December 2003 - cypherpunks-legacy

Mixmaster On A $20 Floppy?
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 05, 1996 19:06:21, 'Adam Shostack <adam(a)lighthouse.homeport.org>' wrote: > Towords the goal of making Mixmasters in a box, I've written >an installer script for mixmaster. If you're running on one of the >supported platforms (alpha, bsdi, hpux, linux, sunos, solaris), the >script will walk you through everything from the make to setting up >cron jobs & /etc/aliases. > > If you've been putting off setting up a remailer because its a >pain, give this a shot. Lance will probably be including it in the >next release of mixmaster, but you can get it now by sending me a >message with the Subject: get mix-installer. > > Comments, bugs, bug fixes are welcome. Thanks to Rich $alz >for a extensive comments & suggestions for portability. > >Adam > I've reports that the latest version of SyQuest's external parallel port EZ135 "floppy" drive is due on the shelves this month. Also reported is the ability to effectively boot off the thing, and thus run whatever OS resides on the SyQuest "floppy" rather than an OS that has to be on the host's hard drive partition. Weight, under two pounds. Price ~$US250. Capacity 135 Mb formatted. Price of spare disks: $US 20. Take it off a computer. Put it in a briefcase. Carry it with you nicely out of public view. Hook it up to another machine and .... Question 1: Can you fit linux, pgp, mixmaster, etc. on the 135 Mb disk and have enough useful space left over for a useful amount of data? Question 2: Anybody want to speculate on what traffic analysis is like when encrypted data comes INTO one known Mixmaster site but goes OUT on one or more "unknown" or (partially) random Mixmaster sites? Question 3: Anyone want to speculate on what data recovery is like when encrypted data and the horse it rode in (and out) on has all been physically destroyed at a replacement cost of only $US20? -- -- tallpaul -- "If they think you're crude, go technical; if they think you're technical, go crude." William Gibson "Johnny Mnemonic"

5 4

Big Bill: "You will be assimilated"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:37 PM 1/5/96, Duncan Frissell wrote: >At 01:47 PM 1/5/96 -0500, Gordon Campbell wrote: >>At 12:56 AM 1/5/96 -0500, Larry Sudduth wrote: >> >>>Attachment Converted: C:\WORK\WINMAIL.DAT >> >>What, pray tell, is this? >> > >When a MS Mail attachment wanders around the world, it is accompanied by a >data file of some kind. That is winmail.dat. So every MS MAIL attachment >is really two attachments. Try to ignore it. You know, between Microsoft Mail, Microsoft Exchange, and other weirdnesses associated with Microsoft, it's almost as if Big Bill (the guy in Washington, but not D.C.) is trying to tell us be assimilated or face continued pseudo-spamming. (No insult to Microsoft intended, but other companies seem to understand it is up to them to make efforts to comply with conventional Internet standards, while MS seems to relish doing things its own way, the rest of us be damned.) I hate the thought of putting all Microsoft domain addresses in my kill file, but at least it solves the problem. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Crypto Rules Report
by John Young 17 Dec '03

17 Dec '03

In response to the December Financial Times article "Encryption Rules Coming," about an international cryptography meeting in Paris, and our request for additional information, we have received from nobody: Report of the Business-Government Forum on Global Cryptogoraphy Policy Held on 19-20 December 1995 in Paris Detailed Report The report includes meeting background information, notes on the speakers articulation of the positions of industry and governments, and four annexes: 1. List of participants (EU, US, Japan -- biz and gov); 2. Statement of Eurobit-ITAC-ITI-JEIDA which sets out 20 principles of global cryptographic policy; 3. Statement by the Infosec Business Advisory Group (IBAG) on 17 principles of international cryptography; 4. The Mike Nelson Policy Problem (last point: "No one trusts anyone.") It would be great if someone would provide an FTP site. It is about 31 kb.

