December 2003 - cypherpunks-legacy

Stego inside encryption
by Mullen Patrick 17 Dec '03

17 Dec '03

My apologies if this shows up twice. I got an error message from my first posting. *************** I know a lot of times the idea behind steganography is to hide the fact that a secret message is in a seemingly normal file/mail/whatever. This is good for avoiding unwanted interest in your file. The benefit of not having people attempt to crack you code, added to the strength of the cryptosystem is wonderful. However, I propose this-- Don't hide that anything's encrypted! Rather than hide this fact, throw it in their face! I propose hiding an encrypted message inside another encrypted message. Set bits in specific places to data in the real message. The benefit is Oscar not only doesn't know what the crypto is, he attacks the wrong message. Hiding statistically random bits from the true message in statistically random bits from the masking message shouldn't be too hard. Granted, this scheme doesn't get you past measures designed to keep out all encrypted messages, and it surely wouldn't keep you message from generating interest, but it would be very hard to decrypt the message, especially when some algorithm is used which (seemingly) randomly selects which bits to use for the stego. Just a thought... My apologies if someone has already proposed this method. Patrick

1 0

CNET Digital Dispatch Vol. 2 No. 38
by Rick Osborne 17 Dec '03

17 Dec '03

This week's c|net digital dispatch had the following top ten list. For number 8, did they mean DES or is the EDS something I'm not aware of. I figure it has to be because what does DES have to do with chat rooms? >9. TOP TEN REASONS WHY THE PRESIDENTIAL DEBATES WON'T TAKE >PLACE ON THE WEB > >10. Kemp would fight with Dole over who gets to > "quarterback" the keyboard. >9. Oops: Gore plugged information superhighway cable > into White House central vacuum system. >8. Perot's crack team of EDS hackers would get him > in somehow. >7. Hotwired editors say presidential candidates not > hip enough. >6. Hillary doesn't let the President in ANY chat rooms. >5. Debate commission insists: event must be on Prodigy. >4. Bill Gates owns the rights to online debates. >3. Dole's Selectric won't connect to the Net. >2. Chelsea is using the White House PC to write a > book report. >1. In cyberspace, no one can feel your pain. ____________________________________________________________ Rick Osborne osborne(a)gateway.grumman.com "The universe doesn't give you any points for doing things that are easy."

2 1

Comments on Emoney regulation
by E. Allen Smith 17 Dec '03

17 Dec '03

JYA has the complete version of this, but I wanted to make a comment that this allegedly pro-consumer group is wanting mandatory receipts - decidedly anti-privacy. Typical; Consumer Reports keeps calling for limits on what can be made available instead of making the information available and letting people decide on their own. There is also the problems associated with welfare-on-a-card - namely limits on what can be purchased, a requirement for full identity disclosures, etcetera. I'd call this effort by government also a form of the pressure-by-economics we saw with the initial Clipper proposal (leaving aside the actual agenda), namely using government purchasing to distort the market (away from anonymous digital cash, in this case). The last statement also brings up the question of why shouldn't banks move out of high-crime areas? I'd appreciate lower bank fees, and so would most people. -Allen > _________________________________________________________________ > Centura > _________________________________________________________________ > REGULATORS TURN SPOTLIGHT ON CYBERMONEY > __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 N.Y. Times News Service > (Sep 19, 1996 00:41 a.m. EDT) -- As concerns grow about electronic > money-laundering, cybercounterfeiting and bank runs on the Internet, > regulators in the United States and around the world are scurrying to > catch up with the rapid development of electronic money. [...] > Moreover, there is now no requirement that a company that issues > stored-value cards must be a bank or be regulated in any other way. > That raises the question whether these cards, if they become popular, > will become as unruly as the market for prepaid telephone cards, in > which a number of card vendors have failed to deliver the calls that > were promised. [...] > To prevent such problems, a number of other countries have decided to > require that stored-value cards be issued only by banks. > The Federal Reserve has issued proposals on whether the consumer > protections guaranteed for other electronic-funds transfers -- like > direct deposits and debit cards -- will apply to stored-value card > purchases. These protections include the requirement of receipts with > every purchase and a limit on liability if a card is lost or stolen. > The Fed has proposed that card systems that cannot hold more than $100 > and those that have no central records of how much money is on each > card be exempt from the strict consumer-protection rules. > "The Fed proposal is destroying consumer protection," said Janice > Shields, the consumer-research director for the U.S. Public Interest > Research Group in Washington. "They don't want to disclose > error-resolution procedures, and they want unlimited consumer losses." [...] > One force pushing the development of the technology, however, is the > government itself, which has mandated that by 1999 all payments to or > from government accounts must be made electronically. This may have > the most significant effect on the recipients of various welfare > programs, many of whom now do not have bank accounts that could > receive an electronic money transfer. > To deal with this, various groups of state governments are developing > special cards on which benefits payments will be stored. Recipients > will be able to use the cards to withdraw cash at automated teller > machines and to make purchases. > One of the thorniest issues is whether holders of these welfare cards > get the same protections as holders of credit and debit cards issued > by banks. State and local governments do not want to absorb the cost > of issuing refunds, for example, though some readings of the > electronic funds transfer act would require that they do. > Some are also concerned that as banks move more toward offering their > services electronically, they will have more reason to close branches > in inner-city areas. [...] > Copyright &copy 1996 Nando.net

