October 2000 - cypherpunks-legacy

CDR: ZKS "Smart Privacy Policies"
by Adam Back 31 Oct '00

31 Oct '00

[Sent this once from a dud address trying to work around a mail problem -- apologies for duplicates] cypherpunk agent X wrote: > Here we get to the meat of the issue... the > item that NAI tried to force down our throats...Corporate Key Escrow.. > this time via key splitting... Shades of the NSA Key!! > > Sick em Adam!! This is referring to me right -- as I was involved in the big fight about NAI's corporate message key escrow proposal? Disclaimer: note I work for ZKS now, below are my personal opinions. It's not key escrow, and it's not building tools for key escrow. Greg wrote: > ZKS has been pretty aggressively and conspicuously hiring wild-eyed > cypherpunk types, who won't necessarily inspire a lot of confidence > or trust in accoutant and risk-manager types. Yeah but the company's goal should be to satisfy users that there is a reason to trust the solution, and ZKS has brand recognition for building "trust no-one" (or at least distributed trust) solutions. Tim wrote: > [...] >By building precisely the tools they and other governments would need >to implement such a system, you are making such a system more likely >to happen. I agree with this argument. I wrote up some GAK-resistant design principles during the NAI/PGP key escrow argument (http://www.cypherspace.org/~adam/grdesign/) in an attempt to get people thinking about the social implications of protocols they write -- and to show that actually crypto protocols are not neutral -- a protocol could even be deliberately designed to frustrate later imposition of GAK -- for example end-to-end forward secrecy. Not suprisingly trying to frustrate GAK typically increases the security of your protocol, because the GAK aspect is a kind of attack, which could be perpetrated by others. This is one of the conclusions of the 11 cryptographers report on the risks of key escrow (http://www.cdt.org/crypto/risks98/) Here's my personal take on the design of privacy systems. It's basically an elaboration of "trust no-one", and "write code not laws" (aka cypherpunks write code). The desired trust model for privacy in order of preferred solution: - best: don't reveal the information in the first place -- critically rexamine whether is it necessary to reveal the personal data in the first place - if it is necessary to do some processing on data, examine the users processing and storing their own profile (client side applications) - try to operate pseudonymously (persistent anonymous) - if you can't do that at least split the data up (think reply-blocks) -- this is what the "split-key" thing is talking about (more on this below). - if possible make the protocols publicly auditable (as in time-stamp servers where if a server lies the users get a signed transcript proving it cheated). - if you can't do that have ombudsmen and traditional auditing of processes. - government laws come into it in the sense that some governments have or are starting to try to regulate companies handling of data. The UK Data Protection Act would be one example, where companies are supposed to forget data. We've discussed in the past the demerits of government laws wrt "forgetting" data -- if there is a business need for the data, the data service will move off shore. Still some companies will try to comply. - only lastly rely on contract law. Even with contract law it's problematic -- you're asking the company to forget something. For contract law, even though private contracting is a nice way to approach it, in practice it may be pretty hard to prove the company broke a contract, and anyway it's always better to prevent than detect and then argue it out in court. It's all a bit vague to talk about this stuff without some concrete example -- the above is talking loosely about areas where the user would currently be asked to reveal some info to a company. There are other applications one could apply crypto to. Also bear in mind that currently often the situation is no privacy at all -- data mining, sharing, reselling data against claimed privacy policies, weak non-technical "privacy seals", etc. Technical steps to ensure the user doesn't have to trust the company privacy policy is a good thing -- if the privacy policy is implemented in the form of cryptographic prevention. If they have the code and the protocols and they can see that they aren't trusting the company because the data doesn't leave their own computer, or is given pseudonymously through a mix net is a good thing. Even if nothing else technical is possible, and they have to trust a few third parties not to collude and there is no way to conduct the business without revealing the info to someone, that's an improvement, as previously they would have trusted the company alone. Hence the subject line -- using crypto to make cryptographic prevention is analogous to Nick Szabo's "Smart Contracts". (http://www.best.com/~szabo/smart.contracts.2.html) Now specifically about "key-splitting" -- the press release includes that one odd semi-technical snippet kind of out-of-context and ambiguously. The context is a system which is pretty much a reply-block. So as Adam Shostack says: it's not key splitting, it's multiple layered encryption -- the onion skin analogy. But as I say IMO it's imbalanced and ambiguous to mention that one technical approach without explaining at all, and without mentioning any of numerous other approaches. Adam

