December 2003 - cypherpunks-legacy

Re: [FYI] FBI Training Eastern European Police
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Dave Del Torto wrote: > FBI School Teaches New Tricks to Old Enemies ... > In matching navy blue polo shirts, the students sat transfixed as > they watched slides showing the destruction of the Oklahoma City and > World Trade Center bombings. > > "God forbid you should ever have anything like this happen over > here," American instructor Ed Burwitz told his Central European > class, outfitted with headphones for simultaneous translation of the > lecture. "It is a tough task for any > freedom-loving country to prevent terrorism," he added. ... > The United States fronted $2.5 million to renovate the campus, which > includes a brand-new gym, classrooms, dormitories and one of > Hungary's few indoor tennis courts. The Hungarian government > contributed $500,000 to renovate the facility, > but the U.S. will pay the $3.5 million yearly cost to operate the > center, which is modeled after the law enforcement training center in > Quantico, Va. > > Students from Hungary, Russia, Poland, the Czech Republic and other > Central and Eastern European nations attend ILEA's 8-week sessions, > the first of which began in April. > > The idea is to help the Eastern Europeans with their burgeoning > crimes problems, as well as to foster cooperation on international > crime problems. This sounds like a capital idea. I'm certain that the FBI and other law-enforcement officials might also learn by living in a city where the East truly meets the West. Budapest is a beautiful old city of bridges, not just literally but figuratively. It's where anyone in the world can find comfort. Americans, French, German, Syrian ... all can use it for transit. And the annual Grand Prix is one heck of a car race as well. An international grand-luxe congregation opportunity. Burwitz probably doesn't consider Budapest a hardship post. Especially if he found himself a shack up in the hills of Buda on Rose Hill. > "I'm amazed at the freedom of travel that is possible" after the > opening up of the Eastern nations, Burwitz said. But "that means > criminals can travel as well," he said, allowing them to traffic > drugs and contraband. "The more interaction we have with these > countries in law enforcement, the better it will be for emerging > democracies," Kaciban said. If Burwitz is concerned with emerging democracies, he might profit from reading some briefing papers, and leaving some of his pre-conceptions at the door. Especially, if he plans on getting full value from his visit. True bang for the buck, as it were. Hungary has always been open to "free travel". That's why they had a Hilton and an Inter-Continental in Budapest. In fact, the "collapse" of the Berlin Wall -- which was missed by most intelligence agencies -- was a direct result of free travel on the far side of the "Iron Curtain". There was always travel freedom within COMECON. There had to be. Truckers as an example traveled throughout the East. And there were always family vacations as well. What was missing was a way to have large population movements from East to West. Migration. Hungary solved that problem when it opened its border with its historic ally-cum-subjugator, Austria. Hungary's boldness allowed East Germans -- skilled East Germans -- to exit in large number to Austria during their ostensible "vacations" to Hungarian resorts. They transited Austria to West Germany where they had guaranteed citizenship, and were assured employment because of their skill-set. This massive population flow of skilled workers is what ultimately lead to East German collapse and the subsequent German re-unification. It was Hungarian and Austrian policy co-operation that allowed Germany to re-join its two halves. A co-operation that flowed from an extended period of Austrian investment in Hungarian enterprise. (I guess Germany owes Hungary one for that.) But the "unification" does lead to some interesting problems, as the non-migratory East German population -- the ones whose skills were not as marketable; or alternatively, those who had valuable skills but were philosophically aligned with the old regime -- are absorbed into the Western EU fabric. Assimilation can be a very difficult process when attempts are made to integrate into the German economy those who choose _not_ to migrate especially if they are either unfit for, or opposed to their Liberators. Eliminating communism did not eliminate the communists. If Burwitz gets briefed on some history, I'm sure that many things will fall into context for him, and there will be a greater understanding of the enemy that he's teaching people to fight. It's always good to understand the scope of a problem before you attack it. That can only help with gaol achievement. > Organized crime is doubly damaging to the emerging nations, because > it undermines their economies, Kaciban said. Investors are naturally > reluctant to dump money into a nation if they believe there is > rampant corruption. I don't think that "investors" are ever reticent about exploiting opportunities -- if they are in fact welcome to, and not locked out. Unfortunately many opportunities are only extended by invitation to a select group of friends and not to an open field. This is true in Europe as well as anywhere in the world. Politicians as an example get access to certain opportunities -- Hillary Clinton's futures investments, or the Canadian equivalent, Alberta Premier Ralph Klein's wife's investment in Multi-Corp, as an example. At it's extreme, Kaciban is correct, this can lead to rampant corruption, something which is best prevented. But that is not the situation we are faced with in the East. In the East, there is an understanding that business is about relationships and understandings. Working relationships. Anyone that a firm would expect to have a contract with, isn't probably someone you should be sharing a bed with -- as they say -- in the first place. > Some teachings do not translate for the European > students. For example, there is no Russian RICO - the Racketeer > Influenced and Corrupt Organizations Act that is one of the strongest > American legal tools against organized crime. Some teachings also probably don't translate well for the American instructors. Cultural differences and expectations, as an example, which are born out of history. While the idea of a Russian RICO is interesting, it's not overly realistic. RICO is meant for a region that has established rules of engagement -- the breach of which calls for quick "rubber-hose" justice to ensure the system continues to function. RICO is best reserved, in that sense for a litigious America, to make sure that everyone remembers where their allegiance should lie. It has very little applicability in a chaotic system. Not only is there nothing to "preserve" -- but it truly begs the question of who'd administer a Russian RICO? You can't expect someone who's earning the equivalent of $50/month not to supplement their official "pay". > Eastern European crime syndicates tend not to be based in crime > families, instructors said. And organized crime in Russia and Ukraine > is so much a part of the society, that it's hard to stop it, said Amy > O'Neil, a State Department official not involved in the ILEA. Yep. This is a very serious problem. Some circles have suggested that the Russian nationalist Zhirinovsky is involved in some fashion in these syndicates; they've drawn a parallel to Sinn Fein. Others think that there is a utilization of KGB remnants (including those former communists which have now been _absorbed_ into the "unified" Germany, and continue to hold positions of power there). They believe that these sympathizers wish to restore and rebuild Mother Russia and the old social state. Some believe that these elements -- those that have a political / nationalistic allegiance -- are very friendly with the Eastern European crime syndicates. A reciprocal arrangement, if you will. One thing is clear. Whether or not any of the foregoing hold, or whether or not this syndicate's motivations are capitalistic or nationalistic -- their tentacles extend worldwide. Not only through a Moscow - St.Petersberg - Frankfurt - Brussels backbone, but even into the heartland of the United States. Hard to believe?? The FBI (I think) has identified about 220 "Eurasian" (mostly