June 2002 - cypherpunks-legacy

Is your car really safe?
by Monitortire.com 25 Jun '02

25 Jun '02

1 0

Low Cost Merchant Accounts [zk9qr]
by Clay Brittany 25 Jun '02

25 Jun '02

1 0

sins of the fathers (brothers, sisters, etc)
by Major Variola (ret) 25 Jun '02

25 Jun '02

On Israel's decision to deport families of martyrs: A Palestinian legislator, Salah Tamari, called deporting families "an illegal, unlawful and inhuman measure. Why should somebody be accountable for someone elses actions? http://www.news.scotsman.com/international.cfm?id=685972002 Someone needs to clue Tamari into the US court-approved practices in welfare cages: families are tossed for the indiscretions of familymembers, if the indiscretions involve pharmaceuticals. Pharms, nitrates, whatever. But then, the US is becoming Israel, why not a bit of the reverse? ----- And the rockets' red glare, the bombs bursting in air, Gave proof thro' the night that Osama was still there.

1 0

Re: Ross's TCPA paper
by Nomen Nescio 25 Jun '02

25 Jun '02

Ross Anderson writes: > During my investigations into TCPA, I learned that HP has started a > development program to produce a TCPA-compliant version of GNU/linux. > I couldn't figure out how they planned to make money out of this. On > Thursday, at the Open Source Software Economics conference, I figured > out how they might. > ... > The business model, I believe, is this. HP will not dispute that the > resulting `pruned code' is covered by the GPL. You will be able to > download it, compile it, check it against the binary, and do what you > like with it. However, to make it into TCPA-linux, to run it on a > TCPA-enabled machine in privileged mode, you need more than the code. > You need a valid signature on the binary, plus a cert to use the TCPA > PKI. That will cost you money (if not at first, then eventually). Hmmmm.... Not clear that this really works to make money. The GPL allows everyone to redistribute HP's software verbatim, right? So a cert on one copy of the software will work on everyone's. How can HP make money on a product that everyone can copy freely, when they can all share the same cert? It's true that modified versions of the software would not be able to use that cert, and it would no doubt be expensive to get a new cert for the modified software. But that still gives HP no monopoly on selling or supporting its own version. Anyone can step in and do that. Is the cert itself supposed to be somehow copyrighted? Kept secret? Will it be illegal to publish the cert, to share it with someone else? This seems pretty questionable both in terms of copyright law (since a cert is a functional component) and in terms of the GPL (which would arguably cover the cert and forbid restrictively licensing it). It seems more likely that the real purpose is to bring the benefits of TCPA to the Linux world. As an innovator in this technology HP will gain in reputation and be the source that people turn to for development and support in this growing area. The key to making money from open source is reputation. Being first makes good economic sense. You don't need conspiracy theories. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Ross's TCPA paper
by R. A. Hettinga 25 Jun '02

25 Jun '02

--- begin forwarded text

3 2

Your Ship Just Came IN!!! adv J3QUnUmmb
by sonicmailuo7lbK＠howamazing.com 25 Jun '02

25 Jun '02

1 0

RE: Steven Levy buys Microsoft's bullshit hook, line, and sinker
by Lucky Green 25 Jun '02

