November 2002 - cypherpunks-legacy

Sending bricks through the mail
by Major Variola (ret) 03 Nov '02

03 Nov '02

At 09:37 PM 11/2/02 -0800, Tim May wrote: >When I was at Intel we sent our designs for microprocessors to European >branches and/or partners. One set of designs sent to MATRA/Harris, a >partner in the 80C86, was stolen in transit. (The box of tapes arrived >in Paris, but the tapes had been replaced by the suitable weight of >bricks.) There exists a website by someone who enjoyed sending unusual things through the US mail. He once sent a brick, with proper postage, no envelope. The brick *eventually* arrived at its destination, sort of, but had been broken by the DEA according to the PO's paperwork.

1 0

Re: Katy, bar the door
by Major Variola (ret) 03 Nov '02

03 Nov '02

At 10:49 AM 11/2/02 -0800, Bill Frantz wrote: >(A number of years ago, there was a case where a >pilot, presumably asleep, flew right past Los Angles, over the Pacific >ocean, and crashed. ATC was very concerned, but couldn't do anything to >wake the pilot.) Around a year ago a small private jet lost contact over the US. A jet was dispatched, saw iced windows, no response to signals. The plane was on autopilot, eventually crashed in the middle of nowhere. The passengers/pilot are believed to have passed out from anoxia. (The autopilot kept them at high altitude too!) When that trucker kamakazi'd into the state capital in Sacramento last year, they decided to put Jersey barriers up. Hard to do that in the air (Blimps with nets?)

2 1

Interesting series of articles on GCHQ, Public Key etc.
by Bo Elkjaer 03 Nov '02

03 Nov '02

List: This Is Gloucestershire has published an interesting little series of articles commemorating the GCHQ 50 years anniversary. The articles can be found at: http://www.thisisgloucestershire.co.uk/displayNode.jsp?nodeId=110560&comman… Yours Bo Elkjaer, Denmark <QUOTE> In 1965, James Ellis, who worked for CSG (GCHQ's codemaking department), went back to first principles to solve the problem and dreamed up the unthinkable. His vision was sending secret messages without the need for exchanging a key. Suppose Alice wants to send a message to Bob. Alice looks up Bob's "public" key and encodes her message using a standard algorithm. Bob receives the message and decodes it using his "private" key and another standard algorithm. Anyone can intercept the message because the public key is widely known, but only possession of the private key enables the decoding step. The private key remains in Bob's possession throughout and never has to be passed to Alice, thus guaranteeing confidentiality. By 1967 public key cryptography had hit a brick wall. Mr Ellis was not able to come up with a private key function to bring his theory to life. But in September 1973 bright young Cambridge graduate Clifford Cocks joined GCHQ. After six weeks, the puzzle was presented to Mr Cocks and within half an hour he came up with a solution - an algorithm that made Mr Ellis' theory a real possibility. In 1975, these ideas were refined further by Mr Cocks' colleague Malcolm Williamson. Because they were employees of GCHQ, they were sworn to secrecy and their brilliant idea was never made public. In 1976, a trio of American academics, Diffie, Hellman and Merkle, filed a patent for their version of public key cryptography which they developed independently. They went on to claim the glory for developing the system. </QUOTE> -- EOT