Russian) gangs operating in 17 U.S. cities in 14 states. And I believe they've identified 5,700 crime gangs in the former Soviet Union (which is up _significantly_ from the 785 identified in 1991). The Russian Ministry of Internal Affairs has estimated that gangs in the former USSR employ about 100,000 _full-time_ members and an estimated 3,000,000 part-timers. These gangs' tentacles even by FBI estimates extend worldwide. The FBI (again) said that Russian gangs are entrenched in 29 foreign countries and maintain contacts with nearly 100,000 criminal enterprises worldwide ranging from illegal alien smuggling rings, and drug gangs, through the child prostitution trade in China and Southeast Asia. If these enterprises are even somewhat loosely organized -- as Sinn Fein was -- then they probably have access to good crypto. Very good crypto. There can be no question of that. The belief that this syndicate is composed solely of thugs is actually contra-indicated. The ISSA (Information Systems Security Association) has suggested that these transnational gangs employ out of work or underemployed Russian scientists, mathematicians and computer experts, who earn as _little_ as $50 to $100 a month in their legitimate jobs because of inflation of Russia's currency. The ISSA, has written that these specialist scientists penetrate the Internet's global web of more than 60,000 computer networks. Radicals even suggest that this group is unique in having access to their own constellations and communications systems -- but I personally think that could only be civilian speculation. This group is well organized, well financed and has a breadth and depth of manpower that has never before been confronted. The idea that those Russians who now winter at St. Tropez and who have joined Monte Carlo cafe society must simply be very effective "capitalists" doesn't float. They are true natural talents who understand the financial system and its networks -- personal networks, financial networks, and silicon networks. The former Russian bankers who managed the countries Gold & Oil Sales, the ones who achieved understandings with De Beer's, the ones who managed Soviet international FOREX operations, and the ones who visited with Armand Hammer, and learned from him personally, probably had some sophistication in these matters. They've "dirtied" their hands with matters of Western finance, before. If they or their lieutenants have donated their talents to these enterprises, then Burwitz truly has his work cut out for him in educating and training at the new FBI School. He's not just facing some Caspian caviar smugglers. He's up against some of the finest talent available. > Both students and teachers said there was a remarkable similarity, > however, in the use of evidence and investigatory tools among the > countries. Eastern Europeans are very familiar with the use of DNA > testing, for example, to identify suspects, although they don't > always have the money to do it, Burwitzsaid."There are different > orders of laws between the U.S. and here," said a Czech student who > would identify himself only as Milan. "But essentially, we have the > same methods of investigation." A far worse scenario can come forward than Milan's. Let's suppose that the other side not only has complete familiarity with your arsenal of investigatory and evidentiary tools, but also has a superior knowledge of your own systems and their vulnerabilities, -- a knowledge that is superior to that you yourself possess. Let's assume that while you were building your systems, hard and soft systems, the other side has been studying them -- looking for holes and vulnerabilities, and quietly documenting them. Taking an action, no different than your very own study of their systems, actually. Now lets suppose that you destroy the other side's system, and cause economic collapse, social chaos, and national humiliation, while preserving your own system. An attempt at supremacy through "other means". Have you not invited a retaliatory attack? Some might suggest that you have ... Not that Eastern syndicate elements might wish to see the disease which has effected post-Soviet Russia propagate. A share in the taste of it. They're too busy tasting what was promised to them by the Voice of America and living the life of a model capitalist -- one of the characters from Dynasty. Groups such as the Congress of Russian Communities, and the decorated Afghan war hero, Gen. Alexander Lebed -- who Yeltsin asked to resign as commander of the 14th Russian Army following Lebed's criticism of the Kremlin -- certainly would have nothing to gain by retaliating in kind to the disease introduced into the Motherland. Striking at the state's head, clearly didn't solve this problem. The essential "talent" has simply re-organized into a new structure, one which is not under any central command or control hierarchy or authority. Simple chaotic self-interests organizing and emerging. Certainly upcoming Presidential Elections in June and November won't play a part in this. "I treat the word democracy with respect," fourty-five year-old Lebed told the newspaper Segodya recently. "But I am sure democracy will not be established within my lifetime. Our country is such that democracy will have to be built by authoritarian methods." Luckily, for all of us, President Boris Yeltsin is firmly in control. He has little to fear. Some people might be looking for a parallel to MacArthur / Truman, in this instance. But I personally wouldn't hang my hat on that hope. Lebed certainly wouldn't subscribe to Douglas MacArthur's statement after he was relieved of command in the Far East, in 1951, when he said, "I find in existence a new and heretofore unknown and dangerous concept that the members of our armed forces owe primary allegiance or loyalty to those who temporarily exercise the authority of the Executive Branch of the Government rather than to the country and its constitution which they swore to defend. No proposition could be more dangerous." The April/May ISSA Password had this to say. "Unless something is done by law enforcement and private security agencies on a global scale to deter these Russian criminals, they will be looting banks, corporations, and government agencies of billions of dollars -- without using guns or the traditional methods. Their modus operandi will be to rely solely on computer keyboards and the Internet. In an article published in the February 6, 1995, issue of the "Washington Times," international security expert and former Times editor-in-chief Arnaud de Borchgrave said: (sic) "Cyberspace detectives" report that financial thefts by Russian organized crime hackers on the Internet last year exceeded an estimated $5 Billion in the United States alone. Furthermore, he reports that about $300 million in untraceable computer transfers have vanished during the past two months (Jan/Feb 95) from banks and securities firms based on the East and West coasts of the U.S. I think in February (1995), the CIA and the National Security Agency (NSA) warned in a joint security report that, "The security of information systems and networks is the major security challenge of this decade and possibly the next century." Burwitz faces a challenge. If you face talent, information, money, and organization, while you can't even get your ducks lined up, if you can't maintain team discipline, then you might pretty well surrender. You've already ceded much of the high ground, as Burwitz can probably attest. To prevent the accusation of being a "red-baiter" perhaps, I might say that Mao Tse Tung, himself once noted: "Some people are intelligent in knowing themselves but stupid in knowing their opponents, and others the other way round; neither kind can solve the problem of learning and applying the laws of war." And to close, a return to de Borchgrave, who according to ISSA Password, wrote: "And it's not juvenile hackers who are committing these crimes. "Those doing it for the sheer pleasure of causing chaos on the net -- usually very young super-hackers -- have rapidly become the minority," one cyber detective told de Borchgrave. "Transnational crime gangs operating on several continents at almost the speed of light are now the main problems." Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: Secret Clearance (was: re: NIST GAK export meeting, sv)
by Peter Trei 17 Dec '03