1 0

CALL for Papers: The Millennium Mac-Crypto Conference
by Vinnie Moscaritolo 31 Oct '00

31 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Take out your calendars, It's that time again folks. I am starting to put together the schedule for the Millennium Edition of the Mac Crypto/ Internet commerce workshop. The dates should be the week of Jan 29th, 2001. I have booked us space for that whole week, on the Apple Cupertino Campus . Henceforth, I am looking for folks to give talks, papers etc. This year's overall theme could cover "Security in a MacOS X world". I would like to see a number of talks related to how MacOS X changes the Macintosh threat model. In addition I would also like to see a few talks about lessons learned in the last few years about developing crypto related products. Maybe something about digital rights management or music. Digital cash talks are always welcome. I would like both technical and tutorial material. As usual I discourage simple marketing presentations without content, this is a technical group. Please try to keep the talks no more than 40 minutes with an additional 10 minutes allocated for for Q&A.. I suspect that there a a number of new people who have never been to a Mac Crypto. To get an idea about what this is all about take a look at the past three conference archives at http://www.vmeng.com/mc/ I will be posting a preliminary schedule, formal announcements and registration form in a month. In the meantime if you would like to give a talk, please send me the Title, Author's full name and email address and a small abstract I can post on the web-page. Once you have slides or possibly a pdf, please send me a copy I post or link to.. -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQA/AwUBOf8/EtixAAkLPvBCEQIIfgCfR3RHnib58GqZ03fbb+m0Ngvw3nQAmwUl F1r76c977zboKxAIK+l6xw5C =0Tx+ -----END PGP SIGNATURE----- -- Vinnie Moscaritolo KF6WPJ ITCB-IMSH PGP: 3F903472C3AF622D5D918D9BD8B100090B3EF042 ------------------------------------------------------- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CALL for Papers: The Millennium Mac-Crypto Conference
by Vinnie Moscaritolo 31 Oct '00

31 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Take out your calendars, It's that time again folks. I am starting to put together the schedule for the Millennium Edition of the Mac Crypto/ Internet commerce workshop. The dates should be the week of Jan 29th, 2001. I have booked us space for that whole week, on the Apple Cupertino Campus . Henceforth, I am looking for folks to give talks, papers etc. This year's overall theme could cover "Security in a MacOS X world". I would like to see a number of talks related to how MacOS X changes the Macintosh threat model. In addition I would also like to see a few talks about lessons learned in the last few years about developing crypto related products. Maybe something about digital rights management or music. Digital cash talks are always welcome. I would like both technical and tutorial material. As usual I discourage simple marketing presentations without content, this is a technical group. Please try to keep the talks no more than 40 minutes with an additional 10 minutes allocated for for Q&A.. I suspect that there a a number of new people who have never been to a Mac Crypto. To get an idea about what this is all about take a look at the past three conference archives at http://www.vmeng.com/mc/ I will be posting a preliminary schedule, formal announcements and registration form in a month. In the meantime if you would like to give a talk, please send me the Title, Author's full name and email address and a small abstract I can post on the web-page. Once you have slides or possibly a pdf, please send me a copy I post or link to.. -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQA/AwUBOf8/EtixAAkLPvBCEQIIfgCfR3RHnib58GqZ03fbb+m0Ngvw3nQAmwUl F1r76c977zboKxAIK+l6xw5C =0Tx+ -----END PGP SIGNATURE----- -- Vinnie Moscaritolo KF6WPJ ITCB-IMSH PGP: 3F903472C3AF622D5D918D9BD8B100090B3EF042 ------------------------------------------------------- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CALL for Papers: The Millennium Mac-Crypto Conference
by R. A. Hettinga 31 Oct '00

