June 2001 - cypherpunks-legacy

The Register: 'Chinaman' dethrones 'Hacker' on cyber-terror hit parade
by Jim Choate 23 Jun '01

23 Jun '01

http://www.theregister.co.uk/content/6/19922.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

[v-nv-mobilize] Gap's New Image (fwd)
by Jim Choate 23 Jun '01

23 Jun '01

----- Original Message ----- To: "v-nv-mobilize" <v-nv-mobilize(a)yahoogroups.com> Sent: Friday, June 22, 2001 1:10 PM Subject: [v-nv-mobilize] Gap's New Image > Gap's New Image > > On Monday, June 18th Gap unveiled a new promotional > display at stores nationwide. > > Faded black jeans hanging in front of an anarchist-red > banner, the words "INDEPENDENCE," "FREEDOM," and "WE > THE PEOPLE" scrawled across display windows in fake > black spray paint. > > Despite the fact that Gap makes their clothes in > sweatshops, and have been subject to many > demonstrations across the nation, they believe that > the growing movement against corporate power is now > large enough to begin marketing on. Now the protest > itself can be essentially sold to consumers as an > image. > > However ridiculous this new marketing scheme seems at > first, due to the tremendous power of corporate > advertising over consumers, Gap just might pull it > off, trivializing the movement against free trade, and > selling jeans at the same time. > > The effect that this new marketing could have on the > movement is tremendous. If Gap succeeds, it will mean > that every protest that is staged will be building on > their new image, in effect turning protestors and > activists into living, walking ads for Gap. Further, > if Gap succeeds it may become a trendsetter, and other > corporations might follow. > > Currently, the majority of consumers are unaware of > how Gap stands on "independence" and "freedom." > > Gap inc. is the corporation under which Gap, Old Navy, > and Banana Republic exist. All three companies have > been notorious for paying sweatshop workers as little > as 11 cents per hour in the third world, denying them > basic health care and the right to form unions, as > well as harassing, beating and forcing contraceptives > on them. Sweatshop workers generally work 12-14 hour > days (although sometimes 24) and can be as young as 12 > years old. > > Although many of Gap's clothes say "Made in USA" they > are actually produced in Saipan, a US territory where > normal US labor laws do not exist. > > The Fisher Family that owns Gap also owns Mendicino > Redwood Company, an active logging company that is > deforesting the valuable redwood forests in Mendicino > County, California. The Fisher family also has a > notorious reputation for lobbying for privatizion of > education and other public works in their home state > of California. > > It appears that to Gap inc., "Freedom" and > "Independence" only applies to the market, not the > people. > > For more info visit: gapsucks.org, globalexchange.org, > and sweatwatch.org -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: The Art of Submarine Warfare
by Jon Beets 23 Jun '01

23 Jun '01

Randomly checking for a drivers license which you are required to have when driving. Many people who have had their drivers license suspended often drive their vehicles anyway. I would assume most states (if not all) require you to surrender you drivers license to the police when asked. I believe the law actually views the drivers license as the property of the state which would be where they have the right to revoke it. Jon Beets Pacer Communications ----- Original Message ----- From: "Reese" <reeza(a)flex.com> To: "Jon Beets" <Jon.Beets(a)pacer.com>; <cypherpunks(a)cyberpass.net> Sent: Saturday, June 23, 2001 12:32 AM Subject: Re: The Art of Submarine Warfare > BUT - what are they randomly checking for? The officer only asks for her > ID, to establish her identity, that's a law enforcement function, he never > asks for her registration, which would marginally be a safety/compliance > function. > > At 04:01 PM 6/22/01, Jon Beets wrote: > >Random roadside checks have been legal in many states for years.... I can > >remember them as far back as 1982 in Texas. > > > >Jon Beets > >Pacer Communications > >

1 0

Boost Your Windows Reliability.
by achaney423＠bugjuise.net 23 Jun '01

23 Jun '01

1 0

Re: Critiques of Libertarianism
by a3495＠cotse.com 23 Jun '01

23 Jun '01

Jim wrote: http://world.std.com/~mhuben/libindex.html The "FAQ" is a joke, right? You know this is strictly a bush-league effort when you read: "This diversity of libertarian viewpoints can make it quite difficult to have a coherent discussion with them, because an argument that is valid for or against one type of libertarianism may not apply to other types." ....you mean you actually have to LISTEN to people before you stick them in a conceptual box and slap your two-bit pre-made labels on them??? Say it ain't so!!!! Moron. You can take any philosophical position under the sun and always find idiots and straw men who "support" it to knock around, why should libertarianism be any different. There's plenty of room for real debate here, too bad he's not up for it. Oh well! (You got me to take the troll bait though, not bad... ;) ~Faustine. *** The future science of government should be called "la cybernitique". Andri-Marie Amphre, (1843).

