August 2001 - cypherpunks-legacy

OPT: CNN.com - Researchers: PDAs prone to hacker attacks - August 16, 2001
by Jim Choate 16 Aug '01

16 Aug '01

http://www.cnn.com/2001/TECH/ptech/08/16/security.palm.reut/index.html -- -- ____________________________________________________________________ natsugusa ya...tsuwamonodomo ga...yume no ato summer grass...those mighty warriors'...dream-tracks Matsuo Basho The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Wristwatch Reviews
by mmotyka＠lsil.com 16 Aug '01

16 Aug '01

> Oh, the irony > Ain't that why someone sent it to this list? Call the seller and say "I'm a crypto-anarchist and I want the 10% discount." Just a marketing technique to make the customer feel like part of a special group. I prefer automatic watches. 200M is standard. Never been below 30M. As for the extra dials of a chronograph, give me a break. I like my TAG but it has not been completely reliable. I'm told Rolex is very reliable but they're too expensive. I know of one from 1961 that was lost waterskiing in the 70's and was found hanging off a stump when the reservior was drained in the 80's. The original owner still uses it. There's a Seiko 200m Auto watch for $195. It's a bit thicker and heavier than the TAG but I like it. Of course a sporty Timex that will survive the pool and hot tub can be had for $25. If it held your crypto key collection that would make the choice easy. M

1 0

Battle Tested Police Watch
by unknown＠example.com 16 Aug '01

16 Aug '01

10% Discount and Free Shipping for all Police Employees! Chase-Durer's SPECIAL FORCES 1000 Swiss-Made Chronograph Watch is shock-resistant, accurate, dives to 1,000 feet and is great-looking. See it at www.chase-durer.com Lee Beale CHASE-DURER, LTD. lbeale(a)chase-durer.com Tel: 310-550-7280 Member, American Watch Guild This message is sent in compliance of the new e-mail bill SECTION 301. Per Section 301, Paragraph (a)(2)(C) of S. 1618, further transmissions to you by the sender of this email may be stopped at no cost to you by sending a reply to this email address with the word "remove" in the subject line.

2 1

re: p-punks
by mmotyka＠lsil.com 16 Aug '01

16 Aug '01

OK Links. http://aerial.evsc.virginia.edu/~jlm8h/class/quant1.html http://www.phy.duke.edu/Courses/100/lectures/Statistics/Sta.html#photon http://newton.dep.anl.gov/askasci/phy99/phy99525.htm

1 0

Lowest Price for a kids magazine
by webman890_936＠email.com 16 Aug '01

16 Aug '01

1 0

erotici
by Massaggi 16 Aug '01

16 Aug '01

Sesso e massaggi erotici a casa tua! Fino a quando qualche simpaticone non mi fa chiudere la mia nuova pagina web (cosi' come ha fatto con la e-mail sulla pagina). Per info e appuntamenti scrivetemi sulla mia nuova mail: dany7741(a)yahoo.it Cosa offro: massaggi erotici in biancheria intima. accompagnatrice per cene,cene di lavoro ,fine settimana,ecc RISPONDO A TUTTI e mi scuso con chi mi aveva scritto in precedenza,ma come avevo detto prima,la mia email e' stata disabilitata per colpa di qualcuno. L'indirizzo per vedere le mie foto: http://hostess74.hothost.tv

1 0

DCSB: Arnold Reinhold; Product 'Q' and Crypto Market Failures (fwd)
by Jim Choate 16 Aug '01

16 Aug '01

---------- Forwarded message ---------- Date: Thu, 16 Aug 2001 17:24:25 -0400 From: "R. A. Hettinga" <rah(a)shipwright.com> To: cryptography(a)wasabisystems.com, coderpunks(a)toad.com, mac-crypto(a)vmeng.com Subject: DCSB: Arnold Reinhold; Product 'Q' and Crypto Market Failures --- begin forwarded text

1 0

DCSB: Arnold Reinhold; Product 'Q' and Crypto Market Failures
by R. A. Hettinga 16 Aug '01

