September 2000 - cypherpunks-legacy

CDR: Confirm your request to register for eGroups
by eGroups 28 Sep '00

28 Sep '00

Hello, You are receiving this because someone has requested to register the email address cypherpunks(a)toad.com with eGroups, a free email group service. To complete your registration, we need to verify that your email address is valid and that you do wish to register with our service. To continue with registration, please follow the confirmation steps below: 1. Go to the Web site: http://www.egroups.com/register?confirm 2. Enter the following authorization number: 53555 To access the eGroups Web site, please visit: http://www.egroups.com If you did not request, or do not want, an eGroups account, please accept our apologies and ignore this message. Regards, eGroups Customer Support IMPORTANT NOTE: If you believe your email address has been registered with eGroups without your consent, please forward a copy of this message to abuse(a)egroups.com

1 0

CDR: Re: Lions and Tigers and Backdoors, oh, my...
by brflgnk＠cotse.com 28 Sep '00

28 Sep '00

Ray said: -- begin quote -- I do not buy the story that what happened to PGP was an accident; on the contrary, it was just NAI doing what they had to do to get approval to put it up for international downloads, the same as Lotus just did what it had to do. -- end quote -- I have to agree. The very existance of unhashed packets in the key structure is insecure. Given that unhashed packets were a design decision for V4 keys, and given that the PGP/NAI guys are arguably not bone-stupid, some coercion must have been brought to bear. BTW, Wells Fargo is happy with Netscape 4.08, but not 4.07. I had wondered why a 4.08 release was built so long after 4.5x was available. I guess now I know.

5 7

CDR: Re: <nettime> Rebirth of Guilds
by James A.. Donald 28 Sep '00

28 Sep '00

-- On Tue, 26 Sep 2000, Tim May wrote: > > Lynching is an act of physical aggression, not at all the same thing as choosing not to trade with someone, not to invite him into one's home, not to interact with him. At 06:32 AM 9/27/2000 -0400, Sampo A Syreeni wrote: > In my mind, that is a rather fine line. You have difficulty telling the difference between being cold to someone and hitting over the head with a baseball bat? Do they allow you metal knives and forks in the institution where you reside, or are you only allowed plastic spoons? If they permitted you anything not made of soft rubber, you would soon figure out the difference. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG AHU6OaoABbrk+uzQS00UtfoouV8+7ljQR5aMkfUa 4tGttLqxcrdUZmd/cvYKXpNBlrcdcvwCTfruS20On

3 2

CDR: police IR searches to Supremes
by A. Melon 28 Sep '00

28 Sep '00

Supreme Court to hear thermal peeking case Tuesday, 26 September 2000 13:36 (ET) Supreme Court to hear thermal peeking case By MICHAEL KIRKLAND WASHINGTON, Sept. 26 (UPI) - The Supreme Court is getting ready to wrestle with the competing values of police technology and privacy in a case that could affect the scrutiny under which Americans live their lives. In a short order Tuesday, the justices said they will hear argument on whether law enforcement use of a "thermal imager" to detect heat sources inside a home violates the Constitutions ban on unreasonable searches, especially when the surveillance is conducted without a warrant. A final decision in the case could also determine how much "passive" intrusion is constitutional in a number of other applications as police deploy ever more sophisticated devices in the 21st century. The Fourth Amendment guarantees the "right of the people to be secure in their persons, houses, papers and effects" and bans "unreasonable searches and seizures." Though the court did not say when it would hear the case, argument probably will occur in January. The case accepted by the justices involves an Oregon man arrested in 1992 for growing marijuana in his house. Having a marijuana plantation inside a building usually involves "grow lights" that give off considerable heat. Federal officers were led to the home of Danny Lee Kyllo in Florence, Ore., because his divorced wife had been arrested by state law enforcement on drug charges. Kyllo and his former wife occupied two of the homes in a triplex building. As part of the investigation, an agent from the U.S. Bureau of Land Management asked an Oregon National Guard staff sergeant to take a thermal reading of Kyllos dwelling. While seated in a parked car on a public street, the sergeant used an AGEMA Thermovision 210 thermal imaging device to scan the triplex. The imager detects heat escaping from a house. Court records say he staff sergeant determined that Kyllos building was giving off a lot more heat than neighboring buildings. Using the information provided by the staff sergeant, the federal agent persuaded a U.S. magistrate to issue a search warrant for Kyllos home. A subsequent search discovered an indoor marijuana growing operation, firearms and drug paraphernalia, again according to court records. Kyllo was indicted on one count of growing marijuana, and entered a "conditional" guilty plea in U.S. District Court. Under an agreement with the prosecution, the plea would stand only if an appeals court failed to suppress the evidence from the thermal imager. Though the case went up and down the appeals court ladder twice, the appeals court eventually decided to let the evidence stand, saying that Kyllo had failed to establish that he had a reasonable "expectation of privacy" for the heat emissions from his home. The defendant "made no attempt to conceal these emissions, demonstrating a lack of concern with the heat emitted and a lack of subjective privacy expectation in the heat," the appeals court said. Kyllo then asked the Supreme Court for review. The case "raises the fundamental question of whether the Fourth Amendments guarantee of personal security in ones home must yield to scientific advances that render our traditional barriers of privacy obsolete," Kyllos court-appointed attorney told the Supreme Court in a petition, "or whether there is a core of privacy that police technology may not pierce without a warrant despite its capability of doing so."