31 Oct '00

--- begin forwarded text

1 0

Bush & Gore On Crypto
by R. A. Hettinga 31 Oct '00

31 Oct '00

--- begin forwarded text

1 0

CDR: Autarchic Creed, The
by Jim Choate 31 Oct '00

31 Oct '00

http://www.paganlibrary.com/editorials/autarchic_creed.php3 -- ____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CDR: Re: (no subject)
by Nomen Nescio 31 Oct '00

31 Oct '00

ShamrockAgent(a)aol.com wrote: > Could you posibly send me instructions on how to construct a bomb and > what materials that are needed? Thank you~ *snort* Ask HettingaAgent(a)aol.com or SunderAgent(a)aol.com.

2 1

CDR: Seattle Match.com Gallery Mixer
by eventseries＠match.com 31 Oct '00

31 Oct '00

Dear Joe3058 Attention Seattle: We have an exclusive event for you! Match.com and NextMonet.com invite you to fall in love through art at their Seattle Gallery Mixer. The event will take place on Thursday, November 9th from 6-8pm at the Ballard/Fetherston Gallery, 818 E. Pike Street (corner of E. Broadway and E. Pike). Members and their guests can enjoy fabulous art, food, drinks, and interesting people and conversation. This is definitely a don't miss event, so RSVP today - http://www.evite.com/larad@match.com/seattlemixer. Space is limited, so be sure and get your RSVP today (please fill out all the information and RSVP yes to ensure that you are on the list!) Thanks, Lara Duncan Community Marketing Manager Match.com ********************************** Thank you for choosing Match. Where you're always just a few clicks away from meeting thousands of interesting,intelligent, and successful people just like you! http://www.match.com/index.htm?AssociateID=1911&FooterID=454&MessageID=467 For billing inquiries, email us at: billing(a)match.com For general questions, email us at: customercare(a)match.com Wanna make the most of your city? Citysearch it! http://www.citysearch.com

1 0

CDR: RE: Re: Visit a hacked site, loose your computers.
by Trei, Peter 31 Oct '00

31 Oct '00

Read the article. Of course the time is well known, and the logs are stamped. You are naive, though, if you beleive that will stop an LEA from trashing the lives of innocents... ...and of course they'll get away with it. Peter [Now, I'm not excusing the FBI's jackboot tactics in this case, but I will point out that Mr. Salomon poked at 'unusual' ports, and zone transfered yankee.com during his investigation. An IDS might well trigger an attack alert under those conditions. The government's theft of his property after all this was explained, is of course inexcusable.] > ---------- > From: mmotyka@lsil.com[SMTP:mmotyka@lsil.com] > Reply To: mmotyka(a)lsil.com > Sent: Tuesday, October 31, 2000 3:19 PM > To: cypherpunks(a)cyberpass.net > Subject: CDR: Re: Visit a hacked site, loose your computers. > > Wouldn't the time of the hack be pretty well known and wouldn't the RPI > firewall logs be timestamped or am I naive? > > Is knowledge being used as evidence of guilt? > > Mike > > >Andres Salomon, a fairly clued in RPI student, heard on > > IRC that the Yankees website had been hacked. He > > checked it out, noted some well-known Red Hat > > security holes, and came to the conclusion that > > there had been a DNS redirect attack. Total time: > > 5 minutes. > > > > The next day, the FBI raided his dorm room and > > seized his computers (along with a copy of ORA's > > DNS & BIND). > > > > Peter Trei > > >