16 Aug '01

-----BEGIN PGP SIGNED MESSAGE----- [The Harvard Club is now "business casual". No more jackets and ties, but see below for details. While it lasts, anyway. Since last year's dot-bomb, the suit-ratio in the main dining room has been asymptotically approaching unity. :-). --RAH] The Digital Commerce Society of Boston Presents Arnold Reinhold "Product 'Q': The Market Failure of Most Cryptographic Products" Tuesday, September 4th, 2001 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA The term "Q" is used in physics as a parameter that describes the quality of a resonant circuit. In product development Q is a metaphor for how difficult it is to meet potential market needs. This analysis will be applied to several past product successes and failures and then to present and proposed products of interest to electronic commerce. Arnold Reinhold is an independent computer consultant and author. He previously managed software development groups at Computervision Corp. and at Automatix Inc, which he co-founded. Mr. Reinhold is co-author of The Internet for Dummies Quick Reference and E-mail for Dummies. He holds a Masters degree in Business Administration from the Harvard Business School. He has created several web site dealing with cryptography including diceware.com and ciphersaber. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, September 4th, 2001, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $37.50. This price includes lunch, room rental, A/V hardware if necessary, and the speakers' lunch. The Harvard Club has relaxed its dress code, which is now "business casual", meaning no sneakers or jeans. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your meal if the Club finds you in violation of what's left of its dress code. We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, September 1st, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $37.50. Please include your e-mail address so that we can send you a confirmation If anyone has questions, or has a problem with these arrangements (we've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: October Jean Camp Trust and Risk in Digital Commerce As you can see, :-), we are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, are a principal in digital commerce, and would like to make a presentation to the Society, please send e-mail to the DCSB Program Committee, care of Robert Hettinga, <mailto: rah(a)shipwright.com>. For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)reservoir.com> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)reservoir.com> . We look forward to seeing you there! -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQEVAwUBO3wlgcUCGwxmWcHhAQHndgf9EilyGjWc0lcZBNojVxFaSMuDd0GIfahT xdukiqmeZ74RVcRtLsHnAIgyvG4uvqvDn5A96SGI4tI0JE3PIyP1VLWFewNLtcfh l6QAeDo6EMFzWEbgNFSaTF9htVJSrrXcBTCf3WkGBenD3ghPM5dPaRiRf/qwmbya phCZDe+0HiOF+EVn4a5jKoPiZr+krU+SpvnYO9TaatD3FLt9I3DWjAy+yDJSEI2J G/E4VMrYFpU1lwZl7QvQFXl6zGE7UE5YthMVkdKiUBGAWPvRfN5tN+btL5mD53ST zzIaqyWky+WkZ+GIGe4Z/aWMJr4mmbzCPN6eHnJhlg0LrAiMDnRjmw== =pwM3 -----END PGP SIGNATURE----- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help". --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

DCSB: Arnold Reinhold; Product 'Q' and Crypto Market Failures
by R. A. Hettinga 16 Aug '01

