October 2002 - cypherpunks-legacy

UK: service providers say no to Blunkett
by Eugen Leitl 22 Oct '02

22 Oct '02

http://www.guardian.co.uk/internetnews/story/0,7369,816523,00.html Internet providers say no to Blunkett Plans to monitor personal emails and web page visits in doubt Stuart Millar, technology correspondent Tuesday October 22, 2002 The Guardian The internet industry has refused to sign up to plans to give law enforcement and intelligence agencies access to the records of British web and email users, throwing David Blunkett's post-September 11 data surveillance regime into fresh disarray. In the latest of a long line of setbacks for the home secretary's data retention campaign, the Guardian has learned that internet service providers have told the Home Office that they will not voluntarily stockpile the personal records of their customers for long periods so that they can be accessed by police or intelligence officers. Nicholas Lansman, secretary general of the Internet Service Providers Association, wrote to officials last month informing them that the industry had not been convinced that extending the length of time companies hold on to customer logs was necessary for the fight against terrorism and serious crime. The letter, which has been seen by the Guardian, makes clear the depth of concern among web companies over the privacy and cost implications of retaining subscriber information. Mr Lansman said that service providers were "rightly concerned" that retaining communications data beyond normal business practices may be unlawful. A paper produced by law enforcement agencies had failed to address these concerns or make a "compelling case" for data retention. "The document fails to provide details of the number of investigations that are currently compromised through lack of available data and assess whether this is detrimental to the public interest and national security. The investigations citedrefer to cases in which officers sought data older than 15 months and where there was no national security consideration involved," he wrote. Industry representatives and Whitehall officials have been struggling to agree terms of a voluntary code of practice introduced under the anti-terrorism legislation rushed through parliament last No vember in the aftermath of the attacks on the US. The apparent collapse of the negotiations may leave Mr Blunkett facing a choice between using his reserved powers under the legislation to force internet prov-iders to comply or dropping the measure in response to public and political opposition. The data to be retained includes customers' names and addresses, source and destination of emails and addresses of websites visited, all of which would be available to the authorities without need for a judicial or executive warrant. Telephone providers are also being asked to retain records of calls made and received as well as mobile phone location data. In July, the information commissioner, the official privacy watchdog, warned the Home Office that data retention might breach the Human Rights Act because communications logs retained strictly for national security purposes could be accessed by police and intelligence officers investigating cases such as public health and tax collection. The Home Office has refused to amend the legislation to resolve this conflict. As a result, Mr Lansman said, the association could not "recommend to members that they voluntarily comply with the proposed code of practice". Mr Blunkett has the power to make the code mandatory. In the Guardian last month, John Abbott, director general of the national criminal intelligence service, said all communications companies should be compelled to stockpile customer logs. Last night, Home Office insiders dismissed suggestions that the voluntary code was dead in the water. But human rights campaigners said Mr Blunkett now had little choice but to think again. Ian Brown, director of the Foundation for Information Policy Research, said: "Civil society, Europe's data protection commissioners, and now internet service providers have all told the Home Office their data retention plans are an unacceptable invasion of privacy." John Wadham, director of Liberty, said: "Service providers are right to raise concerns."

1 0

Date a lonely housewife tonight!
by ceui0156e65＠yahoo.com 22 Oct '02

22 Oct '02

1 0

FREE Nokia Phone with FREE Long Distance!
by Wireless Offers 22 Oct '02

22 Oct '02

Get your FREE* Nokia 3390 Cell Phone! NOW! Just one easy step and the hottest new cell phone on the market is all yours!!! Order Now and Receive: UNLIMITED Weekend Minutes FREE Long Distance & NO Roaming Charges! Click below to learn more about the Free Nokia 3390 http://www.savingsengine.com/click.asp?lnk=8748&email=CYPHERPUNKS@MINDER.NET This offer Includes the Get More Plus Plan - 600 Whenever Minutes - Unlimited Weekend Minutes - Free Nationwide Long Distance - Free Digital Roaming Nationwide - Voicemail with Messaging Alert - Caller ID, Call Waiting, Call Hold - Ping Pong- 50 Text Message Click below to learn more about the Free Nokia 3390 or call 1-800-300-7066 and mention bonus code 14078 & ref code co1021tx http://www.savingsengine.com/click.asp?lnk=8748&email=CYPHERPUNKS@MINDER.NET OR Take advantage of this great offer: Get 2 Free* phones with unlimited calling between them and FREE long distance all on one bill!!! Great for family or friends who want to stay in touch! Click Below to learn more about getting 2 Free Nokia 3390's on the Voicestream FamilyTime Plan http://www.savingsengine.com/click.asp?lnk=8749&email=CYPHERPUNKS@MINDER.NET * Phone free after instant rebate. This offer is fulfilled by InPhonic, and authorized dealer for Voicestream Wireless and T-Mobile. Offer subject to credit approval or deposit, and is available to customers activating a new line of service on a one-year contract with Voicestream Wireless. Early termination fees may apply. Not all US markets are served by Voicestream Wireless or T-Mobile. If you are in a non-Voicestream Wireless or T-Mobile area you will receive another great offer from another major wireless company. Other restrictions apply, see full offer for details. Offer expires October 31, 2002. Offer may vary. Click to view the offer, Call the Toll free number provided above, or send offer inquiries to InPhonic, Inc., 9301 Peppercorn place, Largo, MD 20774. ________________________________________________________________________ Your privacy is extremely important to us. You requested to receive this mailing, by registering at SavingsEngine.com or by subscribing through one of our marketing partners. As a leader in email marketing, we are committed to delivering a highly rewarding experience, with offers that include bargains, entertainment, and money-making ideas. However, if you wish to unsubscribe, please copy and paste the following link into your web browser: http://www.savingsengine.com/unsubscribe.asp?emid=5395&email=CYPHERPUNKS@MI… Third-party offers contained in this email are the sole responsibility of the offer originator.  ________________________________________________________________________

