August 1993 - cypherpunks-legacy

Another BBS Seizure in Ha
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com PLEASE CROSS POST AT WILL R >The Hartford Courant on August 5, 1993 (page b-4) stated that a 21 R >year old computer BBS operator was arrested for maintaining a computer R >bulletin board that had a bomb making recipe. R > R >Michael Elansky was charged by the West Hartford police with inciting R >injury to persons or property - a felony charge - and risk of injury R >to a minor. R > R >He was held in lieu of $500,000 bond (in CT the bond for a person R >accused of murder is normally $100,000) I just spoke to his mother Elaine and Michael himself from jail via the miracle of call waiting. She is establsihing a defense fund. Please send money: Michael Elansky Defense Fund P. O. Box West Hartford, Connecticut 06117 Duncan Frissell --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

Another BBS Seizure in Ha
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com Please crosspost --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

AT&T Home Security Plus
by George A. Gleason 28 Aug '93

28 Aug '93

Today I got a most interesting call from a phone solicitor, who said that he was with AT&T and they were going to be hosting a demo of an AT&T home security system on my block and was I interested in attending. I told him about Clipper and asked if the AT&T home burglar alarms came along with backdoors allowing various govt agents and burglars to sneak in. Somehow the discussion shifts to PGP vs. Clipper, and the caller asks if I've got a handle (I told him my email address, which was Really Dumb) and then he asks if I'm into pirating or anything... of course I'm not, and said so.... Somewhere along the line I entirely forgot to ask how the hell he got any idea what block I lived on, since my residence address information is something I take great pains to protect. And then it occurred to me... perhaps Something Else is also going on...? Like, "are you into pirating...?" Hmmm... I never even thought about that at the time, but if anyone else out there gets a call like this, it might be worth some follow-up research... -gg

2 1

Internet: commercial or n
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com L.>In the current situation, all the government bureacrats fire off L.>messages that `even though your message can travel on commercial nets L.>only, there is no way of guaranteeing that it does not cross public L.>networks, therefore it must abide by NSF Internet Use Policies.' To which I fire back: "Since you consider it OK for Internet to carry pictures of naked men, women, children, and animals as well as text (tiny) sex and such kink as alt.fan.bill.gates, you have to put up with *our* ideas of the sorts of activities that consenting adults can engage in online. I'm sick and tired of this discrimination against commercial intercourse." Duncan Frissell Who practices commercial activities every day on the Internet and is not ashamed to admit it. --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

Re: Another BBS Seizure i
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com R > Does this mean I can be arrested for mentioning the fact that dry R >ice and water put into an empty 2-liter bottle of Coke makes a nice R >explosion? No but it *does* mean that you can be busted for saying that if you mix ammonium nitrate and diesel fuel in a 19 to 1 ratio, you can blow up the World Trade Center. It's a good thing that I never said that. Duncan Frissell Who knows things much more dangerous to the government than explosives and will reveal all for a small fee. --- WinQwk 2.0b#0

1 0

Re: AT&T Home Security Plus
by doug＠netcom.com 28 Aug '93

28 Aug '93

"George A. Gleason" <gg(a)well.sf.ca.us> said: >Somehow the discussion shifts to PGP vs. Clipper, and the caller asks if >I've got a handle (I told him my email address, which was Really Dumb) and >then he asks if I'm into pirating or anything... of course I'm not, and said >so.... >Somewhere along the line I entirely forgot to ask how the hell he got any >idea what block I lived on, since my residence address information is >something I take great pains to protect. >And then it occurred to me... perhaps Something Else is also going on...? The term "handle", as well as the fact that this person could say anything even slightly knowledgeable about any computer related subject, points to him being a hobbyist who frequents BBS's. ("Handle" is pretty much not used in newsgroups, nor have I run into it on muds, but it is very widely used in BBS circles.) Telephone soliciting is generally a minimum wage job, although in high price sales "professional" salespeople are used who get a commission. Even if you assume a conspiracy of some sort, there isn't any reason for the company to make a particular effort to use someone more knowledgeable for cold calling. The question about pirating probably arose because it has always been a very frequent topic of conversation on BBS's. The caller himself might be a pirate; that would be my first guess. As for knowing your address, phone companies sell phone books that are reverse-indexed by address. Companies use these for cold-calling because they can pick out more affluent neighborhoods and skip e.g. ghetto areas where a call might be a waste of time or even worse. Generally "taking great pains" to protect information about your address doesn't guarantee that you are successful; I've heard that some of these sales-tool phone books have more information in them than is released to the public in the usual phone books. Perhaps they cross-reference with mailing lists. I could believe that there's a backdoor built into home security systems, if I could figure out how they would make use of it. Sell the info to organized crime for the purpose of burglary, perhaps? A little paranoid considering you're talking about AT&T. How would they be able to implement such a thing and still keep it secret? Or in cahoots with the FBI/CIA/NSA? Doesn't make sense; if spooks want to get into someone's house, they can do so in any number of ways, they needn't risk a large scale conspiracy, which would only pay off on the very small percentage of homes that used AT&T's system in particular. And regardless of that, again, even if there's a conspiracy, there's just no reason to let the phone solicitors in on it. All they need to do is build a backdoor into the security system and then do everything else aboveboard. Calling people up and hoping to catch someone in the admission of being a pirate during a sales pitch is just ludicrous. Doug