3 3

Re: get mix-installer. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From adam(a)lighthouse.homeport.org Fri Jan 5 20:23:21 1996 From: Adam Shostack <adam(a)lighthouse.homeport.org> Message-Id: <199601060225.VAA21165(a)homeport.org> Subject: Re: get mix-installer. To: ravage(a)ssz.com (Jim Choate) Date: Fri, 5 Jan 1996 21:25:59 -0500 (EST) In-Reply-To: <199601060152.TAA04065(a)einstein.ssz.com> from "Jim Choate" at Jan 5, 96 07:52:17 pm X-Mailer: ELM [version 2.4 PL24 ME8b] Content-Type: text Content-Length: 367 Jim Choate wrote: | I would like a copy to use in my consulting business as well as put on the | Austin Cypherpunks ftp site. Both are fine. I assume that a copy was auto mailed to you; let me know if there is a problem. May I ask who pays to get mixmasters installed? -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: get mix-installer. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From adam(a)lighthouse.homeport.org Fri Jan 5 20:23:21 1996 > From: Adam Shostack <adam(a)lighthouse.homeport.org> > Message-Id: <199601060225.VAA21165(a)homeport.org> > Subject: Re: get mix-installer. > To: ravage(a)ssz.com (Jim Choate) > Date: Fri, 5 Jan 1996 21:25:59 -0500 (EST) > In-Reply-To: <199601060152.TAA04065(a)einstein.ssz.com> from "Jim Choate" at Jan 5, 96 07:52:17 pm > X-Mailer: ELM [version 2.4 PL24 ME8b] > Content-Type: text > Content-Length: 367 > > Jim Choate wrote: > > | I would like a copy to use in my consulting business as well as put on the > | Austin Cypherpunks ftp site. > > Both are fine. I assume that a copy was auto mailed to you; let me > know if there is a problem. > > > May I ask who pays to get mixmasters installed? > > -- > "It is seldom that liberty of any kind is lost all at once." > -Hume > In a earlier message I received from Adam I mistook his auto-remailers scripts responce as a refusal to supply the afformentioned code. I apoligize for my ignorance and retract any negative statements or implications that I may have made. In the last year I have had a couple of local business people and about a dozen individuals ask about remailers and using PGP. I currently have a couple of state political activists in the gun lobby who have begun using it for internal communications. I am hoping to have another machine installed in the next couple of weeks with mixmaster available. It is my intention to run a remailer here in Texas with the help of the local cpunks (I hope) in order to demonstrate what the technology is capable of. I see this script as a major advance in making the software more palatable to the general populace. My current business plan is to educate several international translaters I work with about the technology. They work with foreign patents being applied for here in the US and they typicaly must sign non-disclosure agreements to get the contracts. Such technology may be something they find useful. Jim Choate

1 0

Jan 13 Mountain View CA meeting
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Hi all, happy new year. The Jan 13 Mountain View, California meeting will be held again at Sun Microsystems, at Sparcy's cafeteria. That's building 21, in the set of Sun buildings near Shoreline Park in Mountain View. Take 101 to Amphitheater Parkway exit, turn left onto Charleston at the light (this street is also named Garcia at its far end) and follow the purple Sun signs for building 21. You'll drive down Charleston (Garcia) for about 1/3 mile and then turn right onto a road that in about 3 blocks takes you to B21. Please send mail if you have a topic you would like to speak about, and I'll send out a speaking agenda towards the end of the week. Marianne mrm(a)netcom.com mrm(a)eng.sun.com p.s. I'll bring bagels again but since I never got reimbursed last time around I think I will put out the donation jar this time ...!

1 0

WIRE TAP ON NET
by Douglas F. Elznic 17 Dec '03

17 Dec '03

E-MAIL-TAP NETS CRIMINALS The first-ever court-approved wiretap of an e-mail account has resulted in the arrest of three people charged with running a sophisticated cellular-fraud ring. The alleged mastermind, a German electrical engineer, advertised his illicit wares on CompuServe, where they caught the attention of an engineer at AT&T's wireless unit. The Secret Service and the Drug Enforcement Agency then got into the act and obtained the Justice Dept.'s permission to intercept e-mail messages between the alleged perpetrator and his accomplices. "This case represents the challenges in the future if we can't get ahead of the curve in technology," says a U.S. attorney, whose office is prosecuting the case. (Wall Street Journal 2 Jan 96 p16) -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

2 1

Re: Pi Stuff
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:15 PM 1/5/96 -0800, you wrote: >Various amazed people on the Pi thread wrote: > > > But BTW, isn't it interesting, that news item from a few > > weeks ago, on an algorithm for determining individual bits > > in Pi, regardless of whether you've calculated all the > > previous ones. Only problem is, it only works in > > hexadecimal (and, obviously, binary, etc, not decimal. >A few quick comments. The notion that one might be able to >compute digits of Pi efficiently at any starting point in the >number is not late-breaking news. The Chudnovsky brothers >developed a formula which permitted them to do this a number of >years ago, and used it to compute Pi to several billion digits. While I'm not an expert at this, I think you're misrepresented the Chudnovsky result. They formulated an equation that allowed "you" to continue the calculation past "N" digits as long as you had the result that far. As far as I know, they DID NOT generate any formula for the generation of isolated digits of pi, the more recent news. I'm signing this message after having turned off word-wrap in Eudora. I'm told this my help my clearsigning process. Could somebody verify this? - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi1zvWcAAAEEAKmSqngLWK2N2gOJKPtjF9VCfSkXY+XUZBRCbbFU71uH/dLX C2Uq6wFS8alRgMc3rp90JnnJ/6eJqXwMjCunogwucWOaU7S/w+OwjOG9fUqsXIA6 2j25Wtjce65mbp0TKLAzwMb/P/Qq7BlclqhuKzfVBH7dIHnVAvqHVDBboB2dAAUR tBFKYW1lcyBEYWx0b24gQmVsbA== =G3LA - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMO3ArPqHVDBboB2dAQFXfQP+OhdkTw+3TFF4x97Or4hBRGSCd015+ZfJ 1wTov5MuKgfHlVEqml02mi3RJQSD1WYryysMkcQKrGS+X6IULolxtasKrXEUBw5P fIiEAc+ueY68XZULGTL0IpsUDhUYXTWRaP9l64iELrdtmvtDQAd0zxfGDAoeyhvO goZCWxWXUqs= =ZGyP -----END PGP SIGNATURE-----

