September 2000 - cypherpunks-legacy

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0

CDR: RE: Re: Shunning, lesbians and liberty
by Trei, Peter 29 Sep '00

29 Sep '00

> James A.. Donald[SMTP:jamesd@echeque.com] wrote: > At 12:30 PM 9/28/2000 +0300, Sampo A Syreeni wrote: > > Oh but it is quite possible to put people in similar trouble if we > > grant that the right to property is absolute - if somebody owns on a > > sufficiently wide scale the basic commodities one needs to survive > > in the modern world (like fresh water, farming land, employment > > opportunities), others are born right in the middle of the > > proverbial desert. > > But in a free market this never happens. It only happens when the > government intervenes. Thus, for example, we only see homelessness where > there is rent control, we only see hunger where there is rationing and > collectivized farming, and so on and so forth. > > --digsig > James A. Donald > I haven't been following this debate closely, so I don't know which side you're on, Jim, but I assume (hope!) that you are merely being sarcastic. Peter Trei

1 0

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0

CDR: RE: visor phone vs. starium?
by Trei, Peter 29 Sep '00

29 Sep '00

> ---------- > A. Melon[SMTP:juicy@melontraffickers.com] writes: > from the clueless dept: > > Why would I want a PDA-phone hybrid? > > > Why do I have the uneasy feeling the newly announced > > Motorola/Palm product, due in 2002, may end up combining > > everything Palm knows about cell phones with everything Motorola knows > about personal > > organizers? > I'm going to have to remember that line :-) > Is it that none of the current devices even comes close to being useful > > for most people who already own a cell phone and a PDA? Dont > > take my word for it: Check out the MobilePlanet and iGO catalogs, > > where the latest wireless wonders are all on display. Sure, theyre > > cool, but are they useful? > Well, the Visor GSM phone plugin creates a relatively small increase in the size of the visor, based on photos. I carry both a cellphone and a Palm constantly, and the Visor device looks less bulgy than carrying both. It might be helpful from that point of view. The earlier Qualcomm PDQ phone/palmpilot is like carrying a brick in your pocket by comparison (I've got one in my desk - I don't use it). > > And how about those new devices that are supposed to turn Palms > > and Visors into cell phones? Give me a break -- Im supposed to talk > > into something that looks like that? How useful can the combination > > really be? Cool? Yes. Practical? Hardly. And $299 seems a bit steep. > I'd use it, but the price point sucks. > > Is this really necessary? > > <snip> > > > http://dailynews.yahoo.com/h/zd/20000926/tc/keep_your_phone_off_my_palm__1 > .html > > > > The real issue will be power consumption vs. mips for > > crypto. And user interfaces. > Well, on the visor speech input comes through the Visor's built-in mike, so it may be available to the processor for manipulation. The sound output is on a speaker built into the GSM phone module, and I kind of doubt if the data is available to a user program. You really need to get into a funny place in the stack - below A/D conversion, but above GSM packetization. I have greater hopes for doing encrypted voice-over-ip, if we want something that 's open source and user-verifiable. Peter Trei

1 0

CDR: Vint Cerf and Robert Kahn defend Al Gore
by Declan McCullagh 29 Sep '00

29 Sep '00

http://www.cluebot.com/article.pl?sid=00/09/29/0711253&mode=thread Did Al Gore Really Invent the Internet? posted by cicero on Friday September 29, @02:11AM from the resuscitating-al-gore's-image dept. As the election nears, Net-pioneers Vint Cerf and Robert Kahn are busy defending Al Gore. The veep's invented-here crack about creating the Internet, they claim in their article attached below, has been terribly misunderstood. Now, we're fans of the TCP/IP-inventing duo, but it's been a long time in political ecology since Cerf famously joked 15 years ago in parody RFC968 that: "Twas the night before start-up and all through the net, not a packet was moving; no bit nor octet..." Things are more complicated now, and MCI's Cerf has morphed from an IETF geek into a Washington powerbroker and Friend of Bill and Al. Cerf showed up at the New Year's Eve White House millennium gala, spoke at an October 1999 White House "Millennium Evening" lecture, and appeared with the president and vice president at a July 1997 event to introduce administration policy proposals. We note that other prominent figures recently have made similar attempts to rescue Gore's tattered image among techies. But a more neutral description of the vice president's role in history is, we think, a fine 1999 article by author Virginia Postrel. Their article: http://www.cluebot.com/article.pl?sid=00/09/29/0711253&mode=thread

