September 1993 - cypherpunks-legacy

net.history (flashback)
by Anonymous 04 Sep '93

04 Sep '93

On Fri, 3 Sep 1993 02:20:00 GMT, Bill Murray <WHMurray(a)DOCKMASTER.NCSC.MIL> writes - > I am reminded of a story, perhaps apocryphal. In the middle > seventies Fortune magazine was working a feature on computer > crime. Most of the experts that they interviewed told them > that the security on most of the nation's commercial time > sharing systems was pretty good. However, they admitted that > one convicted felon and hacker, Jerry Schnieder, would tell > them otherwise. Of course Fortune had to interview him. I remember this story, Bill, and I find this correlation interesting. It's funny how Schneider's name hasn't really surfaced in such a long time. In fact, once I think about the real parallels to Herren Doktor's lip service, I find it even frightening, given the anticipated impact with which her opinions seem to affect governmentalism. For what its worth, there was another interesting item concerning Schneider which appeared in Info Security News this issue, in their "Top Ten Events" article of the top ten info-security events since the inception of computers. I relay the pertinent portion of this article below: "Jerry Schneider was not the first computer crook, which he became at 18; nor was he the first computer security consultant, which he became at age 21. Still, his antics on both sides of the law helped bring computer crime to the awareness of the public in general and business managers in particular. Although still in high school in 1968, Schneider started a company called Creative Systems Enterprises and began selling electronic telecommunications gadgets he invented. Each day as he passed the Pacific Telephone and Telegraph Company office, he scavenged the firm's dumpster for discarded equipment that could be used to build his gadgets. He also collected a wide variety of documents, ranging from invoices to training manuals. Within just a few years, he became an expert on telephone company technology and business, and reportedly knew more about Pacific Telephone's telephone equipment supply procedures than any of its employees. In June, 1971, Schneider set into motion an elaborate plan to steal new telephone equipment from Pacific Telephone and resell it as refurbished equipment through Creative Systems. Eventually the scam would net him hundred of thousands of dollars worth of Pacific Telephone equipment. Scneider accessed Pacific Telephone's computerized ordering system and by using a telephone card dialer succeeded in placing orders for equipment. To complete the scam, he needed to learn the telephone equipment budgets for individual telephone company's sites, equipment inventory levels and other key pieces of information. He gathered the required information by getting access codes to a commercial time-sharing service used by the telephone company for inventory control and parts distribution. In January 1972, acting on information provided to them by one of Schneider's former employees, law enforcers raided Schneider's offices and a warehouse where they found equipment the district attorney said was worth $8,000. They also learned at that time that Schneider had stolen a total of $125,000 worth of equipment. Later, Schneider would admit that he had taken close to $900,000 worth of goods. The day after his arrest on February 8, 1972, newspapers across the country called it one of the most famous computer crimes ever. "How he Folded, Spindled, and Mutilated," one headline said. In a plea bargain, Schneider agreed to plead guilty to one count of grand theft of $5,000 worth of equipment. In July, he was sentenced to two monyhs in a minimum security corrections institution. In all, however, served 40 days and paid a $500 fine. Later that year, Schneider, then only 21 years old, formed a computer consulting firm catering to companies that did not want to get ripped off by cyber-crooks. He stayed in the business until 1977. Today, he owns a firm that sells off-shore banking services. 8<------ Gut Here --------------- Gee, imagine that. Ye olde Spooge Meister spooge /spooj/ 1. Inexplicable or arcane code <spooge(a)dev.null.net> or random and probably incorrect output from a computer program.

1 0

Re: Gubment Bombmaker's Cookbook
by nfe＠scf.nmsu.edu 03 Sep '93

03 Sep '93

Most of the IMH has been typed in and posted on various BBS's - don't know of a FTP site for it though... IMH was originally a gvmt publication, and it's been reprinted by several of the R-wing paramilitary publisers (paladine press, desert publications, etc.) it has a ISBN number, can be found, and ordered via Books in print, however will be confiscated by customs at the canadian border as that sort of thing is contraban in canada - I don't know about england... For the address of some of the paramilitary publishers, and reviews of some of these books get a copy of the rec.pyrotechnics FAQ sheet. This includes pointers to FTP sites that have some online "bomb books"... btw: IMH is considered one of the more acurate, and safer books of this kind. The anarchist cookbook is generaly considered the most dangerous book to the prostective "kitchen chemist" in print... hope that helps ps: rec.pyrotechnics has posts of this type of formula all the time, and ANY decent library will have books on explosives. Older High School chem texts have recipies, and a good encyclopedia wil at least tell you how to make black powder. police bomb disposal, and pyrotechnics books are also good sources, as are theatrical special effect books. This type of info is widely available to anyone, anywhere! this court case is obviously pure harrasment.