3 2

Re: No panties?
by John Doe #2 23 Jun '01

23 Jun '01

At 05:28 PM 6/15/01 +0000, Steve Thompson wrote: >For many reasons, we have been perusing the archives in order to resolve a >number of burning questions. One such question revolves around the the >erstwhile entity, Blanc Weber. Despite much heated discussion on the subject, >a first-order analysis of the archives clearly shows that we may not be >certain on the question of whether or not Blanc wore panties. Odd, we had the same feeling at the time; in fact we suspected that BW was JG. However Declan has a picture of an older woman captioned Blanc Weber, so perhaps not.

2 1

Notification of Internet Violations
by Net Authority Investigations 23 Jun '01

23 Jun '01

Dear Joe Cypherpunk, It has recently been brought to our attention that you are, or have been, in violation of the Net Authority Acceptable Internet Usage Guidelines. It has been reported that you distribute and/or view offensive materials over the Internet. Net Authority has investigated these claims and verified that they are true. As a result, your personal information has been added to one or more Net Authority Internet offender databases. Your information will be stored in the databases until enough evidence has been gathered against you to warrant further actions. To help avoid such a situation, it is strongly recommended that you cease your immoral actions on the Internet at once. You have been added to the following databases: - Hate Literature Offenders - Pornography Offenders - Child Pornography Offenders - Bestiality Offenders - Homosexual Pornography Offenders - General Blasphemy Offenders If you would like more information about Net Authority or the Net Authority Acceptable Internet Usage Guidelines, you may read the details at http://www.netauthority.org/. It is imperative that you fully understand the guidelines if you wish to avoid further prosecution. While the individual who reported your actions to us will remain anonymous, he or she wished to pass these words on to you: "Winston loved big brother." May God be with you as you struggle to overcome these evil impulses. You will be in our prayers at night. God speed, Net Authority Investigations Department investigations(a)netauthority.org http://www.netauthority.org/

2 1

OPT: Re: crypto flaw in secure mail standards (fwd)
by Jim Choate 23 Jun '01

23 Jun '01

---------- Forwarded message ---------- Date: 22 Jun 2001 13:27:14 -0400 From: Derek Atkins <warlord(a)MIT.EDU> To: Don Davis <dtd(a)world.std.com> Cc: cryptography(a)wasabisystems.com Subject: Re: crypto flaw in secure mail standards This is not a crypto flaw. This is an engineering flaw. First, the timestamp of the message is certainly encoded in the signature. This is protection against your first suggested attack. The recipient, upon verifying the signature, notices that it was made, e.g., two months previously. Then one would have to wonder why a two-month-old message was being sent. The other obvious problem is that although the sender's identity is encoded in the message's signature (as well as the time the signature is purported to be made), the original intended recipient's are not encoded within the signed portion of the message. The simple fix would be to include the appropriate mail headers withing the signed portion of the message. In particular, including the 'To' and 'Cc' fields would immediately protect against both of these attacks. The problem is not at all with the crypto. The problem is with the integration of the crypto with applications like e-mail. Have a nice day, -derek Don Davis <dtd(a)world.std.com> writes: > All current secure-mail standards specify, as their "high- > security" option, a weak use of the public-key sign and encrypt > operations. On Thursday the 28th of this month, I'll present > my findings and my proposed repairs of the protocols, at the > Usenix Technical Conference here in Boston: > http://www.usenix.org/events/usenix01/usenix01.pdf > > Citation: > Don Davis, "Defective Sign & Encrypt in S/MIME, PKCS#7, MOSS, > PEM, PGP, and XML." To appear in Proc. Usenix Tech. Conf. 2001, > Boston. June 25-30, 2001. > > A short summary: All current secure-mail standards have a > significant cryptographic flaw. There are several standard > ways to send and read secure e-mail. The most well-known > secure mail systems are PGP and S/MIME. All current public- > key-based secure-mail standards have this flaw. Here are some > examples of the flaw in action: > > Suppose Alice and Bob are business partners, and are setting > up a deal together. Suppose Alice decides to call off the > deal, so she sends Bob a secure-mail message: "The deal is off." > Then Bob can get even with Alice: > > * Bob waits until Alice has a new deal in the works > with Charlle; > * Bob can abuse the secure e-mail protocol to re-encrypt > and resend Alice's message to Charlie; > * When Charlie receives Alice's message, he'll believe > that the mail-security features guarantee that Alice > sent the message to Charlie. > * Charlie abandons his deal with Alice. > > Suppose instead that Alice & Bob are coworkers. Alice uses > secure e-mail to send Bob her sensitive company-internal > sales plan. Bob decides to get his rival Alice fired: > > * Bob abuses the secure e-mail protocol to re-encrypt and > resend Alice's sales-plan, with her digital signature, > to a rival company's salesman Charlie. > * Charlie brags openly about getting the sales plan from > Alice. When he's accused in court of stealing the plan, > Charlie presents Alice's secure e-mail as evidence of > his innocence. > > Surprisingly, standards-compliant secure-mail clients will > not detect these attacks. > > ---------------------------------------------------------- > Abstract > Simple Sign & Encrypt, by itself, is not very secure. > Cryptographers know this well, but application programmers > and standards authors still tend to put too much trust > in simple Sign-and-Encrypt. In fact, every secure e-mail > protocol, old and new, has codified na=EFve Sign & Encrypt > as acceptable security practice. S/MIME, PKCS#7, PGP, > OpenPGP, PEM, and MOSS all suffer from this flaw. > Similarly, the secure document protocols PKCS#7, XML- > Signature, and XML-Encryption suffer from the same flaw. > Na=EFve Sign & Encrypt appears only in file-security and > mail-security applications, but this narrow scope is > becoming more important to the rapidly-growing class > of commercial users. With file- and mail-encryption > seeing widespread use, and with flawed encryption in > play, we can expect widespread exposures. > > In this paper, we analyze the na=EFve Sign & Encrypt flaw, > we review the defective sign/encrypt standards, and we > describe a comprehensive set of simple repairs. The > various repairs all have a common feature: when signing > and encryption are combined, the inner crypto layer must > somehow depend on the outer layer, so as to reveal any > tampering with the outer layer. > > ---------------------------- > > Once I've presented the paper, I'll make this link live: > http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.ps > > - don davis, boston > http://world.std.com/~dtd > > > > > > - > > > > > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord(a)MIT.EDU PGP key available --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

