December 2003 - cypherpunks-legacy

pgp on linux
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

i can't seem to get pgp compiled on my linux machine. where should i ask about this?- since cypherpunks would be a bad choice. thanks.

4 3

Re: Escrowing Viewing and Reading Habits with the Governmen
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Sun, 28 Jan 96 21:05:08 > From: <alanh(a)infi.net> > Subject: Re: Escrowing Viewing and Reading Habits with the Government > To: "roy m. silvernail" <roy(a)sendai.cybrspc.mn.org> > Cc: "timothy c. may" <tcmay(a)got.net>, cypherpunks(a)toad.com > > > The "Library Awareness Program," administered by the Justice Department, is > > > designed to identify potential criminals before they have a chance to > > > commit their deeds. The visits to libraries made by the FBI are used to > > > determine who is reading subversive or dangerous material. > Do you really think the FBI believes that asking librarians to keep > records of customer useage is an efficient way to read the customers minds? > Do you really think that the FBI foreign counter-intelligence squad has > nothing better to do than keep a database of who is reading Che Guevara > memoirs? Yes. Heck, I remember this was a big issue about 15 years ago. Try asking someone who was active in library science in the late 70's, early 80's. The general reaction of the library community was, I am glad to say, entirely pro-privacy. Peter Trei trei(a)process.com

2 1

Here's how you put your key on the keyservers...
by Ted Garrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I got a message in response to a request I made to someone for their public key. I wanted to check the signatures that they included with their posts to cypherpunks, but their key was not on the keyservers. The key they included was completely unsigned, and when I use it to validate their previous posts as well as the message they sent which included the key, the signatures come back as bad, the contents of the file changed. Names are appropriately withheld (I hope). As I understand the bcc: definition, only I and the first smtp server this message hits should know who it's to. I don't know if anyone else reading this mailing list needs this info, but just in case... here's my reply to the message. At 10:03 PM 1/28/96 -0800, you wrote: >Sorry, I'm a newbie to Internet, and also the Internet usage of PGP. I just >participated in a local keysigning meeting, so maybe my key will find its >way to a server. Don't worry about being a 'newbie'. Everyone starts somewhere. However, your key will usually not 'find its way' to a server without you specifically sending it. The keyserver I usually use is accessed by sending a mail message which fits the following format. As far as I know, all the keyservers use this format to add or update keys in their databases. You only have to send it to one keyserver, and it will propagate to all the others. I have indented the text so that no handlers decide to interpret it as a new message. - - To: pgp-public-keys(a)pgp.iastate.edu - - Subject: ADD - - - - -----BEGIN PGP PUBLIC KEY BLOCK----- - - Version: 2.6.2 - - - - [key deleted to protect the innocent] - - - - -----END PGP PUBLIC KEY BLOCK----- >I'm sorry to have to admit that I don't even know how to do this! Newbie >alert! If you don't admit you don't know something, nobody will usually tell you how to do it. Also, you should sign your own key. That will make it harder to forge, I think. The reasons were spelled out in a couple of the web pages I read, but I've forgotten them. It has something to do with either a denial of service attack or a man in the middle attack, or both. The command to do this is: pgp -ks 0xHEXKEYID Honestly, I've only just begun to use pgp myself. Also, you should add your e-mail address to the user-id of your key. The command to do so is: pgp -ke 0xHEXKEYID You will be asked if you wish to add a user id to the key. Say yes, and give it your e-mail address. What this does is it allows people who are using pgp-enabled mailers to directly encrypt messages to you without choosing your key manually. The reason that I have not encrypted this message to you using the key you provided is that when I extracted the key and re-checked your message, the signature was no good. I've found that (using eudora) I must turn off the word wrap feature of my mailer to allow for good signed messages out. Of course, having said this, I'll probably not get a good signature on this message. Let me know if it signs ok. Now, I have a question. Which attack(s) is/are a person vulnerable to when distributing an unsigned public key in the open? Could this actually be a complex man-in-the-middle attack? Am I paranoid? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQy/ds1+l8EKBK5FAQER8Af/SE1lTj3zcpm3ildFGO75zjZiJByZQi+3 LAkYgcHyBmtvhCTvyYCP2aMF4RjayrR3OHB85XthIA4sPmU0NDCVZYv7riSPjslp iBxUk92dO+BkP8nrTFgqCzR4qPqbOSmZxeovZI0PfQvbm99fG6Fc2kjhdKP7Aq+G cw4r0vvJY8JbqAuXftgZgndL9iGR/+xjfrpl+EWL3xtWzpIRfwMS5KMsR1UOf1ZA g9mlMEGLXy5KC/BwaupgTTwlSA/NOTv5mAY8+UWt9ydMWXBqNVt/yiGFsjg5UR1M CaT2D23pLAnWZ8M7yrjMamadkn2iLBqq4nhBNOGYHfZrGcbm/mhmxQ== =jGo3 -----END PGP SIGNATURE-----