1 0

PEM vs. PGP formats
by remail＠tamsun.tamu.edu 03 Sep '93

03 Sep '93

> On the other hand, in terms of anonymity, you can always generate a > self-signed key with TIS/PEM (I forget the exact term they use in the > TIS/PEM docs, but you can just make yourself a certificate which > doesn't really say anything about your identity). Yes, but this doesn't provide the service I desire. I *want* to be able to sign a message, but I *only* want the intended recipient to know who I am. PEM discloses the originator's ID *in the clear* when I send a signed message. PGP hides the signature and all other information that identifies me within the encrypted portion of the message!

1 0

programmer's lot
by Andy Wilson 03 Sep '93

03 Sep '93

[forwards deleted] >>From New Scientist, 28 august 93, Feedback column: >> >>"The National Westminster Bank admitted last month that it keeps >> personal information about its customers-such as their political >> affiliation-on computer. But now Computer Weekly reveals that a >> financial institution, sadly unnamed, has gone one better and moved >> into the realm of personal abuse. >> The institution decided to mailshot 2000 of its richest customers, >> inviting them to buy extra services. One of its computer programmers >> wrote a program to search through its databases and select its >> customers automatically. He tested the program with an imaginary >> customer called Rich Bastard. >> Unfortunately, an error resulted in all 2000 letters being addressed >> "Dear Rich Bastard". The luckless programmer was subsequently sacked."

1 0

UK Privacy International Co
by Dave Banisar 03 Sep '93

03 Sep '93

UK Privacy International Conference ANNOUNCEMENT ONE DAY PUBLIC CONFERENCE INTERNATIONAL DEVELOPMENTS IN PRIVACY AND DATA PROTECTION 30th SEPTEMBER, 1993, MANCHESTER, UK A roundtable hosted jointly by Privacy International and the Law School of the University of Manchester Topics include : Privacy concerns with Caller ID and digital phone services Privacy implications of Electronic Health Care Patient Record Systems and medical smart cards Cryptography, and communications surveillance Implications of the European Commission data protection directive The establishment of guidelines for handling police files in emerging democracies in Central and Eastern Europe Weaknesses in the UK Data Protection Act This programme will include a small number of papers and formal presentations, but will primarily be a forum for general discussion of the issues. A number of key international experts will be present at the meeting. The conference is free for all Privacy International members, independent experts, and privacy and consumer advocates. A fee of 50 (US$75) will apply to representatives of government organisations or companies. 8.30 AM - 2.00 PM, Thursday 30th September 1993 Room 2.22, The Law School, University of Manchester, Oxford Road, Manchester, M13 9PL For more information, please contact : Simon Davies at Privacy International in London on (44) 81 402 0737 or fax (44) 81 313 3726 (email : Davies @privint.demon.co.uk ) or Dave Banisar at Privacy International in Washington on (1) 202 544 9240, fax (1) 202 547 5482 (email : Banisar(a)washofc.cpsr.org )

1 0

WANTED: List of very reliable remailers
by nobody＠eli-remailer 03 Sep '93

03 Sep '93

-----BEGIN PGP SIGNED MESSAGE----- I've been experimenting with the remailers lately, and I've been trying to put together all the tools I'll need to start sending most of my email through them. Towards this end, I wrote a simple program called CRM that adds forwarding tags, and calls PGP to do multiple encryptions, and then wraps the result in a /bin/sh script that will extract the cyphertext and do the mailing. In what is starting to look to me like a design flaw, I set the program up to pick a random chain of a specified length out of a set of remailers. All of this talk about remailer reliability has got me a little bit spooked, because I don't have any way of knowing if my mail is going through or not. I'd like to configure my remailer's utility so that it only uses a small list of *very* reliable remailers, preferably with each entry on the list being run by a distinct person. Are there any remailers which: o Support PGP encryption? o Have been in reliable operation for a significant period of time (at least a couple of months)? o Are maintained by someone who knows enough about the software to prevent it from crashing? o Don't introduce significant delays in the remailing? (Unless, of course, they are using some sort of scheme to frustrate traffic analysis.) and o Are set up on systems over which the remailer's administrator has enough clout to prevent a summary shutdown without at least giving a couple of days' notice? I'm assuming (for no very good reason) that Hal Finney's sites fit these criterium. If that's true, then strictly speaking, I'd only need one other similar site run by another person, although I'd feel better if I was using a chain through three remailers. Obviously, the more remailers I have on the list, the better off I am. But I'd rather have a small list of highly reliable remailers than a larger list than contains even a single marginal one. The list of remailers that I'm using now came from a list that was posted to this mail-list a few days ago, and I haven't had any problems with it (at least none that I know of -- I'm assuming that all of my mail went through). I just got a little worried about the post reporting dropped mail from the jarthur remailer administrator, which had been mentioned on the list I had been using as a reliable remailer. If anyone can help me out, I'd be grateful. Please post replies to the list, or mail me directly at: astrashe(a)nyx.cs.du.edu Thanks, Alex -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLIejerGKvmrRrQghAQHvMQQA1Ez5Lxo1glHaJhvquvuti1WseFl4Nw5r g0qRfeWQFwSbZZtsFUiGs6f4iibj9lVpBwtmL8k7oTYRfCNLe+noi6TC0PChEeHt BKQmCAGTx5oPu2UtqXUvfFtb2MwqDXxNpX4BOd+klO6qPjBq6H8eG7GCNzSmeLp5 yr3ALw+qANg= =FSf4 -----END PGP SIGNATURE-----