16 Aug '01

-----BEGIN PGP SIGNED MESSAGE----- [The Harvard Club is now "business casual". No more jackets and ties, but see below for details. While it lasts, anyway. Since last year's dot-bomb, the suit-ratio in the main dining room has been asymptotically approaching unity. :-). --RAH] The Digital Commerce Society of Boston Presents Arnold Reinhold "Product 'Q': The Market Failure of Most Cryptographic Products" Tuesday, September 4th, 2001 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA The term "Q" is used in physics as a parameter that describes the quality of a resonant circuit. In product development Q is a metaphor for how difficult it is to meet potential market needs. This analysis will be applied to several past product successes and failures and then to present and proposed products of interest to electronic commerce. Arnold Reinhold is an independent computer consultant and author. He previously managed software development groups at Computervision Corp. and at Automatix Inc, which he co-founded. Mr. Reinhold is co-author of The Internet for Dummies Quick Reference and E-mail for Dummies. He holds a Masters degree in Business Administration from the Harvard Business School. He has created several web site dealing with cryptography including diceware.com and ciphersaber. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, September 4th, 2001, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $37.50. This price includes lunch, room rental, A/V hardware if necessary, and the speakers' lunch. The Harvard Club has relaxed its dress code, which is now "business casual", meaning no sneakers or jeans. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your meal if the Club finds you in violation of what's left of its dress code. We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, September 1st, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $37.50. Please include your e-mail address so that we can send you a confirmation If anyone has questions, or has a problem with these arrangements (we've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: October Jean Camp Trust and Risk in Digital Commerce As you can see, :-), we are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, are a principal in digital commerce, and would like to make a presentation to the Society, please send e-mail to the DCSB Program Committee, care of Robert Hettinga, <mailto: rah(a)shipwright.com>. For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)reservoir.com> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)reservoir.com> . We look forward to seeing you there! -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQEVAwUBO3wlgcUCGwxmWcHhAQHndgf9EilyGjWc0lcZBNojVxFaSMuDd0GIfahT xdukiqmeZ74RVcRtLsHnAIgyvG4uvqvDn5A96SGI4tI0JE3PIyP1VLWFewNLtcfh l6QAeDo6EMFzWEbgNFSaTF9htVJSrrXcBTCf3WkGBenD3ghPM5dPaRiRf/qwmbya phCZDe+0HiOF+EVn4a5jKoPiZr+krU+SpvnYO9TaatD3FLt9I3DWjAy+yDJSEI2J G/E4VMrYFpU1lwZl7QvQFXl6zGE7UE5YthMVkdKiUBGAWPvRfN5tN+btL5mD53ST zzIaqyWky+WkZ+GIGe4Z/aWMJr4mmbzCPN6eHnJhlg0LrAiMDnRjmw== =pwM3 -----END PGP SIGNATURE----- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help". --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[alg] [Fwd: [PLUG] USENIX Security: SDMI Invited Talk + Panel] (fwd)
by Jim Choate 16 Aug '01

