August 2001 - cypherpunks-legacy

Re: Traceable Infrastructure is as vulnerable as traceable messages.
by Faustine 08 Aug '01

08 Aug '01

On 7 Aug 2001, at 7:38, Declan McCullagh wrote: > Also, users won't immediately know about the new remailers or > have any idea of their reliability. And while the Feds may be > generally sluggish, when it comes to law enforcement (that is, > remailer raids on anti-terrorism pretexts), I suspect they can > be quite efficient. >>Provided they do not stop off at the donut shop. >>Some of the recent FBI scandals were callous indifference to >>human life and disregard of justice, but many of them were >>carelessness, neglect of duty, and gross incompetence. No doubt, but I think it's dangerous and entirely to your disadvantage to dismiss everyone doing government work in computer security as a donut- chomping incompetent Barney-Fife-clone imbecile. Anyone can laugh at the department heads on C-SPAN, but did you ever stop to think about who's really doing the hardcore research for the NSA at Ft. Meade--and elsewhere? And did you ever think that they may have decided it's in their best interest to let otherwise informed and intelligent people like you laugh them off as third-rate and underfunded? Think about it. >Similarly consider the CIA, whose assessments of the Soviet Union >were consistently less accurate than my own. Not everyone who wrote assessments for CIA got them past the politicized review of deputy director Gates. As you may know, the whole culture in the 80s was characterized by a deep rift between two warring factions who literally referred to each other as "knuckledraggers" and "commie symps." If the symps had the upper hand instead of the knuckledraggers under Casey, there's not a doubt in my mind you would have seen an entirely different kind of intelligence product. The same old resentments are still there: just yesterday I heard Michael Pillsbury, a former defense policy planner in the Reagan administration, repeatedly refer to analysts who disagreed with him as "panda huggers" during the course of his testimony before the Senate. The hardliners he called "blue team". (Gee, I wonder which side he was on!) I guess "panda huggers" is a little better than "commie symps" but it sure says a lot about the intellectual climate. It won't come as a surprise when we start seeing the same kind of analytic mistakes again because of it... >It appears to me that the level of corruption, laziness, >irresponsibility, and sheer incompetence is fairly uniform >throughout all branches of the government and all its activities. I'm sure the senior scientists at Ft. Meade couldn't be more delighted to hear you say that. ~Faustine.

1 0

McAfee patent on security services subscription
by Subcommander Bob 07 Aug '01

07 Aug '01

http://wired.com/news/business/0,1367,45897,00.html McAfee.com has won a patent for its system of delivering security-related software and services over the Internet, giving it a potential leg up in the emerging trend of subscription-based software. The patent, issued July 24 by the U.S. Patent Office, covers the technology behind McAfee's system, what co-inventor Srivats Sampath calls the company's "secret sauce," as well as its subscription-based business model, the company said Monday. McAfee applied for the patent in 1998. "The future of software is really going to be delivered as Web services and we have a component of that," said Sampath, McAfee's president and chief executive officer. "The patent is a way to protect our investment." "This doesn't close the door for competitors, it simply sets some boundaries for them," said Harry Fenik, chief executive officer of the Sageza Group, a market research firm. Now, any company or so-called application service provider looking to offer subscription- and Web-based software specifically in the security and PC-management arena "will have to tread carefully" to not infringe on McAfee's patent, or decide to pay McAfee licensing fees, Fenik said.

1 0

Thought-A-Day
by Fountain Of Joy 07 Aug '01

07 Aug '01

Do not waste time and energy to predict your future. Concentrate on inventing it. --Debi Coleman ===================================================== Your name has been recommended to receive thoughts of wisdom from Fountain of Joy. These thoughts will be delivered, free of cost, to your desktop,everyday, for an initial evaluation period of 60 days+.We believe that the meaningful insights of these carefully selected thoughts will make your life peaceful,successful & happy in a way you had never imagined before. If you have received this email in error & if you wish to unsubscribe, reply to this email with 'remove' in the subject line or click mailto:amaha@vsnl.net?subject=remove Director Fountain of Joy