2 1

Re: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:07 AM 1/6/96, Bruce Baugh wrote: >I'd like to bring up a problem I haven't seen addressed much yet, and which >I think is going to come up with increasing frequency as PGP use spreads. > >The problem is this: how can one spread the word that an old key is no >longer to be used when one no longer has the pass phrase, and cannot >therefore create a revocation certificate? Basically, you are screwed. Any revocation you attempt will not be trusted, as we will suspect the new "you" to be an attacker, perhaps an agent of the NSA or the Illuminati. In the view that "you are your key," the old you no longer exists. Perhaps you could just move to a different city, change your name, and create a new key. (However, be sure you write down your passphrase and other salient information to handle your next memory loss.) > >In my case the problem is medical: thanks to autoimmune problems, I get >random memory loss from time to time. Sometimes it's big - like an entire >semester of my sophomore year of college. Sometimes it's small - like three >old pass phrases. So there are keys of mine floating around the key servers >that I don't want used, and which are just taking up space. Pardon me for being politically incorrect (*), but anyone who has these sorts of memory lapses should certainly write down the passphrases! While it is true that writing down a passphrase increases the risk slightly that a black bag operative will sneak into one's house and use his Minox to record the passphrases, in practice this is a minor risk. Especially compared to the immediate risk of losing or forgetting the passphrase. (* I said I was being "politically incorrect" because I've found that people these days don't want their defects and weaknesses commented upon by others, even when they mention them themselves. Thus, cripples don't want anyone to comment on their handicaps, and so on. Someone on this list with "Multiple Personality Disorder" got mightily offended when someone else mentioned MPD in a joking way in a post. Others freak out at innocent remarks, seeing their own demons.) So, if you are losing entire semesters worth of memory, you might want to start writing a lot of stuff down. Seriously, this is an example where "escrow" works. Seal an envelope with your passphrase and any other stuff you want to remember, and leave it with your lawyer or escrow agency with instructions to only turn it over to you. Same as a safe deposit box, unless you forget the key. (You could forget you have a lawyer, so better write that down somewhere, too.) I've not forgotten my PGP passphrase, but then I've only had one PGP key in the last several years and I've written a note to myself someplace which describes what the passphrase is in terms I think would only be meaningful to me. Not fully secure, but nothing really is. And secure enough. If you've had several keys in several years, and yet you are risk of forgetting entire semesters, maybe you ought to think about whether encryption is all that necessary for you. (I rarely see the need to encrypt, even as I cherish the ability and present right to encrypt, so I naturally wonder what it is all these people who seem to be encrypting nearly every private message they send are really concerned about....just my opinion.) I hope all turns out well, and I hope my candid answers to your questions are not too politically incorrect. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

"Microsoft.com" added to my KILL file
by tcmay＠got.net 17 Dec '03

17 Dec '03

After getting another batch of bounce messages from Microsoft's Postmaster, I have reluctantly decided to filter out all messages from Microsoft.com until they fix this problem with Microsoft Exchange. Their latest message was: ***** Your message did not reach some or all of the intended recipients. To: cypherpunks(a)toad.com Subject: Foiling Traffic Analysis Sent: 01/05/96 08:51:18 The following recipient(s) could not be reached: Ron Murray on 01/05/96 08:51:18 The recipient name is not recognized [MSEXCH:MSExchangeMTA:northamerica:RED-70-MSG] ***** Rather than fight their misconfigured mail system, or try to convince them to change their ways so as to conform to accepted practices, I'll just use technology. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Pi Code.......
by mpd＠netcom.com 17 Dec '03

17 Dec '03

In case anyone wants to play with the little program that emits bits of Pi, a Fortran version is available on the Web at... http://www.cecm.sfu.ca/~pborwein/PISTUFF/FORTRAN -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Revoking Old Lost Keys
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 03:10 AM 1/6/96 +0000, Michael C. Peponis wrote: >On 5 Jan 96 , Bruce Baugh wrote: >Another problem, let's say I get your public key from Bob, who signed >your key, and Bob knows you have revoked your key, but I don't, so >what happens to my copy of your key? > >Since there is no revokation certificate, I am forced to take Bob's >word that you have indeed want to revoke your key, but have no way of >verifying that without talking to you, and agin I have to go through >the same verification process that Bob did. I know Bruce and his problem is quite real. I happened to have the three keys that he is wanting to revoke in my keyring. (And one of them he had forgotten he had made at all.) It would be nice if there was a way to use the "web of trust" to certify a key revokation in the same way that one signs a key. Basically get a couple of your friends who are accepted in the crypto community and have them vouch for the actual loss of the key(s). It would certainly help patch the problem. (It might open up things for spoofing anyways. There would have to be a way of overriding such a thing with the real key, but that would require the passphrase. (Which should be available if not lost.)) An idea at least... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMO495OQCP3v30CeZAQHObQf/VtMoPzpBqx9wU2rsrHkMc5K4LF2PbZdj QboPyoR0c56zIGPiDDoRed4aiy8ylBlPjEGdSeLjoVysbY+yfWz1GDzsrmsdNw9G tAE7DxX88kk9ym4ixy+3CIsFqKrHn1CBh64DAsoJzXRLgwEhPENLmqf0VXgRkYnI Dd7UE3fF15sMEEVdGYXBqEy7r3e83R9dW7ap/z8wy/sM5U8pzo0SwRrqEFVNe2/g 8rYDF8uFgDjbCrU60UVqFq3ipRbGDBGMI9xSLqpSkBHuSOk0si3sNqvSM09WuWFE LjkrVWPvZNaw1DbuQT7v2FTXNrNnfBsVH9MicM2fednOV0Fe7ZIoZg== =sT8b -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