1 0

Re: The Unintended Consequences of Suppression
by Bruce Baugh 17 Dec '03

17 Dec '03

At 08:52 PM 1/28/96 -0600, Alex Strasheim <cp(a)proust.suba.com> wrote: >> You just don't get it, do you? Do-gooders like the Wiesenthalistas >> don't need to be *right*; they need *a steady stream of cash contributions* > >It's usually more effective to point out why what someone is saying is >wrong rather than to speculate as to what their motives for saying it >might be. Particularly in cases where, rightly or wrongly, the folks being subjected to ad hominem have a very favorable public image. Explanations that give credit for good intentions and show how the present action works to undermine them, and which include constructive alternatives, are a _lot_ more likely to be listened to. At least that's the way it works for me. And it works for pretty much everyone I know. If there's anyone here who's more impressed by ad hominem, I'd be curious, but they'd still be in the minority. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: An Enigma - Wrapped In a Circle
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Perry E. Metzger" foamed: <snip> I wrote: >> 1. Flame me, in *private* e-mail. [I'll happily ignore you.] >> 2. Go hump a tree. > >What the hell is the cypherpunks relevance here, anyway? I mean, other >than trying to elicit a response from me, which you surely knew would >show up, was there any purpose to this? Why are crop circles important >to people worrying about cryptography and cryptography policy? What >possible linkage could there be? Why Perry! I see your point! Any phenomenon that elicits articles with titles like "Ciphers in the Crops" could have nothing at all to do with cryptography... I repeat: Go hump a tree. In complaining about supposed "noise," you cause more noise than any other person on this list. Learn to read before you spew, or just learn to shut up! JMR Regards, Jim Ray -- Boycott espionage-enabled software! "He that would make his own liberty secure, must guard even his enemy from oppression; for if he violates this duty, he establishes a precedent that will reach to himself." - T. Paine http://www.shopmiami.com/prs/jimray _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMQxOvW1lp8bpvW01AQFvBgP/YQM2CA/f+wq9jCCc/s6BeXm+Lqr6ihCS BhPeB3556EET0mj91XhR1bl5FPb9aUb2f3CeNMBmacr4L/EjAK5S4Fst0WZ10UA8 m7a07IdFdb8wN+TKpAUR4TMmApV1nHnq3fStrSnn1el32rbnMvMmHBDzfXF6wVfk VKvffK+S+WA= =b8Pt -----END PGP SIGNATURE-----

2 1

Re: more RANTING about NSA-friendly cpunks
by Ted Garrett 17 Dec '03

17 Dec '03

At 01:10 PM 1/28/96 +0800, you wrote: >In message <199601262011.MAA17408(a)netcom16.netcom.com>, > "Vladimir Z. Nuri" wrote: >> has anyone *tried* just ignoring the ITAR wrt crypto and seeing what >> would happen? [snip] >> but aren't we equally as comic in assuming that violating the ITAR >> crypto sections will inevitably bring the 4 horsemen of the NSA?? > >One word... >Zimmerman. >I do agree with what you're saying though. But what he's saying is basically this: If instead of targeting a single entity - (eg Zimmerman) for a crypto violation, they had to look at thousands of separate entities per violation (eg cypherpunks, inner circle, users on AOL who have a clue, mit professors, cryptographic experts, corner preachers, etc.), then soon the court system would be forced to come to the realization that, indeed, the genie IS out of the bottle, and the system as a whole would have to recognize that a change needs to be made. As it stands, they bullied on ONE man for something he didn't do, and could drop the case without there needing to be a precedent set. Because there is now no precedent, the NSA and FBI can still use the ITAR regulations to batter any indiviual who attempts to distribute strong cryptography tools to the general public. If they had been confronted with tens, hundreds, thousands, or tens of thousands of people tangibly involved in distributing cryptographic tools, then it would have been much harder for them to say "We are just going to drop this.". They would have had to either go the distance or dismiss it in the beginning. If PGP had been developed under the gnu charter or the Linux concept, what would the government have been able to do about it being distributed? NOT A DAMNED THING. Or at least that's my opinion.

1 0

New Software
by Rev. Ben 17 Dec '03

17 Dec '03

Release time. And I guess I finally get to add my name to the roles of Cpunks that 'write code'. I finished a release of a simple Zero Knowledge Authentication system that uses the GNU Multiprecision Library to implement a modified Fiat-Feige-Shamir ZKIPS. It is written in C on FreeBSD 2.1-R but should run on anything that uses BSD socket code. I tried to write it fairly portably. It is a very early release with little bounds checking or any of the hardening that would be required in a secure environment--hell in a secured environment, you'd want to write the bignum package yourself. But in any case, its just to get some practice writing this sort of code as well as amuse myself My latest project is to write a HTTP anonymizer--sort of like a bit launderer. The plan would be to allow a server to be browsed without actually giving away its real address by using a proxy. The client would have an encrypted URL that would be passed to the proxy. The proxy, using its own private key would decrypt the real URL and make the HTTP request to the server. This would opaque the server's identity from the client. While this sounds all well and good, unless there are multiple proxies deployed a-la Mixmaster with encapsulated encryption, there is the threat that the proxy would be able to match up server-client pairs. In any case, I'm open to suggestions on this project--its very open ended and should be done in a couple of months. If anyone would like a copy of the work done mail me and I'll send you a tarball. Ben. PS: Does anyone know of any French COMPUSEC firms that I could contact? I'd like to try to get a job there for next year. ____ Ben Samman..............................................samman(a)cs.yale.edu "If what Proust says is true, that happiness is the absence of fever, then I will never know happiness. For I am possessed by a fever for knowledge, experience, and creation." -Anais Nin PGP Encrypted Mail Welcomed Finger samman(a)powered.cs.yale.edu for key Want to give a soon-to-be college grad a job? Mail me for a resume

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by James A. Donald 17 Dec '03