17 Dec '03

> Bill Stewart <stewarts(a)ix.netcom.com> said: > BS> Few, if any, other than companies already in the military business; > BS> secret clearances are _expensive_, usually take a long time to get, > BS> and the military only gives them to people who need them. > Strange, the military processed a SECRET clearance on me even > before I signed on the dotted line. Now a TS, that's expensive, but > they didn't have much on me other than my SSAN and, I think, my prints > to process the SECRET, so they couldn't have done much more than run be > through the FBI criminal database. > It varies. My SECRET took almost a year and a personal interview before it was granted. Living 13 years abroad in 5 countries, visiting the eastern bloc, and having relatives over there, made DISA a bit nervous. Clearances tend to be easiest for nth generation midwesterners who are just out of school, have never been anywhere, and have no known relatives abroad. I never went for a TS - I figured it would be too much trouble, and might have been turned down. speaking only for myself... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

secure listservs?
by craig＠passport.ca 17 Dec '03

17 Dec '03

Looking for some secure listserv software, preferably something that will automatically generate purpose-specific PGP keys for each user and one for the listserv. Each user encodes mail for the list with the list's public key, signing it with their own private key (either the purpose specific one, or their regular key). Each user receives mail from the listserv encoded with the corresponding public key. That way each user has a choice of using their published key (for convenience) or their purpose- specific key, possibly in conjunction with an anonymous remailer, to ensure the segmentation of these communications from others that they may engage in. Anyone seen/built anything like this ? -- Craig Hubley Business that runs on knowledge Craig Hubley & Associates needs software that runs on the net mailto:craig@hubley.com 416-778-6136 416-778-1965 FAX Seventy Eaton Avenue, Toronto, Ontario, Canada M4J 2Z5

1 0

Re: Solution for US/Foreign Software?
by jim bell 17 Dec '03

17 Dec '03

At 06:28 PM 12/6/95 -0600, you wrote: > >Bill Stewart writes: > > I had interpreted the suggestion differently - rather than a system with > > user-accessible crypto hooks, the manufacturer could ship a binary patch > > upgrade for US customers to install. The internal design would presumably > > have crypto hooks (i.e. subroutine calls); they can't ban that. > >No, they can't *ban* it, but there's no reason to suspect that they >won't revoke the export license after the scheme becomes clear. And >of course the patch itself would not be exportable. If there's a >"wink wink nudge nudge" implication that the patch would make its way >overseas, I don't understand why that's really any more likely than >the US-only version getting out. It isn't that it's "more" likely. It's probably JUST AS likely. But remember, the goal is to allow the US company to actually MAKE MONEY, not to bootleg its products. The system I've described would be intended to allow a manufacturer to continue to sell its exportable product legally.

1 0

Re: Netscape gives in to key escrow
by James A. Donald 17 Dec '03

17 Dec '03

At 02:14 AM 12/6/95 -0800, Jeff Weinstein wrote: > Our representative at the NIST meeting said [GAK is evil] there today. > It should be up on the web site in a few days when he gets > back from DC. Dang, I was just working on my "death to netscape" page before I started reading my mail. I had done the text, and was going to start stripping background out of the dirty pictures, so that my server would not drop to its knees. The text is visible when viewed in netscape, but the pictures are not. Should have done the fun part first. Let us know when the position is put on the web. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Persona PCMCIA URL?
by Dave Del Torto 17 Dec '03

17 Dec '03

Does anyone have a URL for data sheets on the Persona cards?