1 0

Insider Trading - news report
by E. Allen Smith 17 Dec '03

17 Dec '03

I'd be curious as to the comments of Black Unicorn and others on that legal finding - it does appear to make things at least a bit better in this area... including making it difficult to claim that insider information shouldn't be transmitted on the Net. Incidentally, I find AP's calling insider trading "fraud" rather biased. -Allen > _________________________________________________________________ > Direct Media > _________________________________________________________________ > INSIDER TRADING NEVER WENT AWAY > __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 The Associated Press > WASHINGTON (Sep 18, 1996 10:35 a.m. EDT) -- One of the most infamous > acts in the financial fraudster's playbook, insider trading, remains > at record levels, despite a decade of steady crackdowns by regulators. [...] > The SEC brought one of its more unusual insider trading cases on > Monday, when it sued the unnamed account holders in a Swiss and > Bahamian accounts with insider trading ahead of The Gillette Co.'s > merger proposal for Duracell International. [...] > One disturbing development for regulators is a recent decision by the > 8th U.S. Circuit Court of Appeals that struck down one of the SEC's > main enforcement tools in insider trading cases. > The court, which covers several Midwestern states, rejected the > so-called "misappropriation theory" in insider trading cases, which is > used to nab people trading on inside information who don't owe a > fiduciary duty to the company's shareholders. The court also rejected > an SEC rule used to snare insider trading in tender offers. > The 8th Circuit decision came in August in a Justice Department case > against Minneapolis attorney James H. O'Hagan, who was charged with > insider trading during the 1988 takeover bid of Pillsbury Co. by Grand > Metropolitan PLC. SEC General Counsel Richard Walker has asked the > appeals court for a rehearing on the matter. > While the 8th Circuit decision represents a setback for the SEC, the > agency usually brings its cases in the New York and Chicago areas, > where the federal courts acknowledge these insider trading rules. > Regulators say these enforcement tools are important because insider > trading follows few patterns. In an analysis of 35 cases brought in > 1995 that solely dealt with insider trading, Gerlach said 20 involved > trading ahead of mergers, three ahead of other positive corporate > announcements and six ahead of bad corporate news. > He described 16 of the cases as "classic insider trading" involving an > executive, company director or employee who traded on confidential, > market sensitive information or tipped friends about it. Among the > remaining cases, four involved trading by securities brokers or other > industry officials, four involved law firm employees and one, an > employee at an outside accounting firm. > Investigators at the Nasdaq Stock Market's market surveillance unit > refer a significant number of insider trading cases to the SEC. Halley > Milligan, who heads a team of nine insider trading investigators at > Nasdaq, said the market has made 73 referrals on suspected insider > trading to the SEC so far in 1996, which is on par with last year, > when 107 cases were referred to the agency. > Nasdaq, like major stock markets, uses sophisticated computer > technology to sniff out illegal trading. The Nasdaq system is called > SWAT, or Stock Watch Automatic Tracking, which scans news databases > after detecting any unusual trading. [...] > Copyright &copy 1996 Nando.net

2 1

Re: CIA hacked
by Lord of Entropy 17 Dec '03

17 Dec '03

At 01:11 AM 9/20/96 +1000, you wrote: >+http://www.odci.gov/cia >+Seems the DOJ hack was a good inspiration. Heh! Life's good when you're >+willing to work at it. >Did you or anyone get a mirror of the site?! I wanna set one up! ;) http://www.ilf.net/hacked.websites/cia/ -- T 37 5F 68 3F 0F 1B A3 6B 7F 90 EA 40 73 49 2F B0 R Information Liberation Front U NO http://www.ilf.net/ chaoS(a)ilf.Net T E

1 0

Re: monkey-wrenching GAK
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:46 PM 9/19/96, Ray Arachelian wrote: >Another thing you can do: generate huge key pairs all day long and submit >them to the NSA. If enough people do this, they will be flooded and >overworked, of course they may ignore them, etc, or make it hard to do >so, but if everyone generates a 4K key every hour or two and discards it, >but gives the key pair to the NSA anyway, they will run out of storage >space, or at least it will make it much much harder for them to figgure >out which key you are using for conversation X. Ah, but what about the _fee_ for registering a key? You really didn't think this would be free, did you? (It costs money to register cars, guns, etc., so why would it be "free" to register a key?) Besides being a revenue enhancement tool, charging a fee stops this sort of flooding attack. (Note: One of my biggest objections to GAK, besides the political/civil rights issue, is what it does to systems which generate lots and lots of keys on an ad hoc, continuing basis. GAK, if enforced, puts a major speed bump in the way and increases costs, possibly making certain kinds of systems infeasible.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Declaration against German censorship
by Felipe Rodriquez 17 Dec '03