2 1

Susan Landau on crypto policy
by Christof Paar 31 Oct '00

31 Oct '00

Please note the different day, time, and *building* of this seminar talk. For those coming from outside: Fuller Labs is the large concrete building next to Atwater Kent. - Christof *********************************************************************** ECE GRADUATE SEMINAR TITLE: Have the Crypto Wars Been Won? PRESENTER: Dr. Susan Landau Sun Microsystems Laboratories Place: Fuller Labs, Rm 320 Date and Time: Thursday, Nov. 9, 11 AM ABSTRACT: Telecommunication has never been perfectly secure, as the Cold War culture of wiretaps and international spying taught us. Yet many of us still take our privacy for granted, even as we become ever more reliant on telephones and the Internet. The security of these transactions has become a source of wide public concern and debate. Cryptography is a solution, but because cryptography can provide perfectly concealable communications, over the last quarter century the U.S. government has sought to prevent its proliferation. As a result there have been numerous battles between academics and industry on the one hand, and the U.S. government on the other, over the publication and deployment of strong cryptographic systems. In January of this year, in a major change, the U.S. government removed a number of export restrictions on cryptography. In this talk I will put current cryptography policy in the context of decisions over the last twenty-five years, and I will discuss the legal background behind the government controls, the purpose of the export regulations, and the subtleties behind the remaining restrictions. I will examine: is the battle over, and have the crypto wars been won? BIOGRAPHY: Susan Landau is Senior Staff Engineer at Sun Microsystems Laboratories. Before joining Sun, she was a faculty member at the University of Massachusetts and Wesleyan University, and held visiting positions at Yale, Cornell, and the Mathematical Sciences Research Institute at Berkeley. She and Whitfield Diffie have written ``Privacy on the Line: The Politics of Wiretapping and Encryption,'' which won 1998 Donald McGannon Communication Policy Research Award. Landau is also primary author of the 1994 Association for Computing Machinery report ``Codes, Keys, and Conflicts: Issues in US Crypto Policy.'' ---------------------------------------------------------------------- DIRECTIONS: The WPI Cryptoseminar is being held in the Atwater Kent building on the WPI campus. The Atwater Kent building is at the intersection of the extension of West Street (labeled "Private Way") and Salisbury Street. Directions to the campus can be found at http://www.wpi.edu/About/Visitors/directions.html ATTENDANCE: The seminar is open to everyone and free of charge. Simply send me a brief email if you plan to attend. TALKS IN THE FALL 2000 SEMESTER: 9/27 Christof Paar et al., WPI Elliptic Curve Cryptography on Smart Cards without Coprocessors 10/11 Prof. William Martin, WPI Introduction to resilient and correlation-immune boolean functions 10/25 Prof. Berk Sunar, WPI Implementing New Public-Key Schemes 11/9 Susan Landau, Sun Microsystems Laboratories Have the Crypto Wars Been Won? 11/22 Seth Hardy, WPI Elliptic Curve Point Counting with the CM Method in Java 12/6 Scott Guthery, Mobile-Mind Who are You? Novel Means of Human Authentication TBA Adam Woodbury, WPI Public-key Cryptography in Constraint Environments (MS Thesis presentation) See http://www.ece.WPI.EDU/Research/crypt/seminar/index.html for talk abstracts. MAILING LIST: If you want to be added to the mailing list and receive talk announcements together with abstracts, please send me a short email. Likewise, if you want to be removed from the list, just send me a short email. Regards, Christof Paar ! WORKSHOP ON CRYPTOGRAPHIC HARDWARE AND EMBEDDED SYSTEMS (CHES 2001) ! ! Paris, France, May 13-16, 2001 ! ! www.chesworkshop.org ! *********************************************************************** Christof Paar, Assistant Professor Cryptography and Information Security (CRIS) Group ECE Dept., WPI, 100 Institute Rd., Worcester, MA 01609, USA fon: (508) 831 5061 email: christof(a)ece.wpi.edu fax: (508) 831 5491 www: http://ee.wpi.edu/People/faculty/cxp.html *********************************************************************** For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help". --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Susan Landau on crypto policy
by Christof Paar 31 Oct '00