1 0

Plea for information
by REES＠rmcs.cranfield.ac.uk 17 Dec '03

17 Dec '03

I would be interested in learning more about the politics and mathematics of cryptography, but my site does not have access to a newsreader. As I am new to the Net, I am not aware of any acceptable way around this, which will allow me to read and contribute to the cypherpunk and related newsgroups - please can you help me out on this matter. Also, I would like to know how best to understand cryptography - I have a textbook on the basic mathematical concepts underlying the techniques but it is too advanced for my current knowledge in this field (A-level - ie. end of high school), please can you suggest a good starting place for me. Thanks in advance for your assistance, Daniel Rees

1 0

(Fwd) General release of Open Encryptor interface for PGP
by Siberia 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- Priority: normal Date: Fri, 8 Dec 1995 00:08:30 +1200 Reply-to: Pegasus Mail Announcments <PM-NEWS(a)UA1VM.UA.EDU> From: John Navas <JNavas(a)aimnet.com> Organization: The Navas Group, Dublin, CA, USA Subject: General release of Open Encryptor interface for PGP To: Multiple recipients of list PM-NEWS <PM-NEWS(a)UA1VM.UA.EDU> -----BEGIN PGP SIGNED MESSAGE----- Release 1.0 of my Open Encryptor interface for PGP has been posted on my anonymous FTP server <ftp://ftp.aimnet.com/users/jnavas/winpmail/> PGP information is available at http://www.mantis.co.uk/pgp/pgp.html The MIT distribution of PGP is at ftp://net-dist.mit.edu:/pub/PGP/ ViaCrypt (commercial version of PGP) is at http://www.viacrypt.com/ The International PGP Home Page is at http://www.ifi.uio.no/~staalesc/PGP/ Release notes for PGP Open Encryptor Interface version 1.0: 1. Only public key cryptography is supported in this release, NOT conventional cryptography. 2. Basic Key Management functions are implemented: a. To add a public key block contained in a message to your Key Ring, either Open or select the message before invoking Key Management. (If a public key block is placed in a digitally signed and/or encrypted message, it will not be recognized automatically by this interface.) You can also invoke Key Management and paste a public key block into the dialog from the Windows Clipboard (which does of course work with a signed and/or encrypted message). b. You can check to see if a given email address is on your Key Ring -- just paste the email address (without the name) into the dialog box control. No other Key Management functions are implemented at this time. 3. Both digital signing and signature verification are implemented: a. If a secret pass phrase is needed (and not provided in the PGPPASS environment variable), it MUST be provided each time in the WinPMail Password field. b. Please note that signature verification is a strictly *manual* process -- you must expliticly use the WinPMail menu. This is a characteristic of WinPMail, NOT this interface. 4. When encrypting: a. The recipient email address (e.g., jnavas(a)navasgrp.com) will normally select the appropriate public key automatically, but it may be overridden with an entry in the WinPMail Password field. b. Your recipient may need to add also-known-as entries to his/her public key to ensure that you match on various forms of email addresses (e.g., also known as jnavas(a)mailhost.aimnet.com) c. The WinPMail Password will NOT be used for encryption of a digitally signed message, since the Password is then reserved for the secret pass phrase (whether one is needed or not). 5. If encryption or signing fails (e.g., because the recipient is not on your key ring, or because your secret pass phrase was incorrect), an empty message will be sent. This is a characteristic of WinPMail, NOT this interface. 6. Copies to self of encrypted and/or signed messages are NOT encrypted and/or signed. This is a characteristic of WinPMail, NOT this interface. (If you want an encrypted and/or signed copy, BCC yourself.) 7. It is normally NOT possible for you to decrypt message that you have encrypted for someone else (since you do not have that person's secret key). However, you can establish a master decryption key by setting the PGPJNKEY environment variable to a string needed to select the appropriate public key (yours or not). TEST FOR PROPER OPERATION (BY DECRYPTING A MESSAGE ENCRYPTED FOR SOMEONE ELSE) BEFORE YOU DEPEND ON IT! It may be a good idea to add an also-known-as alias just for this purpose. 8. The Cancel button does not work on the Decryption dialog box. This is a characteristic of WinPMail, NOT this interface. 9. When you do a Find on a folder, WinPMail puts up the Decryption key dialog for every encrypted message, even when you are only searching headers, which can make the process painful. This is a characteristic of WinPMail, NOT this interface. 10. Attachments to encrypted messages are NOT supported. (Outgoing attachments to encrypted messages are NOT encrypted, and incoming binary attachments are corrupted.) This is a characteristic of WinPMail, NOT this interface. 11. Windows 3.10, Windows for Workgroups 3.11, and Windows 95 are supported. Windows NT and OS/2 have NOT been tested and are NOT currently supported. USE THEM AT YOUR OWN RISK. 12. MIT PGP 2.6.2 is supported in this release. Other versions of PGP have NOT been tested and are NOT currently supported. ViaCrypt PGP has NOT been tested for this release, but is expected to be supported in a subsequent release. USE THEM AT YOUR OWN RISK. 13. Reassembly and decryption of multiple-part PGP messages is NOT supported. 14. PGP messages sent by other WinPMail Open Encryptor PGP interfaces may not trigger this interface. (Other PGP sources should not be a problem.) This is a characteristic of WinPMail, NOT this interface. To install the PGP Open Encryptor Interface: 1. UnZIP in a subdirectory of FORMS called PGPJN (e.g., \PMAIL\FORMS\PGPJN). 2. Copy the PGPJNP.FFF file up to your WinPMail directory (e.g., \PMAIL). 3. Make sure that PGP is installed correctly, and that the PGPPATH environment variable is set correctly. (If PGPPATH is set, PGP does not need to be in your PATH.) 4. Encrypt and send a message to yourself to test operation. John Navas <JNavas(a)NavasGrp.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMbC7O5ya4p8vxAtAQHO7wH/atOJoEbrUX2G/Zzr3jZCvblQZXBWzlv6 KTNraPxaui8jtw83U+pZYWV/jNVJ48Fw4Fy6XeQrtdzXJsi0tKJZtg== =jZvU -----END PGP SIGNATURE-----

