July 1993 - cypherpunks-legacy

forged mail
by baumbach＠atmel.com 23 Jul '93

23 Jul '93

I only have access to an email connection to the internet, so I cannot test a method of forging mail that I learned. Is this a taboo topic? It seems it would be useful for anonomous mailers. Give me the go ahead, and I'll continue...tomorrow. I'm done for the day. Peter Baumbach baumbach(a)atmel.com

3 2

local network only?
by any＠uu4.psi.com 23 Jul '93

23 Jul '93

Derek, >mail to me, most likely I can track you down to at LEAST the machine >you forged it from! I don't have an account on this machine. The machine doesn't seem to care. Does the machine keep a record of this letter, I don't know? I'm using the command mconnect on a sun system. It asks me who I am, and then trusts me when I tell it! I have even told it I was ROOT, and it filled in "Operator" from the local passwd file! Is this security so lax because I am on a local area network unconnected to the Internet? Does anyone know? mconnect even gives me help if I ask it! I didn't mail this, not me

4 3

Re: INTERNATIONAL ENCRYPTION
by lefty＠apple.com 23 Jul '93

23 Jul '93

Sandy Sandfort writes: >Geoff Dale asks about statutes prohibiting the transmission of >encrypted data across international boundaries. To the best of >my knowledge, there's no such animal. If such exists, it is >widely violated, with impunity, by me and folks I know, on a >regular basis. Au contraire, I am certain that France has restrictions on the transmission of encrypted data within its borders. I believe Brazil does as well. >Where do these urban legends come from? Umm, many of them are based on fact? -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Macpgp 2.3
by lefty＠apple.com 23 Jul '93

23 Jul '93

>I just fetched macpgp 2.3 from soda, and wound up with a file ending in >the suffix "gz". This is a new one on me, and I don't know how to decode >it. Can anybody inform me? Inside whatever it is is a binhexed compactor >file, and I can deal with those formats, but the outside wrapper defies >every decompressing utility I've got. It's compressed with the gnu utility gzip, as Tim May and Paul Goggin have pointed out. However, as they failed to mention, soda at least will decompress .gz files on the fly. If you want to pull down the file "xxxx.yyyy.gz", issue the command "get xxxx.yyyy" (i.e. leave off the .gz suffix) and soda will unzip it for you as it ftp's it down. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Your Input Requested for Article
by mulivor＠orion.crc.monroecc.edu 23 Jul '93

23 Jul '93

Hello Cypherpunks; I'm a newspaper journalist now writing a piece for the American Journalism Review (formerly Washington Journalism Review). In case you're not familiar with AJR, it's a mass-circulation monthly magazine that's available at many large newsstands. Journalists in the U.S. consider it a principal source of professional news. My article is tentatively scheduled for publication in the Oct. 93 issue. I am looking for: 1. Examples of how and why anonymous e-mail has been used to communicate with journalists. 2. Your comments concerning anon-mail's role in the future of newsgathering, particularly investigative reporting. I need to receive your comments directly, not posted to this list. Kindly include your telephone and fax numbers. Please do not send me responses containing requests to remain partly or completely off-the-record. I won't be able to use those. The less technical your remarks, the more of them I might be able to use, since the magazine has a non-technical readership. (However, in the interest of interview etiquette and personal disclosure, I'll mention that I have a technical degree and teach computer science part-time at a branch of the State University of New York.) I already have the alt.whistleblowers sizeable FAQ. Please do not cross-post this to any other list. Thank you in advance for your kind cooperation. I will acknowledge every reply that I receive from Cypherpunks. ------------------------------ Philip Mulivor mulivor(a)orion.crc.monroecc.edu 716 256-2222 voice 716 271-4052 fax

1 0

Re: Pgp help.
by peter honeyman 23 Jul '93

23 Jul '93

i use a script, which i call sign, as follows: #!/bin/sh exec pgp -sta +clearsig=on ${1+"$@"} please excuse my unix idioms. peter