1 0

Re: Physical security lapses will getcha every time.
by markh＠wimsey.bc.ca 28 Aug '93

28 Aug '93

> > Fact Two: That's why you won't see messages from me either (a.) > signed with PGP, or (b.) encrypted with PGP from any of my other > e-mail accounts. All are UNIX (open) environments and I don't like > the implications of the possibilities of my secret key being exposed, > even if I do trust the folks I work with. Call me a schizoid. Of course, this doesn't make the UNIX versions of PGP useless. There is absolutely no reason why you can't run your own personal Unix box. Really all you need is a 386 machine with Linux or 386BSD. The nice thing about the UNIX/Linux setup, is that you can still use all the UNIX tools to send/receive encrypted mail (your favourite mail user agent+pgp/ripem+UUCP+sendmail/smail) in a convenient way without messing with MSDOS. Mark -- Mark Henderson markh(a)wimsey.bc.ca (personal account) RIPEM key available by key server/finger/E-mail MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433

2 1

"The Internet Letter"--Internet's First Commercial Digest
by nobody＠shell.portal.com 28 Aug '93

28 Aug '93

-------------------------------------------------------------- I hear the first issue of TIL is free. If somebody obtains an e-copy can they post pointers to its availability to cypherpunks, send it via e-mail upon request, or put it up on an ftp site? thanks. --------------------------------------------------------------- The Internet Letter (ISSN 1070-9851), the first commercial newsletter on the Internet, will premiere at INET 93 and INTEROP(r)93, and a hard copy version will be available at Booth #1334 (InterCon Systems Corp.) in the South Hall of the Moscone Center. The first issue of TIL provides provides the following information about the editor: The editor is Jayne Levin (netweek(a)access.digex.net) Levin was former deputy bureau chief of Institutional Investor in Washington, D.C., and has written on the Internet for The Washington Post and Infoworld. Tony Rutkowski (amr(a)CNRI.Reston.VA.US) is special adviser. Rutkowski is founder and vice president of the Internet Society and director of technology assessment at Sprint Corp. He was former editor-in-chief and publisher of Telecommunications magazine. Levin will be available for interviews at INTEROP. Contact INTEROP press relations. The table of contents for the first issue covered a wide range of topics. The articles were professionally written and incisive: 001) INTERNET EXPERIENCING AN INFORMATION EXPLOSION 002) COMPANIES TAP INTERNET'S POWER 003) THE TOP 150 COMMERCIAL USERS ON INTERNET -- CHART 004) CIA, US GOVERNMENT INTELLIGENCE AGENCIES DEVELOP INTERNET LINK 005) REALTY FIRM IMPROVES PRODUCTIVITY, INTERNET SPEEDS REALTY TRANSACTIONS 006) MULTIMEDIA MAGAZINE TO DEBUT ON INTERNET 007) TASK FORCE PROPOSES STANDARD TO SECURE CONTENTS OF E-MAIL 008) INTERNET MERCANTILE STANDARDS EXPLORED 009) GOPHER LICENSING FEE SPARKS DISPUTE 010) FINDING GOPHER & GN 011) FROM SOFTWARE TO MAGAZINES, BUYING ELECTRONICALLY 012) CIX LAUNCHES COMMERCIAL "INFORMATION" EXCHANGE 013) SOME COMPANIES PREFER WAIS FOR BUILDING IN-HOUSE DATABASES 014) MORE ON WAIS 015) INTERNET TO ASSIST BETHANY IN ADOPTION SERVICES 016) FAQ 017) PROVIDERS' CIRCUIT 018) CIX CONTACTS -- CHART 019) TIPS & TECHNIQUES 020) POINTERS 021) TALK OF THE NET 022) WASHINGTON 023) READ ALL ABOUT IT 024) DATEBOOK The first issue of TIL provides the following price information: 30-DAY INTEROP SPECIAL (good until September 30) 40% Discount off the regular rate of $249/year Charter subscriptions: $149/year -- a 40% discount. Universities and nonprofits $95/year. If you not completely satified, your money will be refunded. You can receive The Internet Letter electronically or on paper.