1 0

Re: Windows Eudora and PGP
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:04 PM 1/5/96 +0800, Ng Pheng Siong wrote: >On Fri, 5 Jan 1996, David K. Merriman wrote: >> I've gotten ahold of the WPGP mentioned here a couple days ago, and it seems >> to be working just fine, for me. Even easier to use than PIdaho, though not >> quite as 'full-featured' (ie, remailer support, etc). > >Aegis, which was mentioned on this list some months ago, is the best >of the lot, IMHO. No remailer support: You can talk to a remailer from >an email program. ;) I use Aegis right now and I have only one major problem with it. It does not have a facility to do word wraps in the program before signing. This means that if you use it with Eudora and word wrap is on, all of your sigs are going to be bad. (And hitting return on every line before feeding it through is a pain in the ass.) On the other hand, I have heard that WPGP is not very stable under Win95. Can't win for losing... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

1 0

RE: Revoking Old Lost Keys
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:47 AM 1/6/96 -0000, Frank O'Dwyer wrote: >On Saturday, January 06, 1996 09:18, Timothy C. May[SMTP:tcmay@got.net] wrote: >>At 7:07 AM 1/6/96, Bruce Baugh wrote: >>>I'd like to bring up a problem I haven't seen addressed much yet, and which >>>I think is going to come up with increasing frequency as PGP use spreads. >>> >>>The problem is this: how can one spread the word that an old key is no >>>longer to be used when one no longer has the pass phrase, and cannot >>>therefore create a revocation certificate? >> >>Basically, you are screwed. Any revocation you attempt will not be trusted, >>as we will suspect the new "you" to be an attacker, perhaps an agent of the >>NSA or the Illuminati. In the view that "you are your key," the old you no >>longer exists. > >This is true, but the "old you" can be resurrected if you can get enough >people to believe your new key using any out-of-band means available >to you. You can also put a comment in your new key's uid explaining the >problem and how to verify the new key. You will find it very hard to use this >new key for a while, though, during the transition period. Many people will take >the existence of two keys with the same uid as suspicious in itself, since it at >least indicates some kind of attack (even if only a denial of service attack). There are times when you want multiple keys with the same ID. I have two key sizes becuase one is an older key. I keep it around for use with people who are using versions that do not support the larger keys. (I have run into this once from a sometimes user of PGP. He finally upgraded.) To aleviate the suspicion, I have the two keys sign each other. >This is really a usability flaw with current PGP. Only if you use the name to refer to the key and not the hex ID. (I found out the hard way that some front ends use either the last key created or whatever they feel like for signing keys and/or signing messages. I am still trying to straighten out some of the weird results of that.) Fortunatly, some programs will use the hex ID to refer to the key so there is no confusion. >The PGP formats do allow for a 'revocation' certificate, but PGP doesn't >implement it (yet, I guess). In any case, it's not really strong enough, >since what it says is "I retract all my previous statements that this key is >related to this user". This'd mean that you'd have to visit everyone who'd ever >signed your key and get them to issue this retraction. What would be needed >for this problem is either an "anti-certificate" ("This key does not belong to this >user"), or else some convention. For example, if two _trusted_ keys are found for the >same uid, the most recent one could be chosen, and the earlier one be purged >from keyservers, etc. This may be possible with current PGP. I haven't tried it, >but since I have some keys which have fallen into disuse, I will need to do so >sometime.). Revocations are supported, but they require the passphrase. (I have a number of revokations on my keyring from various folks.) The problem here is occasions where you have forgotten the passphrase. (I have an old keyring that I need to go and revoke all of the old keys on it. I have not used them in a year or two. I doubt if they are even on the keyserver...) Eventually there will be a way of revoking keys in the circumstance. Something similar to a notary (or a combination of notaries) who can vouch and say "hey, this guy really did lose his keys". Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