16 Aug '01

---------- Forwarded message ---------- -------- Original Message -------- Subject: [PLUG] USENIX Security: SDMI Invited Talk + Panel Date: Wed, 15 Aug 2001 21:31:48 -0700 From: Steve Beattie <steve(a)wirex.net> Reply-To: plug(a)pdxlinux.org To: plug(a)pdxlinux.org [I'm at the 2001 USENIX Security Conference in Washington DC this week. The SDMI paper that was prevented from being presented at the Information Hiding conference earlier this year under threat of a lawsuit was allowed by the RIAA/SDMI to be presented here, with an additional panel session discussing the political aspects of the situation. I took notes for the wirex employees not present, and am forwarding it to the PLUG list given that certain members were interested in the Dmitry Sklyarov case, as they're both examples of the egregiousness of the DMCA] USENIX Security: SDMI Invited Talk + Panel Note: by transmitting this summary with comments, I'm possibly in violation of the DMCA by transmitting information about copy protection circumvention measures. Both the talk and forum were excellent. Supposedly USENIX webcast it live; hopefully they'll make it available somewhere on www.usenix.org. ------------------------------------------------------------------------ Technical presentation Reading between the lines: Lessons learned from the SDMI challenge Scott Craver et al SDMI Challenge overview - three weeks in sept oct 2000 - SDMI invited "hackers" to crack a number of proposed technologies - 4 watermarking - 2 authentication - cash prize offered, but under onerous (NDA) terms Just what is SDMI? - both robust and fragile watermarks Challenge terms - 3 samples provided for each technology - original sound clip a - marked sound clip a - marked sound clip b - SDMI provides "oracles" to which to submit attacked sound clip B - no description of algorithms - no access to watermark embedders - no access to watermark detectors - no details to oracle - only 3 weeks General Approach - three types - brute force - slightly "brute" attacks - reverse engineering Technologies B and C - Initial analysis reveled signals with a relatively narrowband signaling Tech a & b - A had a very slight smooth warping in time domain, +/- 0.3 ms every 3+ second - estimating and reversing warping did not defeat technology A, but the same operation defeated technology F! More A - attack: instead of removing/compressing [audio details that I'm missing] - ripples in freq imply echo hiding. Fairly complex echo hiding in this case Echo Hiding - a method of embedding data which deliberate but "inaudible"... Patent search time - Verance US patent #05940135 Echo Detection developed several techniques to estimate echo hiding - can constructively combine multiple frames - drove them to develop better methods for echo detection after the challenge Demo on BeOS of finding echoes (where they do and don't exist) They've used their research to improve data hiding and watermarking technology Technologies D & E A signature Track - TOC hashed into a playable audio track - 2532 samples 80 frequency bins = 80 bits - not a 9kbyte hash, but 80 bits - oh wait, only 16bits repeated 5 times with a constant shuffling. - at most, they gave 100 tracks with two hash collisions. - tech d did not appear to behave as documented - tech e challenge did not include any data to use to analyze Assessment - complex system with many SPOFs - appears to implement a complex usage policy - not a good way to keep "honest people honest" - basic concept is problematic - requires trusted clients in a hostile environment Conclusions - no secret CS-EE skills needed - the only dirty secret in the paper is that there are no dirty secrets - watermarking useful, just not here - overall concept is broken - security through obscurity (still) does not work! - people ignore this principal at their peril Technical questions - peter honeyman: what are the possibility of a real secure SDMI showing up? - a watermark will not work to actively enforce a usage policy - How many technologies did you actually break? - got responses from the four watermarking oracles, don't know the actual criteria of the oracles. - areas where watermarking are useful? - e.g. fragile watermarks for tamper evidence to digital photographs, robust watermarking for the duplication of currency. - john shapiro: complex means to keep "honest people honest" are more likely to fail over simple means? - agrees - what is threat model the challenge trying to echo? - ask SDMI people, not them. couldn't believe how simple the 16-bit scheme was, and had to give up assumption that sdmi people were thinking the same way the researchers were. ------------------------------------------------------------------------ Panel: Peter Jaszi, washington college of law, american university Cindy Cohn, EFF Ed Felten, Princeton Peter Jaszi ----------- Basic Architecture of the anti-circumvention portion of the DMCA Copyright: all about balance between rights of consumers and producers Important thing to understand: chapter 12 is NOT copyright law, it's a (dangerous) add-on to copyright law! Sec 1201 a1A - "Thou shalt not circumvent for access" - Potential for exceptions by rules made under sec 1201 a1b - in oct 2000, the LoC announced a rule limited to circumvention - obsolete techs - lists of web servers - don't apply to creation/traffic of circumvention tools sec 1201 a2: no trafficking in access tools sec 1201 b1: no trafficking in copying tools - SDMI challenge under this section - don't know the scope of these prohibitions Note that the language of sec 1201c, preserving (among other things) the "fair use" defense, applies to copyright, but not "paracopyright" (the DMCA). sec 1201d - library exemption -- completely bogus. sec 1201e - law enforcement exception - quite robust, of limited use to rest of the world sec 1201f - reverse engineering exception - narrower in scope of limitations than allowed under current case law (of copyright) sec 1201h - defeating minors privacy exception sec 1201i - personal data exception - can take advantage of it only if you make your own tools sec 1201g - encryption research exception - uncertain in scope sec 1201j - security testing research exception weakness two these sections: - both are decided upon after that fact, researchers can't know what's legal and not-legal a priori - must have consent of organization performing research on - must have "professional standing" http://www.ipclinc.org Cindy Cohn ---------- Jaszi told us everything about 1201 we need to know, except: - EFF is ground central for fighting DMCA - introduced EFF legal team (doing pro bono work) Opposition papers to DMCA are available on the EFF website. What you can do: make the general public aware of why the DMCA is bad - articulate clearly the problems - each person should find 5 non-technical people and explain to them the problems of the DMCA - prod organizations we belong to to support against the DMCA - join the EFF, "freedom doesn't just happen" Ed Felten --------- acknowledgement of the other authors Presentation of paper is important victory, but came at a major cost in effort. We can't afford do this for every research paper. Forward research in to these areas are NOT protected, and could be squashed. Questions --------- q - smb: ed, why did University presidents not stand up as strongly as they could. ed - princeton did help defend. universities are convservative organizations. q - peter honeyman: dmca seems to be encouraging, not discouraging, copying technologies. cindy - eff has thought about stating that if you want to put out anti-copying technologies, you give you copyright protection. peter - another possibility is to encoding rules of fair use in DMCA (see sec 1201k) q - what is different about today's presentation and the planned presentation, and the wired article fallout. ed - more or less the same presentation. The paper contains more content than what was in the original paper, due to information withheld out of fear DMCA. No legal fallout from the wired article. q - register journalist: press has a role to play. Why doesn't the mainstream press doesn't realize they have a stake in this, wrt press freedom? cindy - amount of press is growing, especially wrt Dmitry situation. The press is mostly concentrated in the hands of content holders. The press wants to appear non-partisan, and not take sides. Journalists did write a brief for the 2600 case. peter - journalist can print smoking gun memos (copyright the corporation) under fair use. But if the journalist has to go to someone to decrypt the same (encrypted) copyrighted documents, it is illegal under the DMCA. q - does the statute take into account dual-use technologies? peter - the statute does take it into account. It does not however give users of the technology some comfort that it cindy - DeCSS was described as for linux playback, with no positive affect. q - jon shapiro, johns hopkins university IT: how abroad is the application of the DMCA? ed - echo technology is useful in seismology, and the princeton seismologists are outraged that the DMCA will prevent the research that they will find useful. cindy - we don't know how broadly it will apply. peter - reads the language, and it's possibly very broad. q - interactions between this case and Dmitry's case cindy - as a strict legal matter, they're different legal jurisdictions, and so they're not binding wrt each other. q - what are lessons learned for university professors and univ. legal councils, dos and don'ts? ed - there's no easy answer to that question. My best advice: talk to people who've been in it before. Keep goals and values in mind when writing papers and doing research. hasn't happened enough times to draw lessons. peter - advice to (conservative) general council, stress how controversial this is. cindy - if university won't support you, there are others (inc. the eff) who will. q - john gilmore: what does the panel think of people who encourage the RIAA and others to break the copyright social contract? dan - they keep us in business breaking their stuff ed - as a scientist, it's important to understand the limitations of this technology. q - can a summary (such as this one) be considered distributed legally under the DMCA? cindy - a stump cindy question. it would be difficult for them to squash such a summary. peter - if you were to talk about the strengths and weaknesses of this paper. ed - the question "can I tell my advisor about this" sums up the problems, that people don't know what their legal limitations are. q - will widespread civil disobedience of this statute be a reality? cindy - I never advise people to violate the law. However, when a law doesn't fit what society believes is right, then legislators need to re-examine the law. peter - copyright system has function well for last couple of centuries, not because it is policed, but because there is a collective buy-in of its purposes and what it accomplishes. The DCMA has some a lot of assumptions that the content industries have about people and scientists. q - why doesn't industry want more research into this, to make the protection mechanisms stronger? ed - RIAA has a different mindset, that it's more important that people believe the technology is strong, not whether really is strong or not. q - nick verbitzky (sp?), working on a documentary: people believe that stealing music from Napster is okay because you're stealing from crooks (the record industry). Public opinion is in our favor. Why aren't consumers aware of what's going on? cindy - (girl scouts DO pay royalties for songs they sing around campfires to BMI) Because this is cutting edge stuff that the EFF deals with. -- Steve Beattie Don't trust programmers? <steve(a)wirex.net> Complete StackGuard distro at http://immunix.org/~steve/ immunix.org ------------------------------------------------------------------------------- Support PLUG and the Open Source Community http://www.linuxfund.org/lugs/?lug=plug To unsubscribe from the PLUG list visit http://www.pdxlinux.org/mailing_list/ -- -- Michael H. Collins Admiral: Penguinista Navy International http://www.linuxlink.com Migration Free Linux Email http://www.78704.com Speech enabled Chat http://24.93.54.40 This Ain't California http://geekaustin.com/ --------------------------------------------------------------------- To unsubscribe, e-mail: alg-unsubscribe(a)austinlug.org For additional commands, e-mail: alg-help(a)austinlug.org

1 0