August 2002 - cypherpunks-legacy

Its closes Mi5,gets PM's steamed and is a definite APster precursor.
by Matthew X 11 Aug '02

11 Aug '02

Once a year the Brits secret services shut down,the PM's of several commonwealth countries are distracted at various times and the people directly(and sometimes indirectly) involved are offered obscene amounts for their 'opinion' on such trivial matters as the lay of the land and/or the weather. Some of the same people interested in such trivia may or may not have been caught betting on the whereabouts of the next religious atrocity. WTF am I on about now? Cricket. How is that an APster precursor? Well JB himself saw AP,(as it was known then,circa 96) as,perhaps best instigated as a betting proposition.Now we have had spread betting on the various stock exchanges for years and various scandals and bank collapse's later,we might recognize APster as being so close now its not funny. There may even have been a plane crash pool for Hansie. Audit report reveals Hansie Cronje has huge assets - [23/07/2001 ... ... Sports. Audit report reveals Hansie Cronje has huge assets Vijay Dutt London, July 22 The sacked South African Hansie Cronje owned eight properties and ... www.hindustantimes.com/nonfram/230701/detSPO14.asp - 30k - Cached - Similar pages Not that auditors are too be trusted.APster,it's not just cricket.

1 0

TCPA/Palladium -- likely future implications (Re: dangers of TCPA/palladium)
by Adam Back 11 Aug '02