17 Dec '03

The German prosecuters are currently targeting the site of Mr Zundel, "who is well known for his open revisionist positions." Zundel is not in fact a Nazi, but an anti nazi: Here is a sample of his work. Bottom line. German prosecuters are amazingly ignorant idiots. Press Release Date: January 3, 1996 Attention: Assignment Editor / For immediate release Hate all that you can hate in the Nazi Reserves! In The Nazi Reserves, we hate more people before 6am, than most people hate all day! We promise if you join The Nazi Reserves, you will be trained in: 1) Marching 2) Re-learning History 3) Growing a mustache just like Hitler's 4) Burning your own house and blaming it on Jews! 5) Learning how to blame *everything* on Jews! 6) Learning how to blame everything that can't be blamed on Jews on the Blacks! 7) Learning how to blame everything that can't be blamed on the Jews or the Blacks on the Liberals! 8) Learning how to blame everything that can't be blamed on the Jews or the Blacks or the Liberals on the Catholics! 9) How to signal the Alien Nazi UFO Mothership! 10) More marching! 11) How to enjoy being anal probed by Nazi aliens from space! 12) How to make your jackboots *really* shine! 13) How to beat up homosexuals (this one's easy-- just make sure you outnumber them by about 6:1, and make sure you're in Colorado) 14) And yes, MORE marching! If you join now, we promise you there will be *no volleyball* and *no push-ups* and no *5 mile runs!* Yes, even middle aged balding men can join the Nazi Reserves! The Nazi Reserves: It's not just a job, it's a perversion! (Not like my other perversions which involve trying to stuff my plump legs into stockings and prance around in heels.) JOIN NOW AND WIN A FREE TRIP TO THE NAZI UFO BASE AT THE CENTER OF THE EARTH! Surveys show that 9 out of 10 prisons prefer candidates who have learned the skills taught in The Nazi Reserves! Join now and you increase your chances of receiving free meals and housing for the rest of your life! -- Ernst Zundel My right to free speech supersedes your right to exist. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

new(?) anti-usenet censorship technique?
by Jon Lasser 17 Dec '03

17 Dec '03

Playing around online today, it occured to me that much of Compu$pend's subscribers (and many other ISPs, especially smaller ones which might be subject to governmental pressures) rely largely on people who use chat modes frequently, often for sex-related chat... they cannot cut off IRC (for example) without hurting their income substantially. If someone put up an IRC<->news gateway, with a bot that allowed anyone on channel to read newsgroups, it'd be virtually impossible to censor; one could use a variable channel name to increase the difficulty of censoring it. Has anyone done this before? Or talked about it? Jon Lasser ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

1 0

Re: "Gentlemen do not read each other's mail"
by Alan Pugh 17 Dec '03

17 Dec '03

>It isn't clear to me that the Constitution grants "rights" to the government >that aren't already possessed by the people themselves. Would that even be >possible? "Powers" maybe, "rights," maybe not. the constitution is an amazingly consistant document internally. take a slow read through it and you will see that you are absolutely correct. when 'people' are being referred to, the term used is 'rights'. when it is a governmental organization (state or federal), the term used is always 'powers'. amp

1 0

Re: Denning's misleading statements
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>At 03:12 PM 1/28/96 -0500, Ben Samman. wrote: >>There's quite a few folks in the Yale CS department that are pro-Clipper >>or fence sitters. They justify it in class by claiming that law >>enforcement needs these abilities if LE is to remain effective. What research grant pays theses guy's salaries? JFA Reality IS, Existence Exists. -John Galt

1 0

Re: more RANTING about NSA-friendly cpunks
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

"Vladimir Z. Nuri" <vznuri(a)netcom.com> said: <much snipped text all over the place> >my point is that, what is anyone's evidence that what happened to >Zimmermann (i.e. NOTHING WHATSOEVER other than an investigation that >ended with NOTHING) would not happen to whoever tried to "export" >whatever algorithms they pleased??? >if people are going to pretend that the ITAR crypto sections have >TEETH, then please >give a disclaimer that YOU HAVE NO EVIDENCE. I have no problem with >people getting "paler shades of white" from all their imagined bogeymen. >Zimmermann SHOWS that any claim that the ITAR has "teeth" APPEARS TO >BE GROUNDLESS. >you can argue all you want about HYPOTHETICAL situations, but the >REALITY is that nobody has ever gotten any nastiness from any >ITAR-crypto prosecution. >if cpunks want excuses to cower in terror of the ITAR (such as e.g. >TCM seems to advocate), you will find endless justification from >your rampant fantasies. I do not think that wether PZ or anybody else was prosecuted in *this* case means that ITAR does not have teeths. The most important thing in order to understand a situation is to put yourself in the other guy's shoes. If I would have been in the govt shoes, maybe I would have let down the case too. It does not mean that I wouldn't attempt any case like this anymore... Theses peoples are not stupid. They might be statists, but they are intelligent statists... PZ case could have been presented as borderline, and could have made a precedent not in their advantage. Non-objectivity of a law never prevented the govt to "enforce" it. JFA Power tends to corrupt, absolute power corrupts absolutely.

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

olmur(a)dwarf.bb.bawue.de writes: > Free speech ends where other people can reasonable claim that their > feelings are badly hurt. Ask yourself what standard in implied in this sentence... Is it "Man as a life-loving rationnal animal" or "Man as an ever sobbing, unable to cope, emotionnally controlled animal" ??? JFA "I always tried to live in order to be able to *fly* another day." -Gen. Chuck Yeager

