you want CERT looking through your directories (and I can just hear the complaints now -- ``On no evidence but an anonymous tip, CERT logged in, listed everything, looked for *my* hidden areas that I used to distribute restricted software, and tied up my link to the Internet for hours while the downloaded everything in sight'') -- it isn't feasible. I just ftp'd to soda for a quick look-see. A ls-lRa generated 160K bytes. Simply screening that takes time. Many of the files showed only numeric uid's; the ftpd passwd file was obviously not up to date. Even if I knew the suspect files, I might not know who the responsible user was. Many of the files had informative names like ``packet123.Z''. They mirrored the full X11R5 distribution. How much time and effort should CERT put in?!?!! A competent SA will at least know the putative ownership and reliability of the owner of most of that stuff; CERT sure doesn't (except, of course, for the list of hackers they may or may not have, and which has been (rightly) objected to). 3) They want to confiscate logs from the system.. That sure as heck isn't any of their business.. Confiscate? Confiscate? They asked for a copy, if available. ``Confiscate'' generally means ``take away''. They're not taking anything from you. If the logs do show anything, it's precisely their business -- evidence of someone abusing your system (I'm assuming here that there really was 3rd-party deposits and retrieval of files). Quick -- how many of those file transfers are coming from stolen accounts? In my experience, a goodly number. Look, I have my own concerns about CERT in this matter, notably the questions of what evidence they're acting on, and whether or not they're being used (consciously or not) to silence unpopular sites. I've sent them a note asking those questions. But let's try to keep things in perspective. Oh yeah -- as an added bonus, I've enclosed a transcript of the kinds of things I do when trying to find an administrative contact for some machine. I don't see any avenues of contact more likely than ``root'' or ``postmaster''. And it's clearly a large-scale timesharing machine, where there's no one individual clearly responsible for it. --Steve Bellovin ----- $ whois -h rs.internic.net soda.berkeley.edu No match for "SODA.BERKELEY.EDU". The InterNIC Registration Services Host ONLY contains Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. $ finger root(a)soda.berkeley.edu [soda.berkeley.edu] Login: root Name: The Allmighty Directory: / Shell: /bin/csh Office: E238, x2-7453 Last login Mon May 31 22:17 (PST) on console No Plan. $ finger postmaster(a)soda.berkeley.edu [soda.berkeley.edu] finger: postmaster: no such user. $ dig mx soda.berkeley.edu ; <<>> DiG 2.0 <<>> mx soda.berkeley.edu ;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 6 ;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 3, Addit: 8 ;; QUESTIONS: ;; soda.berkeley.edu, type = MX, class = IN ;; ANSWERS: soda.berkeley.edu. 55780 MX 4 soda.Berkeley.EDU. soda.berkeley.edu. 55780 MX 6 scotch.Berkeley.EDU. ;; AUTHORITY RECORDS: Berkeley.EDU. 161050 NS VANGOGH.CS.BERKELEY.EDU. Berkeley.EDU. 161050 NS VIOLET.Berkeley.EDU. Berkeley.EDU. 161050 NS UCBVAX.BERKELEY.EDU. ;; ADDITIONAL RECORDS: soda.Berkeley.EDU. 55780 A 128.32.149.19 scotch.Berkeley.EDU. 55780 A 128.32.131.179 VANGOGH.CS.BERKELEY.EDU. 161050 A 128.32.130.2 VIOLET.Berkeley.EDU. 161050 A 128.32.136.22 UCBVAX.BERKELEY.EDU. 39151 A 128.32.137.3 UCBVAX.BERKELEY.EDU. 161050 A 128.32.130.12 UCBVAX.BERKELEY.EDU. 161050 A 128.32.149.36 UCBVAX.BERKELEY.EDU. 51896 A 128.32.133.1 ;; Sent 1 pkts, answer found in time: 0 msec ;; FROM: inet to SERVER: default -- 0.0.0.0 ;; WHEN: Tue Jun 8 20:16:07 1993 ;; MSG SIZE sent: 35 rcvd: 295 $ telnet soda.berkeley.edu 25 Trying... Connected to soda.berkeley.edu. Escape character is '^]'. 