February 2001 - cypherpunks-legacy

Scientific American: Feature Article: To Protect and Self-Serve: March 2001
by Jim Choate 20 Feb '01

20 Feb '01

http://www.sciam.com/2001/0301issue/0301cyber.html -- The Laws of Serendipity: 1. In order to discover anything, you must be looking for something. 2. If you wish to make an improved product, you must first be engaged in making an inferior one. Tivoli Certification Group, OSCT James Choate jchoate(a)tivoli.com Senior Engineer 512-436-1062

1 0

NSA, Pentagon, police fund research into steganography detection
by Declan McCullagh 20 Feb '01

20 Feb '01

http://www.wired.com/news/politics/0,1283,41861,00.html Secret Messages Come in .Wavs by Declan McCullagh (declan(a)wired.com) 2:00 a.m. Feb. 20, 2001 PST FAIRFAX, Virginia -- Neil Johnson has a job that's nothing if not unusual: He investigates how to uncover concealed messages embedded in sound and video files. A researcher at Virginia's George Mason University, Johnson is one of a small but growing number of digital detectives working in the field of computer steganalysis -- the science of detecting hidden communications. "I analyze stego tools," said the 32-year-old security specialist who is the associate director of GMU's Center for Secure Information Systems. "I try to find out what can be detected or disabled. I see what their limitations are." The tools he's talking about include programs such as Steghide, which can embed a message in .bmp, .wav and .au files; and Hide and Seek, which works with .gif images. Most computer-based steganography tools have one thing in common: They conceal information in digitized information -- typically audio, video or still image files -- in a way that prevents a casual observer from learning that anything unusual is taking place. The surprising news, according to Johnson and other researchers: Current stego programs don't work well at all. Nearly all leave behind fingerprints that tip off a careful observer that something unusual is going on. Johnson's work on steganalysis may seem obscure, but it has important law enforcement and military applications. The National Security Agency and police agencies have underwritten his research -- his center's graduate program at GMU is even certified by the NSA. The Pentagon funds related research at other institutions, and the Naval Research Laboratory is helping to organize the fourth annual Information Hiding Workshop in Pittsburgh from April 25 to 27. Earlier this month, news reports said U.S. officials were worried that operatives of accused terrorist Osama bin Laden now use steganographic applications to pass messages through sports chat rooms, sexually explicit bulletin boards and other sites. That complicates the NSA's mission of "sigint," or signals intelligence, which relies on intercepting communications traffic. [...] WetStone's "Steganography Detection and Recovery Toolkit" is being developed for the Air Force Research Laboratory in Rome, New York. The project overview, according to the company, is "to develop a set of statistical tests capable of detecting secret messages in computer files and electronic transmissions, as well as attempting to identify the underlying steganographic method. An important part of the research is the development of blind steganography detection methods for algorithms." Gordon said the effort arose from a study the Air Force commissioned from WetStone on forensic information warfare in 1998. The company was asked to identify technologies that the Air Force needed to guard against and it highlighted steganography as one of them. In addition to the NSA and the eavesdrop establishment, military installations, government agencies, and private employers could be affected by steganography. An employee or contractor could send sensitive information via e-mail that, if hidden, would not arouse suspicion. [...] -Declan http://www.mccullagh.org/

2 1

Phil Zimmermann leaves NSI, says PGP source should be published
by Declan McCullagh 20 Feb '01