6 7

CDR: Confirm your request to register for eGroups
by eGroups 28 Sep '00

28 Sep '00

Hello, You are receiving this because someone has requested to register the email address cypherpunks(a)toad.com with eGroups, a free email group service. To complete your registration, we need to verify that your email address is valid and that you do wish to register with our service. To continue with registration, please follow the confirmation steps below: 1. Go to the Web site: http://www.egroups.com/register?confirm 2. Enter the following authorization number: 53555 To access the eGroups Web site, please visit: http://www.egroups.com If you did not request, or do not want, an eGroups account, please accept our apologies and ignore this message. Regards, eGroups Customer Support IMPORTANT NOTE: If you believe your email address has been registered with eGroups without your consent, please forward a copy of this message to abuse(a)egroups.com

1 0

CDR: Confirm your request to register for eGroups
by eGroups 28 Sep '00

28 Sep '00

Hello, You are receiving this because someone has requested to register the email address cypherpunks(a)toad.com with eGroups, a free email group service. To complete your registration, we need to verify that your email address is valid and that you do wish to register with our service. To continue with registration, please follow the confirmation steps below: 1. Go to the Web site: http://www.egroups.com/register?confirm 2. Enter the following authorization number: 53555 To access the eGroups Web site, please visit: http://www.egroups.com If you did not request, or do not want, an eGroups account, please accept our apologies and ignore this message. Regards, eGroups Customer Support IMPORTANT NOTE: If you believe your email address has been registered with eGroups without your consent, please forward a copy of this message to abuse(a)egroups.com

1 0

CDR: New email could confound law enforcement
by anonymous＠openpgp.net 28 Sep '00

28 Sep '00

By Cecily Barnes Staff Writer, CNET News.com September 22, 2000, 12:20 p.m. PT URL: http://news.cnet.com/news/0-1005-200-2841067.html A start-up is set to release a novel messaging service that lets people send heavily encrypted email directly to each other, a development that could be a boon for privacy advocates but a headache for law enforcement authorities. AbsoluteFuture.com of Bellvue, Wash., has dubbed its service "SafeMessage," describing it as a "direct messaging" service that transmits messages from party to party without the use of a central server. This distinction is significant because email, which always passes through mail servers, leaves a trace copy of itself that can be subpoenaed, read or otherwise accessed by unauthorized readers. Besides bypassing a central server, the messages are heavily encrypted and are programmed to be automatically erased after a period of time designated by the sender. The encryption not only prevents outsiders from reading the message, but also limits the message recipient's ability to forward, cut and paste, or print the message. "(Email) leaves a permanent trail," said CEO Graham Andrews. "Not only on your computer and the receiver's computer, but also three or four servers in the middle." Whether or not direct messaging can strip away all traces of a document sent over the Internet is unclear, as the system does not do away with the need for an Internet service provider to allow parties to share files. "It's certainly going to pass through the server that connects you to the Internet and the server that connects the recipient to the Internet, but it will not pass through the typical mail servers," said Tony McNamara, AbsoluteFuture's chief technology officer. Amid growing concerns about privacy on the Internet, more people are inquiring about the secure transfer of data online, especially in instances of financial and banking data. AbsoluteFuture joins a growing list of companies that are responding to this market need with encrypted email services. Rival products include HushMail, ZixMail, Disappearing Inc. and Authentica. Unlike AbsoluteFuture, however, these services use ordinary email delivery systems that are prone to online eavesdropping and may leave trace copies behind in the computers used to carry them. AbsoluteFuture believes it has found a solution to this problem by harnessing technology known as peer-to-peer networking, which connects personal computers directly, without the need for a central server to route file transfers. Meta Group analyst David Thompson calls the market for peer-to-peer or encrypted messaging nascent. "People are just starting to realize that this kind of thing is even possible," he said. Peer-to-peer technology gained widespread notice after file-swapping company Napster was sued by the Recording Industry Association of America for allegedly facilitating the transfer of copyrighted material. While SafeMessage does not present any copyright violation, it could undermine the efforts of law enforcement agencies that sift and subpoena email messages to catch criminals. Most notably, privacy advocates have called attention to the FBI's Carnivore program, which is installed at ISPs and scans massive amounts of email to track messages sent by people under investigation. AbsoluteFuture's SafeMessage system would potentially allow people to operate below this radar screen. AbsoluteFuture said it is marketing its product primarily to corporate clients. "We believe this should be available to individual consumers, too, but we're not really in a position to handle that, so we are going to go the route of licensing to ISPs," Graham said. "We are very close to signing up several resellers." The company said SafeMessage is already being tested by a number of large corporate clients including a major oil trading company in Moscow, a large accounting firm, and a couple of stockbrokers. To use SafeMessage, a person signs on to the program with an ID and password, similarly to an email client. When typing the recipient, the person sends the contact to AbsoluteFuture's server, which locates the recipient online and allows the sender to send the message directly to the recipient. The message is encrypted before it leaves the sender's computer, and the decoder key is destroyed. If the recipient is not online, the sender must send the message to AbsoluteFuture's server, which will hold the message until the recipient logs on or the message times out. "In one sense this is slightly less secure because we're looking after it," Graham said. "But we don't have the key to get at it. Even if there was a court order for the message, it is highly encrypted. We'd say, 'OK, go ahead try to open it.'" Meta Group's Thompson said that while the system sounds secure, he is not convinced that it is foolproof. He said that during the period of time before the message is destroyed, keys exist that could unscramble the encryption. "At some point everything is gone," he said. "But there is some window in there in which there is still exposure"

