August 2002 - cypherpunks-legacy

Rum plan for global death squads.
by Matthew X 12 Aug '02

12 Aug '02

http://smh.com.au/articles/2002/08/12/1029113895506.html "...United States special forces may be sent to operate under cover throughout the world, under proposals being discussed by the Defence Secretary, Donald Rumsfeld, and senior military officers. Mr Rumsfeld is anxious to expand the role of Special Operations..." Battlefield prep. "The plans could lead Special Operations units to get more deeply involved in long-term covert operations in countries where the US is not at war and, in some cases, where the local government is not informed of their presence. This expansion of the military's involvement in clandestine activities could be justified, Pentagon officials said, by defining it as "preparation of the battlefield" "(the plans)...may at some point conflict with the presidential ban on assassinations. "With a stealthy, mercurial adversary like al-Qaeda, which learnt quickly and adapted its tactics to the US response, the military had to be allowed to react just as quickly, a senior administration official said. The head of the Special Operations Command, General Charles Holland, has briefed Mr Rumsfeld and a small group of senior Defence Department and military officers on initial proposals." Assassination politics? Why should they have all the fun? TATTOOED 'LEMON' Hired killer refuses to murder A Czech hired killer known as 'The Lemon' has turned himself in to police so he would not kill his latest target, an investigative journalist and her young son. He was paid about $11,600 to blow them up after she uncovered shady government property deals. more AND Gay-hate murders 'done as sport' By Ruth Pollard August 13 2002 Many gay-hate murderers were exceptionally brutal, surprisingly young, and killed to support a society they believed approved of their actions, a report released yesterday says. http://smh.com.au/articles/2002/08/12/1029113894539.html APster; reach out and kill someone.Everybodies doin' it.

1 0

How to torture a child.
by Matthew X 12 Aug '02

12 Aug '02

http://smh.com.au/articles/2002/08/12/1029113895915.html "...Israeli Attorney-General, Elyakim Rubinstein, was revealed to have been close at hand when soldiers beat a Palestinian child and two Palestinian men at the main Israeli checkpoint outside Ramallah last week." Entire Island fingerprinted? http://smh.com.au/articles/2002/08/12/1029113895934.html Morg,bucket and chinny cleared thank god.

1 0

Re: On the outright laughability of internet "democracy"
by Niemand Nirgendwo 12 Aug '02

12 Aug '02

On Sun, 11 Aug 2002 22:07:11 -0400, R. A. Hettinga <rah(a)iubc.com> wrote: 160 lines, 1,150 words, 6,393 characters, all insisting on describing his being guthooked, sinker eating, line chewing and flopping up into the greasy bilge, furiously spewing offense and defense, in serious, righteous and angry pursuit of the diaphanous illusion of anoned bait-spilth, becoming clearly the easiest, but also the lowest calorie catch o' the day. Back over the side with you, little fellow. Good fish. Thank you for playing.

