October 2000 - cypherpunks-legacy

CDR: stats
by Knaps24＠aol.com 12 Oct '00

12 Oct '00

would you be able to send me statistics on how many people are killed by police officer fire in a year? thank you knaps24

1 0

CDR: Stu Baker making an ass of himself at Surveillance by Desgn
by anonymous＠openpgp.net 12 Oct '00

12 Oct '00

In http://heise.de/tp/english/inhalt/konf/8847/1.html Mr Baker, who served as the General Counsel (senior lawyer) of the U.S. National Security Agency from 1992-1994, began his speech in "anonymous" disguise, wearing a large black cycle mask and a baseball cap turned back to front. He made a series of rude remarks about himself and others, in an attempt to show the dangers of what he called "the anonymity industry". The audience appeared baffled by his conduct. Does anyone have pictures online? ...later... Former NSA counsel Stuart Baker cited ZKS a week later as a leading member of the "anonymity industry" and claimed "in the long term, law enforcement will find ways to make anonymity partial". Companies like ZKS, he threatened, could in some countries face civil discovery suits, or even "could be charged with complicity in crime". Its "something to keep your eyes on", he added with apparent enthusiasm. We know who we should keep an eye on, Stu baby

1 0

CDR: simonsingh on bbc
by anonymous＠openpgp.net 12 Oct '00

12 Oct '00

I am currently presenting a TV series for Channel 4 in Britain, entitled The Science of Secrecy. It airs on Thursday nights at either 9.00 or 9.30pm until November 2. The final programme includes an exclusive interview with Clifford Cocks, the secret co-inventor of RSA. This is the first time that a British Government cryptographer has been permitted to talk about his work. Details of the series can be found on the Channel 4 website The series is accompanied by a book entitled The Science of Secrecy. Please note, this is an adaptation of The Code Book, and so it will not be of interest to anybody who has already read The Code Book. It has the advantage of following the series more closely and contains more illustrations. Hence, I would certainly recommend it to anybody who has not read The Code Book, and who wants to learn more about cryptography having watched the TV series. I hope that the TV series will be shown overseas, but as yet there are no plans to do this. http://www.simonsingh.com/cipher.htm

1 0

CDR: Satellite promotion with direct email
by Free.E.Book.traffic.20000＠unbounded.com 12 Oct '00

12 Oct '00

You are invited to view our free E Book on "How to Promote your Satellite Business Through Direct Email" See: http://63.82.144.35/327/4738756838489.html Thank You To be removed from further mailings send a bank email to traffic2000(a)unbounded.com with "remove" in the subject. --------------------------------------------------------------- Please report any internet abuse to abusecop(a)mail.ru

1 0

CDR: Re: Multi-part security solutions (Was: Re: Rijndael & Hitachi)
by Paul Crowley 12 Oct '00

12 Oct '00

Meyer Wolfsheim <wolf(a)priori.net> writes: > The only reasons I see for having a security system (be it an encryption > product, or a physical access device) with a large discrepancy in the level > of security that the individual components provide is either: [snip reasons a, b and c] I'm sure you've thought of this, but there's also a reason (d): because the most convenient component for a particular application is vastly more secure than you need. When using a cipher as a component, you might as well use a ludicrously strong one like Rijndael or Blowfish, because there's nothing to be gained from using a weaker one. Good locks are more expensive than bad ones, but strong crypto is free. -- __ \/ o\ Employ me! Cryptology, security, Perl, Linux, TCP/IP, and smarts. /\__/ paul(a)cluefactory.org.uk http://www.cluefactory.org.uk/paul/cv/

1 0

CDR: RE: Burglar Politics, Tempesting PC's that watch TV and DVD regio
by Trei, Peter 12 Oct '00

12 Oct '00

> ---------- > Lucky Green[SMTP:shamrock@cypherpunks.to] wrote: > Sunder wrote, quoting > > http://www.theregister.co.uk/content/1/13863.html > > > > <SNIP> > [...] > > It's my understanding that TV detector vans work by picking up > > the radiation emitted by cathode ray tube TVs - which should mean > > that, if you're rich enough to run an LCD monitor they'll never > > know you're a secret Paxman admirer. > > A popular, but false, myth. The video cards radiate more than the CRT's. > Laptops tend to be the worst offenders. > > --Lucky Green <shamrock(a)cypherpunks.to> > Yep. Most laptops have a video card for attaching an external monitor, with an unshielded port - they thus spray out monitor-driving RF signals while they run, regardless of whether there is a monitor out there to receive them. Of course, a *good* laptop design would power off the video card if it's not in use, to extend battery life if nothing else. I don't know if they do this. One of my home systems is a Compaq desktop with an LCD screen. It does *not* use a standard video cable: there is a pure digital interface for the LCD. (I've never investigated as to whether I can seperately remove the SVGA card or interface). Peter Trei