Thought-A-Day
by Fountain Of Joy 23 Jun '01

23 Jun '01

Health is natural,sickness requires efforts --Dr.Andrew Weil ***************************************************************************** Your name has been recommended to receive thoughts of wisdom from Fountain of Joy.These refreshing thoughts will be delivered,free of cost,to your desktop,everyday,for an initial evaluation period.We believe that the meaningful insights of these carefully selected thoughts will bring peace,success & happyness in your life. If you would like your near and dear ones to receive these thoughts,please send their email addresses to amaha(a)vsnl.net We apologise if this email is received by you in error.If you desire to unsubscribe,reply to this email with 'remove' in the subject line. Thank you. ----Director, Fountain of Joy (Non-religious Organisation)

1 0

NSA Snooping Domestic Crypto
by John Young 23 Jun '01

23 Jun '01

Debate on whether the NSA spies domestically on US persons appears to be "yes" according to USSID 18, dated July 23, 1993, which was obtained by the National Security Archive a while back, for which we offer an HTML: http://cryptome.org/nsa-ussid18.htm Parts previously redacted concerning domestic surveillance are now revealed, among them these provisions for acquiring and retaining indefinitely domestically acquired encipherments: [Quote] (2) Domestic communications reasonably believed to contain technical data base information may be retained for a period sufficient to allow a thorough exploitation and to permit access to data that are, or are reasonably believed likely to become, relevant to a current or future foreign intelligence requirement. Sufficient duration may vary with the nature of the exploitation. (S-CCO) a. In the context of a cryptanalytic effort, maintenance of technical data bases requires retention of all communications that are enciphered or reasonably believed to contain secret meaning, and sufficient duration may consist of any period of time during which encrypted material is subject to, or of use in, cryptanalysis. (S-CCO) b. In the case of communications that are not enciphered or otherwise thought to contain secret meaning, sufficient duration is one year unless the Deputy Director for Operations, NSA, determines in writing that retention for a longer period is required to respond to authorized foreign intelligence or counterintelligence requirements. (S-CCO) [End quote] Again, these sections were censored in versions of USSID 18 previously made public, a 1980 version here: http://cryptome.org/nsa-ussid18-80.htm While the quoted material is a small part of the 52-page document, variations on it are repeated more than once, and seems to be the one exception to the requirement to avoid domestic interceptions and to destroy any that are inadvertently acquired. The classification (S-CCO) is not explained but some think it perhaps indicates material limited to the UK/USA agreement and/or the Echelon partners. A better answer is welcomed.

1 0