2 1

A couple of ideas for PGP-based programs
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am posting these ideas here before I annoy the people who will probibly implement them just to see if they have much merit... (If this is incoherent it is because of the late night posting, but I want to get it done while the thoughts are still there...) Maybe some of this will occur after PGP 3.0 is released. (That is, if the universe has not cooled down into a small lump of coal before then...) 1) Something I would like to see on the keyservers for PGP is a way of retreving all of the key revokations since x date without having to get all of the keys since that date. I hate having to check each key every so often to see if it is revoked. It would make it alot easier to avoid using compromised or old unused keys. 2) I would like to see a program like private Idaho have the ability to send mail to the key server and grab all of the "unknown signator" keys. This would have the interesting effect of building a more complete keyring, while using the "web of trust" to weed out alot of the bogus keys that tend to crop up on the key servers. After n number of itenerations you would have more of the "important keys" and the ones that have little or no signage would be left to grab when needed. This would avoid the need to grab the entire key database. (In fact, it would make it desirable NOT to...) More later when I am not so tired... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMO5PTOQCP3v30CeZAQET8wf/WI8o18pAol3HcN8j+EZyM7aIkPRFg/EQ IYU+J8c5UrXrHDyUY+lZI11Ip2CgXfL/9ER6+vJ/xKPRfNOYnzOe+53FIOKbhJ0U VPGCJYi7tbIpqBB+SHJe555fijEeGAORMvGqCVosb+KKsZQvQP5SHGK3zsy9rBP+ ojkM3AyJs5uyia4pAjV1Zz3DfxEgMPvBPtqXObN32FVbAq7hGmscDKNHEJ7ifO7H xQiMWyzPJgWdUttdoi9ko7kFYLzze4472hEGNV9DbFZMlpVn6Eex9Hhz/wq20j4i mgfyjU3GF+6+OY8KgkXU79FYKkZYqa019uCuPk50cgRdUZsI1BLyHA== =ImCD -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

2 1

CelBomb
by John Young 17 Dec '03

17 Dec '03

Can anyone in IL, or elsewhere, report more on the head-job of The Engineer: Any crypto used to authenticate the target for the boombox, or to obscure links to the assassin? How was the blast specifically targeted at him and not a phone borrower? How it was set off -- by user-dialing, remote control, some other means? Any fishy smelling brand names to immediately run from? Answers urgent.

3 3

Re: Revoking Old Lost Keys
by Michael C. Peponis 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 5 Jan 96 , Bruce Baugh wrote: > I'd like to bring up a problem I haven't seen addressed much yet, and which > I think is going to come up with increasing frequency as PGP use spreads. > > The problem is this: how can one spread the word that an old key is no > longer to be used when one no longer has the pass phrase, and cannot > therefore create a revocation certificate? It's an administrative nightmare. I assume that you mean if the key is widley distributed. If it's only circulating among a small group of people that know each other, no problem. If it's widley distributed, or on a keyserver, that becomes hard. First you would have to be authenticated as the origional key owner, ie how do I realy know that you are you, and not somebody saying you are the orgional key owner? Another problem, let's say I get your public key from Bob, who signed your key, and Bob knows you have revoked your key, but I don't, so what happens to my copy of your key? Since there is no revokation certificate, I am forced to take Bob's word that you have indeed want to revoke your key, but have no way of verifying that without talking to you, and agin I have to go through the same verification process that Bob did. Good topic. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMO2+BkUffSIjnthhAQFPuQP7BOBJTkqInT4nIAQ7ity4/AutSn9QusFx FdG6iPQVG11fp2BbGtDeQMSgaFUDxXm99Oim/VINGWDmbMWhcWTAXDPpYrd2+bjH Q9/SNs+5akQc+bbojqIjDoXas/5LL4VvbrEeSOvklpKg+GrCleJYqN+Mh2aY35ZL 04GLVJJLzSo= =Xr5x -----END PGP SIGNATURE----- Regards, Michael Peponis PGP Key Avalible form MIT Key Server Key fingerprint = DD 39 66 3D AE DE 71 C2 B6 DA B2 3F 47 2A EB AC

1 0

Re: Windows Eudora and PGP
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:32 AM 01/6/96 -0800, Alan Olsen <alano(a)teleport.com> wrote: >At 03:04 PM 1/5/96 +0800, Ng Pheng Siong wrote: >>On Fri, 5 Jan 1996, David K. Merriman wrote: >>> I've gotten ahold of the WPGP mentioned here a couple days ago, and it seems >>> to be working just fine, for me. Even easier to use than PIdaho, though not >>> quite as 'full-featured' (ie, remailer support, etc). >> >>Aegis, which was mentioned on this list some months ago, is the best >>of the lot, IMHO. No remailer support: You can talk to a remailer from >>an email program. ;) > >I use Aegis right now and I have only one major problem with it. It does >not have a facility to do word wraps in the program before signing. This >means that if you use it with Eudora and word wrap is on, all of your sigs >are going to be bad. (And hitting return on every line before feeding it >through is a pain in the ass.) > >On the other hand, I have heard that WPGP is not very stable under Win95. >Can't win for losing... > I'm running WPGP under Win95, and so far it's been as stable as Win95. On my machines, that's been pretty darn stable - YMMV :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMO3EV8VrTvyYOzAZAQGrLwP+M2Sol133Vg329ImG39utW+kxhjcg9Ctc nEPZl9hqPXGG/tPbRG7UMbNi8TBW8/Qqw4oWV6hNb/aOLlYuQ5hrxOogFCSzUn4w 0smLGwrc1siWa1YEWiBgbgrzY7nP0thCgM7jiVbkbaNLAn01+Rj8ZzuSxWP/1sxW l6E7+pZ7Rx8= =5lv3 -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: Compuserve grovels to foreign censors
by Chris Claborne 17 Dec '03