3 2

FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

[My apologies in advance if you see several copies of this message. I am posting this fairly widely due to the severity and importance of the problem described.] As you may already have heard via the popular press, First Virtual Holdings has developed and demonstrated a program which completely undermines the security of every known credit-card encryption mechanism for Internet commerce. This is a very serious matter, and we want to make sure that the Internet community is properly informed about the nature of the problem that we have uncovered, and the manner in which we have made the information known. In this (unavoidably lengthy) post, I will try to explain the nature of the problem and its implications for Internet commerce. In deference to those who are not technically oriented, the detailed explanation of how the attack works will be the LAST part of this message. First of all, let me be perfectly clear about the nature of the problem we have exposed. It is NOT a bug in a single program, and it is therefore NOT something that can be fixed with a "patch" or any other kind of software upgrade. Instead, we have demonstrated a very general attack that undermines ALL programs that ask users to type a credit card number into their home computer. We have tested the program and confirmed that it undermines the security of the credit card encryption software from Netscape and Cybercash, and we expect that it will work similarly for ANY future software based on the encryption of credit card numbers on the desktop. Quite simply, we believe that this program demonstrates a FATAL flaw in one whole approach to Internet commerce, and that the use of software to encrypt credit card numbers can NEVER be made safe. For consumers, we recommend the following simple rule: NEVER TYPE YOUR CREDIT CARD NUMBER INTO A COMPUTER. We should also be clear about the Internet commerce mechanisms that are NOT affected by this problem. First Virtual is unaffected because we never ask the user to put a credit card number at risk by typing it into a computer. Hardware-based solutions can also be devised that are immune to this attack, including solutions based on smart cards and solutions based on "card swipe" machines in the home. We believe that current digital cash solutions are also not vulnerable to this attack, although some variants of digital cash may be vulnerable to a similar form of attack. Commerce mechanisms based on the use of telephones or fax machines to transmit credit card numbers are also unaffected by this kind of attack. Other proposed commerce mechanisms should, from now on, be evaluated with this kind of attack in mind. The bottom line: INTERNET COMMERCE CAN BE VERY SAFE, WITH SEVERAL DIFFERENT MECHANISMS, BUT ENCRYPTING CREDIT CARDS ON THE DESKTOP IS NOT ONE OF THE SAFE MECHANISMS. It's important to understand why we have taken this step. Obviously, as the long-time leaders in Internet commerce, the last thing we would want to do is to undermine general confidence in Internet commerce. However, we realized that many people believed that credit card encryption was a safe and easy path to Internet commerce, and that very few people understood how easily it could be undermined. Upon investigation, we were frankly startled to realize just how easy it was -- a single programmer got the first version of our program running in about a week. Aside from our obvious interest in promoting our own commerce mechanism, we felt that we had an ethical obligation to bring this problem to the attention of the consumers, banks, and other financial institutions who could conceivably suffer catastrophic losses if software encryption of credit card numbers became widespread. We also realize that we have an obligation to do everything possible to avoid helping any unscrupulous people who might seek to utilize this flaw for malicious purposes. We have accordingly been extremely responsible in how we have handled our discovery. We first demonstrated and explained our program to vital organizations such as CERT (the Computer Emergency Response Team) and the ABA (American Banking Association). Only after many such private disclosures, none of which revealed any defense against our technique, did we publicly disclose the existence of this program. In addition, we have taken several steps to "cripple" our demonstration program, all of which will be discussed below. Furthermore, we have NOT made the program itself generally available. We are currently demonstrating it to selected financial institutions and government agencies, and will provide copies of the program only to CERT and a few other independent security-minded organizations. We have also alerted Netscape to the problem as part of their "bugs bounty" program. At some future date, we might conceivably distribute the program, in binary form on CD ROM, to selected financial institutions. The source code will always be very closely guarded. Unfortunately, however, the general method of attack is extremely easy to duplicate, and we don't know of any good way to alert the public to the problem without explaining it. THE TECHNIQUE Our basic approach was to write a computer program that runs undetected while it monitors your computer system. A sophisticated version of such a program can intercept and analyze every keystroke, mouse-click, and even messages sent to your screen, but all we needed was the keystrokes. Selectively intercepted information can be immediately and secretly transmitted via Internet protocols, or stored for later use. First Virtual's research team has built and demonstrated a particular implementation of such a program, which only watches for credit card numbers. Whenever you type a credit card number into your computer -- even if you are talking to "secure" encryption software -- it captures your card number. Our program doesn't do anything harmful with your credit card number, but merely announces that it has captured it. A malicious program of this type could quietly transmit your credit card number to criminals without your knowledge. The underlying problem is that the desktop -- the consumer's computer -- is not secure. There is no way of ensuring that all software installed on the consumer's machine can be trusted. Given this fact, it is unwise to trust ANY software such as a "secure" browser, because malicious software could have easily been interposed between the user and the trusted software. The bottom line for consumers is that, on personal computers, INFORMATION IS INSECURE THE MOMENT YOU TOUCH A KEY. We have dramatically proven that security ends the moment you type sensitive information into your computer. The vulnerability lies in the fact that information must travel from your keyboard, into your computer's operating system, and then to your "secure" application. It can be easily intercepted along the way. This kind of insecurity is very frightening, and has implications far beyond credit card theft. However, credit cards embody and demonstrate the kind of information that is MOST vulnerable to this kind of attack. Credit card numbers are far more vulnerable to this kind of attack than most other forms of information because of the following particular characteristics of credit card numbers: -- Credit card numbers are easily recognized by simple pattern recognition. -- Credit card numbers are "one way" financial instruments, with no user-level confirmation or verification required for their use. -- Credit card numbers are of direct financial value. In short, credit card numbers are an almost perfect example of how NOT to design a payment instrument for an insecure public computer network such as the Internet. DETAILS: HOW TO TOTALLY UNDERMINE SOFTWARE ENCRYPTION OF CREDIT CARDS First Virtual's demonstration credit-card interception program, once installed, observes every keystroke that you type, watching for credit card numbers. It recognizes credit card numbers with almost perfect accuracy, because credit card numbers are specifically designed to match a simple, self-identifying pattern, including a check digit. Our program is even smart about punctuation and simple editing functions, so that nearly any credit card number that you type into your computer is immediately recognized as such by this program. When our program spots a credit card number, it immediately plays a warning sound and pops up a window on your screen, including an iconic representation of the type of credit card that you have just entered, along with a clear explanation of what has just happened. The current program works only on Microsoft Windows (Windows 3.1, Windows NT, and Windows 95), but we believe that it would be simple to implement on Macintosh and UNIX systems as well. The program doesn't exploit any "holes" or bugs in the operating system. It uses existing, necessary operating system facilities which are part of the published Windows API, and which are necessary for the implementation of screen savers, keyboard macros, and other important software packages. First Virtual's intent is to educate the public, certainly not to endanger it. For that reason, our program incorporates four important precautions intended to prevent any possibility of harm: 1) Our program is not self-replicating. While a malicious program exploiting the same security flaw could easily be embedded in a virus, spreading itself all over the world, that was not our goal. Instead, the program must be deliberately and manually installed on each computer on which it is to run. 2) Our program always puts up an icon on your screen when it is watching your keystrokes. This is certainly not necessary, and it is clear that a malicious program would be unlikely to do this. 3) Our program is easy to remove from your computer, and even offers an "Uninstall" button to the user. Obviously a malicious program would hide itself as well as possible, and make itself as hard to remove as possible. 4) Our program never transmits your credit card over the Internet. While a program using this approach could transmit your information to a criminal in a totally untraceable manner, we would never do anything like that. In fact, we erase your credit card number from our program's memory before we even tell you that we've seen it, thus making sure that the credit card number can't even be retrieved by an inspection of our program's memory. It is frankly difficult to overstate the severity of the problem demonstrated by our program. A clever criminal could use viral techniques to spread a malicious program based on the same approach, and would be no more likely to be caught in the act than the authors of any of the computer viruses that plague the world today. Once it detects a credit card number, a criminal program could use any of several techniques to send that number to the original criminal without providing any way to trace the criminal's receipt of it. (If you're skeptical about this claim, we'd prefer to talk with you privately, as we've never seen the "best" methods for doing this spelled out in public, and we would prefer to keep it that way.) Altogether, this means that if millions of credit card numbers were being typed into Internet-connected personal computers, a criminal could obtain a virtually unlimited supply of card numbers for his own use. In fact, for all we know this could already be happening today. The first visible sign of such an attack, if it were well-executed, would be a gradual rise in the overall rate of credit card fraud. POSSIBLE SOLUTIONS First Virtual believes that the flaw we have uncovered is fatal. In the foreseeable future, all commerce schemes based on software encryption of credit cards on the desktop are completely vulnerable to this sort of attack. The basic problem is that software encryption of credit cards is predicated on the notion of "trusted software". On the consumer computing platforms, however, general purpose operating system functionality makes it unwise to assume too strong a level of trust in such software. No operating system with anything less than military-grade security (B2) is likely to be safe from an attack such as this one. This does not mean that Internet commerce is dead. Any scheme that is not based on self-identifying one-way financial instruments such as credit cards will be essentially unaffected by this problem. Moreover, even credit cards may be made safe on the Internet using one of two approaches: secure hardware add-ons and the First Virtual approach. First Virtual's Internet Payment Systems never places the consumer's credit card number on the Internet. Instead, the consumer provides it to us by telephone when the account is opened. After that, all purchases are made using a "Virtual PIN". Virtual PINs are essentially Internet aliases for underlying payment mechanisms such as credit card numbers, but with several kinds of added security. Virtual PINs are free-form text, with no recognizable pattern, which makes them much harder to detect with the kind of attack we have just demonstrated. Moreover, Virtual PINs are only usable in conjunction with First Virtual's unique email verification process. No payment is made until the consumer confirms an email query, which means that defrauding First Virtual is a multi-step process that is extremely difficult to automate. (For more details, we recommend our paper, "Perils and Pitfalls of Practical CyberCommerce", available via ftp from ftp://ftp.fv.com/pub/nsb/fv-austin.txt.) The bottom line, once again, for those of you who have read this far: NEVER TYPE YOUR CREDIT CARD NUMBER INTO A COMPUTER. There's simply no other way to keep credit cards safe on the net. The program we have demonstrated completely undermines the security of all known programs that claim to handle credit card numbers safely on the Internet. -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