3 2

Multi-part security solutions (Was: Re: Rijndael & Hitachi)
by Meyer Wolfsheim 12 Oct '00

12 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 11 Oct 2000, Arnold G. Reinhold wrote: > Derek Atkins adds: > > > > >Why try to pick a Medeco when it's locking a glass door? :-) > > The fact that some people put Medeco's in glass doors, doesn't mean > Medeco should never develop a better lock. Sure, Medeco should keep working on developing the best locks that it can produce. However, if you are going to design your structure with a glass door, it really makes no technological sense to exceed the security provided by the glass door with the other components (locks, hinges, etc.). Put a Medeco or an ASSA in a door that can be jimmied or broken down, and you've gained nothing that you wouldn't have had with a high quality lock lacking a sidebar. Except a warm fuzzy feeling inside: "We have unpickable locks!" Most burglar aren't going to spend the time picking your locks, regardless of what you have installed. The James Bond approach of sticking a pick in a lock (sans tension wrench), wiggling it a half a second, and then opening the door is pure fantasy. Lock picking, even for a very seasoned locksmith, takes more time than can be afforded in most cases. The same principle applies for fancy biometric access measures. I've seen high profile Internet security companies that have hand geometry scanners and I-Button controlled locks on doors that have door hardware that can be opened with pen-knives, coat hangers, and credit cards in a matter of seconds. How about ISP collocation centers with private, locked compartments for security conscious customers? Check the raised floors and the drop ceilings. In many cases, I fear, you will find that the steel doors on the compartment stop 18 inches above the concrete floor below, and/or don't extend past the ceiling tiles. Is it likely someone is going to pop the floor tile, craw around the cables and then pop up in your private collo space? No. But you as the customer deserve to be aware of where the weaknesses are. The only reasons I see for having a security system (be it an encryption product, or a physical access device) with a large discrepancy in the level of security that the individual components provide is either: a) Incompetence on the part of the designer, when the weaker component is thought to be as or nearly as secure as the stronger component, or b) An intentional marketing design stunt, where the purpose of the stronger component is to make the consumer comfortable with using an inherently weaker solution, or c) "Future capacity planning" (see also: budget cutbacks). Perhaps most excusable is "c", where the hypothetical Medeco would be installed in the glass door, with the intention of implementing a steel door in the future, while retaining the Medeco lock. The chances of such improvements happening decrease drastically the longer the weaker (but working) solution is in place. ("It's been good enough so far...") As for the other two reasons, obviously, "a" is the better case here, as the problem will (in a lot, if not most cases) be corrected after being discovered. I am disgusted by the use of security devices purely for marketing reasons. The mentality that "It doesn't matter that we can't provide quality entropy in our encryption product as long as we can say we use 256 bit Twofish" is demonstrative of negligence. I want to be told the security of the *weakest* part of the system, as that is the measure of the entire system's security. Then I will decide if it is sufficient for me. Certain things we just take for granted. No one seems phased by using wooden or glass doors to secure sensitive locations. Some people religiously arm their car alarms, but when was the last time you paid attention to a blaring car alarm, other than to wish it would stop? Does anyone hear one of those, and call 911 to report theft? I don't think so. Who here actually verifies ssh key fingerprints before accepting them upon connecting to a host for the first time? Or when the host key changes? Very few people, I would bet. Security is a ritual, not a product. - -MW- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 Comment: No comment. iQEVAwUBOeT/dSsFU3q6vVI9AQFVdwf/YvVNrEnup42xIZh6xasSkGuvW1IIqLTL rUBLgI67Ip/Cpv7Q127nzv/1oQzVkfSSPzfRmN7UnjQMDQab+LQHqUv22eIDk5Ft 9Zoqef5JeKmz7NkUjt+6GX/B4WTHo3ZefrIVD0Hqg4dkTTsFC+ibiqEnC3xM4gT6 xHUpbnX/Vhfudw+j1bpkUwTFFlP0lPKVEK803bNOMoPUcubHj9TRoFq64f+got5s ieEqPMEc3/EZAq+/72kZgZHMN1YEBg3rZ+i2EaZhG5iIleEO69DqYau6kVUxX5lJ nEditzNjXox4jV0p+CwBCRU4r6WFX27480zh5iAo6M24FFfQlg/sng== =fjfM -----END PGP SIGNATURE-----