20 Feb '01

******* Here's a photo: http://www.mccullagh.org/image/6/phil-zimmermann.html ******* http://www.wired.com/news/business/0,1367,41896,00.html PGP Creator Bolts to Hush by Declan McCullagh (declan(a)wired.com) 8:25 a.m. Feb. 20, 2001 PST Phil Zimmermann, the legendary creator of e-mail and file-encryption program PGP, will become the chief cryptographer for Web-based e-mail company Hush Communications. Citing differences with Network Associates -- which bought PGP in 1997 -- Zimmermann said he left the company so he could devote his time to making the open standard called OpenPGP more accepted in the industry. "For the past decade PGP has been the gold standard for e-mail encryption but we've always had trouble expanding beyond the power users because of ease-of-use problems," Zimmermann said in a statement on Monday. "The OpenPGP standard will be well served by Hush's fresh approach to ease of use and its roaming capability." Hush Communications, based in Dublin, Ireland, is a venture-capital funded company best known for its free, encrypted Hushmail and HushPOP services. Zimmermann's departure from Network Associates caps a turbulent decade marked by the release of his first version of "Pretty Good Privacy" in 1991, his instant fame as a hero of the online privacy movement, a tussle with patent-holder RSA Data Security, and an agonizingly extended criminal investigation by the federal government for alleged violations of U.S. export laws governing cryptographic products. When the antiwar-activist-turned-programmer sold his company, PGP Inc., to Network Associates and became a senior fellow, he began to have clashes with executives over the direction of PGP. Network Associates repeatedly flirted with the concept of key recovery -- endorsed by the Clinton administration but anathema to privacy advocates -- and has refused to publish the source code to the latest versions of PGP so outside experts can verify that no backdoors are present. Network Associates' departure from the aggressive kind of full disclosure favored by security analysts has fueled a move in the open-source community toward GNU Privacy Guard, a free replacement for PGP that does not rely on the patented IDEA algorithm. But its graphical interface, GNU Privacy Assistant, still is being developed and is not a finished product. [...]

1 0

Internet and Web Service Providers Directory
by Metaccess 20 Feb '01

20 Feb '01

Dear service provider, The registration of Internet and Web Service Providers in Metaccess.com (http://www.metaccess.com) - the Internet and Web service providers directory started on February 10, 2000. Metaccess enables any user to search for Internet and Web Service Providers based on over 450 search criteria. It puts providers directly in contact with thousands of decision-makers, purchasers and prescribers. Currently, over 1,200 Internet and Web Service Providers have already been registered in this new search engine that will be launched officially in a few days. If your company is not yet registered in the Metaccess.com search engine, you can register your business if it provides one or several services in the following fields : Website, Intranet or Extranet creation or redesign Advertising Applications development Database Domain name E-commerce Graphic design Hosting Internet access Online marketing, promotion Online payment Registration, web positioning Surveys, web monitoring, etc. Technologies, languages Traffic analysis Training Translation You can access the site at the following address : http://www.metaccess.com. To register your business, click on "Submit a site". See you soon on Metaccess.com... ----- Metaccess, the Internet and Web service providers directory. http://www.metaccess.com

1 0

Re: Secure Erasing is actually harder than that...
by David Honig 20 Feb '01

20 Feb '01

At 10:30 AM 2/20/01 -0500, Trei, Peter wrote: > >It's my vague recollection that some of the newer storage technologies >(CD-RWs, MOs, etc) use preformatted pits to store the data bits. Its >possible that for these technologies, the number of overwrites >required to make data irrecoverable is considerably lower, but that's >outside my area of expertise. > >Peter Trei Not only that, but I was able to find *no* specs on secure wiping of CDs and MOs, searching both the net and querying cypherpunks some time ago. (This thread is quickly misinterpreted and devolves into CD aging and shredding issues; neither of which helps if you're using a CD for OTP and want to wipe used bits.) ....... "What company did you say you were from, Mr. Hewlett?" ---Walt Disney to Bill Hewlett eetimes 22.01.01 p 32

1 0

To journalist: Beyond The Valley of 1984
by Jim Choate 20 Feb '01

20 Feb '01

In particular "Pig is a Pig"... http://plasmatics.com/BeyondCD.html -- The Laws of Serendipity: 1. In order to discover anything, you must be looking for something. 2. If you wish to make an improved product, you must first be engaged in making an inferior one. Tivoli Certification Group, OSCT James Choate jchoate(a)tivoli.com Senior Engineer 512-436-1062