17 Dec '03

At 01:47 PM 1/5/96 -0500, you wrote: >At 12:56 AM 1/5/96 -0500, Larry Sudduth wrote: > >>Attachment Converted: C:\WORK\WINMAIL.DAT > >What, pray tell, is this? If a MSMail for Windows user attaches a file to her message, it also sends along the icon for the ride. This file could also be a picture that someone pasted in to their message. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Revoking Old Lost Keys
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd like to bring up a problem I haven't seen addressed much yet, and which I think is going to come up with increasing frequency as PGP use spreads. The problem is this: how can one spread the word that an old key is no longer to be used when one no longer has the pass phrase, and cannot therefore create a revocation certificate? In my case the problem is medical: thanks to autoimmune problems, I get random memory loss from time to time. Sometimes it's big - like an entire semester of my sophomore year of college. Sometimes it's small - like three old pass phrases. So there are keys of mine floating around the key servers that I don't want used, and which are just taking up space. Others will have more mundane problems, like creating a key years ago and just plain not using it. But as PGP use moves out of essentially pure-geek communities into the surrounded net.world, accidents and other carelessness _will_ happen. I'm curious as to what thoughts, if any, y'all have about how to deal with it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMO4fZH3AXR8sjiylAQHOqwfPbvjHnfM7WlbjjUrrmYQ6Diba2aJb0g2K KjsgTAZ3hyUGcnSBRsMPAb+GTkf440SRvX3JxBsRKn0X0lzHvM6ejKducQPrlJyM ter8C8kiwhZXLcNQiAVpOthrarO7qYqs9JBXmEIm2JwAXtO2SwhB8KsUxvHJpf5R v2036MQb2DSpz1VwmPw6yJYSCy5WrvyT/bRCgJ1Tukx2N0AJ3+tEBeXO9BhpwkjZ oGQPa1XtvcgUGsR1a+HKytz9RrBcgh8voXOBz3LmP1EZH0YEG0VA0a2ej/JUkwza et55dxK8LuuwOz6qo/9QJ2kyGqo641nRLowCdjXI29wITQ== =Asuu -----END PGP SIGNATURE----- Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

2 1

Forgetting passphrase/escrow/pgp 3
by Don M. Kitchen 17 Dec '03

17 Dec '03

As has been mentioned, this is a good situation for the use of some kind of escrow. Not meaning to talk about crypto or anything, but it seems to me that there's already some good shamir sharing code out there, I hope the overworked, underpaid PGP 3.0 people put shamir sharing capabilities. I see it as a slight modification of the split/merge code, which PGP already has, plus already written shamir code that hopefully need only be cut-and-pasted into PGP. This is what non-GAK escrow people want, right? Easy-to-use strong-crypto escrow? Don -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Mitnik: latest? -- Long, watch it
by John Young 17 Dec '03