1 0

Re: Spoliation cites
by Eric Murray 07 Aug '01

07 Aug '01

On Mon, Aug 06, 2001 at 11:51:46AM -0400, Trei, Peter wrote: > > jamesd@echeque.com[SMTP:jamesd@echeque.com] wrote: > > > > I am unable to reconcile Black Unicorn's recent post, where he denounces > > almost the entire cypherpunk program as illegal by current legal standards > > and a manifestation of foolish ignorance of the law and obstinate refusal > > to take his wise advice, with the conjecture that Black Unicorn is aware > > of > > current recommended best practice in record keeping. > > > I've mostly been staying out of this stormy little teacup, but I'll > concur that BU is overreaching himself. When he starts to claim > that writing security software to best industry practices - erasing > sensitive data as soon as it's need has passed, clearing disks > and buffers, etc - all practices mandated for meeting certain > government FIPS levels, and widely documented as standard - > when he claims that writing programs correctly could get me > in trouble - then it's time to downgrade my estimates of his > knowledge and expertise. > > Peter Trei I read him as suggesting that some ambitious prosecutors might possibly try to extend spoliation to that point, not that they're doing so now. A bit of Googling finds a good definition of spoliation (in California): ---- Plaintiff possessed a potential defense to a claim for damages against a defendant. Defendant knew or reasonably should have known of this claim for damages by plaintiff. Defendant knew or reasonably should have known of the existence of the physical evidence and knew or reasonably should have known that it might constitute evidence in pending litigation involving plaintiff. Defendant knew or reasonably should have known that if he did not act with reasonable care to preserve the physical evidence, the potential evidence could be destroyed, damaged, lost or concealed. Defendant failed to act with reasonable care. Defendant's failure to act with reasonable care caused the destruction of, damage to, or loss or concealment of such evidence. As a result, plaintiff sustained damage, namely plaintiff s opportunity to prove its claim was interfered with substantially. ---- As BU points out, if "reasonably should have known" can be defined in court as "you were running a service that allowed drug dealers and pedophiles to send anonymous email", talking about FIPS 140 etc. won't help much in front of a jury of Oprah-watching "peers", even if it's factually and technically correct. Are things this bad already? I don't know, but it wouldn't suprise me. A murder case in silicon valley recently finished. The jurors were interviewed by the local paper. When asked why they convicted the defendant on circumstantial evidence, the answer was "he felt guilty". Eric

2 1

Safeweb [was: RE: Advertisements on Web Pages]
by Trei, Peter 07 Aug '01

07 Aug '01

> From: Tim May[SMTP:tcmay@got.net] > > > Just a note about what's happening with Web advertising. > > Went to a site, www.imdb.com, to check something about a film. Up popped > a doubleclick.net ad. In front of the main page, obscuring it. I clicked > the close box. Up popped a _different_ ad. I clicked the close box. Yep, > up popped a third ad box. I closed it. I think it stopped at this point. > [...] > --Tim May > I do a lot of my random web browsing thru www.safeweb.com, which allows me to disable pop-ups. It also 1: Causes the direction and content of my browsing to be obscured from any observer between me and the Safeweb site. 2: Obscures the target site from knowing who is surfing them. 3. Manages cookies intelligently. It's not perfect - safeweb.com could build a pretty good profile of where I surf. Ideally, you'd want to chain through two or more non-colluding Safeweb type services - think of it as a remailer for HTTP. Also, In-Q-Tel (the CIA VC firm) is one of Safeweb's investors The CIA's story is that they want a way for their agents to surf without leaving footprints. Safeweb appears to have been founded a group of programmers of Chinese descent, and is designed to act as a route around the Great Firewall of China. There's even a entry proxy called 'Triangleboy' which should allow Safeweb to be used if the main site is blocked. Unlike a lot of the people on this list, these guys actually write code. Peter Trei

1 0

[IRR] Using the Fluhrer, Mantin, and Shamir Attack to Break WEP
by Monty Solomon 07 Aug '01

07 Aug '01

Using the Fluhrer, Mantin, and Shamir Attack to Break WEP AT&T Labs Technical Report TD-4ZCPZZ Authors Adam Stubblefield John Ioannidis Aviel D. Rubin Abstract We implemented an attack against WEP, the link-layer security protocol for 802.11 networks. The attack was described in a recent paper by Fluhrer, Mantin, and Shamir. With our implementation, and permission of the network administrator, we were able to recover the secret key used in a production network, with a passive attack. The WEP standard uses RC4 IVs improperly, and the attack exploits this design failure. This paper describes the attack, how we implemented it, and some optimizations to make the attack more efficient. We conclude that 802.11 WEP is totally insecure, and we provide some recommendations. http://www.cs.rice.edu/~astubble/wep/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[IRR] Using the Fluhrer, Mantin, and Shamir Attack to Break WEP
by Monty Solomon 07 Aug '01