31 Oct '00

Please note the different day, time, and *building* of this seminar talk. For those coming from outside: Fuller Labs is the large concrete building next to Atwater Kent. - Christof *********************************************************************** ECE GRADUATE SEMINAR TITLE: Have the Crypto Wars Been Won? PRESENTER: Dr. Susan Landau Sun Microsystems Laboratories Place: Fuller Labs, Rm 320 Date and Time: Thursday, Nov. 9, 11 AM ABSTRACT: Telecommunication has never been perfectly secure, as the Cold War culture of wiretaps and international spying taught us. Yet many of us still take our privacy for granted, even as we become ever more reliant on telephones and the Internet. The security of these transactions has become a source of wide public concern and debate. Cryptography is a solution, but because cryptography can provide perfectly concealable communications, over the last quarter century the U.S. government has sought to prevent its proliferation. As a result there have been numerous battles between academics and industry on the one hand, and the U.S. government on the other, over the publication and deployment of strong cryptographic systems. In January of this year, in a major change, the U.S. government removed a number of export restrictions on cryptography. In this talk I will put current cryptography policy in the context of decisions over the last twenty-five years, and I will discuss the legal background behind the government controls, the purpose of the export regulations, and the subtleties behind the remaining restrictions. I will examine: is the battle over, and have the crypto wars been won? BIOGRAPHY: Susan Landau is Senior Staff Engineer at Sun Microsystems Laboratories. Before joining Sun, she was a faculty member at the University of Massachusetts and Wesleyan University, and held visiting positions at Yale, Cornell, and the Mathematical Sciences Research Institute at Berkeley. She and Whitfield Diffie have written ``Privacy on the Line: The Politics of Wiretapping and Encryption,'' which won 1998 Donald McGannon Communication Policy Research Award. Landau is also primary author of the 1994 Association for Computing Machinery report ``Codes, Keys, and Conflicts: Issues in US Crypto Policy.'' ---------------------------------------------------------------------- DIRECTIONS: The WPI Cryptoseminar is being held in the Atwater Kent building on the WPI campus. The Atwater Kent building is at the intersection of the extension of West Street (labeled "Private Way") and Salisbury Street. Directions to the campus can be found at http://www.wpi.edu/About/Visitors/directions.html ATTENDANCE: The seminar is open to everyone and free of charge. Simply send me a brief email if you plan to attend. TALKS IN THE FALL 2000 SEMESTER: 9/27 Christof Paar et al., WPI Elliptic Curve Cryptography on Smart Cards without Coprocessors 10/11 Prof. William Martin, WPI Introduction to resilient and correlation-immune boolean functions 10/25 Prof. Berk Sunar, WPI Implementing New Public-Key Schemes 11/9 Susan Landau, Sun Microsystems Laboratories Have the Crypto Wars Been Won? 11/22 Seth Hardy, WPI Elliptic Curve Point Counting with the CM Method in Java 12/6 Scott Guthery, Mobile-Mind Who are You? Novel Means of Human Authentication TBA Adam Woodbury, WPI Public-key Cryptography in Constraint Environments (MS Thesis presentation) See http://www.ece.WPI.EDU/Research/crypt/seminar/index.html for talk abstracts. MAILING LIST: If you want to be added to the mailing list and receive talk announcements together with abstracts, please send me a short email. Likewise, if you want to be removed from the list, just send me a short email. Regards, Christof Paar ! WORKSHOP ON CRYPTOGRAPHIC HARDWARE AND EMBEDDED SYSTEMS (CHES 2001) ! ! Paris, France, May 13-16, 2001 ! ! www.chesworkshop.org ! *********************************************************************** Christof Paar, Assistant Professor Cryptography and Information Security (CRIS) Group ECE Dept., WPI, 100 Institute Rd., Worcester, MA 01609, USA fon: (508) 831 5061 email: christof(a)ece.wpi.edu fax: (508) 831 5491 www: http://ee.wpi.edu/People/faculty/cxp.html *********************************************************************** For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help". --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CDR: Re: ZKS goes GAK
by Anonymous Remailer 31 Oct '00

31 Oct '00

>If the original Freedom product is: > >a. as unbreakable/untraceable as was originally planned (verdict is out, IMO) > >and > >b. is continued to be supported and distributed > >then why would the new "trusted third parties" system be needed? Risking to fall into the doomsayer trap, I would call this a classical "bait switch" technique. Bait was a genuine product, probably developed by the genuine company and people. Switch happened later, when men with guns decided to pick up this thing. But what really pisses me off is that seemengly intelligent people keep on ranting about their intentions. Who the fuck cares what the intentions are/were ? Establishing trust with the crypto-savvy is what ZKS did. That asset is owned by whoever owns the company, not by hired hands. And the use of that asset will be whatever they decide. Creating such an asset brings responsibility, and ZKS folks failed there: their work will be used for other purposes, and there is nothing they can do about it. Assuming that one can make money by providing protection from the people that print that money is just plain silly.