1 0

RE: CDR: Re: Lions and Tigers and Backdoors, oh, my...
by Trei, Peter 29 Sep '00

29 Sep '00

> ---------- > From: Ray Dillinger[SMTP:bear@sonic.net] > Sent: Wednesday, September 27, 2000 4:39 PM > To: Trei, Peter > Cc: cypherpunks(a)cyberpass.net > Subject: RE: CDR: Re: Lions and Tigers and Backdoors, oh, my... > > > > On Wed, 27 Sep 2000, Trei, Peter wrote: > > >Can you document this claim of the existance of 'help fields' in > >Netscape? > > Not directly I can't, at least not without betraying someone. > In retrospect, I should've used a nym to make the statement > to keep him out of trouble. > I don't accept this. You should be able to: generate traffic dumps pointing to the 'help field', and showing where it fits within the SSL specifications. This is hardly rocket science. There is no need to compromise anyone whatsoever. Put forward the evidence, so we can independently confirm it. This sort of thing happens every year or two on this list. Someone makes a claim which, if true, has interesting and/or important implications. However, the nature of the claim is one which is quite capable of verification. The onus is placed on the claiment to 'put up or shut up'. Usually, they shut up. Examples of such claims include: * PGP has a secret backdoor. (OK: Here's the source: Where is it?) * gcc is hacked to stick secret backdoors into PGP. (OK: Here's the source: Where is it?) * All gcc binaries will stick the PGP hacking code into gcc when compiling gcc. (Here's a dump: show us.) * Emily Dickinson hid her boyfriends initials in her poems. (Here's some statistical tests you need to run: Show us). So I call upon you: Put up or Shut up. > >I am (to put it mildly) astonished by this claim, and > >more than a little skeptical. I was aware of the Workfactor > >Reduction field in the export 'aka International' version of Lotus Notes > >(which this 'help field' seems identical to), but was not aware > >of it being included in any other application. > > Okay, let's forget what I know from people I don't want to drag > into the fire and go through it from the "circumstantial" angle. > > What does it mean when Lotus Notes has to put a work reduction field > in their product in order to get export approval status, and then > doesn't talk about it? But lots of other companies who also don't > talk about it, with stronger-seeming crypto get export approval > status? > <you brought it up, you document it...> > Huh? "Doesn't talk about it"? It was announced with fanfare at the RSA Data Security conference a few years ago. There were press releases. It was widely discussed on this list. I invented the term 'espionage enabled' to describe this kind of application. Lotus got a lot of flack about it, but persisted. Some customers even bought it, noteably the Swedish government (See Risks Digest http://catless.ncl.ac.uk/Risks/19.52.html#subj1) > What does it mean when banks refuse to work with earlier versions > of Netscape claiming it's because the security certs are expired -- > but when new security certs are downloaded and installed, they > still refuse to work with earlier versions of netscape and refuse > to tell you why? (This, btw, was what made me suspicious in the > first place and why I started digging...) > <http://banking.wellsfargo.com/> > Well, it could mean that they want to use Web features available in later versions but not in earlier ones. Or maybe there are known security holes in earlier editions. Wells Fargo has actually been ahead of the curve at times: they were one of the first sites to require 128 bit encryption. > What does it mean when Lew Giles, even after the rules change to the > BXA-controlled system, made a living going around convincing > engineers working for american companies to compromise their products' > security? With or without knowledge of the companies' execs? > <http://www.counterpane.com/crypto-gram-9902.html#backdoors> > Is it after BXA? Bruce notes that the stories are all at least two years old, which would place them in very early 1997 at latest. I can't remember when the switch took place. Of course, if LG was doing this (and I have no real doubt that the NSA might try), it's excreable, but what is the relevance to products today? He can no longer seriously threaten to hold up export. > What does it mean when PGP has a "flaw" introduced into its > Additional Decryption Keys at the same time NAI is seeking > export approval for it? And NAI gets export approval, and > then nobody notices the flaw for several years after, and > then they go oops, it was just a mistake? > <in light of recent news, I don't figure I have > to document this one> > > What does it mean when a CEO who actually can and does review > code, so subverted engineers can't seem to get one past him, in > a meeting with NSA officials refuses to compromise -- and one of > the spooks loses his cool and offers to run the guy over in the > parking lot? I'll explain this one to you... it means that spook > _HAD_NEVER_SEEN_ anyone refuse to compromise, and had no fucking > clue what to do. That's if you buy the "he just lost his cool" > story. On the other hand, death threats may be policy and this > was just the first time they were needed. And on the gripping > hand, maybe it's just the first time it was *reported*. Not very > many execs would talk about something like that, and I figure most > who've experienced it probably just shut up and gave the spooks > whatever they wanted. > > <Considering your address, I figure you know about this one, > so I'm not going to bother documenting it. > > > Lew Giles and its ilk had to have some kind of bargaining position, > and if export approval was forthcoming without subverting security > in some way, would have had none. The only way a spook could lose > his cool and offer Bidzos a death threat would be if that spook were > totally unfamiliar with people not compromising. > Actually, I know of at least one other case where a major exec at a crypto company threw NSA people out on their ears after they offered to write some software to help with a project. I think you're confusing two different types of subversion. 1. Company policy based subversion. This is the type where word comes down from above to put in 'helper fields', etc. I can't see this happening in any company which was not simply a LEA front (such as Crypto-AG). The liability would be simply too great, the exposure too likely. This would require a large number employees and former employees to know, yet keep their mouths shut. When exposed, the officers of the company would be subject to criminal fraud and conspiracy charges, as well a variety of civil suits. It's simply a non-starter. Lew Giles can make as many pleas as he wishes; but I don't think he'll get many results. 2. Individual treachery. This type involves corrupting one or more engineers, whether via money, threats, or misplaced appeals to patriotism. This is more likely to succeed in the short term than type 1, but is very fragile for several reasons familiar to anyone who has done commercial software development. * Peer code reviews mean that many eyes look at the code. * Employee turnover in the field is high - 30-50% year. Thus, bugs inserted by earlier compromised employees are unlikely to last through many release cycles, as new employees come in and say 'Oops - Joe forgot to init the PRNG properly - lets fix that!' * Source code management systems make it very difficult to a single actor to monkey with code secretly, and even harder to cover his tracks. > You may consider me paranoid, but I'm telling you that the case of > Lotus Notes was just the one that people found out about. If Lotus > had to do that to get export approval from the BXA, then so did > everybody else. I do not buy the story that what happened to PGP > was an accident; on the contrary, it was just NAI doing what they > had to do to get approval to put it up for international downloads, > the same as Lotus just did what it had to do. And, I'm telling > you now, the same as AOL and Microsoft did what they had to do with > the browsers. > > Ray > Actually, it's pretty clear what happened with most of those cases where companies were allowed to ship strong crypto overseas before most of the restrictions were lifted. They all involved products where at least one party of the communications was a large organization or company which was subject to, and could be counted on complying with, sub poenas and court orders. Thus the authorities had another route by which to acquire content in which they were interested. I have little doubt that government organizations have attempted to subvert commercial crypto at various times in various ways. However, the 'help fields' you describe are simply implausible in open protocols such as SSL. Again, I ask you to point to the evidence. I and others have already run the searches you suggested and come up dry. Where are the URLs? As it stands, you are spreading FUD. Peter Trei