25 Jun '02

Bram wrote: > http://www.msnbc.com/news/770511.asp?cp1=1 > > Of course, the TCPA has nothing to do with security or > privacy, since those are OS-level things. All it can really > do is ensure you're running a particular OS. > > It's amazing the TCPA isn't raising all kinds of red flags at > the justice department already - it's the most flagrant > attempt to stifle competition I've ever seen. [Bram is correct, stifling competition is one of the many features TCPA will enable. In more ways than one. And for more players than just Microsoft]. Coincidentally, Steven Levy's article that Bram is citing also helps answer Mr. Anonymous's question with which he challenged Ross and myself earlier today. First, however, I must apologize to the reader for my earlier, now incorrect, statement that TCPA member companies would deny that DRM is an objective of the TCPA. I had been unaware that, as evidenced by the publication of the Newsweek article, the public phase of the TCPA effort had already begun. What a bizarre coincidence for this phase, after all those years the TCPA effort and its predecessors have been underway, (the design, and in fact the entire architecture, has morphed substantially over the years) to be kicked off the very day of my post. [Tim: do you recall when we had the discussion about the upcoming "encrypted op code chips" at a Cypherpunks meeting in a Stanford lecture hall? Was that 1995 or 1996? It cannot have been later; I know that I was still working for DigiCash at the time because I remember giving a talk on compact endorsement signatures at the same meeting]. >From Levy's article: "Palladium [Microsoft's TCPA-based technology - LG] is being offered to the studios and record labels as a way to distribute music and film with "digital rights management" (DRM). This could allow users to exercise "fair use" (like making personal copies of a CD) and publishers could at least start releasing works that cut a compromise between free and locked-down. But a more interesting possibility is that Palladium could help introduce DRM to business and just plain people. "It's a funny thing," says Bill Gates. "We came at this thinking about music, but then we realized that e-mail and documents were far more interesting domains."' Another paragraph of the Newsweek article has this to say: "In 1997, Peter Biddle, a Microsoft manager who used to run a paintball arena, was the company's liason to the DVD-drive world. Naturally, he began to think of ways to address Hollywood's fear of digital copying. He hooked up with [...] researchers Paul England and John Manferdelli, and they set up a skunkworks operation, stealing time from their regular jobs to pursue a preposterously ambitious idea-creating virtual vaults in Windows to protect information. They quickly understood that the problems of intellectual property were linked to problems of security and privacy. They also realized that if they wanted to foil hackers and intruders, at least part of the system had to be embedded in silicon, not software." Well, now that Bill Gates himself is being quoted stating that DRM was a driver behind the technology the TCPA is enabling (Microsoft is one of the companies that founded the TCPA and should be in a position to know), does Mr. Anonymous consider this sufficient "evidence that the TCPA is being designed for the support of digital rights management (DRM) applications"? Or does Anonymous continue to believe Ross and Lucky are making this stuff up out of whole cloth? To answer Anonymous's question as to whether the "the TCPA [is] really, as [Ross and Lucky] claim, a secretive effort to get DRM hardware into consumer PCs?", I am not sure I would exactly call this fact a secret at this point. (Though by no means are all cards already on the table). DRM is a significant objective of some of the TCPA's member companies, which includes Microsoft. There are of course other objectives. Some of which Ross published, some which I mentioned, some which Steven Levy has published (though he largely fell for the designated bait and missed the numerous hooks), some which Bram has realized, and some which have yet to be talked about. Some desirable, some questionable, and a lot of them downright scary. Sincerely, --Lucky Green --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