11 17

Re: PAC_man
by jim bell 17 Dec '03

17 Dec '03

At 12:05 PM 1/28/96 -0500, John Young wrote: > 1-28-96. TWP: > TWP has a followup on the AOL raid, mostly a police story > grisler on the cyber-prowling horny-cats. Has ICU of the > terminal logoff by a 13-year-old nerd. The fuz posted a > call-in for anon tips: > > "You know how many we've gotten from our on-line hot > line? Not one. It's like they have this fantastic world > they operate in, and we are seen as intruders or > something." > ICU_ded Maybe, they're catching on, huh?!?

1 0

Over-reacting?
by jim bell 17 Dec '03

17 Dec '03

At 05:42 PM 1/28/96 -0800, Timothy C. May wrote: > >Folks, > >When people decide to copy other mailing lists on messages they send to >Cypherpunks (or vice versa), we often get flooded with insults and spams >from people who don't share our views. (While I have nothing against trying >to recruit others to our views, in my opinion this is best done by >judicious writing of essays for _them_, tuned to their interests, and not >in mindless spamming of every list that might have a passing interest in >some of the topics.) > >We already have enough traffic here, and don't need replies from a bunch of >other lists, be they libertarian lists, digital commerce lists, human >rights lists, or java lists. > >The latest example of this is the rantfest invvolving these players: I really don't know why I'm being "killed" by May in this way. He cites a rant by a local (Portland, Oregon) crackpot named "Jack Hammer." I even took the time to apologize for his existence, while I do claim a certain lack of responsibility: Basically, I'm being targeted because Hammer can't stand my essay. (Whether May will even see my apology is in doubt, I suppose...) While May certainly has the right to "killfile" whomever he wishes, it might be a bit more logical to do this in a graduated fashion, "killing" Hammer and then waiting to see if the rest of us follow in his habits.