1 0

Re: What email encryption is actually in use?
by Tyler Durden 03 Nov '02

03 Nov '02

"Prior to that, the encrypted email I've sent in the past year or so has almost always failed, because of version incompatibilities," While in Telecom I was auditing optical transport gear, and we adopted the practice of encrypting all of our audit reports to vendors. Of course, the chance of there being an eavesdropper (uh...other than NSA, that is) was a plank energy above zero, but it gave the vendors the imporession we really cared a lot about their intellectual property (if we determined a problem with their equipment, and if that info ever leaked, it could have a major impact on them). That the mesages were decrypted I know for sure, and it was easy for the customers: we would verbally tell them the password for unpacking the encrypted file, and they merely typed it in a it extracted itself. I think the encryption tool was installed directly into the file manager (or whatever it's called now), so it was easy to do. >From: Steve Furlong <sfurlong(a)acmenet.net> >To: cypherpunks(a)lne.com >Subject: Re: What email encryption is actually in use? >Date: Sat, 2 Nov 2002 12:41:55 -0500 > >On Saturday 02 November 2002 12:09, Adam Shostack wrote: > > An interesting tidbit in the September Information Security Bulletin > > is the claim from MessageLabs that only .005% of the mail they saw in > > 2002 is encrypted, up from .003% in 2000. > > > > ... Last month, about > > 5% of my email was sent PGP encrypted, about 2% STARTTLS encrypted, > > and about 25% SSH encrypted to people on the same mail server, where > > POP and IMAP only function via SSH. > > > > I'd be interested to hear how often email content is protected by any > > form of crypto, including IPsec, Starttls, ssh delivery, or PGP or > > SMIME. There's probably an interesting paper in going out and > > looking at this. > >Well, here's a datum for you: in the past four or five months, I have >sent exactly no encrypted email. There are several reasons, notably >that most of my email correspondents are business types who can't >handle encryption even after several lessons and checklists and even >when the tools are integrated into the MUA. > >Prior to that, the encrypted email I've sent in the past year or so has >almost always failed, because of version incompatibilities, human >error, changes of email address, and what-not. Or because the recipient >simply isn't bothering to decrypt mail any more because it's more >trouble than it's worth for the low quality of information conveyed. > >The only business environment I've ever worked in which successfully >used encrypted email mandated specific versions of mail client >(Outlook, ecch) and PGP (integrated into Outlook), had a jackbooted >thug to make sure everyone's keyring was up to date, and had a fairly >small (couple dozen), mostly technically proficient, user base. And >even there, half the time the encrypted message wasn't sensitive enough >to be worth encrypting nor important enough to be worth decrypting. > >I have signed a few messages in the recent past, but that was probably >even less worthwhile than encrypting them. For all I know, not a single >one has been verified. > >-- >Steve Furlong Computer Condottiere Have GNU, Will Travel > >Vote Idiotarian --- it's easier than thinking _________________________________________________________________ Unlimited Internet access for only $21.95/month. Try MSN! http://resourcecenter.msn.com/access/plans/2monthsfree.asp

2 1

Re: What email encryption is actually in use?
by David Howe 02 Nov '02

02 Nov '02

at Monday, September 30, 2002 7:52 PM, James A. Donald <jamesd(a)echeque.com> was seen to say: > Is it practical for a particular group, for > example a corporation or a conspiracy, to whip up its own > damned root certificate, without buggering around with > verisign? (Of course fixing Microsoft's design errors is > never useful, since they will rebreak their products in new > ways that are more ingenious and harder to fix.) Yup. In fact, some IPSec firewalls rely on the corporate having a local CA root to issue keys for VPN access. from there it is only a small step to using the same (or parallel issued) keys for email security. The problem there really is that the keys will be flagged as faulty by anyone outside the group (and therefore without the root key already imported), and that will usually only work in a semi-rigid hierachical structure. There *is* an attempt to set up something resembling a Web of trust using x509 certificiates, currently in the early stages at nntp://news.securecomp.org/WebOfTrust > I intended to sign this using Network Associates command line > pgp, only to discover that pgp -sa file produced unintellible > gibberish, that could only be made sense of by pgp, so that no > one would be able to read it without first checking my > signature. you made a minor config error - you need to make sure clearsign is enabled. > I suggest that network associates should have hired me as UI > design manager, or failing, that, hired the dog from down the > street as UI design manager. It's command line. Most cyphergeeks like command line tools powerful and cryptic :)

2 1

cypherpunks, $5.00 per 100MG dose for Gen*ric V*agra. Limited Time Free Doctor Consultation
by Will Bandel 02 Nov '02