1 0

(Fwd) General release of Open Encryptor interface for PGP
by Jeff Hupp 17 Dec '03

17 Dec '03

I believe this may be of intrest to those on this list. Pegasus is available at <ftp://risc.ua.edu/pub/network/pegasus/winpm223.zip> Enjoy. ------- Forwarded Message Follows ------- Priority: normal Date: Fri, 8 Dec 1995 00:08:30 +1200 Reply-to: Pegasus Mail Announcments <PM-NEWS(a)UA1VM.UA.EDU> From: John Navas <JNavas(a)aimnet.com> Organization: The Navas Group, Dublin, CA, USA Subject: General release of Open Encryptor interface for PGP To: Multiple recipients of list PM-NEWS <PM-NEWS(a)UA1VM.UA.EDU> -----BEGIN PGP SIGNED MESSAGE----- Release 1.0 of my Open Encryptor interface for PGP has been posted on my anonymous FTP server <ftp://ftp.aimnet.com/users/jnavas/winpmail/> PGP information is available at http://www.mantis.co.uk/pgp/pgp.html The MIT distribution of PGP is at ftp://net-dist.mit.edu:/pub/PGP/ ViaCrypt (commercial version of PGP) is at http://www.viacrypt.com/ The International PGP Home Page is at http://www.ifi.uio.no/~staalesc/PGP/ Release notes for PGP Open Encryptor Interface version 1.0: 1. Only public key cryptography is supported in this release, NOT conventional cryptography. 2. Basic Key Management functions are implemented: a. To add a public key block contained in a message to your Key Ring, either Open or select the message before invoking Key Management. (If a public key block is placed in a digitally signed and/or encrypted message, it will not be recognized automatically by this interface.) You can also invoke Key Management and paste a public key block into the dialog from the Windows Clipboard (which does of course work with a signed and/or encrypted message). b. You can check to see if a given email address is on your Key Ring -- just paste the email address (without the name) into the dialog box control. No other Key Management functions are implemented at this time. 3. Both digital signing and signature verification are implemented: a. If a secret pass phrase is needed (and not provided in the PGPPASS environment variable), it MUST be provided each time in the WinPMail Password field. b. Please note that signature verification is a strictly *manual* process -- you must expliticly use the WinPMail menu. This is a characteristic of WinPMail, NOT this interface. 4. When encrypting: a. The recipient email address (e.g., jnavas(a)navasgrp.com) will normally select the appropriate public key automatically, but it may be overridden with an entry in the WinPMail Password field. b. Your recipient may need to add also-known-as entries to his/her public key to ensure that you match on various forms of email addresses (e.g., also known as jnavas(a)mailhost.aimnet.com) c. The WinPMail Password will NOT be used for encryption of a digitally signed message, since the Password is then reserved for the secret pass phrase (whether one is needed or not). 5. If encryption or signing fails (e.g., because the recipient is not on your key ring, or because your secret pass phrase was incorrect), an empty message will be sent. This is a characteristic of WinPMail, NOT this interface. 6. Copies to self of encrypted and/or signed messages are NOT encrypted and/or signed. This is a characteristic of WinPMail, NOT this interface. (If you want an encrypted and/or signed copy, BCC yourself.) 7. It is normally NOT possible for you to decrypt message that you have encrypted for someone else (since you do not have that person's secret key). However, you can establish a master decryption key by setting the PGPJNKEY environment variable to a string needed to select the appropriate public key (yours or not). TEST FOR PROPER OPERATION (BY DECRYPTING A MESSAGE ENCRYPTED FOR SOMEONE ELSE) BEFORE YOU DEPEND ON IT! It may be a good idea to add an also-known-as alias just for this purpose. 8. The Cancel button does not work on the Decryption dialog box. This is a characteristic of WinPMail, NOT this interface. 9. When you do a Find on a folder, WinPMail puts up the Decryption key dialog for every encrypted message, even when you are only searching headers, which can make the process painful. This is a characteristic of WinPMail, NOT this interface. 10. Attachments to encrypted messages are NOT supported. (Outgoing attachments to encrypted messages are NOT encrypted, and incoming binary attachments are corrupted.) This is a characteristic of WinPMail, NOT this interface. 11. Windows 3.10, Windows for Workgroups 3.11, and Windows 95 are supported. Windows NT and OS/2 have NOT been tested and are NOT currently supported. USE THEM AT YOUR OWN RISK. 12. MIT PGP 2.6.2 is supported in this release. Other versions of PGP have NOT been tested and are NOT currently supported. ViaCrypt PGP has NOT been tested for this release, but is expected to be supported in a subsequent release. USE THEM AT YOUR OWN RISK. 13. Reassembly and decryption of multiple-part PGP messages is NOT supported. 14. PGP messages sent by other WinPMail Open Encryptor PGP interfaces may not trigger this interface. (Other PGP sources should not be a problem.) This is a characteristic of WinPMail, NOT this interface. To install the PGP Open Encryptor Interface: 1. UnZIP in a subdirectory of FORMS called PGPJN (e.g., \PMAIL\FORMS\PGPJN). 2. Copy the PGPJNP.FFF file up to your WinPMail directory (e.g., \PMAIL). 3. Make sure that PGP is installed correctly, and that the PGPPATH environment variable is set correctly. (If PGPPATH is set, PGP does not need to be in your PATH.) 4. Encrypt and send a message to yourself to test operation. John Navas <JNavas(a)NavasGrp.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMbC7O5ya4p8vxAtAQHO7wH/atOJoEbrUX2G/Zzr3jZCvblQZXBWzlv6 KTNraPxaui8jtw83U+pZYWV/jNVJ48Fw4Fy6XeQrtdzXJsi0tKJZtg== =jZvU -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Expertise in one field does not carry over into other fields. But experts often think so. The narrower their field of knowledge the more likely they are to think so.