1 0

Re: where can I get the source for BSD mail?
by jim＠tadpole.com 03 Sep '93

03 Sep '93

Oh, several places. Look for the source to metamail (ask archie, or fish around on bellcore.com) and there is typically a 'tahoe.tar.Z' file around. Jim

1 0

PGP features
by edgar＠spectrx.Saigon.COM 03 Sep '93

03 Sep '93

Brad Huntting recently posted: Perhaps it's time we polished the edges, added a few of the features that are lacking, and wrote up up an RFC for the PGP message format. Some features I'd like to see in PGP are: I've added my comments [with these full margins] as appropriate. The ability to send an encrypted message to multiple recipients without duplicating the entire message. The most logical way to do this would probably be to encrypt the random IDEA key once for each recipient. ??? This has been implemented in PGP since at least release 2.2. (Maybe 2.1, memory fails). Just specify multiple UserID fragments in the command line when encrypting. Note that if you don't specify a UserID in the command line, you -cannot- enter multiple ID's in the resulting prompt. This is in the -h help text: To encrypt a message for any number of multiple recipients: pgp -e textfile userid1 userid2 userid3 There needs to be a facility for having multiple signatures on a single document without making the signers sign each others signatures. Besides the obvious application of removing a signature from a document, this would also facilitate things like petitions where many people could asynchronously sign a single document, and latter assemble all the signatures together. This can be done via detached signature certificates, which can be gathered together and presented with the original document. To create a signature certificate that is detached from the document: pgp -sb textfile [-u your_userid] It should be possible (though certainly not mandatory) to hide the recipient's identity entirely. Not currently implemented, but being discussed. You can acheive much the same effect by using a another key-pair with a pseudonym in the UserID, to be distributed only through remailers or otherwise anonymously. The message format needs to allow for alternate forms of encryption (besides IDEA). Furthermore, the (shared key) algorithm used to encrypt a message should be hidden in the RSA encrypted part of the message along with the shared key. Ideally, a list of algorithms could be given which would allow the message to be optionally compressed before being encrypted, or encrypted two or more times with different algorithms. Not implemented, but has been mentioned. Triple-DES is one possible alternative. You can achieve multiple IDEA encryption by just using current PGP to encrypt twice (or more). Even if you encrypt to the same public key, the IDEA key used will be different. Compression can currently be turned off, if desired, via a CONFIG.TXT option, which can also be specified in the command line. Compression is also automatically turned off if the plaintext is recognized as the output of PKZIP or other popular compressors. If I'm confused and the PGP message format already supports some of these features, please correct me. Consider yourself corrected (:} -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

where can I get the source for BSD mail?
by an23135＠anon.penet.fi 03 Sep '93

03 Sep '93

I am looking for a copy of the source for BSD mail. Can anyone help me? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Crypto Greetings from Russia
by mbriceno＠aol.com 03 Sep '93

03 Sep '93

> Whooaa! Slow.... > > Please remember that the former SU is full of "companies" that claim > to be *the* whatever national initiative of Russia. Mostly they are > just a couple of former research scientists with a Grand Plan, and > usually they have no clue as to how to make it fly. They just think > that with the new market echonomy, simply forming a company and > having some Big Words will make them filty rich automatically... > > I know there are exceptions. But.. Beware. Thanks for telling me. I was not aware of that. However, they claim to have equipped quite a number of sites. I haved asked them for more info on their products. Let's see what they got. --Marc

2 1