02 Nov '02

1 0

Re: Katy, bar the door
by John Kelsey 02 Nov '02

02 Nov '02

At 09:32 PM 10/31/02 -0800, Tim May wrote: ... >If the attackers/hijackers cannot get into the cockpit and gain control >of the plane, then the most they can do with disabling/lethal/nerve >gases is to cause the plane to essentially crash randomly...which kills >a few hundred people, but probably not many more. > >Which is yet another reason why securing the cockpit door very, very >well is the single most important, and cheapest, solution. Hmmm. I agree, but if the attackers chose the right time (while the plane's on autopilot) to release the gas or whatever, they might have an hour or two to get through the cockpit door, with no resistance at all from the now-dead passengers or crew. Securing a cockpit door in those circumstances is *much* harder than securing it against someone with a shorter time to get through, and with the possibility of active resistance from the other side. (I seem to recall hearing some pilot comment that he was very confident of his ability to keep someone from breaking through the door, just by flying so that it's almost impossible to stay on your feet. Certainly, trying to use a hacksaw or cutting torch or something wouldn't be much fun while the pilot did loops or something.) On the other hand, the pilot or copilot pretty much just have to figure out something is wrong and indicate this fact to the people on the ground, and there will be a plane along shortly to shoot them down if necessary. And I don't think this kind of gassing attack would work all that smoothly in practice--some people would be affected before others, due to nonuniformity in the way air is distributed in the cabin and different levels of susceptibility. The combination of a hard-to-break-into cockpit and some kind of response to prevent these planes being used as low-tech cruise missiles seems like a win. Maybe it would make sense to add some kind of remote surveilance of the cockpit, though I imagine this wouldn't be too popular with pilots, and they'd definitely need to secure the channel properly. >--Tim May --John Kelsey, kelsey.j(a)ix.netcom.com // jkelsey(a)certicom.com

1 0

Derty Sweeeet Dirty Pink Cunt tmj
by Pinelopi Jones 01 Nov '02

01 Nov '02

1 0

Re: Flight security analysis (was Re: Confiscation of Anti-War Video)
by Harmon Seaver 01 Nov '02

01 Nov '02

On Fri, Nov 01, 2002 at 01:35:06PM -0800, Major Variola (ret) wrote: > At 02:45 PM 11/1/02 -0600, Jim Choate wrote: > >On Fri, 1 Nov 2002, Major Variola (ret) wrote: > > > >> At 30K feet, you have about half a minute before you pass out > > > >Which isn't the problem it's the -40F that kills you. You freeze > >your ass off well before you ever die from lack of oxygen. The vast > >majority of folks can hold their breath long enough for a jet to go > >from 30k to 10k in a emergency dive. Less than 60s. > > Wow, Choate biophysics now. > > Do the thermal conductivity/inertia calcs. -40F *air* can't drop your > coretemp in 30 seconds. Do the math. Or go up to the Dakotas > this winter and step outside for half a minute. It hurts but > doesn't kill that quickly. We lived for a long, long time in far northern MN in a cabin with no electricity or running water. When I had to pee in the middle of the night, I'd just run outside and pee in the yard. Summer or Winter, it made no difference, and I never found it a problem standing out there buck naked and barefoot at 30 below. Can't imagine that 40 below would be much different. And since my wife objected to yellow snow right by the house, I had to walk at bit away, not clear to the outhouse, but a piece. OTOH, I did once when we lived up about halfway between Jasper and Prince George, BC fall thru the ice in the Fraser River up to my waist (fully clothed tho) and my legs lost all feeling almost immediately. Of course, that river up there was pretty close to being straight off a glacier and was too cold to swim in even in July or August. I likewise went thru the ice to my waist in N. MN once and it wasn't bad at all. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com "War is just a racket ... something that is not what it seems to the majority of people. Only a small group knows what its about. It is conducted for the benefit of the very few at the expense of the masses." --- Major General Smedley Butler, 1933 "Our overriding purpose, from the beginning through to the present day, has been world domination - that is, to build and maintain the capacity to coerce everybody else on the planet: nonviolently, if possible, and violently, if necessary. But the purpose of US foreign policy of domination is not just to make the rest of the world jump through hoops; the purpose is to faciliate our exploitation of resources." - Ramsey Clark, former US Attorney General http://www.thesunmagazine.org/bully.html

1 0

Re: Flight security analysis (was Re: Confiscation of Anti-War Video)
by Major Variola (ret) 01 Nov '02

01 Nov '02

At 05:16 PM 11/1/02 -0500, Steve Furlong wrote: >But Maj Variola made a questionable point, too: > >> At 30K feet, you have about half a minute before you pass out > >I just tested that, sort of. I emptied my lungs, then lifted weights for >30 seconds. It was a little painful toward the end, but I didn't grey >out or anything. I was unable to find my ref. But I also know that muscles can work anaerobically; also that asphyxiation-feeling is from too much CO2, not a lack of O2. Also, you can't really empty your lungs. I once saw a show about medicine. In it, an M.D. rebreathed his own CO2-scrubbed air as he wrote the alphabet, on camera. Halfway through he started scribbling incoherently and fell over, unawares. (There were assistants to save him.) FWIW

1 0