1 0

Re: GAK
by Daniel Miskell 17 Dec '03

17 Dec '03

Scott Binkley writes: >I heard a while back about being able to "split" up a PGP key. What >about >splitting up the key into many parts, and giving them out to multiple >INDEPENDANT >agencies. ie: One piece goes to the FBI, one to the NSA, one to some >other committee, and >so on. That way, no goverment body could just tap your conversations >without getting >approval from others, and gaining the pieces of your key. > >just a thought Why give them your key in the first place? Personally, I wouldnt trust any government agency with even a fraction of my key - what makes you think they arent *allready* working together? Then you have effectively given your key, and all of your private mail, to the government, no restrictions. --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

Re: Responding to Exon -- technology is not enough
by Daniel Miskell 17 Dec '03

17 Dec '03

Bill Humphries writes: >Instead of figuring out how to build a new treehouse that excludes Exon and >Hyde, how about fighting the damned bill in the courts? Possibly because a) it is allready being faught, and b) court battles cost money which most folks dont have. If people are unfamilliar with encryptation, they should do a web search and find out what they can, then use it. What you are saying (as far as encryptation not being an answer because so few know how to use it) feels like "lets not use a gun to defend our home from intrusion because so few know how to handle them. You dont just assume that bewcause you dont know how that you give up. You learn how. That is how i found this list - because i did a little running around. Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

Prayers Pay
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The raiders hit early this morning, banging the door about 4 AM, me groggily peeking out, a subpoena wadded into my shirt, then the bastards barged in. My ex-wife holding back, grinning like shit, saying you're fucked this time Johnny wee-dick. The black suits took all of it, computers, backup disks and tapes, printers, scanners, plotters, fuck, even the phones and message box -- jeez, why those? Harassment, teaching you a lesson, Bess my shark phoned just now, they shut your business down, take weeks to rummage the equipment and data, give it back slowly, one at a time, no hurry, wanting you to ache in case they find nothing. Swift justice, she hisses, even if you're innocent, cause nobody really is, they want you to scream, use you to broadcast a scare. Fuckups are getting gutted all over that Net Playboytoy. Six others this week, Bess coughs on, dragging deep, it's gonna rain even heavier in Exon's maelstrom, sweet darling maryjesus, prayers pay.

1 0

Plea for information
by John Young 17 Dec '03

17 Dec '03

Daniel, During a year in this penitentiary, here's five I heard the older cons mutter: 1. "Applied Cryptography," Second edition just out, Bruce Schneier, Wiley, 1996. Flip through it and stare in disbelief and awe. Enjoy 2-5 and return, anxious. 2. "The Codebreakers," David Kahn, Macmillan, 1967. Crypto- biblical tales of lying and cheating via momentarily secret tricks. Continued in 3. 3. "Cyphernomicon," Tim May et al, 1006-Far Future. A wad of inspiring sci-non-fi of miscreating, eluding hard-bars and regaling in off-shore soft-bars. Also, C4. 4. "Cypherpunks archives," All Wholesomes, <www.hks.net>, Infinite. The stingers honey pot for luring beekeepers into berzerk swarms. Wear 5 for protection. 5. "PGP." Download it somewhere somewhat legally while you can, practice picking this sitar. And heave some brick- bucks at benefactor Phil for malefactor dues.

1 0

Re: 1)Age etc CA 2)Swedish Digicash
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:56 PM 12/7/95 +0100, Mats Bergstrom wrote: >Posten has licensed Digicash and plans to >open a mint/bank (Posten already is closely connected to a bank) >dealing in Swedish crowns. (This is not news but things seem to >be moving right now.) Some (but slight) mention of laundering, >of course. It's supposed to come about in 'the beginning of next >year'. I wonder how exchanges crowns/dollars will be managed. Is there an existing Post Office Bank in Sweden? If so, can foreigners open accounts? The UK's postal bank (Girobank) has become more like a normal bank and I think foreigners can open accounts. (The US Postal Savings System was closed in 1956 or so.) I'd rather have a Swedish Digicash account than one in the US. DCF "A bank is just a money switch. Soon we'll all have money switches."