1 0

NSA & the Crypto-Zionist Myth of "Public Key"!
by remail＠tamsun.tamu.edu 28 Aug '93

28 Aug '93

>I'm rather surprised that the most significant piece of evidence in favor of >the "NSA has cracked PGP" theory is that no one's put a bullet through Phil >Zimmerman's head. Excuse me, but I'm getting tired of this silly paranoia. NSA is not Evil Incarnate Central, and we are not fighting a Valiant War We Are Fated to Lose. The NSA are a bunch of Americans who went to school & college with the rest of us, and share our communities with us. Most of them joined NSA to fight totalitarian Communism, and most of them are sympathetic with values most Americans share when they bother to think about them, like freedom, privacy, etc. Sure, NSA has been caught up in the Cold War habits of secrecy, bureaucracy, and an ingrained habit to control information. It's also almost surely caught up in the same kind of bureaucratic incompetence we see in the rest of the U.S. Federal government (most of the DoD, the space programs, the BATF, the FBI, etc.) Does a $40+ crypto-voice-chip with an obvious trap door look like Malicious Plot to Destroy All Strong Crypto and Take Over The World, or does it look like an a half-competent, half-hearted attempt to retain Cold War era capabilities they had gotten used to? NSA is going through the same crisis of goals as the rest of the Cold War establishment. Their mission, if they have any left at all, has changed radically, and they know it. While it may be "in the best interest of NSA" to maintain control over strong crypto, that's only a superficial analysis at one level. NSA employees are also Americans, community members, family members, etc. They don't typically go around murdering hackers they don't like. Nor would that accomplish anything for them -- RSA was published internationally long ago, and PGP is now scattered at sites all over the world, with new versions being hacked on in nearly a dozen countries. The biggest problem I've encountered talking to various people about implementing encryption is that they think cypherpunks are a bunch of paranoid nuts, so only paranoids would want to do things like use digital cash for their semi-legal barter schemes. Your expression of surprise that the NSA hasn't offed Phil Zimmerman just confirms their suspicions. How can I convince them that cryptography is not just for paranoids? The rest of us are concerned about things like protecting and enhancing our privacy and freedom, and there's nothing silly or paranoid about that. But now that you mention it -- Shamir does operate out of Tel Aviv. Obviously he built RSA with a hole in it, and NSA is the main arm of the Crypto-Zionist conspiracy of Jewish Planetary Hegemony! And he didn't publish "Differential Cryptanalysis of the DES" until non-Zionist bankers got ahold of DES. It's all clear now! > I think that, personally, the public-key stuff's gotta have some sort > of a hole in it that nobody's thought of yet outside of spook central. I think your head has to have some sort of a hole in it. Perhaps the NSA's work?

1 0

Plausible Spookiness
by an31144＠anon.penet.fi 28 Aug '93

28 Aug '93

> Whoever "Raymond Paquin" is, he's no spook. Spooks just don't do > things like that - tell a little bit, then clam up. They are > trained by instinct never to leak. I got a sad little chuckle out of that one. Leaving aside the paradoxical "trained by instinct" line, I can assure you that your claim here is simply naive. Perhaps you watch too much TV. For every Ivy League CIA careerist station chief with a vested interest and thorough indoctrination, there are several thousand nobodies who more or less blundered into the racket in minor capacities. These are underpaid, ignored, fucked-with, jacked around, abused, denied, manipulated, lied to, insulted, cut loose, yanked back and otherwise generally driven nuts until they quit, at which time they discover they are too burned out to do anything in the real world - say, hold down some shitty job ("There seems to be a rather large hole in your resume, Mr. Smith...") or maintain personal relationships. What these people will or won't do is beyond reliable conjecture. Did you guess I speak from personal experience and observation? What Paquin is or isn't, I can't say. I haven't believed or trusted anyone since late 1970 or so anyway, but I would not be surprised if Paquin actually was doing pretty much what he said, namely working at some university doing crypto math on some government grant with big strings. This is completely plausible. > If there is any flaw in PGP, there are only a few places where it > could be. The basic mechanics of the program (RSA, IDEA, etc) > obviously work... If you mean that they are NSA-proof, or that only brute force attacks would affect decryption, I would suggest that we know no such thing, and it is extremely unlikely that we ever will. The NSA has _astounding_ resources, unequalled by anything in the private sector, dedicated to no other purpose than compromising world-class cyphers. Their successes are not public knowledge, to say the least. No one here should blithely dismiss claims of PGP weaknesses when the opposition has literally billions of dollars earmarked to find such flaws. It bears noting that the concealment of major successes in decryption are every bit as important as the decryption itself, a fact often overlooked. I would like to see "Paquin's" case against PGP as well as a competent analysis of his claims. Unfortunately, I cannot produce either. > A subtle flaw would have to be somewhere like: prime number > generation, random RSA key generation, or random session key > generation. If the primes weren't actually prime, that would make the > RSA keys breakable. But you could take the primes (pgp -kg -l and you > will see them in hex) and feed them into a primality tester to verify > that. I have seen numerous conjectures about PGP primes, but am not competent to judge them. > The most likely place for a bug would be in the randomness. This has been another subject of discussion, though I know of no firm conclusions being reached.

2 1