2 1

CDR: Yahoo! News Story - $1 Million Pot Tax Bill Stirs Fight
by Yahoo! News 31 Oct '00

31 Oct '00

IRS (nobody(a)zedz.net) has sent you a news article ------------------------------------------------------------ Personal message: $1 Million Pot Tax Bill Stirs Fight http://dailynews.yahoo.com/htx/ao/20001027/cr/_1_million_pot_tax_bill_stirs… ============================================================ Yahoo! News http://dailynews.yahoo.com/

1 0

CDR: Yahoo! News Story - $1 Million Pot Tax Bill Stirs Fight
by Yahoo! News 31 Oct '00

31 Oct '00

IRS (nobody(a)zedz.net) has sent you a news article ------------------------------------------------------------ Personal message: $1 Million Pot Tax Bill Stirs Fight http://dailynews.yahoo.com/htx/ao/20001027/cr/_1_million_pot_tax_bill_stirs… ============================================================ Yahoo! News http://dailynews.yahoo.com/

1 0

CDR: Visit a hacked site, loose your computers.
by Trei, Peter 31 Oct '00

31 Oct '00

It'll probably be slashdotted by the time you get to it, but see: http://devrandom.net/~dilinger/ Andres Salomon, a fairly clued in RPI student, heard on IRC that the Yankees website had been hacked. He checked it out, noted some well-known Red Hat security holes, and came to the conclusion that there had been a DNS redirect attack. Total time: 5 minutes. The next day, the FBI raided his dorm room and seized his computers (along with a copy of ORA's DNS & BIND). He described them as 'nice' -after all, they left him his CD-Rs of mp3, divx & pr0n. Peter Trei

1 0

CDR: Susan Landau on crypto policy
by R. A. Hettinga 31 Oct '00

31 Oct '00

--- begin forwarded text

1 0

CDR: Re: Bush Calls Administration Encryption Policy "Outdated"
by mmotyka＠lsil.com 31 Oct '00

31 Oct '00

> Bush Calls Administration Encryption Policy "Outdated" > Responding to a question about encryption technology in an ongoing > Internet debate, Texas Gov. George W. Bush castigated President Clinton > and Vice President Gore for what he called "outdated" technology policy. > "The Clinton administration has repeatedly been slow to recognize the > realities of the international market for encryption products regulated by > our nationís export laws," Bush said in a written response posted on the > Web White & Blue Web page. > Read the article: Newsbytes @ > http://www.newsbytes.com/news/00/157435.html > This Bush bit may sound positive but I expect increasingly draconian legitimate access legislation from both parties. Neither of them can be trusted and they will settle for nothing less than an absolute right to gather information and force key disclosure when they can't read it. If they can't have what they want today they will work towards tomorrow. Nonstop, like ants or termites. Mike