2 1

Re: latest librand source now av
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

an116512(a)anon.penet.fi writes > ... [various profanities omitted] ... The bad is getting worse. I don't know how these services work. Can I killfile the account, or do I need to ax the host? Many thanks. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

1 0

NIST GAK, Escrow Agent Criteria available
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

At the meeting, the NIST/NSA folks presented their criteria for being an acceptable escrow agent criteria. They had hardcopy, and Geoff had slides. The slides didn't exactly match the hardcopy. I have typed in the text from my hardcopy. It is on my clipper2 page (which is under construction at <a href="http:/www.isse.gmu.edu/~pfarrell/nist/clipper2.html">) url for the criteria for escrow agent entities is <a href="http:/www.isse.gmu.edu/~pfarrell/nist/escagent.html"> I will _not_ post it (about 4 pages) to the list. If you can't use the web, email me and I'll forward a copy. I've got some notes on Geoff's presentation that I'll post later on. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Re: 1)Age etc CA 2)Swedish Digicash
by James A. Donald 17 Dec '03

17 Dec '03

At 10:06 AM 12/7/95 -0500, Duncan Frissell wrote: > Is there an existing Post Office Bank in Sweden? If so, can foreigners open > accounts? While any foreign account is of course better than any home country account, Sweden is not really a place that I would like to keep my money. High taxes, rigid controls, intrusive and unpredictable government, and, most importantly, the country has repeatedly teetered on the edge of bankruptcy. I would wait for some more solvent foreign country to get into digicash. More to the point -- few people will accept or spend digicash unless those unreasonable charges come right down. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2

Re: Still more on the Digicash protocol
by Mark Twain Ecash Support 17 Dec '03

17 Dec '03

At 06:01 PM 12/6/95 -0500, you wrote: >Hal has pointed out that payments & deposits with a wildcard in the >payment_hdr should NOT be sent in the clear, since they can be stolen >by any passive eavesdropper. Let us contemplate in which type of situation the payee will send such a wildcard coin. To pay a shop via TCP? No. The payment request comes in with the shop ID. The resulting payment won't be done with a wildcard coin. So when will the user pay with a wildcard coin? To make a payment to a party that is (pseudo-) anonymous to the payor. That is, if the payor sends the payment via anonymous remailer, in which case the messages should be encrypted anyway. [Why a remailed message should be encrypted is left as an exercise to the reader.] >Ian has pointed out the same problem with cancellations: the payer_code >should NOT be sent in the clear, since any passive eavesdropper can >grab this info and steal the corresponding payment. As mentioned before, this will be fixed. >Anyhow, the obvious solution is encryption. Our new observation is >that encrypting deposits & cancellations with the mint's public key >is not enough to solve the problem. [Argument in support of claim elided... I am not conviced.] >While I'm ranting, let me also remind you of a problem Ian discovered >earlier through reverse-engineering: the payment & deposit messages aren't >encrypted, [...] >With traffic analysis, if payers use the default TCP connection, all >this information about them can be compiled. If I target a payer, I'll >probably be able to record all his transactions (unless he's using >remailers or pipenet). If I sit outside a small business, I can compile >a dossier on its buying habits. One more time: this is only an issue if the payor is using a secure http connection. Otherwise, you can gather all that information with out without Ecash. The next release will use an already established SSL connection to transmit this information, should the payor request it. >Worse still, anonymity for the shop is worse with Digicash than with real >cash. If I pay you real cash on a secluded street, you're fairly anonymous. >If I pay you Digicash over the Internet, any passive eavesdropper could be >recording your identy and the whole transaction. Blech. This is raising an issue that has nothing to do with Ecash. The complaint is in fact about the lack of a gereral link encryption on the Internet. I agree that this is needed, but providing it really isn't Ecash's job. I am eagerly anticipating the general use of IPSEC. > (Yes, this means shops will need to have certificates if you want > to avoid a man-in-the-middle attack. So be it. Most online shops > will be using SSL, and thus have a certificate anyhow. You can safely > punt on the authentication between customer <-> shop if you're not > worried about active attacks.) That's why the next version will use existing SSL, should the user so desire. >* add a big warning to the documentation: users should not use wildcards > in payments (unless they know the dangers & are encrypting with e.g. PGP). Will do. >* continue specifying the protocol at a deeper level, like you promised > (and throw in source for security-critical modules too, eh? :-) Writing all this down takes time. DigiCash may hire a tech writer soon. That should improve communications between all parties. --Lucky Green --Mark Twain Bank Ecash Support Ecash. The secure Internet payment system that protects your privacy. <http://www.marktwain.com/ecash.html>

2 1

More FUD from First Virtual
by cman＠communities.com 17 Dec '03

17 Dec '03

It is important to remember that Nat Borenstein is a principal in a company that very much does not want to see anonymous e-cash succeed. Their extremely backwards technology cannot compete in the long term with cryptography-based methods, and therefore they are compelled to run around the country and on the Internet, bad- mouthing cryptography and anonymity at every turn, while pointing to some charity work for Phil Z. as a fig leaf to cover their actions in this regard (sort of like Exxon building an artificial reef and claiming to be friends of the environment.) I have, on several occasions, refuted his "infinite liability" rant, but it keeps on resurfacing. A few months ago, I wrote a short tech note on why this claim doesn't hold water. I thought I might stretch it into something longer, but other things have more urgently grabbed my attention. It's available at: http://www.communities.com/foo/noninf.txt Also, I haven't had time to confirm it, but based on conversations with and hints from Digicash people online, I'm pretty sure they are doing something similar to this (possibly better) that they are hoping to patent. --doug

2 1

RSA '96 Conference
by Kevin L Prigge 17 Dec '03

17 Dec '03

This might be a little early, but will there be a cypherpunks get together at RSA '96? Perhaps a Coed Naked Cypherpunks Key Signing or something? -- Kevin L. Prigge |"A computer lets you make more mistakes faster UofM Central Computing | than any invention in human history--with the email: klp(a)umn.edu | possible exceptions of handguns and tequila." 01001001110101100110001| - Mitch Ratcliffe

1 0

re: Re: Secret Clearance (was: re: NIST GAK export meeting, sv)
by Christopher Kleiman 17 Dec '03