17 Dec '03

Send a mail to tuamotu(a)duplox.wz-berlin.de to sign this declaration against current German censorship and IP-filtering of sites. ------------------------------------------------------------------ A Letter of Protest On August 30th 1996, the German Federal Prosecutor wrote to German Internet providers and on-line services telling them that they could possibly be charged with aiding and abetting persons who are currently the subject of a preliminary inquiry by the German Federal Prosecutor due to an article published in a magazine which offended German anti-terrorism laws. The German Federal Prosecutor wrote (excerpt): "Under the following Internet addresses ... [the GFP names two WWW sites, which will be not quoted here because we do not refer to the actual case of a specific text which gives cause for complaint, instead we are interested in the act of censorship as such] ..the complete issue is available... [of the magazine who is subject of preliminary inquiry by the GFP. The GFP explains why they deem the text to be illegal in Germany]... We want you to be aware that you are possibly making yourself liable to prosecution by acting as an accessory to criminal offences [according to German anti-terrorist laws '' 129a,3 and 130a,1 StGB] if you allow the text to be accessed via your Internet dial-ins and host computers." Although the German Federal Prosecutor merely pointed out the possibility of being liable to prosecution and although the opinion of the GFP as expressed in the letter has not as of yet been proven right by a court decision, several German providers responded to the letter by temporarily (for no longer than 28 days) closing off the WWW sites where the electronic version of the article was previously available to Internet readers. From the point of view of a WWW site, for example xs4all.nl in the Netherlands, the action of German providers (among them the largest German providers) means a blockage of all of their WWW information for a great number of German netizens because of a single web page among the thousands of pages xs4all offers at their site. We think denying access to WWW sites is wrong. Beside the fact that it is practically impossible to filter the flow of data in order to keep specific WWW pages which are stored on WWW sites in other countries outside of the German state territory when Germans are allowed to contact these countries by phone for example - unless the German government decided upon massive censorship measurements which would be not according to German Laws as they are today - we demand equal rights for Internet providers and TelCo providers, thus making the GFP's letter unsubstantiated if equal rights were applied. So far, neither German Telecom nor the German postal service have been liable to prosecution by acting as assessories to criminal offences by simply transporting telephone or mail data. xs4all and xs2all Internet Information! back to the letter of protest in german language Internet Information (available in English, Dutch, German): http://www.xs4all.nl/~felipe/germany.html --- latest news Internet Information in German language http://www.spiegel.de/aktuell/sonv0296370906.html http://www.nadir.org/NA/Text/Archiv/Medien/Zeitschriften/radikal/netzzensur/ http://www.anwalt.de/ictf/mirror

1 0

Re: CIA hacked
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From remailer(a)mailhub.bart.nl Thu Sep 19 13:18:03 1996 Received: by bwalk.dm.com (1.65/waf) via UUCP; Thu, 19 Sep 96 16:10:20 EDT for dlv Received: from spoof.bART.nl by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA03960 for dlv(a)bwalk.dm.com; Thu, 19 Sep 96 13:18:03 -0400 Received: (from remailer@localhost) by spoof.bart.nl (8.7.5/8.6.8) id TAA28972 for dlv(a)bwalk.dm.com; Thu, 19 Sep 1996 19:19:58 +0200 (MET DST) Date: Thu, 19 Sep 1996 19:19:58 +0200 (MET DST) Message-Id: <199609191719.TAA28972(a)spoof.bart.nl> To: dlv(a)bwalk.dm.com From: remailer(a)2005.bart.nl (Anonymous) Comments: Please report misuse of this automated remailing service to <remailer-admin(a)remailer.nl.com> The contents of this message are neither approved or condoned by nl.com or our host bART Internet. *** Replying to it will not send your reply to the sender *** There is no way to determine the originator of this message. If you wish to be blocked from receiving all anonymous mail, send your request to the <remailer-operators(a)c2.org> mailing list. The operator of this particular remailer can be reached at <remailer-admin(a)remailer.nl.com> Subject: Re: CIA hacked Return-Path: <cypherpunks-errors(a)toad.com> To: cypherpunks(a)toad.com Subject: Re: CIA hacked From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) Comments: Dole/Kemp '96! Date: Thu, 19 Sep 96 08:08:39 EDT Organization: Brighton Beach Boardwalk BBS, Forest Hills, N.Y. Sender: owner-cypherpunks(a)toad.com Mike van der Merwe <mikev(a)is.co.za> writes: > I'm sure we will find out in a few years that Microsoft invented the > Net. Or brought it to the masses. Or saved it from a certain and > early demise. Or all of the above. > JAMES SEYMOUR >Dr. John M. Grubor created the 'net. Who created you? You tub of shit?