07 Aug '01

Using the Fluhrer, Mantin, and Shamir Attack to Break WEP AT&T Labs Technical Report TD-4ZCPZZ Authors Adam Stubblefield John Ioannidis Aviel D. Rubin Abstract We implemented an attack against WEP, the link-layer security protocol for 802.11 networks. The attack was described in a recent paper by Fluhrer, Mantin, and Shamir. With our implementation, and permission of the network administrator, we were able to recover the secret key used in a production network, with a passive attack. The WEP standard uses RC4 IVs improperly, and the attack exploits this design failure. This paper describes the attack, how we implemented it, and some optimizations to make the attack more efficient. We conclude that 802.11 WEP is totally insecure, and we provide some recommendations. http://www.cs.rice.edu/~astubble/wep/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

RE: Spoliation cites
by Aimee Farr 07 Aug '01

07 Aug '01

james wrote: > If one keeps records, and suddenly someone sues one, and THEN one > starts shredding, yes, then one can get into trouble. If > however, one shreds away indiscriminately, on a routine and > regular schedule, one is in the clear. As a remailer operator > said to the courts "Sorry, I do not keep > records". > > Now if he had kept records, and then erased them on being > summoned to the court, he would have had a problem. But because > he erased them routinely, no problem. If you read any of those cites and shep'd them, you will see there are circumstances where defendants didn't know the documents were relevant to a specific lawsuit. There is support for the words "SHOULD HAVE KNOWN" might NOT equivocate to: "a lawsuit has been filed." Nor even "expect a specific lawsuit." Furthermore, in Lewy, they did adhere to a destruction policy and plaintiffs got a jury instruction allowing for a negative inference. Does this tell you anything? Normally, you consider the following in a retention policy: o pending or threatened litigation = easy answer, keep it. o statute-specific retention requirements = easy answer.... o statutes of limitations = starts getting fuzzy here, usually the length of the relationship, plus the limitations periods.... o real estate = long time. o IP = forever. o email = most say a few weeks, unless it is a complaint, etc. It's not so simple as many think. It's document specific. ------- In certain cases, opponents may argue that the high-risk nature of certain enterprises amounts to a state of continual pending or threatened litigation, although non-specific in nature. They also may argue, as in Lewy, that destruction pursuant to a retention policy and normal business practice -- is not good enough. The court will look beyond the practice to ask if the policy is reasonable GIVEN THE PARTICULAR NATURE OF THE DOCUMENT AT ISSUE. The root of the matter is: SHOULD YOU HAVE KEPT IT? The court seemed to infer in Lewy that the nature of the business and the likelihood of litigation is a consideration. -------------------------------------------------------- Lewy v. Remington Arms Co. 836 F.2d 1104 (8th Cir., 1998) -------------------------------------------------------- ..."We hold that there was sufficient evidence from which the jury could find that Remington knew the M700 was dangerous. The following evidence was before the jury: complaints from customers and gunsmiths that the Model 700 would fire upon release of safety, some of these complaints dating back as far as the early 1970s; .... .....Remington was unable to produce several documents that were destroyed pursuant to Remington's "record retention policy." Remington argues that destroying records pursuant to routine procedures does not provide an inference adverse to the party that destroyed the documents. Smith v. Uniroyal, Inc., 420 F.2d 438, 442-43 (7th Cir. 1970). The record reflects that Remington had its record retention policy in place as early as 1970. In addition, the records that have been destroyed pursuant to the policy -- complaints and gun examination reports -- were kept for a period of three years and if no action regarding a particular record was taken in that period it was destroyed. Vick v. Texas Employment Commission, 514 F.2d 734, 737 (5th Cir. 1975) (records destroyed pursuant to regulations governing inactive records). ...First, the court should determine whether Remington's record retention policy is reasonable considering the facts and circumstances surrounding the relevant documents. For example, the court should determine whether a three year retention policy is reasonable given the particular document. A three year retention policy may be sufficient for documents such as appointment books or telephone messages, but inadequate for documents such as customer complaints. ****************** ...Second, in making this determination the court may also consider whether lawsuits concerning the complaint or related complaints have been filed, the frequency of such complaints, and the magnitude of the complaints. ***************** [i.e., not just lawsuits - complaints. The court probably wanted to know if the defendant was on notice that this information would be sought in future NON-SPECIFIC litigation.] **************** Finally, the court should determine whether the document retention policy was instituted in bad faith. Gumbs v. International Harvester, Inc., 718 F.2d 88, 96 (3rd Cir. 1983) ("no unfavorable inference arises when the circumstances indicate that the document or article in question has been lost or accidentally destroyed, or where the failure to produce it is otherwise properly accounted for."); Boyd v. Ozark Air Lines, Inc., 568 F.2d 50, 53 (8th Cir. 1977) ("We recognize, however, that the destruction of business records may be sufficient to raise an unfavorable inference."). In cases where a document retention policy is instituted in order to limit damaging evidence available to potential plaintiffs, it may be proper to give an instruction similar to the one requested by the Lewys. Similarly, even if the court finds the policy to be reasonable given the nature of the documents subject to the policy, the court may find that under the particular circumstances certain documents should have been retained notwithstanding the policy. ************ For example, if the corporation knew or should have known that the documents would become material at some point in the future then such documents should have been preserved. Thus, a corporation cannot blindly destroy documents and expect to be shielded by a seemingly innocuous document retention policy. Gumbs, 718 F.2d at 96 ("Such a presumption or inference arises, however, only when the spoliation or destruction [of evidence] was intentional, and indicates fraud and a desire to suppress the truth, and it does not arise where the destruction was a matter of routine with no fraudulent intent.") (quoting 29 Am. Jur. 2d Evidence ' 177 (1967)). ### In some high-risk endeavors, opponents may argue that destruction or purposeful non-retention = fraudulent intent. I don't think Remington REALLY wanted to keep those complaints 3 years, James. Ask yourself why they did even that. Look, we are just trying to envision what opponents are likely to try. The outcome will depend on the facts. Finally, the fact that a case (within the range of hypotheticals we have discussed) has not arisen is not dispositive on the issue. If that were the case, James, precedent would have no value, because the law could never move forward. Indeed, precedent, by it's very nature usually involves something novel. Otherwise, it wouldn't get to court, because everybody would know the answer. > You guys keep telling us we are not allowed to routinely purge > records, You keep speaking in absolutes. It's more complicated. > But if you routinely destroy records on the basis that all > records of type Y more than X days old shall be destroyed, unless > there is some specific reason for keeping them, routine, > regularly scheduled erasure of logs, then you are not destroying > them in specific anticipation of a lawsuit. You > may well be destroying them in general anticipation of the > general possibility of lawsuits, as Microsoft quite obviously is, > as most companies quite obviously are, but Microsoft is not > destroying them in specific anticipation of a specific lawsuit, > so they are in the clear. See above. ~Aimee