11 Aug '02

On Thu, Aug 08, 2002 at 09:15:33PM -0700, Seth David Schoen wrote: > Back in the Clipper days [...] "how do we know that this > tamper-resistant chip produced by Mykotronix even implements the > Clipper spec correctly?". The picture is related but has some extra wrinkles with the TCPA/Palladium attestable donglization of CPUs. - It is always the case that targetted people can have hardware attacks perpetrated against them. (Keyboard sniffers placed during court authorised break-in as FBI has used in mob case of PGP using Mafiosa [1]). - In the clipper case people didn't need to worry much if the clipper chip had malicious deviations from spec, because Clipper had an openly stated explicit purpose to implement a government backdoor -- there's no need for NSA to backdoor the explicit backdoor. But in the TCPA/Palladium case however the hardware tampering risk you identify is as you say relevant: - It's difficult for the user to verify hardware. - Also: it wouldn't be that hard to manufacture plausibly deniable implementation "mistakes" that could equate to a backdoor -- eg the random number generators used to generate the TPM/SCP private device keys. However, beyond that there is an even softer target for would-be backdoorers: - the TCPA/Palladium's hardware manufacturers endoresment CA keys. these are the keys to the virtual kingdom formed -- the virtual kingdom by the closed space within which attested applications and software agents run. So specifically let's look at the questions arising: 1. What could a hostile entity(*) do with a copy of a selection of hardware manufacturer endorsement CA private keys? ( (*) where the hostile entity candidates would be for example be secret service agencies, law enforcement or "homeland security" agencies in western countries, RIAA/MPAA in pursuit of their quest to exercise their desire to jam and DoS peer-to-peer file sharing networks, the Chinese government, Taiwanese government (they may lots of equipment right) and so on). a. Who needs to worry -- who will be targetted? Who needs to worry about this depends on how overt third-party ownership of these keys is, and hence the pool of people who would likely be targetted. If it's very covert, it would only be used plausibly deniably and only for Nat Sec / Homeland Security purposes. It if becomse overt over time -- a publicly acknowledged, but supposedly court controlled affair like Clipper, or even more widely desired by a wide-range of entities for example: keys made available to RIAA / MPAA so they can do the hacking they have been pushing for -- well then we all need to worry. To analyse the answer to question 1, we first need to think about question 2: 2. What kinds of TCPA/Palladium integrity depending "trusted" applications are likely to be built? Given the powerful (though balance of control changing) new remotely attestable security features provided by TCPA/Palladium, all kinds of remote services become possible, for example (though all to the extent of hardware tamper-resistance and belief that your attacker doesn't have access to a hardware endorsement CA private key): - general Application Service Providers (ASPs) that you don't have to trust to read your data - less traceable peer-to-peer applications - DRM applications that make a general purpose computer secure against BORA (Break Once Run Anywhere), though of course not secure against ROCA (Rip Once Copy Everywhere) -- which will surely continue to happen with ripping shifting to hardware hackers. - general purpose unreadable sandboxes to run general purpose CPU-for-rent computing farms for hire, where the sender knows you can't read his code, you can't read his input data, or his output data, or tamper with the computation. - file-sharing while robustly hiding knowledge and traceability of content even to the node serving it -- previously research question, now easy coding problem with efficient - anonymous remailers where you have more assurance that a given node is not logging and analysing the traffic being mixed by it But of course all of these distributed applications, positive and negative (depending on your view point), are limited in their assurance of their non-cryptographically assured aspects: - to the tamper resistance of the device - to the extent of the users confidence that an entity hostile to them doesn't have the endorsement CA's private key for the respective remote servers implementing the network application they are relying on and a follow-on question to question 2: 3. Will any software companies still aim for cryptographic assurance? (cryptographic assurance means you don't need to trust someone not to reverse engineer the application -- ie you can't read the data because it is encrypted with a key derived from a password that is only stored in the users head). The extended platform allows you to build new classes of applications which aren't currently buildable to cryptographic levels of assurance. eg. It allows general purpose policies to be built just by writing policy code that sits in a Trusted Agent code compartment, without having to figure out how to do split-trust (a la mixmaster chaining), or forward-secrecy or secret-sharing or any of the other funky stuff; you can just implement some policy code and it becomes so. The danger is people will use it to build applications with squishy interiors, with no cryptographic assurance. Forward-secrecy implemented only by a policy in a Trusted Agent that sets a time-limit on access. Anonymity but only in the sense that you trust the hardware isn't tampered with, etc etc. It will be really tempting because: - it's much easier: network distributed crypto protocols are relatively complex - you can build things you can't otherwise build, the are currently unsolved problems with distributed crypto protocols - even where good crypto protocols exist, people will defend not using them by claims to paranoia: "What you think the NSA has tampered with your CPU?", or just laziness, cost of implementation etc So in short probably mostly the answer will be "No", people won't still aim for cryptographic assurance. And so a big networked world of distributed applications with a very squishy and insecure interior inside the closed world will be built. The new application spaces squishy interior -- like a corporate firewall with poor to no internal security -- could be ok if you could be sure the firewall is 100% guaranteed reliable. TCPA/Palladium proponents are effectively claiming it be an air-gap grade firewall guarding the distributed closed world application spaces squishy interior. But there is a problem: there are master keys by-passing all that -- the endorsement CA's private keys. 4. What coming political battles will result? a. If TCPA/Palladium systems get built -- and it may be politically unstoppable given the power of the distributed security paradigm it opens up -- then the battle of the coming decades will center around control of access to that squishy interior. The keys that control access to the closed world are the endoresment CA private keys. b. You will see many clipper like attempts by governments attempting to make policies surrounding conditional access to that closed world: - law enforcement access to the endorsement private CA keys controlling access, so they can setup sting operations, demand that ISPs and ASPs collaborate with virtualized versions of network services so they can trace things - NSA designed protocols to allow such things, black box mediated, court order approved, split database access to hardware manufacturers private keys c. As b. progresses RIAA/MPAA will chime in protesting that: - Kazaa2 is distributing 10 exabytes a day of ripped recent release content not based on BORA (which is now somewhat harder), but on ROCA (Rip Once Copy Anywhere) as the content rippers move into hardware hacking territory - the RIAA/MPAA can't hack, spoof or jam kazaa2 with bogus content because cypherpunks have fixed the protocols using WoT, certified content, and other crypto-fu so they can't even observe who's downloading what or who's serving what - and therefore they also demand access to the closed world so they can exert their recent legal rights to hack and DDoS the file sharing networks d. Unauthorised access to the closed environment (by hacking your own hardware) will become illegal with DMCA like restrictions (if it wouldn't already be where some relation to copyright could be drawn). e. Software companies, and OS vendors will follow Microsoft's current lead into an unholy battle with highlights such as: - undocumented APIs to gain advantage over competitors, not only hardware hacking required to discover APIs, but attestation to ensure only those companies who have licensed the right to use the API can use it - incompatible file formats to lock out competition with hardware tamper resistance levels of assurance, even file formats that must have certified documents for applications to open them, so even if you had the spec you couldn't be compatible - copyright protection with software encrypted for the CPU, so you can't even audit the static code - software renting models again enforced by hardware - whole collection of 2nd generation IP "innovations" which will be built on top of such things - charge per person you share file in a given document format; - charge per format conversion f. Lucky's Documentat Revocation lists to allow governments, companies etc to to some extent after the fact control distribution of data g. Increasingly minute enforcement of repressive levels of IP tracking, and arbitrarily user hostile, fair-use eroding document viewing and use policies 5. What could be done to protect the user? a. implement cryptographic assurance inside the closed space where possible -- that way if you are targetted by someone able to get inside it you still have the same protection as now. b. use web-of-trust techniques to provide an overlay of trust on the endorsement trust. ie users endorse their own machines to say "this is my machine" this implies that either: - it's not tampered with (presuming the user himself was not a target of some attack or investigation) - or the only tamperer is the certifying user web-of-trust overlaid on the hardware endorsement helps as: - This makes the endorsement keys less useful in a covertly obtained endorsement CA private key scenario - Even if there are court authorized law enforcement access to endorsement CA private keys, or RIAA/MPAA access to endorsement CA private keys you can to the extent of your connectivity in the web of trust, better avoid using the services of rogue agents inside the closed space. c. Demand ability to audit information in-flows into trusted agents where there are unauditable out-flows; demand that this is implemented in a way which allows code under user control to audit d. Demand the ability to audit information out-flows, where there are unauditable in-flows or sensitive user data processed by the application; similarly demand that this is implemented in a way which allows code under user control to audit e. Demand cryptographically assured anonymity protection so that there are no "trusted third parties" who can link your network usage and identify you. e. Other ideas? (Other than to lobby to prevent the building or use this model). Adam -- http://www.cypherspace.org/adam/ [1] "FBI Bugs Keyboard of PGP-Using Alleged Mafioso", 6 Dec 2000, slashdot http://slashdot.org/yro/00/12/06/0255234.shtml --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