1 0

RE: Private key server
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

Gary Howland[SMTP:gary@systemics.com] wrote: f_estema(a)alcor.concordia.ca wrote: > > On Wed, 18 Sep 1996, Gary Howland wrote: > > > If you really want this functionality, a nicer solution is to use your > > passphrase as a seed to the key generator - that way you never need > > So much for entropy. If you can actually remember your seed generator, it > can't be that random, can it? I don't know about you, but I can certainly remember enough bits to be secure. The fact that passphrases are so widely used goes to show that I'm not the only one that can do this. [Darth Vader voice:] "Don't overestimate the entropy of your passphrase" Let's see, 128 bits (say) of info, mapped comfortably into the upper case letters and digits (5 bits/char), means a string of about 26 *really random* characters. An example might be "KQI8CH49SCK3PKWNA37AYV9QJ5". If that just rolls off your toungue, you have my respect (and I have pi memorized to 110 decimal places!) This assumes a full 5 bits of entropy/character. If your passphrase is more coherent (i.e., less entropy) than that, like "Strange kr0ws fly 1azily at MIDnight", it almost certainly contains _far_ less entropy than that. 128 bits of truly arbitrary (random) info is a fair amount of information to comfortably remember. Mind you, I think a properly constructed passphrase (like the one above) is pretty darn resistant against any sort of reasonable dictionary or quasi-brute force attack. But I don't think it's got anywhere near, say, 128 bits of entropy. Probably closer to half that. Anyway, the point I was making that this method would be preferable to a "secret key server". My proposal would offer the same security, would it not? (The secret key server is arguably less secure than generating keys from passphrases, since key generation takes longer than IDEA decryption - however, they are still of the same order). Using a pass phrase to seed key generation (or more directly, using the hash of a pass phrase as a key) does not increase the entropy, of course. Not sure if this is relevant to your claim, as I've sort of lost track of the original context! Best regards, Gary Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ====================================================================== begin 600 WINMAIL.DAT M>)\^(BH6`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <` M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`06 `P`.````S <)`!,` M#P`"`"<`! `K`0$@@ ,`#@```,P'"0`3``\``@`H``0`+ $!"8 !`"$```!# M14-"1C(a)T1#)$,3)$,#$Q.3,P-C P04$P,$$U1C8P1 `L!P$-@ 0``@````(` M`@`!!( !`!<```!213H@4')I=F%T92!K97D@<V5R=F5R`.P'`0.0!@#D"@`` M&@````,`)@```````P`V```````>`' ``0```!,```!0<FEV871E(&ME>2!S M97)V97(```(!<0`!````&P````&[ID2E\4WXRWL2+1'0DP8`J@"E]@T``$$D MNP`#`"X```````,`!A"7!9D@`P`'$-D'```>``@0`0```&4```!'05)92$]7 M3$%.1%--5% Z1T%264!365-414U)0U-#3TU74D]413I&15-414U!0$%,0T]2 M0T].0T]21$E!0T%74D]413I/3E=%1"PQ.%-%4#$Y.38L1T%264A/5TQ!3D17 M4D]4``````,`$! ``````P`1$ `````"`0D0`0```-0'``#0!P``GPT``$Q: M1G7 ,,# _P`*`0\"%0*D`^0%ZP*#`% 3`U0"`&-H"L!S973N,@8`!L,"@S(# MQ@<3`H/&,P/%`@!P<G$2(!.(]C0/?Q"'-10_!T 'L K E0-@=P*#-A,/9C<$ M1KD4HS$@"%4'L@*#.!=\H0:P<W1E;0*#.036P12E0G)U<V@&``4$O$U4$,0/ M9A2E%DU]"H"+",\)V3LC/S(U-0* IPJ!#;$+8&YG(' S%"!!"P-L:3$T- +1 M:7XM)R,,T"<C"U44(@P!8ZL`013 ;QVP8P5 1PK &'D(a)2!CP)B%D6U.1( !0 M.F<J$4!S'9.0:6-S+@6@;5TH7^D;<"!W*9(Z+%\I: J+>2<`,S8H1QEB# $I MAF;F7P>0';%A0 = !:$L`=IN!:%D!S L`&$MA0J%5CXOEC3 3P.@5PF +"@@ M,3@&47 UX#DY/C8UT"H*,^\X!C3 26:T('D(8" C0 = ;"HP9G<`< 5 =&@$ M`#(@=1DS0'1I`B '0&ET>5<UT#/0`P!C&^%S!O!U13KR(#J!=&\@'U!E'3E2 M<CB)"K $$'!H<O\^4#TP/E [D1'P"8 \TCI@:3TP:V4J,&<)\ 208?L\X 7 M+3I10) Z`2HP.6+]0&!V&^% 8 F -_\&`#SPO&UU$; R( 6Q"?!T`V!X<'DN M.28SP .@`-!T_G4YPR- !X &T!OA/5(_--] 1S70.U!"=T51)P5 1G!_0/0^ MH"J@`W UT$52.U _,PJ%"H5)($G 2-)K;K\8\#N0!N \4#E2-=!B3&'_2V!% M4COA`9 +@$7Z"? (8/IG'W!B.U \PT9P"H41\$IC"'!E1, @5#_19G]%D4#T M/D@_`2- /!$M@&GO#; YX3T11S%O!Y$\X1](a)YTP!00)*]B=M.[ IH#^S?P(@ M.>$"($DE15))P#I3+I\*CPN1$O(M%5=U6T0*P!$Z8"!6802!('9O03O1.ET@ M(D1+DV__0?$R40=P0)!)(CTP1%55P%<Y0P7 /D@B2HQ,$@`G-P0@/T$UT3(V M`$\C*'-]06 I71(+@ (0-= `P'#^<#]A+!%$$0&1.>$+@#^5WG5A@07 ,\ ] M(6P2`!VPKQ'@.Y W83. 9V S-4\3^B\1LBEA03FP!C$_(41P#0N 9UT23#0R M-B J^SFE290J14 1P4619!%0D<)!`Z!E>&%M"U ], <KP$[P2/,B2U%). !# M2#0Y4T-+,P!02U=.03,W08!95CE12C4B4)&[.3%!`VH?4$EQ!O!L!"#O72!= M-3S@.L!G"E UT#EBOQ' 0?!#L$8"/G IPB@W4G-+8&\S<&EEX01@!1!Z_3]D M,2!P2W %D%P!`R +47D[X',A8+!0L3J!/E%U[P>",] ZL#G0(&4471)$5?]E M<VCC;'1=73RB<4$], 6@QS_0(T Z,2AI+E" -=#_8] $$4158+!!`0.@00)Y M`79I0 !;$%-$<"8Q/^%RC#!W.I$YX3%A>@,08RHP02%-240#`&I!(OM'XCN0 M; 1@;4%-B#,A3;+E!"!?40!R7WD;>?A0D=]?YUTA1'!T4'R!<D\A/J#]*B$H M291@L&$"/*)T(0MPWP7 :<!N<5MQ8.1R7!$\<M\\X6':1B979E=U30N -W#G M3)-+8#IA;FL[D2F!8T&_?I1F<4/0'; W<#Y)*'JS_U64/M$&X$'P@W$$(!3 M8^']*C!D"L #H%O!! `!D#HQ[F$K('\1?9%N*C \( `@_UT2.:$\(#L@`F ] M,#. .N2;*B$%L7%%P "0+6(?0)]<,401.^!\D0&08VM0D?Y"3/-+A(D$.U!? M85.0CL/^=WA"0<$*P#708(%?R74(U5"14 -@8F)#8R+0$?#[;D)O(6QLM%=L M,'\QB5=U[VEPE+"5DC_"<%JP.C%+8/,Z$'>Q86MFHD$#.F,'@.\Z8 1P+8 ( M8&PW<$D1C0&N9D!QD!(\X6%7=2)0,=^-$3_SE_%!\6QB32HPB8+_?> 8@9\$ M;=&8`C_18( '@']0)#M3GP-7=7V!55%*?2CW4,*A#X/3<FZ@8D-Y(U T_WGT M0$5FHD !.I$#85=U4:G_E6$+@)(A0 F%HYV0!Y$BT,][4:.R`Y%\X$5!<B(J M(/L%,#QR+5=U5"%!XIQC@D)_4H$Z\'1A@=*CYC-A!) I]U=O6'^SDU6LT6; MB6$^4=\^,#Z44^(_4JT]* 6Q=]/_,X C0"G0.> UT!]0G;0],/\1P!]A9N*V M2S[S0 %@L$G _P>155*LX8^B7$LUT%TA!:#W"' 1\%"13E5A<\!2<0:0[SI4 M.H$C0&/0=CHC//!&L_^7P MP2>$^\540;U&/)I?1_SI!:-&)0+)%<5%DL#LA M?K.Y::!T(4J,F7^:CT(R4?LYD2LA9*R@2HPJ`K-_M(_]RA)4.L".\,GO"Y$: MD3%Z7CW.S\_?T._1_SW,E2#^2J0A$V%$P,Q"*] G`*.!&2UP('PUD-4P96(Z M@V\@`D!P.B\O=]80GBYA`7A2.^ L`B]^1;#OS&@Y(-9F&X%RG,"MM=4!X%!' M4"!&9J$$D!3 %V*1U8 M<$.O<#(S($I%$B!&VQ!!0V=@1&0@,-N@-S?3)M=# M0/_8%RP"U.'5`=Y/+7#&4-O@L#<@1#G?<-L0,]O0RC,2(#7;$#E#S)72'[_B M;^-_Y(_3!\R5(F$`YN! `#D`\#\O1G:FNP$#`/$_"00```(!1P`!````,@`` M`&,]55,[83T@.W ]26YF97)E;F-E.VP]3$%.1%)5+3DV,#DQ.3(R,#(S.5HM M,34U,C8````"`?D_`0```$H`````````W*= R,!"$!JTN0@`*R_A@@$````` M````+T\]24Y&15)%3D-%+T]5/4Y/5D%43R]#3CU214-)4$E%3E13+T-./515 M3DY9````'@#X/P$````5````2F%M97,@02X@5'5N;FEC;&EF9F4``````@'[ M/P$```!*`````````-RG0,C 0A :M+D(`"LOX8(!`````````"]//4E.1D52 M14Y#12]/53U.3U9!5$\O0TX]4D5#25!)14Y44R]#3CU454Y.60```!X`^C\! M````%0```$IA;65S($$N(%1U;FYI8VQI9F9E`````$ `!S!@L\PQ1J:[`4 ` M"## A(]&=J:[`0,`#33]/P```@$4- $````0````5)2AP"E_$!NEAP@`*RHE M%QX`/0`!````!0```%)%.B `````"P`I```````+`",```````(!?P`!```` M40```#QC/553)6$]7R5P/4EN9F5R96YC925L/4Q!3D1252TY-C Y,3DR,C R M,SE:+3$U-3(V0&QA;F1R=2YN;W9A=&\N:6YF97)E;F-E,BYC;VT^``````>; ` end