1 0

Pgp help.
by J. Michael Diehl 23 Jul '93

23 Jul '93

Hi all! I've got YAPP (Yet Another Pgp Problem!) I want to know how people are signing their messages and keeping the message in plaintext. I see the message and the pgp sig on the end. Could someone outline how this is done so I can implement it in my mailing system. BTW, I sure like being able to compose email in WordPerfect.... ;^) +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

Remailers/PayPhones and Today's NYT
by Peter Wayner 23 Jul '93

23 Jul '93

Today's NYT has an article on PayPhone salons that offer phone booths to their customers. They buy the long distance connection in bulk and resell them to the customers so the customer doesn't have to pay the high payphone charge. They're quite common in poor sections of town. The article mentions that the phones can be problematic because drug dealers can use them to avoid phone taps, but it seems to conclude that this is a small price to pay for bringing the connection to the poor. Most customers use the service to call their home country and speak to relatives. I thought it was interesting that the danger of untraceable drug dealers popped into the reporters mind when they were researching the article. After all, they don't tend to mention illegal problems when they speak about used car dealers or other services. -Peter

2 1

STEG: subliminal messages
by Karl Barrus 23 Jul '93

23 Jul '93

[I'm forwarding mail from Eric which was meant for the list as well] From: Eric Hughes <hughes(a)soda.berkeley.edu> To: elee9sf(a)Menudo.UH.EDU >An interesting related topic is subliminal channels and messages. A >subliminal channel is one in which communication takes place without >an external observer realizing it. [summary deleted] Gus Simmons has recently written a paper on subliminal channels in the DSA (the one PKP is about to license). The paper as of yet is not officially published, but likely will be at Crypto '93 next month. I've seen a copy of the paper, but don't have a copy. I do, however, remember this one line. "The DSA provides the most hospitable environment for subliminal channels in any system yet seen." (Almost verbatim, but not quite.) Assume this is true. (I believe Simmons, myself.) What might this mean? Suppose some agency of the government makes digital signatures on some certificate for individuals. To take a concrete example, take driver's licenses. The subliminal channel in the signature might be used to encode, say, the following: 1. number of drunk driving convictions 2. number of drunk driving arrests 3. insurance rating 4. whether this person is suspected of habitually a. merchandising narcotics b. carrying large amounts of cash c. looking at child pornography d. wanting to kill police officers e. carrying concealed messages Since the signature itself contains this information, and since the channel is subliminal, the only way to know whether the channel carries data is to see the software. For this reason the DSA should not be used by government agencies to make certificates for individuals. It should be scrapped for this purpose and some other algorithm designed which has a provable upper bound on the subliminal channel of less than one bit. Eric

1 0

more on FBI credit search access
by L. Detweiler 23 Jul '93

23 Jul '93

Hm, maybe someone could just check out the article (Sat Jul 17 NYT p. 7). This is a distinctly different interpretation. ===cut=here=== From: Shari Steele <ssteele(a)eff.org> Date: Wed, 21 Jul 1993 09:17:28 -0400 Subject: New law on FBI and credit records Hi Peter. Your post in alt.privacy was forwarded to me. I don't know of any legislation that will permit the FBI to obtain your credit report without a search warrant. While it is possible that such legislation exists, what you describe from the NY Times article sounds an awful lot like a proposed amendment to the Electronic Communications Privacy Act (ECPA) introduced this year that would allow the FBI access to *telephone calling data* with a letter (rather than a search warrant) certifying that the person was being investigated for engaging in terrorism or international espionage, or cohorting with such folks. The telephone calling data includes the names and telephone numbers of all calls made from the phone number being investigated, as well as the duration of the calls. While this in itself may be cause for alarm, it is not the same as FBI access to credit reporting information. Shari ****************************************************************************** Shari Steele Director of Legal Services Electronic Frontier Foundation 1001 G Street, NW Suite 950 East Washington, DC 20001 202/347-5400 (voice), 202/393-5509 (fax) ssteele(a)eff.org ------- End of Forwarded Message

2 1