17 Dec '03

Perhaps Brian Davis will comment with the latest but here's Littman on Mitnick (and scans of Shimomura/Media/Feds) through October, 1995: As Tsutomu Shimomura launched his new careers as pitchman, author, movie subject, and video game designer, Kevin Mitnick sat in a Southern county jail. Mitnick wrote to me nearly every week on yellow legal paper in longhand, bemoaning the lack of a word processor as he recounted the hardships of jail. He told me he had been attacked and robbed by two inmates and barely avoided fights with several others. When he complained that the vegetarian diet he requested was limited to peanut butter sandwiches, and that his stress and stomach medication prescriptions weren't filled, he was moved to a tougher county jail. His grammar wasn't perfect, but his writing was surprisingly frank and descriptive. Mitnick punctuated his letters with Internet shorthand, noting the precise minute he began each letter, as if he were still online. He was bitter, but he hadn't lost his sense of humor. When his jailers admitted they'd read the letter Mike Wallace wrote him, inviting him to appear on 60 Minutes, Mitnick admitted the irony of him, of all people, complaining about other people reading his mail. "Poetic justice, eh? ..." Once in a while he'd slip in a tantalizing comment about his case. One week he'd appear to trust me, the next he'd wonder whether I would betray him. It was strange corresponding with the man the media and our government had cast as a twenty-first-century Frankenstein. Mitnick himself didn't seem sure of who or what he was. He asked whether I felt he should be given a long prison sentence. Did I think he was evil? Dangerous? When he was sent to his second jail, as a matter of policy the U.S. Marshals confiscated his books, his underwear, his toiletries. Mitnick was doing the worst prison "time" possible, because the Eastern District of North Carolina had no federal detention center. That meant he would have to defend himself without access to a law library, required by law in federal institutions. The nurse in Mitnick's second county jail cut his medication again, and on June 18, his attorney filed a motion in federal court stating that Mitnick "was taken to the hospital and diagnosed with esophageal spasms." The attorney argued that the "deliberate indifference" to Mitnick's "serious medical needs" violated constitutional standards. Before a federal judge could order a hearing on the medical issues, Mitnick was transferred to his third North Carolina jail in as many months. "He [Mitnick] overextended his welcome," explained a deputy U.S. Marshal in Raleigh who preferred to remain anonymous. "It was time for a change of scenery. This happens with a lot of them. They get where they think they're running the place." Mitnick's third county jail was his worst yet. He shared a cell with seven other men. There was no law library, radio or television, and each inmate was allowed only two books at a time. Mitnick's were the Federal Criminal Code and the Federal Sentencing Guidelines. The eight men in Mitnick's cell were forced to share a single pencil stub that was taken away in the afternoon. Mitnick was allotted one sheet of paper a day. On April 10, 1995, John Dusenberry, Mitnick's public defender, filed a motion to suppress evidence and dismiss the indictment. He argued that the blank search warrants and the warrantless search of Mitnick's apartment violated the Fourth Amendment, which specifically prohibits unreasonable search and seizure. In the government's response, John Bowler, the Assistant U.S. Attorney in Raleigh, defended the blank search warrants, not an easy proposition in a free country. Bowler prefaced his argument by claiming, despite evidence to the contrary, that Shimomura tracked Mitnick on his own until February I4, just hours before his capture. The government's response to the issue of the blank search warrants was to blame Magistrate Wallace Dixon. Bowler asserted that the FBI had wanted to execute the search properly, but the magistrate had "upon his own initiative" insisted on signing the blank search warrants. But a judge never ruled on these arguments. The twenty-three-count indictment the Associated Press had hypothesized could land Mitnick 460 years in jail fell apart. The government abandoned its case in Raleigh, dismissing all but one of the counts in accepting a plea bargain from Mitnick that would likely get him time served, or at most eight months. The tiny story was buried in the back pages of the New York Times. "Kevin is going to come and face the music in L.A., where, of course, the significant case has always been," David Schindler, the U.S. Attorney in Los Angeles, told the L.A. Times. The newspaper said the prosecutor believed Mitnick would receive stiffer punishment "than any hacker has yet received," a sentence greater than Poulsen's four years and three months. Mitnick's letters revealed how Schindler planned to win the record prison term. Schindler was claiming losses in excess of $80 million, the amount that would garner the longest possible sentence for a fraud case according to the Federal Sentencing Guidelines. Nor would Schindler have to substantiate his claim. The government only had to "estimate" the loss. Mitnick's attorneys said the figure was grossly exaggerated, and added that the case rested on source code allegedly copied from cellular companies. There was no proof that Mitnick had tried to sell the code, and there was no evidence it could be sold for an amount approaching $80 million. But under the guidelines the absence of a profit motive was no obstacle to a long jail term. David Schindler was seeking an eight-to-ten-year sentence for Kevin Mitnick, about the same prison time doled out for manslaughter. The jailed hacker wasn't the only one whose feats were being hyped. By August of 1995, the advertisement in Publishers Weekly for Shimomura's upcoming book featured Mitnick's New York Times photo stamped with the caption HE COULD HAVE CRIPPLED THE WORLD. Declared the ad, "Only One Man Could Stop Him: SHIMOMURA." The hyperbole made me flash on what Todd Young had done in Seattle. The bounty hunter had tracked Kevin Mitnick down in a few hours with his Cellscope. Unauthorized to arrest him, he'd kept Mitnick under surveillance for over two weeks as he sought assistance. But the Secret Service didn't think the crimes were significant. The U.S. Attorney's Office wouldn't prosecute the case. Even the local cops didn't really care. When I met Young in San Francisco a couple of weeks after Mitnick's arrest, he was puzzled by the aura surrounding Shimomura and his "brilliant" capture of Kevin Mitnick. We both knew from independent sources that Shimomura had never before used a Cellscope. Young asked why the FBI would bring an amateur with no cellular tracking skills to Raleigh for the bust. If Shimomura's skill was measured by his ability to catch the hacker, then he was on a par with Todd Young, a thousand-dollar-a-day bounty hunter who never had the help of the FBI. The simple, unglamorous truth was that Kevin Mitnick, whatever his threat to cyberspace and society, was not that hard to find. I tried to get the government to answer Young's question about Shimomura's presence. I asked the San Francisco U.S. Attorney's Office and they suggested I ask the FBI. But the FBI had no comment. I asked Schindler, the Assistant U.S. Attorney in L.A., and he didn't have an answer. I asked Scott Charney, the head of the Justice Department's Computer Crime group, and he said he couldn't comment. I asked the Assistant U.S. Attorney who would logically had to have approved sending Shimomura three thousand miles to Raleigh, North Carolina. But Kent Walker oddly suggested I ask Shimomura for the answer. The response reminded me of what John Bowler, the Raleigh prosecutor, had said when I asked him how John Markoff came to be in Raleigh. He, too, had suggested I ask Shimomura. Shimomura seemed to be operating independently. outside of the Justice Department's control. Or was he running their show? The media appeared captivated by Shimomura's spell. Except for the Washington Post and The Nation, most major publications and the television networks accepted John Markoff's and Tsutomu Shimomura's story at face value. Kevin Mitnick's capture made for great entertainment. Not one reporter exposed the extraordinary relationship between Shimomura and the FBI. Most seemed to ignore the conflict of interest raised by the financial rewards Shimomura and Markoff received by cooperating with the FBI. A Rolling Stone magazine story condoned Markoff's actions, saying he had merely done what any journalist would do when presented with the possibility of a big scoop. The media critic for Wired suggested only that Markoff should have advised New York Times readers earlier of his personal involvement in capturing Mitnick. The media functioned as a publicity machine for Shimomura and the federal government, quickly churning out a round of articles arguing for tougher laws and greater security on the Internet. But the fury over what Assistant U.S. Attorney Kent Walker described as Mitnick's "billion dollar" crimes simply distracted the public from the real issues. Privacy intrusions and crime in cyberspace were old news, and a series of Internet break-ins after Mitnick's arrest proved the capture of cyberspace's most wanted criminal had changed little. The real story was that Internet providers, the new equivalent of phone companies on the information superhighway, appeared naive about how to investigate break-ins while protecting the privacy of their subscribers. After an FBI computer child-pornography investigation was made public in September of 1995, the Bureau revealed that it had read thousands of e-mail correspondences, and invaded the privacy of potentially dozens of citizens in the course of its investigation. Privacy activists complained that constitutional rights were being bulldozed, but the FBI announced the public should expect more of the same. "From our standpoint, this investigation embodies a vision of the type of investigatory activity we may be drawn to in the future," said Timothy McNally, the special agent in charge. The government seemed to be promoting a hacker dragnet to make sure the Internet was crime free for the millions of dollars of commerce on its way. Kent Walker, the Assistant U.S. Attorney who left the Justice Department within weeks of Mitnick's arrest for a job with a Pacific Telesis spin- off, was one of the many government officials who claimed the FBI couldn't crack high-tech cases without people like Shimomura. Perhaps prosecutions would increase if the FBI bolstered its force with nonprofessionals. But where would that leave the law and the Constitution? (pp. 368-73)