1 0

None
by alsdsoa＠rosa.ro 20 Feb '01

20 Feb '01

<<< No Message Collected >>>

1 0

privacy regulations suck also (Re: Formal apology)
by Paul Sholtz 20 Feb '01

20 Feb '01

> I've been thinking about the current trend in privacy regulations > also. I came to the same conclusion. My bank sent me a shiny new > leaflet explaining their privacy position. It wasn't even an > especially desirable or equitable position, but they presumably felt > the new regulations obliged them to write it. I'm thinking: "so how > do the laws that caused this leaflet to be written help my privacy?" Yes, of course they will. They are designed to give you choice over how personal information is to be used. They will help orders of magnitude more than any "anonymization" technology ever will (reasons to follow) > These laws are almost exclusively about *handling* of data, rather > than questioning the fact that the data is collected in the first > place. (Well there is a principle that they should have a reason for > collecting it, and/or that they get consent, but they do have some > reason to have pretty much all the data they collect by their > standards.) I'm not sure what world you live in, but this point about not needing to collection infomration in the first place is barely a realistic way to conduct business in any way that I'm familiar with. Have you ever tried going to the doctor for basically anything? It's REALLY REALLY hard for him to treat you unless you tell him what's wrong, what your medical history is, and he is able to associate this information w/ YOU. I've done a little research on some of these "anonymization" protocols (like the cocaine auction by Ross Anderson: http://www.cl.cam.ac.uk/~fms27/cocaine/) and it seems like they are interesting mathematical curiosities, but that they don't model reality very well. No cocaine dealer on earth will do business anonymously. The reason is because "risky" businesses like this require an inordinately high level of trust, which the dealer cannot get from anonymous transactions. The dealer must make ABSOLUTELY certain that the person w/ whom he is dealing is NOT a government agent, and in the case that he gets shafted by a customer, he needs to know enough personal information about that customer to come after him guns blazing, killing him and preferrably taking out most of his immediate family too. Granted, the cocaine dealer has an interest in erasing any financial records of said transaction (i.e., dealing in cash and money laundering), but now we're talking about cash (or something like it; in general cash can be traced if it "wants" to be), not about anonymity or about "concealing" personal information in the course of a business transaction. > So here's the problem: these laws will if anything make it less > visible what information companies and governments have on you because > they will restrict uses. How the data is handled and used isn't the > problem, the problem is that the information is collected, and > available to law enforcement, national intelligence and your average > dick (private detective). The purpose of the laws is to make MORE visible the information that businesses and government have on you. None of these laws call for "restricting" the use of information, unless of course you the consumer are requesting the restriction, in which case the laws mandate that said organization must comply with the restriction. Like I said before, the information MUST be collected in order to perform most normal business transactions (especially in health and finance). The way the information is handled and used has TREMENDOUS implications for privacy. I'm not sure why you think that the "way" the information is handled has "nothing" to do w/ privacy.. uhh.. to most people working in the privacy field, this has EVERYTHING to do w/ privacy.. > Privacy to me means being able to keep my affairs private from > governments if I choose. The UK princple allowing you to use any name > you want (so long as it is not for committing fraud or a crime) is > agood one. (I'm hoping that using an alias does not affect the legal > systems evaluation of the severity of the crime -- and that there are > no "use of an alias in the commission of a crime" types things in > effect though I don't know the details). That is an interesting definition of privacy, but it is really a subset of the more general definition that is more widely used in the industry, which is namely the ability to control secondary uses of personal information. Your example about the UK allowing you to use multiple names seems to me to be a classic case of what one would call "security through obscurity." Most professionals would consider this to be EXTREMLEY weak security (or, in your case, privacy).. I'm not sure why you think this makes you more secure or private than a legal/economic/technical regime that allows you property rights over personal information.. > So the solution appears to be technological countermeasures, and > repealing laws. Neither of which appear even remotely likely within > the political system. The political system has a systemic desire to > create more laws. Every new law introduces more problems. The people > writing the laws don't know the technology, they are control freaks, > and pander to media and take bribes and broker favors with special > interest groups. So at this point I firmly believe in "write code not > laws", and think that "cypherpunks write code" is important. I'm not certain what you mean by "technological countermeasures". If you mean "anonymization" technology, or "zero-knowledge proofs", you can talk till you're blue in the face and it still won't happen, although that has nothing to do w/ the current political system. It has to do w/ the fact that businessmen won't conduct business w/ people they can't trust (ie., people who are anonymous) and even IF they could, the economic reality is that NOTHING in the infrastructure (of banks, hospitals, retail, etc) is even remotely prepared for this, so why bother talking about it? Better to guarantee privacy through systems that engender communication of adequate amounts of personal information for the transaction at hand (whether financial, medical or retail), but that ensure trusted handling of the info on the transaction is complete.. Paul Sholtz PrivacyRight, Inc. - www.privacyright.com Chief Technology Officer