On analaliens and enema's
by Matthew X 11 Aug '02

11 Aug '02

Gay Jewelry by Ponce,Gay & Lesbian Jewelry specializing in ... ... FOR OUR COMPLETE FREE BROCHURE, PLEASE CALL 1-800-969-RING or 1-949-497-4154 Jewelry By Ponce ... Hosted and designed by Gem of the Net. Jewelry By Ponce. Description: Offers pride jewelry, keyrings, and watches, including items for the bear, bisexual, and leather communit... Category: Shopping > Niche > Gay, Lesbian, and Bisexual > Jewelry www.jewelrybyponce.com/ - 19k - Cached - Similar pages See your own responce, think about it this time. -- ____________________________________________________________________ Conform and be dull......J. Frank Dobie ravage(a)ssz.com www.ssz.com jchoate(a)open-forge.org www.open-forge.org -------------------------------------------------------------------- Conform and be dull-Mmm.Dont ask don't tell seems advisable at this point.

1 0

On the outright laughability of "Internet Bearer Underwriting"
by Matthew X 11 Aug '02

11 Aug '02

Without Mongo(who's buying some second hand couches in porn valley,btwSEE http://www.simplyjimmyd.com/ chowderHETT has worked up some head of steam. >>In short, sir, please to fuck off, until you actually know what > you're talking about. < Now hett if that was to happen this list would completely clam up.If fisherpersons knew what they were doing where would the outer banks be today? The Black sea?See? When your IBU get's up then you can pay someone to get us to fuck off.(to the trust territories?) I want your IBU to get up.don't get me wrong,no one more than me wants to see anonymous e-cash in wide (and APster) use.You and Mongo are high on my personal hitlist if for no other reason than being insufferable terminal and crashing bores. If anyone fucks with Jims encrypted election donation's scheme,they know what'll happen.Messing with the international vote,(if we ever need one.)will be the equivalent of suicide.IBU requires APster...and remailers/mints/cryptoanarchy.Wake up.