17 Dec '03

Bill Stewart <stewarts(a)ix.netcom.com> said: >>BS> secret clearances are _expensive_, usually take a long time to get, >>BS> and the military only gives them to people who need them. > Strange, the military processed a SECRET clearance on me even >before I signed on the dotted line. Now a TS, that's expensive, but >they didn't have much on me other than my SSAN and, I think, my prints >to process the SECRET, so they couldn't have done much more than run be >through the FBI criminal database. >#include <disclaimer.h> /* Sten Drescher Actually, you filled out some paperwork when you signed up that was sent forward; it wasn't much more than a check against all of the govts "evil type people" databases. However, I understand that it depends on what Level of background check as well. A limited background investigation involves filling out a long form saying that you've been a good boy/girl; it goes up from there. "Civilians" are different from military as well; after all, in one they own you, in the other, you can actually go home at night.;-) ** Nothing I say can be held as the viewpoint of my employer; I'm a short-timer any, so I really don't care what they think! Chris **

1 0

Re: Still more on the Digicash protocol
by Hal 17 Dec '03

17 Dec '03

From: Mark Twain Ecash Support <support(a)marktwain.com> > Let us contemplate in which type of situation the payee will send such a > wildcard coin. To pay a shop via TCP? No. The payment request comes in with > the shop ID. The resulting payment won't be done with a wildcard coin. > > So when will the user pay with a wildcard coin? To make a payment to a party > that is (pseudo-) anonymous to the payor. That is, if the payor sends the > payment via anonymous remailer, in which case the messages should be > encrypted anyway. There might be some situations where it is useful to send a wildcard coin even via a TCP connection. For example, a pseudonymous server might pop up at some internet address different from its real one, make some transactions, and then go away. Or someone might set up an anonymous account at some public server (like c2.org) and conduct business anonymously on an ongoing basis. In either case the payee would be anonymous to the payor even though they communicated via TCP. The shop would have to send its payment request using "@" as the shop_accID field (I have heard of an undocumented "-X <payee>" switch in the Unix ecash program which allows the shop software to control this field in the payment request). We have also discussed the "pipe-net" which would allow anonymous TCP connections. This does not look like it can be as secure as the remailer net but for occasional or short-term use it can provide considerable privacy protection. I am glad that DigiCash supports this type of cash which anyone can deposit. Actually, I am surprised and puzzled that it does, given Chaum's apparent reluctance to endorse schemes to allow payee anonymity (due to political problems, apparently). It would be interesting to hear how DigiCash envisions this feature being used, and whether they plan to continue to allow it. Since it is not well documented (if at all) it's possible that they don't plan to keep it. But if they do, I think it would be good to adapt the protocols so this feature is usable over TCP connections. Hal

1 0

Re: Responding to Exon -- technology is not enough
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"Bill.Humphries(a)msn.fullfeed.com" 6-DEC-1995 20:16:17.29 >Anyone wish to comment on the prospect of a double blind server, set >outside U.S. borders, that can act as an interface to the rest of the >world, perhaps encrypting or stego'ing the data transfered between it and >the user? Basically, an anonymous remailer that acts as a cross between >an NNTP, POP3, and SMTP servers. ------------------------------ Encrypting data between the server and the user would probably not work very well, due to the lack of cryptographic knowledge among most users (_I_ don't know how to set up PGP for a VAX (even if I had the room to store it in my quota), and I have some interests in this stuff). However, something where someone did a standard http link in, typed in a destination, and got put there in a way that would look like the person was coming in from the server should work. For best bookmarking results, the added link should probably be inside the link that it looked to the user like they were on. For instance, http://www.anonserve.net/http/www.hotsex.com/ should bookmark properly, and be interpretable by the server as being a command to do a http link to that that web location. I am admittedly not that familiar with the root mechanism of the WWW, but I believe this would work. -Allen

1 0

Re: Still more on the Digicash protocol
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 7 Dec 1995, Mark Twain Ecash Support wrote: > >Anyhow, the obvious solution is encryption. Our new observation is > >that encrypting deposits & cancellations with the mint's public key > >is not enough to solve the problem. > [Argument in support of claim elided... I am not conviced.] I think he means you shouldn't use a stream cipher like RC4 that XORs the plaintext with the generated keystream, since if you know part of the plaintext, you can XOR those bytes with (the id you want) XOR (the id being sent) and change the encrypted data so that the payment goes into your account and not theirs. This is a tough, but potentially feasible attack if you use that kind of encryption scheme. Is there anywhere that you could use a similar attack on SSL ? Mark

1 0

Re: FW: websurfer 4.6
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On 7 Dec 95 at 18:06, Enzo Michelangeli wrote: > On Sat, 2 Dec 1995, Michael Froomkin wrote: > > > so much for compatibility....guess I'm sticking with netscape > > for now. > > These guys at Netmanage's support seem to confuse Trumpet's > version number with the Winsock version... Trumpet 2.0b (as, > AFAIK, any other Winsock package presently available) is > Winsock 1.1 compliant. Not surprising. They confuse random doodling with software, too. The real problem with NetManage is a severe case of brain death. The Sampler TCP/IP sucks, the paid-up TCP/IP is so-so, but of the clients, only ftp is fair, and the rest bite. All the NetManage clients I've tried crater, Mail can't rebuild its index structures if they are corrupted (uh, what was it that rebuild was supposed to do, Harvey?), the version of WebSurfer I evaluated took longer and longer to load and shut down, revealed on inspection to be due to loading/storing a very wordy global history in its, ahem, config file! Delete it and your config is gone. I wouldn't concern myself with what crypto is or isn't in a NetManage product -- they are not players as far as I'm concerned. They've been riding the wave of their TCP/IP not crashing as often as some others, but otherwise they're vacuum packed, untouched by coherent human thought.

1 0