urgent response is needed
by PETERS STEVENS 24 Jun '02

24 Jun '02

FROM:MRS. M SESE-SEKO DEAR FRIEND. I AM MRS. MARIAM SESE-SEKO WIDOW OF LATE PRESIDENT MOBUTU SESE-SEKO OF ZAIRE? NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO (DRC). I AM MOVED TO WRITE YOU THIS LETTER, THIS WAS IN CONFIDENCE CONSIDERING MY PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED ALONG WITH MY HUSBAND AND TWO OF OUR SONS TIMOTHY AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO (DRC) TO ABIDJAN,COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLED IN MORROCO WHERE MY HUSBAND LATER DIED OF CANCER DISEASE. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGED MOST OF MY HUSBAND'S BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATE OF (DR) MR LAURENT KABILA HAS MADE ARRANGEMENT WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE HUSBAND'STREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES. HENCE MY CHILDREN AND I DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER, LIKE NOW THAT PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER(JOSEPH KABILA). ONE OF MY LATE HUSBAND'S CHATEAUX IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT, AND AS SUCH I HAD TO CHANGE MY IDENTITY SO THAT MY INVESTMENT WILL NOT BE TRACED AND CONFISCATED. I HAVE DEPOSITED THE SUM OF ONE HUNDRED MLLION UNITED STATE DOLLARS (US$80,000,000,00.) WITH A SECURITY COMPANY , FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENT. WHAT I WANT YOU TO DO IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF IN EUROPE. I WANT YOU TO ASSIST IN INVESTING THIS MONEY, BUT I WILL NOT WANT MY IDENTITY REVEALED. I WILL ALSO WANT TO BUY PROPERTIES AND STOCK IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON-SPECULATIVE INVESTMENTS. MAY I AT THIS POINT EMPHASISE THE HIGH LEVEL OF CONFIDENTIALITY, WHICH THIS BUSINESS DEMANDS, AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE, WHICH I REPOSE IN YOU IN CONCLUSION, IN THE EVENT YOU ARE INTRESTED TO ASSIST US I WILL LIKE YOU TO CONTACT MY LAWYER WHO I HAVE STATIONED IN HOLLAND TO WITHNESS THE TRANSACTION TO IS CONCLUTION.YOU CAN REACH HIM ON IS DIRECT LINE WHICH IS +31-612-480-860 OR VIA MAIL peters_stevens5000(a)yahoo.com.HIS NAME IS STEVENS AND I HAVE THE FALL TRUST IN HIME. I SINCERELY WILL APPRECAITE YOUR ACKNOWLEDGMENT AS SOON AS POSSIBLE. BEST REGARDS, MRS M. SESE SEKO

1 0

Ross TCPA paper
by Larry J. Blunk 24 Jun '02

24 Jun '02

For those who question the use of the TCPA spec as part of a DRM system, I refer you to the following article where the author interviewed Jim Ward of IBM (one of the authors of the TCPA spec) -- http://www.101com.com/solutions/security/article.asp?ArticleID=3266 In particular, note the following text: "The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content." And then there is the DRMOS patent granted to Paul England, et al. of Microsoft -- http://cryptome.org/ms-drm-os.htm. Mr. England is also one of the authors of the TCPA specification. Note the section describing the interaction of the DRMOS with the CPU and the cryptographic/certificate requirements of the CPU. This is precisely how the TCPA spec works. The TCPA website avoids mentioning the DRM applications of the spec precisely because it is so controversial. However, it's no big secret that this is clearly one of the intended uses of the spec. ------ Larry J. Blunk Merit Network, Inc. Ann Arbor, Michigan --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Secure mail relays [was:RE: DOJ proposes US data-rentention law. ]
by RL 'Bob' Morgan 24 Jun '02

24 Jun '02

On Sat, 22 Jun 2002, Lucky Green wrote: > I am limiting relaying on port 25 smtp to authorized users by using > Cyrus-SASL, which integrates cleanly with postfix + TLS as the MTA. > Since Outlook only provides the plaintext variant of SASL > authentication, my MTA is configured to not offer smtp AUTH as an option > until after the TLS connection has been established to prevent > eavesdroppers from capturing the relaying authentication password. We run the main MTA for my university this way (of course it will relay without authentication if the client source address is within the university IP ranges), using sendmail and cyrus-sasl. It's my impression that many US universities are starting to do this. We started it as a one-off MTA handling submission of mail for travelers, then realized that the regular MTA could just provide this service. It also does Kerberos authentication, which I use (though not many MUAs support it). > Since more and more misguided ISP's are flat out blocking outgoing > connections to port 25 from inside their network, I have postfix > listening at a higher port number in addition to port 25, just as many > hosts today are running sshd on several ports to help compensate for > similarly misguided corporate firewall policies. The obvious port is 587, the "submission" port (see RFC 2476), which in fact is the one that MUAs "should" use, rather than 25 (we support it, I'm submitting this mail using it, via my home ISP). Of course if it actually becomes popular those misguided ISPs will block it too ... - RL "Bob" --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0