1 0

[noise/rant] Re: Anonymous trashing of Jim Bell
by Alan Olsen 17 Dec '03

17 Dec '03

[Some people will object to this thread, and rightly so. This is very off topic. I understand it is off topic. But it needs to be said... If you don't want to read this, hit 'n' or equivalent now. I also request that responses to this be made in private e-mail and not to the entire list.] [Also note that I stripped off the references to the Libertarian list and the Democracy now list and avoided the urge to add the psychoceramics list.] Jim, I used to take your postings at least semi-serious. I ignored the ad hominem as much as I could and tried to concentrate on the validity of the arguments. I had difficulty with many of your ideas, but I have that problem with many people so it was not a big deal... Then I met you at the Portland Cypherpunks meeting. You blew whatever credibility that you had with me at that time. At that meeting you made claims that were fantastic and beyond belief. You gave no evidence to support those claims, just relying on some sort of future "proof". (Sorry, but the burden of proof in these sort of cases lies on the claimant, not the rest of the audience.) Assassination politics is immensely credible compared to your plan to disable electronic equipment. (And that is saying alot.) Assassination politics suffers from a number of problems. The biggest being its difficulty in being implemented. Such a system would suffer from Federal agents posing as hit men, outright fraud, and attempts to destroy the system from within and without. I have seen nothing that makes me believe it could ever be put into place. I have yet to see you address any of the flaws without resulting to flames and rant. Unfortunately, you would rather attack your critics than deal with the flaws in your beliefs. The following is an example... At 08:30 PM 1/26/96 -0800, jim bell wrote: >At 01:54 AM 1/27/96 +0100, Anonymous wrote: >>Jim Bell writes: >> >>>While this would normally be my cue to offer up my "Assassination Politics" >>>idea, which (if presumed to be correct) would stabilize "anarchy" and >>>prevent "lawlessness and social disorder" (at least as normally seen by the >>>average reader) I think that under the circumstances that would be redundant >>>here. >> >>I'm not *sure* that your Assassination Politics trip is the worst piece of >>tripe I've ever seen on the list, but if it's not, it's right up there. > >I notice that you responded through an anonymous remailer, and didn't even >use a nym. This is strange. If anything, the people who criticize my idea >seem to be under the illusion that it is _I_ who should be embarrassed for >proposing it, and in fact vociferously promoting it. "Those of you" who >object to it should be the ones who are "proudly" taking the "moral high >ground" and thus should be happy to identify yourself and defend your position. There are reasons why an individual would do that. Maybe they did not want to create a nym just to respond to one message. Maybe they thought that you would recognize their other nyms. Maybe it is someone you know. Whatever the reason, it does not diminish their arguments. >Even if, arguably, you invented the fiction that you feared for your life >trying to argue with people like me, nothing prevents you from developing a >stable nym and arguing your position using it, secure in the knowledge that >your body is safe from attack. Your arguments would still be subject to >sudden death, however. You think very highly of your arguments, but have shown nothing that would make me believe that you could actually do that without resorting to ad hominem attacks. In fact the poster brings up some interesting questions which you totally ignore, due to your unwavering belief in your pet theory. All you do is flame him, instead of dealing with the immense flaws in that theory. >>Those of us who are anarchists > >What?!? You imply that you are an anarchist, yet you don't approve of a >system which might not only produce anarchy, but in fact in record time? >Well, EXCUUUUUUUUSE MEEEEEE! Sorry to put you out of a "job." Not all anarchists believe in killing others. Sorry, but there are as many variety of anarchy as there are anarchists. As for the results of "Assassination Politics", you have yet to show that it would produce any results whatsoever, or if it is even possible to implement. In fact, I cannot see a way that it can be put into place without everyone involved being put in jail. >> are often that way because we think the *means* the State uses are evil, >>not to be excused by any amount of mumbo-jumbo. > >I think the state's ENDS are evil, too, not merely their MEANS. Yet you never explain why it is valid to use evil to fight evil. It is this lack of willingness to discuss the details of your beliefs that make people unwilling to take your ideas seriously. >> And you gleefully propose to let us *all* in on the immoral game of >>murdering those who annoy us sufficiently. > >Actually, if you followed my arguments carefully, you will notice that my >position is most accurately described by pointing out that I _could_not_ >keep you from participating in this "immoral game", even if I wanted to. Or not participating... Jim, if annoying people were a qualification for murder, you would need to watch your back pretty damn carefully. But it is not a qualification yet... You have yet to show, however, how your plan could ever be enacted. If it was possible to enact, you would probably be in jail for "conspiracy to commit murder" or some similar charge. Anyone who assisted in such a plan would also risk such charges. The feds are pretty ruthless in ferreting out people who try an hire hitmen. Especially from private citizens. the only people who are able to hire hitmen and get away with it are the heavily funded or the government themselves. Setting up an organization to compete with these groups will not be viewed favorably. >For the record, I suspect some people who are total pacifists view the rest >of us, those willing use use violence to defend ourselves, as "immoral." This is not as easily defendable as self-defense. If you were shooting the politico yourself, then I might agree. But you are not. You are hiring someone else to do your dirty work for you. If you were actually helping out in the slaughter, then i might have a bit more respect for your argument. As it is though, I find it about as toothless as those who eat meat, but are too squeamish to go hunting themselves. >>I'll pass. > >Others won't. The digestibility of your plan has little relevance to its possible adoption... >>You know, if I were constructing an agent provacateur, I'd want a persona >>who's willing to be loudly clueless with ideas that show minimal or >>non-existent awareness of basic human hopes and fears, like security from >>random hit-squads. I'd have him go on and on with his ideas, until >>eventually they can splashed all over headlines and used to discredit the >>whole realm of privacy protection. > >Aha! You're implying (actually, implying is an understatement here) that I >am an "agent provocateur." Naturally, it would be useless to deny this >(although, for the record, I will deny it), because anybody who was >convinced of its truth wouldn't expect me to tell the truth anyway. Nope. The poster is claiming that you are *TOO CLUELESS* to be an Agent Provocateur. You are missing the point. >But hey, let's put it up for a vote. How many people out there believe that >I am an "agent provocateur"? C'mon people, don't be shy, you've seen my >prose. What do the rest of you think? I don't think you are any such thing. I believe that you are convinced of the rightness of your ideas and no amount of rational discourse will sway you from that belief. Being a fanatic does not make you evil or an Agent Provocateur. It does make you less credible though... >>But no, I don't think you're an agent. > >Good! I'd hate to argue with a person who didn't realize I am SERIOUS. You seem to miss the point that the poster was making, but no worry... >> More fool you, you're willing to do the government's disinformation work >>for it without even thirty pieces of silver or a 401K. > >To be perfectly honest, I did a lot of soul-searching in early 1995 about >whether I should publicize my ideas. No, it wasn't because I was AFRAID >that it might happen. I _WANTED_ it to happen. Every little bit. Every >government on the face of the earth, to come crashing down in a heap. >Complete, total, absolute anarchy. (But not the "anarchy" that most people >are pre-programmed to think of...) No more governments, no more borders, no >more taxes, no more holocausts, no more wars, no more politicians. Forever >and ever and ever. > >Rather, I was fearful that by publicizing the idea, I might end up >PREVENTING it from occurring. You know, by giving the governments advance >warning about what was going to happen, I might actually help them prevent it. > >That worried me, a lot. But eventually, I made my decision. After a huge >amount of thought that some day I might be inclined to relate. However, if >I'd REALLY wanted to PREVENT this, I would have alerted the government >secretly, so that they could manipulate things behind the scenes, secretly, >to prevent this "crypto/digicash/internet anarchy." _That_ I did not do. >I publicized it, allowed it to be criticized and therefore "perfected" (not >that it's "perfect, by any means!) it, and I'm now promoting it the best way >I know how. And with all due modesty, it's getting a pretty good reception, >considering how extreme and drastic it initially might appear. > >Part of my reasoning was that unless I engaged in the absurd conceit of >believing that I was, cumulatively, smarter than everyone currently in the >government, I had no choice but to conclude that the government was already >aware of the potential problem. And if that were the case, they were, at >that very moment, working desperately to PREVENT what I wanted, desperately, >to ACHIEVE. > >At that point, I made the choice of forcing the government's hand. The above speaks for itself. (I could say that this is one of the looniest things I have read in a while, but I do take the Psychoceramics list... It is pretty high up there.) It is definitely hard core crankdom of the purest form. If you were a threat to the Government, even a small one, you would have been picked up and put away. You seem to forget that this is an open mailing list. Many of the people who read this list are Government employees. (I am willing to bet that a sizable percentage work in some variety of law enforcement.) They know what you believe and what you are agitating for. But you are not a threat because you are not credible. No one is going to adopt your ideas because every time you open your mouth, you make yourself look like a loon. Not only do you make yourself look like a loon, but every organization and group you associate with looks bad. If you really desire to make your views accepted, you need to look at how you present yourself to others. Willingness to analyze your own belief structures and refine them is a first step. Ability to take criticism is a second step. Without that, your ideas will be taken as the views of an unwavering fanatic. You will not sway many people with fanaticism. >>At this point I recommend to you the 12-step program I explained to Vladimir. >> >>Signed, >>A Friend > >Recommendation: If you really want to be taken seriously, use your real >name or at the very least generate a stable nym. Preferably, with messages >signed by the nym's public key. Without it, you are a silly, unbelieveable >ass. Even with it, you may STILL be a silly, unbelieveable ass, but at >least people would pay more attention to you. I think that you have little to nothing to say about being taken seriously. If you continue to go off on pseudo-science rants at meetings at the drop of a hat, no one will take you serious there as well... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