1 0

Re: dangers of TCPA/palladium
by AARG! Anonymous 12 Aug '02

12 Aug '02

Mike Rosing wrote: > The difference is fundamental: I can change every bit of flash in my BIOS. > I can not change *anything* in the TPM. *I* control my BIOS. IF, and > only IF, I can control the TPM will I trust it to extend my trust to > others. The purpose of TCPA as spec'ed is to remove my control and > make the platform "trusted" to one entity. That entity has the master > key to the TPM. > > Now, if the spec says I can install my own key into the TPM, then yes, > it is a very useful tool. It would be fantastic in all the portables > that have been stolen from the FBI for example. Assuming they use a > password at turn on, and the TPM is used to send data over the net, > then they'd know where all their units are and know they weren't > compromised (or how badly compromised anyway). > > But as spec'ed, it is very seriously flawed. Ben Laurie replied: > Although the outcome _may_ be like this, your understanding of the TPM > is seriously flawed - it doesn't prevent your from running whatever you > want, but what it does do is allow a remote machine to confirm what you > have chosen to run. David Wagner commented: > I don't understand your objection. It doesn't look to me like Rosing > said anything incorrect. Did I miss something? > > It doesn't look like he ever claimed that TCPA directly prevents one from > running what you want to; rather, he claimed that its purpose (or effect) > is to reduce his control, to the benefit of others. His claims appear > to be accurate, according to the best information I've seen. I don't believe that is an accurate paraphrase of what Mike Rosing said. He said the purpose (not effect) was to remove (not reduce) his control, and make the platform trusted to one entity (not "for the benefit of others"). Unless you want to defend the notion that the purpose of TCPA is to *remove* user control of his machine, and make it trusted to only *one other entity* (rather than a general capability for remote trust), then I think you should accept that what he said was wrong. And Mike said more than this. He said that if he could install his own key into the TPM that would make it a very useful tool. This is wrong; it would completely undermine the trust guarantees of TCPA, make it impossible for remote observers to draw any useful conclusions about the state of the system, and render the whole thing useless. He also talked about how this could be used to make systems "phone home" at boot time. But TCPA has nothing to do with any such functionality as this. In contrast, Ben Laurie's characterization of TCPA is 100% factual and accurate. Do you at least agree with that much, even if you disagree with my criticism of Mike Rosing's comments?

2 1

The friends of declan mccullagh.
by Matthew X 12 Aug '02

12 Aug '02

http://www.moldea.com/rightwing.html Right-Wing Interactive: Investigating America's Right-Wing ... ... Association of Literary Scholars and Critics. Bradley Foundation. Cato ... National Right to Work. * National Taxpayers Union. NewsMax.Com. Pacific Research Institute. ... www.moldea.com/rightwing.html - 16k - Cached - Similar pages

1 0

Thanks, Lucky, for helping to kill gnutella
by AARG!Anonymous 12 Aug '02

12 Aug '02

An article on Salon this morning (also being discussed on slashdot), http://www.salon.com/tech/feature/2002/08/08/gnutella_developers/print.html, discusses how the file-trading network Gnutella is being threatened by misbehaving clients. In response, the developers are looking at limiting the network to only authorized clients: > On Gnutella discussion sites, programmers are discussing a number of > technical proposals that would make access to the network contingent > on good behavior: If you write code that hurts Gnutella, in other > words, you don't get to play. One idea would allow only "clients that > you can authenticate" to speak on the network, Fisk says. This would > include the five-or-so most popular Gnutella applications, including > "Limewire, BearShare, Toadnode, Xolox, Gtk-Gnutella, and Gnucleus." If > new clients want to join the group, they would need to abide by a certain > communication specification. They intend to do this using digital signatures, and there is precedent for this in past situations where there have been problems: > Alan Cox, a veteran Linux developer, says that he's seen this sort of > debate before, and he's not against a system that keeps out malicious > users using technology. "Years and years ago this came up with a game > called Xtrek," Cox says. People were building clients with unfair > capabilities to play the space game -- and the solution, says Cox, > was to introduce digital signatures. "Unless a client has been signed, > it can't play. You could build any client you wanted, but what you can't > do is build an Xtrek client that let you play better." Not discussed in the article is the technical question of how this can possibly work. If you issue a digital certificate on some Gnutella client, what stops a different client, an unauthorized client, from pretending to be the legitimate one? This is especially acute if the authorized client is open source, as then anyone can see the cert, see exactly what the client does with it, and merely copy that behavior. If only there were a technology in which clients could verify and yes, even trust, each other remotely. Some way in which a digital certificate on a program could actually be verified, perhaps by some kind of remote, trusted hardware device. This way you could know that a remote system was actually running a well-behaved client before admitting it to the net. This would protect Gnutella from not only the kind of opportunistic misbehavior seen today, but the future floods, attacks and DOSing which will be launched in earnest once the content companies get serious about taking this network down. If only... Luckily the cypherpunks are doing all they can to make sure that no such technology ever exists. They will protect us from being able to extend trust across the network. They will make sure that any open network like Gnutella must forever face the challenge of rogue clients. They will make sure that open source systems are especially vulnerable to rogues, helping to drive these projects into closed source form. Be sure and send a note to the Gnutella people reminding them of all you're doing for them, okay, Lucky? --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