1 0

(no subject)
by Cold Calling Professionals 21 Oct '02

21 Oct '02

1 0

Re: Intel Security processor + a question
by Major Variola (ret) 21 Oct '02

21 Oct '02

At 05:13 PM 10/21/02 -0400, Tyler Durden wrote: > >So I guess the follow on question is: Even if you can look at the code of a >RNG...how easy is it to determine if its output is "usefully random", or are >there certain "Diffie-approved" RNGs that should always be there, and if not >something's up? Start with something analog, where no one knows the initial state perfectly, and the dynamics are dispersive (chaotic). Digitize it. You can use ping pong balls if you like. 1. Measure its entropy (eg see Shannon). Xor values together (xor doesn't generate change (variation), but preserves it). Go to 1 until you find that your measurments have asymptoted. You should then hash ('whiten') your distilled 1bit/baud values, to make it hard to go backwards throught the deterministic iterative "distilling" in the above recipe. In practice, you may feed a hashing digest function directly with your raw measurements and rely on the digest compressing the number of bits in:out to assure 1 bit/baud (even without the hash-whitening). However the output of such a hash function will be noise-like even with very low entropy input, e.g., successive integers. Ergo measuring after hashing is pointless. Discuss the results with your troopleader, and you will receive your crypto merit badge in 4-6 weeks.

1 0

Shop for Free at Perfumania.com
by Perfumania 21 Oct '02

21 Oct '02

1 0

Viagra - Phentermine - Xenical - Propecia and MORE!
by Confidential Pharma 21 Oct '02

21 Oct '02

ORDER YOUR NEXT PRESCRIPTION WITH PRIVACY! http://www.partner2profit.com/redir.cfm?ccode=BB12EB7B&pcode=D95F7021 -Weight Loss -Hair Loss -Skin Care -Stop Smoking Benefits Of Ordering: Confidential and Private Secure Online Order Form No Consultation Fee Next Day Shipping Available Easy Refills Discreet Packaging Order Now http://www.partner2profit.com/redir.cfm?ccode=BB12EB7B&pcode=D95F7021 Order Now with Privacy from your own home or office Click Here http://www.partner2profit.com/redir.cfm?ccode=BB12EB7B&pcode=D95F7021 ConfidentialPharmacy.com ==================================================================== This is brought to you by FreeGasDaily. You are receiving this because of your participation in the FREE GAS FOR LIFE sweepstakes. If you feel this has reached you in error or if you would no longer like to be eligible and would like to stop receiving offers from us, please visit http://www.freegasdaily.com and click on unsubscribe. Thank you. c&y&p&h&e&r&p&u&n&k&s&%m&i&n&d&e&r&~n&e&t&

1 0

Re: Intel Security processor + a question
by Major Variola (ret) 21 Oct '02

21 Oct '02

At 07:40 PM 10/18/02 -0400, Tyler Durden wrote: >Well,I disagree about psuedo random number generation, sort of. >First, if I have PSR sequence of the known variety (ie, ANSI or ITU), and if >it's mapped to some telecom standard (DS-1/3, OC-3/12/48/192), then my test >set can and should be able to lock onto that sequence. This is true whether >that telecom signal is raw PRBS, or if it has been mapped into the payload >(you use different test sets). 1. Shift reg sequences are cryptographically weak. 2. Re-synch'ing with a PR stream is useful for some apps, true. 3. In crypto, we consider the adversary who claims to have a true RNG but instead is faking us out with an opaque PRNG. If We are not privvy to the PRNG algorithm (or key) then we can't tell if its truly random or not. >With encrypted info who knows? I would think that testing if there's monkey >business might boil down to algorithms--ie, if certain bit patterns happen >too often, then something's wrong... Bit-bias is trivial to correct (see Shannon). Take a look at Prof. Marsaglia's "Diehard" suite of statistical-structural tests for a real obstacle course. But no such "does it look random" test can tell good PRNG from TRNG. You must peek under the hood.

1 0

Re: palladium presentation - anyone going?
by Tyler Durden 21 Oct '02

21 Oct '02

<<< No Message Collected >>>

1 0

Re: The Register - UK firm touts alternative to digital certs (fwd)
by Eric Murray 21 Oct '02

21 Oct '02

On Mon, Oct 21, 2002 at 03:37:33PM +0100, David Howe wrote: > at Monday, October 21, 2002 3:14 PM, Trei, Peter > <ptrei(a)rsasecurity.com> was seen to say: > > I'd be nervous about a availability with centralized servers, > > even if they are "triple redundant with two sites". DDOS > > attacks, infrastructure (backhoe) attacks, etc, could all > > wreck havoc. > Indeed so, yes. > I suspect (if it ever takes off) that they will have to scale their > server setup in pace with the demand, but to be honest I think 600/sec > is probably quite a high load for actual payments - we aren't talking > logins or web queries, but actual real-money-payment requests. Looking at their web site, they seem pretty generic about what it's for, but I did not see any mention of using it for payments. So I assume it's for logins. They do say that their servers are "benchmarked at 300 transactions/sec". That's pretty darn slow for single des. There would have to be an authenticated and probably encrypted session between the server accepting the login (or the merchant if it really does payments) and the back end. But even using SSL/TLS, which would be more than is required but an easy component to plug in, they ought to be able to get at least a true 1000 sessions/sec using one of the current SSL accelerators out there. Maybe they have a bunch of slow database lookups? Perhaps there is a long RTT for the check against the CIA blacklist? If it is for logins, how many sites would be willing to let someone else know when their employees log in? That could be useful competitive intelligence. Eric

1 0