6 6

Re: CDR: pictures of Diana accident
by Ken Brown 29 Sep '00

29 Sep '00

lucinda chrissley wrote: > > Could you please send any pictures of the accident thank you > > lucinda I am happy to send you every picture I have of the accident by attachment to this mail. In fact every picture I have of every accident in the entire history of accidents. Here they are:. Don't they have public libraries in your country?

1 0

CDR: pwl cracker
by pipeline 29 Sep '00

29 Sep '00

hi please send me the code of glide.c (program to crack pwl files of win95). thanks ----------------------------- reply soon bye ==== deepak ---- have a great day ICQ 30662394 -- To invent, you need a good imagination and a pile of junk. --Thomas Edison

1 0

CDR: hi
by Michael 29 Sep '00

29 Sep '00

Hi, Want to earn $500-$1000 part time or $2000-$4000 full time around your current situation? We are rapidly expanding worldwide and are looking for people. Reply to me at hashim(a)japan.com if you would like more information. Have a great day!

1 0

CDR: Can we kill the 64-bit nonsense this year?
by Sandy Harris 29 Sep '00

29 Sep '00

I've already posted this to cryto-canada(a)greatvideo.com, but it seems to me wider distribution might be appropriate. >From the Canadian gov't Dep't of Foreign Affairs and International Trade (DFAIT) site: http://www.dfait-maeci.gc.ca/~eicb/notices/ser113-e.htm > ... the Wassenaar Arrangement Participating States reached a consensus > decision on export control revisions for cryptographic goods and > technologies at a meeting in Vienna on 03 December 1998. > > 12. The Wassenaar Arrangement Participating States agreed to ... > ... a Cryptography Note applicable to both hardware and software goods > that meet all of the following: > > (a) generally available to the public by being sold, ... > (b) the cryptographic functionality cannot easily be changed by the user; > (c) designed for installation by the user ... > (d) does not contain a symmetric algorithm employing a key length > exceeding 64 bits; and > (e) when necessary, details of the items are accessible ... to the > appropriate authority ... to ascertain compliance with ... > a. to d. above. > > 13. In addition to the technical changes, the Wassenaar Arrangement > Participating States agreed that the controls on Mass Market goods as > defined in sub-paragraph 12 (d) above will remain in effect for two years > and that the renewal of such controls for a successive period will require > the unanimous consent of the Wassenaar Arrangement Participating States. My reading of that is that the current 64-bit limit for freely exportable commercial software dies at the end of this year if any Wassenaar country acts sensibly and votes to kill it. Of course, there will be pressure from the US and perhaps some others to act stupidly and maintain the 64-bit limit or rplace it with some larger but still insecure limit. What can we do to ensure that unanimous consent to this does not occur? It should be rather difficult to get unanimous consent to anything from a group of 35, and maintaining the limit is clearly a remarkably dumb thing to do, so the odds may be with us here. Still, I'd feel better if I knew of a dozen or so countries publicly committed to withholding that consent.

2 1