11 12

Re: responding to claims about TCPA
by AARG!Anonymous 12 Aug '02

12 Aug '02

David Wagner wrote: > To respond to your remark about bias: No, bringing up Document Revocation > Lists has nothing to do with bias. It is only right to seek to understand > the risks in advance. I don't understand why you seem to insinuate > that bringing up the topic of Document Revocation Lists is an indication > of bias. I sincerely hope that I misunderstood you. I believe you did, because if you look at what I actually wrote, I did not say that "bringing up the topic of DRLs is an indication of bias": > The association of TCPA with SNRLs is a perfect example of the bias and > sensationalism which has surrounded the critical appraisals of TCPA. > I fully support John's call for a fair and accurate evaluation of this > technology by security professionals. But IMO people like Ross Anderson > and Lucky Green have disqualified themselves by virtue of their wild and > inaccurate public claims. Anyone who says that TCPA has SNRLs is making > a political statement, not a technical one. My core claim is the last sentence. It's one thing to say, as you are, that TCPA could make applications implement SNRLs more securely. I believe that is true, and if this statement is presented in the context of "dangers of TCPA" or something similar, it would be appropriate. But even then, for a fair analysis, it should make clear that SNRLs can be done without TCPA, and it should go into some detail about just how much more effective a SNRL system would be with TCPA. (I will write more about this in responding to Joseph Ashwood.) And to be truly unbiased, it should also talk about good uses of TCPA. If you look at Ross Anderson's TCPA FAQ at http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html, he writes (question 4): : When you boot up your PC, Fritz takes charge. He checks that the boot : ROM is as expected, executes it, measures the state of the machine; : then checks the first part of the operating system, loads and executes : it, checks the state of the machine; and so on. The trust boundary, of : hardware and software considered to be known and verified, is steadily : expanded. A table is maintained of the hardware (audio card, video card : etc) and the software (O/S, drivers, etc); Fritz checks that the hardware : components are on the TCPA approved list, that the software components : have been signed, and that none of them has a serial number that has : been revoked. He is not saying that TCPA could make SNRLs more effective. He says that "Fritz checks... that none of [the software components] has a serial number that has been revoked." He is flatly stating that the TPM chip checks a serial number revocation list. That is both biased and factually untrue. Ross's whole FAQ is incredibly biased against TCPA. I don't see how anyone can fail to see that. If it were titled "FAQ about Dangers of TCPA" at least people would be warned that they were getting a one-sided presentation. But it is positively shameful for a respected security researcher like Ross Anderson to pretend that this document is giving an unbiased and fair description. I would be grateful if someone who disagrees with me, who thinks that Ross's FAQ is fair and even-handed, would speak up. It amazes me that people can see things so differently. And Lucky's slide presentation, http://www.cypherpunks.to, is if anything even worse. I already wrote about this in detail so I won't belabor the point. Again, I would be very curious to hear from someone who thinks that his presentation was unbiased. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Challenge to David Wagner on TCPA
by AARG! Anonymous 12 Aug '02