Re: Escrowing Viewing and Reading Habits with the Governmen
by Alan Horowitz 17 Dec '03

17 Dec '03

> > Do you really think that the FBI foreign counter-intelligence squad has > > nothing better to do than keep a database of who is reading Che Guevara > > memoirs? > > Yes. > > Heck, I remember this was a big issue about 15 years ago. Try asking > someone who was active in library science in the late 70's, early 80's. I did. They said you're wrong. Shall we start a CP flame-war of unattributed allegations from librarians who will recall what *they thought* the FBI is interested in?

3 2

[FACTS] Germany, or "Oh no not again"
by Thomas Roessler 17 Dec '03

17 Dec '03

I had the prosecutor's spokesman on phone today. The result is that someone gave a hint to the prosecutors which explicitly mentioned Zundel, T-Online and Compuserve. Consequently, the prosecutors *had* to start investigations against Zundel, T-Online and Compuserve. In particular, they are right now *checking* whether providing internet access is a criminal offence due to the possibility to gain access to `inciting material' (the German word is `Volksverhetzung') via the Net. This means that it is not even clear whether the investigations against internet providers will be dropped or not; in fact many people believe that these investigatinos *will* be dropped. My personal guess about all this is that some net.citizens are trying to have the prosecutors engaged in absolutely absurd investigations (or, even better, achieve a court room clash on this subject) to get some clarification of the legal situation of the Net in Germany. Quite similar to the RSA T-Shirt story in the States. ,-) tlr