4 9

RE: [spam score 5.00/10.0 -pobox] RE: Spoliation cites
by Aimee Farr 07 Aug '01

07 Aug '01

> > jamesd@echeque.com[SMTP:jamesd@echeque.com] wrote: > > > > I am unable to reconcile Black Unicorn's recent post, where he denounces > > almost the entire cypherpunk program as illegal by current > legal standards > > and a manifestation of foolish ignorance of the law and > obstinate refusal > > to take his wise advice, with the conjecture that Black Unicorn is aware > > of > > current recommended best practice in record keeping. > > > I've mostly been staying out of this stormy little teacup, but I'll > concur that BU is overreaching himself. When he starts to claim > that writing security software to best industry practices - erasing > sensitive data as soon as it's need has passed, clearing disks > and buffers, etc - all practices mandated for meeting certain > government FIPS levels, and widely documented as standard - > when he claims that writing programs correctly could get me > in trouble > - then it's time to downgrade my estimates of his > knowledge and expertise. > > Peter Trei You guys are acting like Uni said, "THOU SHALT NOT WRITE CODE." Put down your pungi sticks. ~Aimee

2 1

Ricardo "el gato Perez web site
by ricardoel gato perez 07 Aug '01

07 Aug '01

!! HI !! I hope YOU like my site www.gatoperez.com Check it out and enjoy. !!! HOLA !!! Espero que les agrade mi pagina web www.gatoperez.com Mirenla y disfrutenla. Regards Saludos RICARDO P :-)

1 0