1 0

Women shot dead.
by Matthew X 11 Aug '02

11 Aug '02

http://www.infoshop.org/inews/stories.php?story=02/08/10/4020832 Apparently buoyed by the earlier success in the take over of oil facilities, Itsekiri women yesterday in Warri marched against three multinational oil companies namely Shell, Chevron and Texaco, disrupting their operations. At least one woman was shot dead in the scuttle that ensued between the protesters and security operatives drafted to ward off the women from advancing beyond the gates of Shell main office, situated opposite the Federal Government College, Warri. The women protest coincided with the commencement of the strike by the Shell Petroleum Development Company (SPDC) branch of the Nigerian Union of Petroleum and Natural Gas Workers (NUPENG) in response to the lock-out of some members of the union by Shell management. But the women, who sealed off the gates to the operational bases of the three oil companies simultaneously, said their action was to demand for scholarships and jobs for their children and wards, micro credit schemes for the women and the aged as well as the immediate end to gas flares, acid rains, oil spillage and other forms of environmental degradation plaguing their communities. Hows yer SUV goin' sport?

1 0

Re: Seth on TCPA at Defcon/Usenix
by Matthew X 11 Aug '02

11 Aug '02

XPalatrocious. PALladium by stealth:This is why CJ deserves a freaking medal for telling william Gates Esq where to step off.Has anyone in fUcking americaStAn heard of the WISDOM of INSECURITY,by allan Watts? >>http://www.mail-archive.com/cryptography@wasabisystems.com/msg02134.html This scenario of word processor vendors denying people access to their own documents until they do something to benefit the vendor is not just "plausible" -- it's happening here and now. John << Lots of heavy shit is happening,"here and now,"Get out of Dodge.

1 0

Re: On alliances and enemies.
by Mark 11 Aug '02

11 Aug '02

Jim Choate said: > > > > I don't see Stalin/Hitler, I see; > > > > > > > > Standard Oil/ > > > > Department of Transporation/ > > > > Interstate Commerce Commission) > > > > General Motors/ > > > > Ford/ > > > > and so forth. > > > > > > You draw a false distinction. And what is your position on IBM, Hitler, their interaction during WWII, etc?

1 0

In Thrall.Utima Thule?
by Matthew X 11 Aug '02

11 Aug '02

anarchist magazine from Aotearoa/New Zealand. We apologise for the delay in getting this issue up on the web. visit http://free.freespeech.org/thrall/23nzmayday.html Contents include: - People's Global Action - We are Everywhere even Aotearoa. An important international decentralised anti-capitalist network that has a branch right here in Aotearoa. (Note: Since we published no.23, it has been announced there will be a PGA Aotearoa nationwide conference in November 9-10 in Wellington this year. This will most probably be the biggest gathering of direct action, anti-capitalist groups in Aotearoa for some time). - People's Global Action - Analysis: A New International? - Direct Action versus the Wellington inner city bypass. A brief documentation of working class community resistance. - Wildcat strikes in Aotearoa - Mayday reports from around Aotearoa - Anarchy in the R.K. part two - a look at anarchism in South Korea from 1961 to the present day by a NZer who visited Korea - Auckland housing occupation - Anti-war, anti-Israeli state protests in Aotearoa - The true story behind the mayday anti-capitalist invasion of Wellington and some international news we couldn't squeeze into the printed issue of thrall specially for our website readers: - Sydney Mayday report - London Mayday report The Thrall website has also been substantially updated to include new links to texts, radical history, and analysis people may be interested in. If you are overseas and wish to receive the printed version of Thrall, you can subscribe if you send us a donation to the address below. Send us well-concealed cash (Aus $, US$ etc.). We appreciate donations as well, as we distribute our magazine for free. Cheers, Fydd for the Thrall collective. ===== Thrall PO Box 22-076 Christchurch AOTEAROA/NEW ZEALAND e-mail: thrallnet(a)yahoo.com website: " target=_blankhttp://www.thrall.orcon.net.nz/ or http://www.freespeech.org/thrall ... Ultima Thule The highest or uttermost point or degree attained or attainable, the acme, limit; the lowest limit, the nadir. The most distant unknown land. ... RIP.Neil.