2 1

Phil Zimmerman leaves NAI
by Trei, Peter 20 Feb '01

20 Feb '01

>From Slashdot: http://slashdot.org/article.pl?sid=01/02/19/1356257&mode=thread (I may have broken the signature while copying) Peter Trei -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A note to PGP users: As most PGP users know, Network Associates Inc (NAI) acquired my company, PGP Inc, in December 1997. For three years after that, I stayed on with NAI as Senior Fellow, to provide technical guidance for PGP's continued development, and to ensure PGP's cryptographic integrity. But I can't stay on forever. In the past three years, NAI has developed a different vision for PGP's future, and it's time for me to move on to other projects more fitting with my own objectives to protect personal privacy. Let me assure all PGP users that all versions of PGP produced by NAI, and PGP Security, a division of NAI, up to and including the current (January 2001) release, PGP 7.0.3, are free of back doors. In all previous releases, up through PGP 6.5.8, this has been proven by the release of complete source code for public peer review. New senior management assumed control of PGP Security in the final months of 2000, and decided to reduce how much PGP source code they would publish. If NAI ever publishes the complete PGP 7.0.3 source code, I am confident that the public will be able to see that there are still no back doors. Until that time, I can offer only my own assurances that this version of PGP was developed on my watch, and has no back doors. In fact, I believe it to be the most secure version of PGP produced to date. While it is true that NAI holds the PGP trademark and the source code for the NAI implementation of PGP, I'd like to point out that PGP is defined by an IETF open standard called OpenPGP, embodied in IETF RFC 2440, which any company may implement freely into its products. I will be working with other companies to support implementations of the OpenPGP standard, to turn it into a real industry standard supported by multiple vendors. I think the emergence of more than one strong commercial implementation of the OpenPGP standard is necessary for the long term health of the PGP movement, and will, incidentally, ultimately benefit NAI. To this end, I will be assisting the makers of HushMail, Hush Communications (http://www.hush.com) to implement the OpenPGP standard in their future products. They will be doing their own announcement of this new relationship. In addition, I will be assisting Veridis (http://www.veridis.com) a recent spin-off of Highware (http://www.highware.com) to create other OpenPGP compliant products, including software for certificate authorities for the OpenPGP community. I am also launching the OpenPGP Consortium (http://openpgp.org) to facilitate interoperability of different vendors' implementations of the OpenPGP standard, as well as to help guide future directions of the OpenPGP standard. This coming June marks the 10 year anniversary of the 1991 release of PGP to the public. PGP was originally designed for human rights applications, and to protect privacy and civil liberties in the information age. By proliferating the OpenPGP standard, we can renew that promise, and continue the commitment to personal privacy that captured the imagination and participation of millions around the world. Philip Zimmermann 19 Feb 2001 prz(a)mit.edu http://web.mit.edu/prz -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQA/AwUBOpDtWmPLaR3669X8EQLv0gCgs6zaYetj4JwkCiDSzQ JZ1ugMhqsAoMgS me78KR5VEfCVEUFpwOCCk8Tx =JVF2 -----END PGP SIGNATURE----- -- --------------------------------------------------

1 0

Following our mailing sent Friday, 17 November 2000
by francois.xavier.bodin＠winealley.com 20 Feb '01

20 Feb '01

Greetings wine lovers! I have exciting news. Following our e-mail of Friday, 17 November 2000, I have the pleasure of announcing the arrival of our prestigious "Wine Alley" wine-tasting presentation box. This is a limited edition, sponsored by the most-renowned wine specialists, including Olivier Poussier, who was voted world's best sommelier in 2000, and backed by more than 400 international appellations. Join our 5,000 members and take advantage of this unique gift. Remember, it's a limited offer! Discover right away your "Wine Alley" wine-tasting presentation box by clicking on: http://www.winealley.com/box/uk/ WINE ALLEY The Club for Wine Enthusiasts. By you. For you. And for everyone who turns wine into the art of living. P.S. This prestigious, solid-wood box, designed and made in Bordeaux, with 11 essential wine tasting accessories, makes an ideal gift. Think of giving it to someone special! If you would prefer to not receive unsolicited mail from us, please click on the site below to permanently remove your e-mail address from our list. http://www.winealley.com/wines/desmail.asp?id=cypherpunks@cyberpass.net&l=uk This offer respects general sales conditions, which can be consulted at the following address: http://www.winealley.com/box/uk/

1 0