220 soda.berkeley.edu Sendmail 5.65/KAOS-1 ready at Tue, 8 Jun 93 17:10:50 -0700 helo research.att.com 250 soda.berkeley.edu Hello research.att.com, pleased to meet you vrfy root 250-Eric Hollander <"|/accounts/hh/remail/slocal.pl"> 250-Keir Morgan <kmorgan> 250-ERic MeHlHaFf <mehlhaff@ocf> 250-ERic MeHlHaFf <\mehlhaff> 250-Tom Holub <tom> 250-John S. Jacob <jsjacob> 250-Matthew L. Seidl <seidl> 250-Shannon D. Appel <"| /usr/local/lib/mh/slocal -user appel -verbose"> 250-Sean N. Welch <welch(a)xcf.berkeley.edu> 250-Dan Wallach <dwallach(a)postgres.berkeley.edu> 250-Donald J. Kubasak <kube> 250-David G. Paschich <dpassage> 250-Adam Glass <\glass> 250 Adam Glass <glass@postgres > vrfy postmaster 250-Eric Hollander <"|/accounts/hh/remail/slocal.pl"> 250-Keir Morgan <kmorgan> 250-ERic MeHlHaFf <mehlhaff@ocf> 250-ERic MeHlHaFf <\mehlhaff> 250-Tom Holub <tom> 250-John S. Jacob <jsjacob> 250-Matthew L. Seidl <seidl> 250-Shannon D. Appel <"| /usr/local/lib/mh/slocal -user appel -verbose"> 250-Sean N. Welch <welch(a)xcf.berkeley.edu> 250-Dan Wallach <dwallach(a)postgres.berkeley.edu> 250-Donald J. Kubasak <kube> 250-David G. Paschich <dpassage> 250-Adam Glass <\glass> 250 Adam Glass <glass@postgres > quit 221 soda.berkeley.edu closing connection Connection closed by foreign host. $ finger @soda.berkeley.edu [soda.berkeley.edu] Login Name Tty Idle Login Time Office Office Phone aaron Aaron C. Smith qR Jun 8 08:58 Limbo 643-7217 aaron Aaron C. Smith *qT Jun 8 08:58 Limbo 643-7217 achoi Andrew Choi pB 3 Jun 7 18:19 appel Shannon D. Appel pK Jun 8 09:57 CEA 643-5657 aswan Andrew Swan pW Jun 8 17:06 calvin Wa Pak qe 22:11 Jun 7 18:57 cgd Chris G. Demetriou qf Jun 7 22:15 278 Cory 510-642-7520 cliffwd Cliff Draper pe 36 Jun 8 16:30 9-204a 643-3426 cynthia cynthia leigh haynes *pr 3 Jun 8 16:43 cynthia cynthia leigh haynes ps Jun 8 16:43 deb Debra Waldorf *p7 Jun 8 16:20 deb Debra Waldorf *qg 51 Jun 8 15:27 eganloo Egan Loo pJ Jun 8 16:57 eric Eric van Bezooijen qz 1:01 Jun 8 15:50 238E gwh George William Herbe pc 1 Jun 8 14:13 238E gwh George William Herbe pm Jun 8 14:26 238E henchiu Henry Chiu pR Jun 8 17:02 ho Kinson Ho *q3 1:13 Jun 8 15:08 608-1 Evan 642-8290 hughes Eric Hughes *qm 36 Jun 8 10:34 238E isaac Isaac Cheng *pE 12 Jun 8 09:51 isaac Isaac Cheng *qw 12 Jun 8 10:59 jenn Jennifer Hom *pF Jun 8 16:52 238E 415-688-8034 jlb Jordana Brown pQ Jun 8 14:45 karlht Karl Thiessen *pb 13 Jun 8 16:28 238 Evans 642-7453 kenji Kenji Hubbard *pX Jun 8 17:08 238E kube Donald J. Kubasak pU 2 Jun 8 17:05 CEA ESOC 643-7367 marco Marco Nicosia qI Jun 8 15:58 238E 510-283-9587 maroo Maroo Lieuw *qx Jun 8 13:33 849-9872 michelle Michelle Tisi *qZ 5:30 Jun 8 11:34 ming Tje Ming *qj 9 Jun 8 15:28 ming Tje Ming *qO 2:17 Jun 8 13:50 mlee Michael Lee *pD Jun 8 16:49 mlee Michael Lee *qC Jun 8 15:52 nancy Nancy Cheng *pf 1:18 Jun 8 14:17 nancy Nancy Cheng *qV 1:53 Jun 8 13:52 payam Payam Mirrashidi po 19:13 Jun 7 20:54 199MD Cory 642-1297 psb partha s. banerjee *py 2:25 Jun 8 14:32 IBM Almade 510-649-7505 psb partha s. banerjee *pz 2:38 Jun 8 14:32 IBM Almade 510-649-7505 ralbers Rick Albers *pV Jun 8 17:06 rmgee Randall Gee *pn Jun 8 14:28 robert Roberto Boyd *pA Jun 8 16:47 rsr Roy S Rapoport *pY Jun 8 17:09 510-540-5535 seidl Matthew L. Seidl qk 1 Jun 8 10:31 238E x2-7453 seidl Matthew L. Seidl *qB Jun 8 08:32 238E x2-7453 sfd Scott Drellishak pl Jun 8 16:40 Kerr 3-202 tom Tom Holub *pH Jun 8 16:53 tom Tom Holub pI Jun 8 16:53 welch Sean N. Welch *p0 Jun 8 09:04 MTV21-122 415-336-4289

2 1

CERT netnews
by norm＠netcom.com 09 Jun '93

09 Jun '93

Netnews group "comp.security.announce" seems to be the product of CERT. About once a week, on the average, they post something relating to the security of some specific operating system. The few postings that I have seen seem directed to the sys-op (typically Unix) regarding some common practice with security implications or often holes in the defaults that some system comes with. What I have seen there is technical and not political.

1 0