8 11

CDR: ADV: Use the Power of the Net!
by jimmsocks＠mail.com 28 Sep '00

28 Sep '00

1 0

CDR: Re: Lions and Tigers and Backdoors, oh, my...
by Michael Motyka 28 Sep '00

28 Sep '00

>From the article... Until recently the US government strictly controlled the strength of cryptography in software exported to different countries, in order to protect the government's ability to access and monitor communications data. The regulations were relaxed after pressure from industry but Madison believes that this may have driven the NSA to find ways to carry out surveillance. "They're not going to give in over exporting strong cryptography without getting something in return," he says. I can't believe that they would voluntarily enter a period of weakend capabilities. My guess would be that he has the event ordering wrong. More likely the security types had alternatives in place and this, along with the easy flow of crypto code over the borders meant that relaxing the crypto regulations would not alter the landscape. It might even appease some of the privacy activists. Keep your eye on the birdie. I'm still waiting for RIP-USA to rear its ugly mug. Mike

6 6

RE: CDR: Re: Lions and Tigers and Backdoors, oh, my...
by Trei, Peter 28 Sep '00

28 Sep '00

Can you document this claim of the existance of 'help fields' in Netscape? I am (to put it mildly) astonished by this claim, and more than a little skeptical. I was aware of the Workfactor Reduction field in the export 'aka International' version of Lotus Notes (which this 'help field' seems identical to), but was not aware of it being included in any other application. If you can document this, I'm seriously interested in following up. Peter Trei Cryptoengineer RSA Security Inc. ptrei(a)rsasecurity.com > ---------- > From: Ray Dillinger[SMTP:bear@sonic.net] > Reply To: Ray Dillinger > Sent: Tuesday, September 26, 2000 8:37 PM > To: Michael Motyka > Cc: cypherpunks(a)cyberpass.net > Subject: Re: CDR: Re: Lions and Tigers and Backdoors, oh, my... > > > > On Tue, 26 Sep 2000, Michael Motyka wrote: > > > > >>From the article... > > > > Until recently the US government strictly controlled the strength of > > cryptography in software exported to different countries, in order > > to protect the government's ability to access and monitor > > communications data. The regulations were relaxed after pressure > > from industry but Madison believes that this may have driven the > > NSA to find ways to carry out surveillance. "They're not going to > > give in over exporting strong cryptography without getting > > something in return," he says. > > > >I can't believe that they would voluntarily enter a period of weakend > >capabilities. My guess would be that he has the event ordering wrong. > > Nope, he's got it right. > > There used to be, officially, a 40-bit key length limit on exportable > software. This made american software products with any crypto capacity > ridiculously weak, to the point where anyone concerned about security > would not use it -- the software industry was losing to foreign > competition, and the quality of the intercepts was going down because > everybody was wise to it and nobody who mattered to them was using it > anymore. > > New policy: The BXA approves export licenses for people who put all > but the last 40 bits of the key in the headers or trailers somewhere, > encrypted under a key that the NSA doubtless knows. > > Not that this is noised about too much. Feature AOL saying "yes, we > broke the encryption in Netscape starting after version 4.07..." not > bloody likely. > > After a little security skirmish with my (now Ex)Bank, I discovered > this about Netscape and Internet Explorer; both have "help fields" > in their headers that facilitate cryptanalysis of SSL connections > if you have the key to the help field. > > As far as I know, the same is true of all software that has BXA approval > for downloadable status. At least (name deleted -- a friend who works > at netscape) confirmed that they couldn't get BXA approval for export, OR > get anyone at BXA to tell them why not, except for vague wailing about > "security considerations" until someone finally offered to put in a > "help field". > > Anyway; people concerned about security from ordinary theives can now > be reassured because only the US gov't gets the juicy bits, and the > Uber-theives at the US gov't are reassured because they are getting > the juicy bits again now that most people think US products have "strong" > crypto. > > Don't get me started on this; I get so mad I can't see straight. > > Keywords to search by: "Help field" (in quotes), PKI, NSA, "40 bits" > "Netscape" -- It's out there, mostly in smarmy self-congratulatory > tones about how "We are pleased to announce that Netscape is working > with us and will be in compliance with the Public-Key Infrastructure" > by (Date -- I forget the date, but it coincides with the release of > Netscape 4.5). > > Ray > > >

4 3