1 0

Fwd: Undeliverable: Re: Massey, CEO of Compuserve, on Internet
by Steve14571＠aol.com 17 Dec '03

17 Dec '03

Something else I want to know... Why is my mail going through microsoft.com? --------------------- Forwarded message: From: postmaster(a)microsoft.com (Postmaster) To: Steve14571(a)aol.com (Steve14571(a)aol.com) Date: 96-01-05 19:32:00 EST Your message did not reach some or all of the intended recipients. To: goerzenj(a)complete.org Cc: cypherpunks(a)toad.com Subject: Re: Massey, CEO of Compuserve, on Internet Sent: 01/04/96 18:43:35 The following recipient(s) could not be reached: David Tagliani on 01/04/96 18:43:35 The recipient name is not recognized [MSEXCH:MSExchangeMTA:northamerica:RED-70-MSG] Eric S. Hanson (NT RPC) on 01/04/96 18:43:35 The recipient name is not recognized [MSEXCH:MSExchangeMTA:northamerica:RED-70-MSG] Original Message Follows ======================== From: "Steve14571(a)aol.com" <Steve14571(a)aol.com> To: "goerzenj(a)complete.org" <goerzenj(a)complete.org> Cc: "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> Subject: Re: Massey, CEO of Compuserve, on Internet Date: Thu, 4 Jan 1996 18:43:35 -0800 In a message dated 96-01-03 00:34:25 EST, you write: >CompuServe is not location-dependant. The network operates exactly the >same regardless of calling location (indeed, the system doesn't even know >where you're calling from I believe). It is a worldwide CompuServe >Network that people use to access it. This network just allows dialups >and then gets the users connected to the CompuServe computers. The main >computers handle all traffic. They don't are location-independant, >making it impossible to block access based on location. I see two possible ways to censor German users only (but I still believe censoring anyone is wrong). First, the "main computers" could be told where they are, and "censored" material could be filtered at that level before it is sent to individual users. Or CompuServe could release a software update for German users. The software would not recognize banned newsgroups. How difficult could that possibly be?

1 0

Re: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:10 AM 1/6/96, James Black wrote: >Hello, > >On Fri, 5 Jan 1996, Bruce Baugh wrote: > >> The problem is this: how can one spread the word that an old key is no >> longer to be used when one no longer has the pass phrase, and cannot >> therefore create a revocation certificate? > > If there is someone that you trust (or several people), just make a >revocation certificate and possibly cut it into pieces, and just let >those know when to send it out, so that you don't have to rely on a >faulty memory, and by having it in several hands they can't just send it >out, as they don't know the other people. Just a thought. If one can safely and securely store a revocation certificate for later use, why not just store the much shorter passphrase? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Internet & Porno on A&E tonite
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Just saw an add for a Investigative Reports show tonite on A&E dealing with the Internet and some of the current issues relating to porno and privacy. Jim Choate

1 0