1 0

Commentary on news coverage of attacks
by E. Allen Smith 17 Dec '03

17 Dec '03

I thought it was interesting to note what got deleted - namely cryptographic (signature) protection against such attacks - and what got included - namely faked addresses. You can get the original NYT version via JYA. -Allen > _________________________________________________________________ > webslingerZ > _________________________________________________________________ > CONCERN AT RASH OF ATTACKS BY HACKERS ON INTERNET SITES > __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 The Financial Times > SAN FRANCISCO (Sep 19, 1996 00:23 a.m. EDT) -- A rash of hacker > attacks on commercial Internet sites -- including one in which the > services of Panix, a New York-based Internet access provider, were > seriously disrupted -- has raised new concerns about the security and > reliability of the worldwide computer network. [...] > Attacks have been "isolated incidents," said Pete Solvik, > vice-president of information systems at Cisco Systems, the leading > manufacturer of routing equipment for the Internet. The company, > however, is concerned that the problem could spread, disrupting > Internet service for millions of users and effectively closing down > large commercial sites on the Internet. > With many banks and retailers now planning Internet services, the > potential for financial losses as a result of such attacks is rising. > Disruption of Internet service can also be a serious problem for the > tens of thousands of businesses that now rely on electronic mail and > sites on the World Wide Web to communicate with their partners and > customers. > The impact of a large-scale "denial-of-service attack" can be > devastating, said Solvik. Within a minute, a computer linked to the > Internet can be completely overwhelmed and it may take days before > service can be restored. [...] > Because the attacks came from fake addresses on the Internet, it was > "impossible to trace the source without a major effort on the part of > all Internet service providers between Panix and the attacking party," > said Rosen. > "The nature of the Internet, which is designed to let machines > communicate with a minimum exchange of identifying information, makes > every site on the Internet vulnerable," said Rosen. > The Federal Bureau of Investigation's New York Computer Investigations > Threat Assessment Center is understood to be investigating the attack > on Panix. Computer Emergency Response Teams, a US organization that > collates information about security and technical problems on the > Internet, are looking into the incident. [...] > Copyright &copy 1996 Nando.net