6 7

Re: Escrowing Viewing and Reading Habits with the Governmen
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:12 PM 1/29/96, Alan Horowitz wrote: >> > Do you really think that the FBI foreign counter-intelligence squad has >> > nothing better to do than keep a database of who is reading Che Guevara >> > memoirs? >> >> Yes. >> >> Heck, I remember this was a big issue about 15 years ago. Try asking >> someone who was active in library science in the late 70's, early 80's. > > > I did. They said you're wrong. Shall we start a CP flame-war of >unattributed allegations from librarians who will recall what *they >thought* the FBI is interested in? I'm not interested in a flame war about librarians and the FBI, but will tell you what I know: the "Library Awareness Program" was very real. It reached public awareness in the mid- to late-80s, and was the subject of numerous news reports. The various librarian unions blew the whistle on this. As I recall, new stantards about access to materials by patrons, and privacy expectations, were issued. Ah! Once again I thank Alta Vista. A simple search on "Library Awareness Program" revealed 20 hits on the Web. Here is an excerpt from one of the hits: ------ WHAT'S NEW, Friday, 3 June 1988 Washington, DC 1. THE NATIONAL SECURITY ARCHIVE FILED SUIT AGAINST THE FBI yesterday to force the release of documents relevant to the FBI's "Library Awareness Program" (WN 9 Oct 87). The documents were requested under the Freedom of Information Act eleven months ago. The FBI at first denied the existence of the program, and now contends it is confined to the New York area, but librarians from all over the country report FBI visits. Meanwhile, the FBI has not provided a single document either to the National Security Archive, or to the American Library Association, which filed a similar FOIA request. People for the American Way is assisting the National Security Archive in its lawsuit. 2. THE FBI'S "LIBRARY AWARENESS PROGRAM" is not an effort to raise the literacy of its agents. Even as President Reagan was lecturing to students at the University of Moscow on the virtues of a free society, his new FBI chief, William Sessions, before a Senate Committee, was defending the FBI's attempts to recruit library employees as snitches. Sessions released an unclassified version of a top-secret FBI report that must have been ghost written by Art Buchwald. Entitled "The KGB and the Library Target: 1962 - Present," it includes examples of suspicious behavior, such as an individual who "is observed departing the library after having placed microfiche or various documents in a briefcase without properly checking them out of the library." .... --- Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by dmacfarlane＠zip.sbi.com 17 Dec '03

17 Dec '03

Is this the most transparent media attention grab or what? FV's "Chief Scientist" writes a killer application to destroy Internet commerce and it is really only a keystroke capture program with a bit of credit card number recognition code tacked on. I don't think this has any "implications for Internet commerce". If you run any number of virus protection programs on your computer, and you get your software from reliable sources, you never need worry about clandestine number snarfing. I readily admit that there is a larger issue about viruses and being able to trust your software, but the presentation from FV of this announcement as a "fatal flaw" in internet commerce is remarkably disingenuous. They are really saying, "We have the only safe approach" quietly between the lines. And before pm. says it, this has very little to do with cryptography. Skeptically yours, David Macfarlane.

5 4

The Big Lie
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

Timothy C. May wrote (with some judicious editing): , I took it as a fact that the >so-called Holocaust actually happened. I saw pictures of death camps, >interviews with survivors, etc. > > It seems more likely that >the pictures were faked, > >, I suspect the >stories are true that the Holocaust was part of Truman's "Big Lie." > Good Lord! We've all enjoyed Tim's rants, but this takes the biscuit. What's next? A denial of the athletic abilities of Negroes? --Dave Rose

3 2

Re: Escrowing Viewing and Reading Habits with the Government
by Ted Garrett 17 Dec '03

17 Dec '03

At 08:54 PM 1/27/96 -0800, you wrote: >According to >Director Freeh, "If we had had this program in place when Timothy McVeigh >was a child, we could have detected his interest in ANFO and picked him up >for reeducation, or at least recruited him for the CIA's Lockerbie team." ^^^^^^^^^^^ Please tell me this was not an actual quote. The term re-education scares me more than anything, as it's the term typically used by authoritarian dictatorships for their tortures and murders.

1 0

Germany, or "Oh no not again"
by Deranged Mutant 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- Date: Sun, 28 Jan 1996 19:30:21 -0500 (EST) Reply-to: educom(a)elanor.oit.unc.edu From: Educom <educom(a)elanor.oit.unc.edu> To: "EDUCOM Edupage Mailing List" <edupage(a)elanor.oit.unc.edu> Subject: Edupage, 28 January 1996 [..] GERMAN PROSECUTORS TARGET INTERNET RACIAL HATRED The Mannheim, Germany, prosecutor's office has launched an investigation of CompuServe and Deutsche Telekom's T-Online service for inciting racial hatred, a crime in Germany. At issue is online access to a Web site run by a neo-Nazi extremist in Canada who uses the Internet to distribute anti-Semitic propaganda. The legal reasoning, according to a prosecutor's office spokesman, is that "because it's available over the Internet, it also can be called up in Germany. Then the scene of the crime is all Germany." Although the investigation is now limited to CompuServe and T-Online, there are also several hundred small companies that provide Internet access in Germany. (Wall Street Journal 26 Jan 96 B2) [..] Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas (douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. Technical support is provided by the Office of Information Technology, University of North Carolina at Chapel Hill. *************************************************************** EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Emmitt Smith (assuming that your name is Emmitt Smith; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.) --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

None
by Mr. Nobody 17 Dec '03

17 Dec '03

In article <ad32cd9601021004af4e(a)[132.162.233.188]> jrochkin(a)cs.oberlin.edu (Jonathan Rochkind) writes: > 3) I believe that FV works by assigning the user some sort of id number. > They send the id accross the net, FV has a database with "FV-ID" <-> > credit-card-number correspondences, the merchant sends FV the id, FV bills > your card and pays the merchant. Now, if I'm correct about how FV works, > we could clearly write a program that searches your HD for FVs data files, > extracts your FV-ID from it, and steals it. It could be a virus, it could > send the FV accross the net, whatever. We could then use your FV-ID to > make fraudulently make purchases through the FV system that would be billed > to you. This is essentially the same attack as FV "demonstrates" against > software encrypted credit cards over the net: that is, the "You have an > insecure system and if we can put evil software on it, we can get you." > attack. This sounds like a fatal security flaw in FV's system! We need to publicize this fact widely to prevent innocent people from using their FV accounts from computers or over the network.

1 0