12 Aug '02

Declan McCullagh writes at http://zdnet.com.com/2100-1107-946890.html: "The world is moving toward closed digital rights management systems where you may need approval to run programs," says David Wagner, an assistant professor of computer science at the University of California at Berkeley. "Both Palladium and TCPA incorporate features that would restrict what applications you could run." But both Palladium and TCPA deny that they are designed to restrict what applications you run. The TPM FAQ at http://www.trustedcomputing.org/docs/TPM_QA_071802.pdf reads, in answer #1: : The TPM can store measurements of components of the user's system, but : the TPM is a passive device and doesn't decide what software can or : can't run on a user's system. An apparently legitimate but leaked Palladium White Paper at http://www.neowin.net/staff/users/Voodoo/Palladium_White_Paper_final.pdf says, on the page shown as number 2: : A Palladium-enhanced computer must continue to run any existing : applications and device drivers. and goes on, : In addition, Palladium does not change what can be programmed or run : on the computing platform; it simply changes what can be believed about : programs, and the durability of those beliefs. Of course, white papers and FAQs are not technical documents and may not be completely accurate. To really answer the question, we need to look at the spec. Unfortunately there is no Palladium spec publicly available yet, but we do have one for TCPA, at http://www.trustedcomputing.org/docs/main%20v1_1b.pdf. Can you find anything in this spec that would do what David Wagner says above, restrict what applications you could run? Despite studying this spec for many hours, no such feature has been found. So here is the challenge to David Wagner, a well known and justifiably respected computer security expert: find language in the TCPA spec to back up your claim above, that TCPA will restrict what applications you can run. Either that, or withdraw the claim, and try to get Declan McCullagh to issue a correction. (Good luck with that!) And if you want, you can get Ross Anderson to help you. His reports are full of claims about Palladium and TCPA which seem equally unsupported by the facts. When pressed, he claims secret knowledge. Hopefully David Wagner will have too much self-respect to fall back on such a convenient excuse.

10 10

FOX Encryption 24-7.
by Matthew X 12 Aug '02

12 Aug '02

24-3am to 4am. Research files.Encryption.http://www.fox.com/24/research.html "Encryption is a means by which a digital message can be coded so that only the recipient with the proper'key'can decode and understand the message. Encryption technology has ,in fact,gotten so good that its raised serious concerns that messages will become unbreakable,thus putting all manner of criminal activity-from child pornography to espionage to organized crime communiques-beyond the ability of the Govt.to investigate. To address these concerns a key recovery approach called KMI (key management infrastructure) is being talked about in Washington.KMI is designed to allow law enforcement to have access to encrypted on an International basis. es (sic.jacks is?)a flatbed scanner in his car which works like a copy machine..." Theres more...4am to 5,mentions CALEA.5 to 6-the presidents analyst.8to9,the SS. 9to10-wireless tracing.10-11- knives.(not fibreglass.)11-12.GPS.12-1.Ultrasound. 2-3.Mi5.4-5.Fibre optics.6-7.Power grids 3 way split.9-10.CTU-CIA. Hate to feed anyones paranoia but a quick KMI search yields... Applications and Operating Systems Consulting and Technical ... KMI, a top Microsoft Certified Solution Provider Partner, is a consulting services company that provides design and planning, implementation, and support of ... Description: Back Office implementation and support services. Category: Computers > Consultants > Microsoft www.kminet.com/ - 15k - Cached - Similar pages

1 0

Do you like jammin'?
by Matthew X 12 Aug '02

12 Aug '02

Employ a GPS jammer. Most U.S. jets, bombs and ships use the satellites for navigation and timing. The squadron built one jammer small enough to fit in a cigarette pack. It had a weak signal and would have to be close to the antennae to work. Another jammer, about 15 feet tall, could interrupt the signal from farther away. It was relatively easy to build. The airmen bought the plans online for $35. The amplifier came from an electronics store, the generator from a ham-radio operators convention. The rest - PVC pipe, copper tubing, wood supports and hardware - came from a home improvement store. The total cost was less than $9,000. "This is not something cosmic," said Lt. Col. Rad Widman, who until recently commanded the squadron. GPS jamming usually can be defeated by changing a channel frequency, but operators must realize they are being jammed, Widman said. Next week-What traffic analysis tells,Wardriving warbases.us.http://www.gazette.com/stories/0811top2.php

1 0