1 0

It seems a million dollars in cash is illegal...
by Robert Hettinga 17 Dec '03

17 Dec '03

...in India, anyway. Yes. I know. He probably didn't *earn* it. Well, not *that* way, anyway... Cheers, Bob Hettinga --- begin forwarded text To: economist-politics(a)postbox.co.uk From: The Economist <null(a)postbox.co.uk> Subject: Politics This Week (September 13th - September 19th) Data: Thu Sep 19 17:33:56 GB 1996 Sender: Nobody <nobody(a)ivision.co.uk> Date: Thu, 19 Sep 1996 17:33:57 +0100 **************************************************************************** Welcome to Politics This Week (September 13th - September 19th) A weekly summary of the world's main events from The Economist Also available at http://www.economist.com/ **************************************************************************** <snip> Indian police arrested Sukh Ram, a former communications minister, a month after police found over $1m in cash hidden in his house. Mr Ram was arrested on his return from abroad. <snip> Information about this newsletter This is a free newsletter published by The Economist newspaper. To find out where best to direct queries to The Economist, do not reply to this message. Send a blank e-mail message to help(a)economist.com If you are having problems receiving this list, send an e-mail to support(a)postbox.co.uk To cancel your subscription, send an e-mail with the message "leave economist-politics" to newscaster(a)postbox.co.uk Alternatively, you can cancel your subscription (or re-subscribe at any time) by visiting http://www.economist.com/mailing/ Copyright The Economist Newspaper Limited --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

undeliverable mail
by Brian Durham 17 Dec '03

17 Dec '03

Anyone else having problems posting? I've been getting a mailbox full problem from a vaxen at mqg-smtp3.usmc.mil ... if anyone is interested, will forward error. This post may make it through ...

1 0

unimbibe cypherpunks@toad.com
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:24 AM 9/19/96, Steve Dyson wrote: >unscribe cypherpunks(a)toad.com > Please unimbibe me, too! I tried "unscrive," "unsuscrive," and "unscribe," and even "unsuckscribe," so now I'm trying "unimbibe." Help, I'm trapped on this list and I can't unscrive from it! --Tim (Of course, had I kept any of the many instructions that have been posted, or the instructions I got when I got signed up, I would've known that the correct way to "unsubscribe" is to send a message to "majordomo(a)toad.com" with the body message of "unsubscribe cypherpunks".) We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

(fwd) Strange telephone call
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

>From: vandy(a)avana.net (Vandy Terre) Newsgroups: alt.folklore.urban,alt.pagan,alt.revenge,alt.snowmobiles,ga.forsale,ga.general,misc.consumers.frugal-living,misc.rural Subject: Strange telephone call Date: Wed, 18 Sep 1996 14:27:05 GMT Organization: Tanglewood Farm Lines: 59 Message-ID: <323ffe3d.188173(a)news.avana.net> This message is being cross posted to several groups that I read in an effort to find an answer to my questions. Please email replies, not all posts make it to my server. If you must answer on the net, please trim headers. Okay, this is the story. I just received a strange telephone call. My caller ID system shows only 'OUT_OF_AREA-----000-----'. The female voice claimed to be taking a survey for the Department of Defense and that she was acting as a representative of my government. She did not say US Government or State Government, just 'your government'. When I said that there was no way for me to verify she was what she claimed, she gave me a business name, supervisor's name and an 800 telephone number. She claimed this survey had to do with a Department of Defense program named 'YATS' and told me that if my household did not qualify, then our telephone number would be removed from the calling list. She then ask the same question three different ways. The question was 'Is there anyone in your household between the ages of 16 and 24?'. When I said no for the third time, she said we did not qualify and hung up. So here are my questions. Was this a legitimate call? The government should already know exactly how many people are in my household. It is on my tax forms every year and many other places. Why would any government office or representative of a government office be making cold calls to unknown telephone numbers for any kind of survey? Who or what is 'Westat'? This is the name of the company this woman supposedly represented. The telephone number given to me is 1-800-638-8778. The same woman answered it as called me. Seems like a company doing a survey for the government would have more than one employee. Her supervisor's name is Chris Martin. Is she Chris Martin? In a single person office, I guess you would be your own supervisor. The woman never gave her personal name. This survey was supposed to be for the Department of Defense for a program named 'YATS'. What is YATS? My biggest question is, Is this a new face on an old scam? Instead of posing as the local fire department looking for donations, are the scam-artist now posing as the government? What a way to case a home in preparation for theft or running yet another scam of questionable legality. Yes, I am a very suspicious person. I have seen too many scams being run. Thank you for taking the time to read this. Please answer by email. Please trim headers if answering on the net. Thank you. Any significantly advanced scam vandy(a)avana.net is indistinguishable from religion. Georgia, USA -- frogfarm(a)yakko.cs.wmich.edu (Damaged Justice) is officially declared Unmutual. "Would I had phrases that are not known, utterances that are strange, in new language that has not been used, free from repetition, not an utterance which has grown stale, which men of old have spoken."