1 0

Critical mass;way to go.Blocking up roads is a lot of fun.
by Matthew X 11 Aug '02

11 Aug '02

On 15th July, a bunch of people from activist groups Rising Tide and Critical Mass met up on London's South Bank for a climate change bike ride round the city centre. We were going to stop at five evil companies around the capital to give them an award for fucking up our planet. Our first stop was the International Finance Corporation, which is part of the World Bank. It's right next to the Houses of Parliament - coincidence or what? We made some noise outside, handed out leaflets and gave them the award. Next we cruised off round Parliament Square. The 'Countryside Alliance' had a stall there, and I gave them a couple of shouts of 'get a job'. Then it was up Whitehall, through Trafalgar Square and on to the National Portrait Gallery, which is sponsored by BP. Next we moved off to Enterprise IG in Soho. These are the people responsible for BP's Helios awards, the in-house awards given to BP employees who do a good job of making the company look green and nice. We got a baffled response from the company's workers. They had to be told by their boss to get back inside and close all the windows (in case we bit?). We were on our way to Cromwell and Sullivan when some dude in a BMW ran over one of the guys on a bike. Luckily he wasn't hurt, even though the car had gone over his back wheel. The guy in the car looked like he was gonna shit himself when thirty bikers pulled up around him. He called the cops, who soon came and pestered everyone. Last of all, we went to the BP Head Offices in Finsbury Circus. Here the cops were waiting for us. British Transport Police had a dog unit and meat wagon ready. The security people from BP were also waiting, even though we'd no intention of raiding the place. The Azerbaijan PR man Ð sorry, 'Community Relations' officer - came out to talk to us (the demo was mainly about BP's proposed Azerbaijan pipeline). Eventually, everyone except from a couple of the hardcore went off to the London Activist Resource Centre (LARC) in Whitechapel. The hardcore stayed to play with the cops and nearly got stopped for cycling the wrong way round a roundabout. It was a nice protest - Critical Mass is so fucking empowering, I recommend everyone to try it. Blocking up roads with a load of bikes, making noise and just cruising around London Rkn Anarchist Youth Network

1 0

Towels tax deduction.
by Matthew X 11 Aug '02

11 Aug '02

The Taliban's Committee for the Promotion of Virtue and Prevention of Vice has been out of work since being so rudely interrupted by the infidel last fall. The MO worries that having these guys just sitting around might be a case of idle hands becoming the Great Satan's workshop - remember what happened with all those T-men after they repealed prohibition? So to prevent the Committee from turning into a bunch of nuevo-federal narcs who'll terrorize us all for decades, the MO suggests the Committee be put to work reviewing pornos and adding appropriate sound effects per Islamic law. Ludicrous dialog could have a laugh track added, just like in Chica Boom #12 The depiction of adultery could have the sound of stones falling on flesh; public nudity would have the sounds of lashing, all with suitable scrams and cries. You get the idea. And in certain special cases, like Hershel Savage doing one of his disgusting stepfather routines, you would have the sound of a firing squad. Anything by Max H. would of course be drowned out by sounds of the urination of 1000 fat lesbians. Truly, the possibilities are endless. The MO offers to bring all the members of the idle Committee to his bunker in Quatar, set up editing bays, and put them to work in exchange for a modest federal grant. Surely this is preferable to a bunch of towel-headed dildos sitting around looking for work. http://www.lukeford.com/ Site also seeks well hung asians if thats not an oxymoron.There has to be some legal asian hardwood out there somewhere.Get yer wood on! Lets not forget big Jim,tax rebel par exellence..Like most guests of the state penal system,JB is working in prison for what amounts to slave wages and has "virtually no money for toothpaste, magazines, socks, snacks,(well,maybe thats good.) writing paper and stamps." None of these items are allowed inside the facility from the outside world but JB can purchase them from the prison canteen. http://www.bop.gov/facilnot.html

1 0