1 0

CDR: IRS Tentacles grow
by anonymous＠openpgp.net 31 Oct '00

31 Oct '00

IRS Can Access Offshore Credit Info By Catherine Wilson AP Business Writer Tuesday, Oct. 31, 2000 7:38 a.m. EST MIAMI In a sweeping tax-evasion probe, the IRS has been granted access to thousands of MasterCard and American Express credit card accounts held by U.S. taxpayers in three offshore banking havens. U.S. District Judge Adalberto Jordan on Monday agreed with the IRS that cardholders may have violated U.S. tax laws and that their identities are not readily available from other sources. The court order allows the IRS to issue summonses for charge, debit and credit cards issued by banks in the Bahamas, the Cayman Islands and the country of Antigua and Barbuda in 1998 and 1999. Investigators want to look at such things as car, boat and airline ticket purchases and hotel and car rentals to learn whether the account holders are living beyond their reported means. The investigation is one of the largest targeting offshore accounts in the history of the Internal Revenue Service. MasterCard International spokeswoman Sharon Gamsin said in a statement that the company has "a long history of cooperating with governmental agencies." But she also said MasterCard keeps transaction records only by account number, with the bank keeping personal information. Judy Tenzer, a spokeswoman for American Express Travel Related Services Co., said, "We are now speaking to the IRS to get a better idea of what theyre looking at." Neither spokeswoman would answer questions. Offshore accounts are legal for U.S. taxpayers, but they must file forms with the IRS about them and pay taxes on income earned in the United States. The three nations targeted by the IRS have long been known as offshore tax havens and favorite spots for drug money launderers. Promoters of offshore accounts boast that income can be sheltered because the U.S. government cannot penetrate some foreign banking secrecy laws. But the IRS believed it could avoid those laws by getting records through the Miami headquarters of the companies Caribbean operations. The IRS does not know how many accounts created by U.S. citizens and residents are involved but believes the number to be in the thousands. Banks in the targeted islands require customers to open bank accounts before obtaining credit cards. So obtaining the names of the cardholders produces the names of the bank account holders as well. Fifteen countries and territories have been blacklisted by a 29-nation task force for failing to cooperate in the fight against money laundering. The Bahamas and Cayman Islands are among them, but officials in the Cayman Islands promised in June to end tax-haven practices within five years. Daniel Mitchell, a tax expert at the conservative Heritage Foundation, worried that the IRSs blanket record request would affect financial privacy. "We should not be trying to enforce a worldwide tax regime," he said. "It tends to lead to cartel-like behavior, OPEC for politicians, for lack of a better phrase." http://www.washingtonpost.com/wp-srv/aponline/20001031/aponline073856_000.h…

1 0

CDR: Words to live by
by anonymous＠openpgp.net 31 Oct '00

31 Oct '00

"The advantage of lone wolf and small cell activity is that it is untraceable and is the best use of our meager resources- no membership dues, rental of meeting halls, driving, lodging and time-off for endless conventions," Curtis says in an article on his Web site. "All of your personal and cell resources go to exactly what you want them for, not to a "leader" who lives off you." And rather than terrorizing people in public, the 26-year-old Curtis says, racists should strive to work in secrecy. His site includes articles advising against answering police questions under any circumstances. "Remember, talk is cheap!" one article says. "But when it involves law enforcement authorities, it may cost you, or someone close to you, dearly. Remember the 5 words -- I have nothing to say. It has worked for us many, MANY times." "Hate site threat to public, group says" http://www.usatoday.com/life/cyber/tech/cti722.htm

1 0

CDR: identity theft
by anonymous＠openpgp.net 31 Oct '00

31 Oct '00

Bruce McKim DOB: 2/26/69 Soc Sec. No.: 212-04-8280 Martin Benjamin (for classified) DOB: 7/6/68 Soc. Sec. No.: 089-56-3596 Mary De Wolfe Stone DOB: 7/7/63 Soc. Sec. No. : 047-60-6209 http://cryptome.org/usa-v-qaeda-po.htm

1 0

CDR: when the Fedz come..
by anonymous＠openpgp.net 31 Oct '00

31 Oct '00

you are not being paranoid enough. The FBI managed to get a search warrant based on logs from a firewall, that showed my IP only connecting, not even logging in, hours after news of the cracking had appeared on news sites. If they can get a search warrant this easily, your data is not safe, sitting on your hard drive. For the past two months Ive been living in this dorm, I locked my doors, securified my boxes, and backed up my essential things. I never even imagined the federal government would just let themselves in and take it. excerpt from http://devrandom.net/~dilinger/ as seen on /.