2 1

CDR: RE: Think cash
by Trei, Peter 12 Oct '00

12 Oct '00

> ---------- > Marcel Popescu[SMTP:mdpopescu@geocities.com] wrote: > An interesting idea has surfaced on the freenet-chat list: is it possible > to > build a program that creates some sort of a puzzle, whose answer the > generating computer knows (and can verify), but which can only be answered > by a human being, not by a computer? [Additional requirement: it should be > easy for the human to answer the puzzle.] > > My proposal was to randomly create an image, which should be 1) easily > recognizable by a human (say the image of a pet), but 2) complex enough so > that no known algorithm could "reverse-engineer" this. [You need a > randomly-generated image because otherwise one could build a large > database > of all the possible images and the correct answers.] Background > information > would also be very useful - see > http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy > for > a human being to identify the animal in the picture, but (AFAIK) > impossible > to write a program to do the same thing. > > Ideas? > > Mark > That's a really interesting question. My off-the-cuff answer would be 'no'. The constraints which say that the problem is randomly generated by a computer and the answer also evaluated by a computer are the killers. Any problem which one computer can create, and solve, can also be solved by another. Perhaps one could generate the solution, and find a problem which is solved by that solution, but finding a type of problem which humans will always solve one way, and computers another is the rub. You refer the the problem of recognizing a photo of an animal. It used to be said that no computer program could reliably distinguish between a dog and a cat, but I'm not sure that's the case since the development of neural networks. Almost any question which has a solution which is clear, unambiguous, and easy determined by a human can probably also be solved by either a regular program or a neural net. What you are really attempting to find is a reliable, fast, single-question Turing test. I'm far from sure this is possible. Peter Trei

2 1

Re: CDR:Multi-part security solutions (Was: Re: Rijndael & Hitachi)
by drt＠un.bewaff.net 12 Oct '00

12 Oct '00

Meyer Wolfsheim <wolf(a)priori.net> writes: > Most burglar aren't going to spend the time picking your locks, > regardless of what you have installed. The James Bond approach of sticking > a pick in a lock (sans tension wrench), wiggling it a half a second, and > then opening the door is pure fantasy. Lock picking, even for a very > seasoned locksmith, takes more time than can be afforded in most cases. In Germany there is a Group calling themselvs "Sportenthusiasts of Lockpicking" - http://www.ssdev.de/ They have a tournament every year at the CCC Congress and be assured they open nearly every Lock in James Bond Time. drt -- Aber laß mich dich gleich mal vor der Zeitverschwendung deines Lebens bewahren: wenn du mit diesem Problem schon überfordert bist, ist Assembler nichts für dich. Denn da muß man logisch denken und Probleme selbständig lösen, die sonst ein Compiler für einen löst. ---Felix von Leitner http://koeln.ccc.de/~drt/

1 0

CDR: RE: Think cash
by Bill Stewart 12 Oct '00

12 Oct '00

>> Marcel Popescu[SMTP:mdpopescu@geocities.com] wrote: >> My proposal was to randomly create an image, which should be 1) easily >> recognizable by a human (say the image of a pet), but 2) complex enough so >> that no known algorithm could "reverse-engineer" this. [You need a >> randomly-generated image because otherwise one could build a large >> database of all the possible images and the correct answers.] >> Background information would also be very useful - see >> http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy >> for a human being to identify the animal in the picture, but (AFAIK) >> impossible to write a program to do the same thing. Ideas? At 01:53 PM 10/11/00 -0400, Trei, Peter wrote: >You refer the the problem of recognizing a photo of an animal. >It used to be said that no computer program could reliably >distinguish between a dog and a cat, but I'm not sure that's >the case since the development of neural networks. Blind humans aren't always good at recognizing screen images. Neural networks are good at recognizing things. Sometimes more precisely defined algorithms are good too. Some examples of recognition systems - you can look in the archives for pointers to the UCBerkeley "Naked People Finder", which does a reasonably accurate job of distinguishing whether pictures on the internet contain naked people. The people who did the research on that also designed the "Incredible Horse Finder", which identifies horse pictures on the net. I remember that those systems did a lot of modelling; I don't remember if they also did neural nets or not. If they wanted to describe shapes of dogs and cats and differentiate between them, it would be relatively doable. There's also a company out there that does "passfaces" - they pop up 9 pictures of people's faces, and you identify which one is in the set that's you password-equivalent. They do about 4 rounds of this, with random sets of faces; it's closer to a PIN than a real passphrase in strength, because they thought that was enough for their problem space. An interesting aspect of it is that humans are very good at recognizing faces, but not usually that good at describing them, so it's hard to give somebody else your passface set. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0