3 2

(fwd) Re: Strange telephone call
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

>From: MS <selahi(a)fox.nstn.ca> Newsgroups: misc.consumers.frugal-living Subject: Re: Strange telephone call Date: Thu, 19 Sep 1996 18:19:12 -0400 Organization: NSTN Lines: 159 Message-ID: <3241C6DF.17CE(a)fox.nstn.ca> X-No-Archive: Yes I did an Altavista search on Westat with these results: 1.) Westat's Internet site 2.) A document from the DEFENCE LOGISTICS AGENCY on YATS I guess that phone call wasn't a scam after all... BTW, whenever in doubt, just run your Internet browser and use the search engines. You'll be amazed at how much info you can get by just typing in a word or two. MS 1.) Quoted from Westat's home page (http://www.westat.com/) Westat An Employee-Owned Research Corporation Welcome to Westat Westat is an employee-owned corporation headquartered in the greater Washington, DC, metropolitan area. We conduct surveys and provide statistical research and related services to the agencies of the U.S. Government and a broad range of institutional and business clients. Our diverse staff of 800 enables us to assemble project teams to meet the challenges of complex research projects. With a more than 30-year history of technical and managerial excellence, Westat has emerged as one of the foremost statistical research and evaluation organizations in the United States. Additional Information about Westat: Research Capabilities Program Areas Employee Ownership How to Contact Westat Opportunities for Systems Professionals Statistical Software (WesVarPC) Last Modified: May 14, 1996 Site comments or problems: Webmaster(a)Westat.com Please note: Pages at this site have been designed for viewing with Netscape 1.1X Navigator using monitors displaying at least 256 colors. Use of a different HTML viewer or a display with less than 256 colors may result in the loss of page layout information and/or poor quality images. 2.) Document on 'YATS' (the following lines as they appeared on Altavista's search) No Title May 1, 1996. DEFENSE LOGISTICS AGENCY. Environmental Research Institute of Michigan, Ann Arbor, Michigan, is being awarded an estimated $44,425,774... http://www.fedmarket.com/blue5-1.html - size 8K - 29 May 96 *********** Westat, Incorporated, Rockville, Maryland, is being awarded a $1,630,647 increment as part of a $15,155,183 firm fixed price contract for a Communications Enlistment Decisions - Youth Attitude Tracking Study (YATS). This effort requires the contractor to administer half-hour computer assisted telephone interviews (CATIs) in an annual survey of 10,000 16-24 year-old men and women that evaluates their attitudes toward the military. The purpose of this survey is to provide the Armed Services with market data that enables them to more accurately target advertising and recruiting activities to appeal to potential recruit populations. The project includes design and selection of the sample, modification of the survey instrument, questionnaire administration, compilation and weighting of the data, production of preliminary and public use data tapes and preparation of documentation and analytical reports. Work will be performed in Rockville, Maryland, and is expected to be completed by July 31, 2001. Contract funds will not expire at the end of the current fiscal year. There were 45 bids solicited on January 26, 1996, and two bids received. The contracting activity is the Defense Supply Service-Washington, Washington, D.C. (DASW01-96-C-0041). ************* -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information Tell your friends 'n neighbors you read this on the evil pornographic Internet "Where one burns books, one will also burn people eventually." -Heinrich Heine People and books aren't for burning. No more Alexandrias, Auschwitzs or Wacos.

1 0

[Noise] Do unto others...
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:26 AM 9/19/96 +0000, attila wrote: >Mike Farrell, actor and longtime opponent of the death penalty: > > "We don't rape rapists, > we don't burn arsonists, > why should we kill killers?" > > well, come to thing of it, why don't we let a bull rape a rapist? > > or burn an arsonist at the stake? > > seems fair to me. maybe even sell tickets to pay for the cost. I guess that begs the question of what to do with politicians... "Squeal like a pig! Squeal! Squeal!" "There will be no crisco today!" - Caligula --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: unimbibe cypherpunks@toad.com
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:37 PM 9/19/96 -0700, you wrote: >I tried "unscrive," "unsuscrive," and "unscribe," and even "unsuckscribe," >so now I'm trying "unimbibe." Try sending mail to: drummajor(a)toad.com with uncircumcise cypherpunks in the body of the message. --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: All Bets Off
by Daniel Miskell 17 Dec '03

17 Dec '03

I don't doubt this, honestly. After all, novels alone don't earn the kind of guided tours, information, and assistance he's received on many counts. It had the feel of military connections, but I wasn't about to doubt it, I've allways this truely was the Land Of Opertunity. In any event, he deserves such treatment. He's an excellent author, and does justice to the people he portrays, despite the disclaimer that none of the characters are made to represent anyone living or dead. Daniel.

1 0

Re: Private key server
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:46 AM 9/18/96 -0400, csteel(a)teir.com (Chris Steel) wrote about the problem of getting his public and private keys to various machines around his company, and would like some sort of secret-key-ring server to make it easier to download them (and presumably to avoid leaving them on the disks of shared machines for longer than necessary.) This is, of course, semi-dangerous, for a couple of reasons 1) Limiting access to your secret keyring file reduces the probability of a brute-force cracker attack against your keyring - if your password is "foo", then anybody who has your keyring can probably find that out quickly if they hack a pgp-keyring-cracker. 2) Your keyring has, in cleartext, the identities of the different keys on it. If you only use one id, and it's well-known, that doesn't expose you particularly, but if you're using multiple nyms, anyone who has your file can connect them by just looking at the printable parts of the file. However, assuming you've decided to do it anyway :-), what are your options? You could use a networked file system such as NFS or Netware or the Evil Microsoft NETBIOS-based filesystems, and take advantage of their protections. Since they don't ship encrypted data, any eavesdropper can find them anyway, but they won't be able to just grab the file off the net. You'd be better off, however, using a secure web server, like Apache-SSL, and only providing https: access to the page plus passwords plus address-based restrictions to try to make it accessible only to you and not eavesdroppable. Also, you can encrypt the copy of the secret keyring you distribute using a secret key you can remember. But don't do it :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: PGP in the workplace
by James A. Donald 17 Dec '03