1 0

CDR: Re: Ho to KICK OUT Junkbusters users
by Nomen Nescio 31 Oct '00

31 Oct '00

Igor Chudov wrote: > One of the most popular features, aside from math help, is "Talk to > Splotchy", which is a conversation with an Eliza-like AI program. But > unlike Eliza, Spltchy is more like a chatterbox with a lot more > personality. Some people even have cybersex with Splotchy. > Also, I have a "talk to George W Bush LIVE" section at > bush-2000.algebra.com. Basically the same thing but politically > educated. Has anyone had cybersex with your incarnation of G W Bush? [shudder]

3 3

CDR: RE: Zero Knowledge changes business model (press release)
by Trei, Peter 31 Oct '00

31 Oct '00

I can't help but feel that this is a weakening of ZK's position regarding privacy. The critical paragraph is: > >Zero-Knowledge is committed to deploying systems that are > >transparent and accountable. In keeping with this policy, > >MPS will incorporate third party verification and split > >encryption key structures, as well as provide consumers > >with access to white papers, independent auditors' reports > >or other materials that assure a company is doing what it > >claims. With MPS Zero-Knowledge strengthens its commitment > >to building responsible systems that empower consumers to > >control the disclosure and use of their personal > >information, while still enabling businesses to thrive in a > >data and relationship-driven marketplace. > I don't want to be 'assured that a company is doing what it claims' (with my personal information). Companies change policies at whim. What a firm's founder may fervently believe could become a curio of corporate history after the next board meeting. Look at Amazon's recent policy change, for example. Also, data in the possession of a corporation and me is always less secure than information possessed only by me. Instead of being assured that the company is acting in accordance with their stated policy du jour (or at least, their lawyers' spin on it), I want to know that they CAN'T abuse my personal data, because the don't have any. That is the confidence which ZK's original scheme was intended to produce, and which the introduction of this plan seems to seems to suggest is no longer considered a high priority at ZKS. It may be that the ZK's product 'Freedom' is proving a financial bust (I won't use it until I can buy nyms for cash at CompUSA). I understand the drive to meet payroll and pay off VCs, but I can't help but be saddened. I understand that some transactions require more state than "Here's an order, some money, and a shipping address", but in a great many cases, corporations by policy ask far more than this. The most egregious example I've seen is a cheap travel site which, when you register, suggests that you tell them your 'favorite internet password' as a key to get get back to your account. I hope that ZKS's new service doesn't simply "culminate in the deployment of a tailored privacy layer that integrates seamlessly with the client's existing enterprise applications".... but rather looks at their business and informs them of the absolute minimum of data they need to acquire, and how long to keep that data, if they need to keep it at all. I don't want to rely on a 'privacy layer' under the control of an entity which will profit from silently circumventing it, or be subject to leaks and third party seizures of data. Peter Trei Disclaimer: The above represents my personal opinions only.

3 2

CDR: ELIXIR automated signal collection
by Bo Elkjaer 31 Oct '00

31 Oct '00

Hi I'm looking for information concerning a SIGINT system with the codename ELIXIR. I don't know much about it except that was (is?) deployed by the US Air Force, probably in the United Kingdom, initially in the late 80'ies. I have located one former USAF Analyst who claims to have worked with the system. He's in Florida now, but was in the UK 1983-1987. Any info on ELIXIR will be much appreciated. Yours Bo Elkjaer, Denmark >>Bevar naturen: Sylt et egern.<< >>URL: http://www.datashopper.dk/~boo/index.html<< >>ECHELON URL:<< >>http://www1.ekstrabladet.dk/netdetect/echelon.iasp<<

1 0

CDR: Bush Calls Administration Encryption Policy "Outdated" (was Re: GigaLaw.com Daily News, October 31, 2000)
by R. A. Hettinga 31 Oct '00

31 Oct '00

At 5:19 AM -0800 on 10/31/00, GigaLaw.com wrote: > [POLITICS] > Bush Calls Administration Encryption Policy "Outdated" > Responding to a question about encryption technology in an ongoing > Internet debate, Texas Gov. George W. Bush castigated President Clinton > and Vice President Gore for what he called "outdated" technology policy. > "The Clinton administration has repeatedly been slow to recognize the > realities of the international market for encryption products regulated by > our nationís export laws," Bush said in a written response posted on the > Web White & Blue Web page. > Read the article: Newsbytes @ > http://www.newsbytes.com/news/00/157435.html -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0