17 Dec '03

At 11:20 PM 9/17/96 -0400, Rick Osborne wrote: > Upon explaining to them that I was simply trying to make sure of my own > security, I was told that I was to just assume that I was secure, and that > *any* 'poking around' was found to be "highly aggravating" and could only > only "exascerbate the situation further.". > > Now, seeing as I'm fairly new to the Corporate world, but is this something > common? Not at all common in my experience, though whether this is because most bosses are more enlightened, or because most bosses are pig ignorant about security, I am not sure. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

** 9/24 Ca. Dig. Sig. Working Group Meeting **
by Kaye Caldwell 17 Dec '03

17 Dec '03

Reposted from spki. - Bill -------- Apologies for duplicates - some of you I'm sure are on multiple notice lists for this. California Digital Signature Regulations Working Group sponsored by the Software Industry Coalition and CommerceNet THIS MEETING IS OPEN TO ANYONE WHO WISHES TO ATTEND However, please let me know if you will be attending via e-mail to: kaye(a)ix.netcom.com WHEN: Tuesday September 24, 1-4 PM WHERE: Sun Microsystems, 901 San Antonio Rd, (Building PAL-1) (corner of S. A. & Charleston, just off 101), Palo Alto Cancun Conference Room, 2nd Floor AGENDA I. Report on status of Secretary of State's Task Force - request for demos of technology in Sacramento II. Review of draft of our principle 1, suggestions for additional principles III. Review of current draft of outline of regulations IV. Review of draft Digital Signature Acceptance Procedures background paper V. Draft language for additional technologies For more information, e-mail Kaye Caldwell at kaye(a)ix.netcom.com or call 408-479-8743. Kaye Caldwell Software Industry Coalition Policy Director CommerceNet Adovocacy and Public Policy Committee Chair -------------------------------

1 0

Re: LEOs running anon servers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:15 AM 9/20/96, "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami. wrote: >This claim was made at a symposium held at Harvard by a sometime lecturer >at the National Defense college. He later denied it. Since lots of other >things he said in the same lecture were plainly false (more likely his >ignorance than a clever attempt to spread FUD), I wouldn't lose sleep over >it. > >Anyway, who cares -- you just use encryption and chaining and all is well. The coauthors (the other works for Science Applications) have never supplied evidence for the verbal claim, as Michael notes. From there paper, they seemed ill-informed, and apparently took most of their material from published Web pages (e.g., Raph Levien's). But I'm not as sanguine about chaining being enough. Think of it as a "percolation" problem, similar to finding a path through a network. To make this clear, if there are M remailers and N of them are "colluding" (whether NSA-controlled or working for Burger King), and one chooses O of them for a chain, what are the chances that one is compromised? To put some numbers on this, if there are 30 remailers and 15 are NSA-owned and one picks 5 remailers in a chain, there's a 3% chance that all the remailers picked are NSA-owned. And so on. A standard probability calculation. There are nuances to consider. Reputations of remailers (beliefs by others, a la Demptster-Shafer propagation of beliefs). Using one's self a remailer is always a nice touch. And so on. I do think there is almost no chance any of the "well-known" remailers are NSA or GCHQ-controlled, but the situation may change as remailers become less well-known and more fluidly instantiated, and as the NSA begins to take more serious notice of remailers than they apparently have so far. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: HipCrime as MetaSPAM
by James A. Donald 17 Dec '03

17 Dec '03

At 02:10 AM 9/15/96 -0700, Bill Stewart wrote: >5) "Anarchist Info" - sigh. Where do people get the idea that publishing >recipes for drugs and explosives is anarchist info? He didn't talk >about anarchy, or getting along without governments, or getting rid of them. >Also, he neglects to note that you can simply _buy_ potassium chlorate, >rather than having to (dangerously) boil down bleach and potassium chloride In addition: Potassium chlorate based explosives are not particularly safe or reliable, but worse than that, much worse, because of their relatively slow detonation rate, they are very ineffectual for smashing stuff and killing people, --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: did you go to school?
by HipCrime 17 Dec '03

17 Dec '03

message returned, then deleted (UNREAD) -- HTTP://www.HIPCRIME.com

1 0

Re: stealthy key exchange
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:37 AM 9/19/96 DST, Bodo_Moeller(a)public.uni-hamburg.de (Bodo Moeller) wrote: >If both have public keys, what is the point of using Diffie-Hellman? >The two channels (Alice -> Bob and Bob -> Alice) are independent, so >they can use different session keys. Alice creates a random key K_A >and sends it to Bob (encrypted with Bob's public key). Alice uses K_A Diffie-Hellman gives you forward security - if an eavesdropper copies your message and later steals your secret keys, he can't decrypt it, because there's no encrypted session key to recover. To prevent man-in-the-middle attacks, sign your half-keys with your public key. There are some problems with this method - it requires several exchanges, so it's awkward to use for email (though you can do it.) Also, it does expose the signed keyparts, which reveals the public key used for signing, though you can play games to prevent this (e.g. negotiate the key, and send the signed keyparts encrypted with the public key, though if there _is_ a man-in-the-middle, the MITM can see this, and your connection will fail.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0