December 2003 - cypherpunks-legacy

No Subject
by Fabio Rosetti 17 Dec '03

17 Dec '03

______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Returned mail: User unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Mon, 2 Mar 1998 14:07:36 -0500 (EST) from ts35-10.homenet.ohio-state.edu [140.254.114.193] ----- The following addresses had permanent fatal errors ----- <54689590(a)hotmail.com> ----- Transcript of session follows ----- ... while talking to mail.hotmail.com.: >>> RCPT To:<54689590(a)hotmail.com> <<< 550 Unknown user <54689590> 550 <54689590(a)hotmail.com>... User unknown Reporting-MTA: dns; mail4.uts.ohio-state.edu Received-From-MTA: DNS; ts35-10.homenet.ohio-state.edu Arrival-Date: Mon, 2 Mar 1998 14:07:36 -0500 (EST) Final-Recipient: RFC822; 54689590(a)hotmail.com Action: failed Status: 5.1.1 Remote-MTA: DNS; mail.hotmail.com Diagnostic-Code: SMTP; 550 Unknown user <54689590> Last-Attempt-Date: Mon, 2 Mar 1998 14:07:44 -0500 (EST) To: 54689590(a)hotmail.com Subject: REMOVE From: cypherpunks(a)toad.com Date: Wed, 02 Jan 1980 01:41:00 -0500 Reply-To: cypherpunks(a)toad.com

1 0

FW: Business Week on encryption controls
by Mixmaster 17 Dec '03

17 Dec '03

-----Original Message----- From: Anonymous <nobody(a)replay.com> To: cypherpunks(a)cyberpass.net <cypherpunks(a)cyberpass.net> Date: Monday, March 02, 1998 10:47 Subject: Business Week on encryption controls >From > >http://www.businessweek.com/premium/10/b3568070.htm > >THE GREAT ENCRYPTION DEBATE > >>Is all this firepower necessary? Many veterans of the decade-long >>encryption battle believe Freeh's plan is too extreme to even take >>seriously. ''Proposals like this are a tremendous stalking horse, but >>are dead on arrival,'' says Kawika Daguio, encryption-policy expert at >>the American Bankers Assn. > >Many cypherpunks seem to believe it is only a matter of time before >crypto is made illegal in the U.S. But sophisticated observers think >otherwise. > >Frankly, the resolution is obvious: crypto-in-a-crime will be controlled. >If you use crypto in planning a crime, and you're convicted of the >crime (or conspiracy), then some years will be added to the sentencing >guidelines. Some cypherpunks will proclaim this the end of individual >freedom in our time. > >>Also, a compromise may be at hand. Senators John McCain (R-Ariz.) and >>J. Robert Kerrey (D-Neb.) are currently working on a bill, sources say, >>that would release exports from controls when similar encryption products >>are already available overseas. They could also add a ban on domestic >>controls. ''It appears McCain and Kerrey are searching for some way >>out of what appears to be legislative gridlock,'' says Commerce Under >>Secretary William A. Reinsch, who oversees the Administration's policy. > >Again, the results are clear to those with vision. Export controls >will be lifted, no domestic controls will be imposed on general use of >encryption. The only new limits will be in the sentencing guidelines, >which already consider dozens of factors in a complex formula. >Whether crypto was used will be a small change there, and won't effect >anyone's life. > >Remember, you read it here first. > This guy is living his elitist life looking through rose colored glasses, with blinders on, in a vacuum, with his head buried in sand, with his neck snugly supported by his sphincter muscles. "vision"?.... "sophisticated"?.... what is this? If people disagree or are more cynical about what the government may or may not do concerning cryptography we are less sophisticated and/or lack vision? What an idiot!! Wake up and smell the bullshit you and others like you are shoveling. McCain is a serious control freak (former AZ resident who has seen him in action) and will never, regardless of his vomitous, pendulous rhetoric, support a domestic "free encryption" standard without government controls, there will always be a catch. The glass is not even half empty, it's shattered.

1 0

Accept Checks By Phone
by way＠utz.com 17 Dec '03

17 Dec '03

Accept Checks By Fax or Telephone Accept checks by telephone, fax or e-mail just like credit cards. The customers signature is not necessary. Verbal authorization over the telephone is all that is needed. Increase your sales and collection results by 200% and more. Don't lose that all important impulse sale because your customer doesn't have credit card or has no available credit to make a purchase. Eliminate credit card chargebacks that can cause you to lose your credit card merchant status! Collect on that problem customer in advance to save you time and money. Do away with the check is in the mail syndrome. It is fast and simple to accept checks over the phone. Donations Collections Sales Monthly Payments Post Dated Checks Here's How It Works! Your telephone sales or collections people simply collect the check information right there over the phone, Telephone Check Systems supplies all the necessary forms. This information can either be faxed into the National Headquarters 24 hours per day, or called in to them between 9 am and 10 PM EST on any business day. As soon as National Headquarters receives the information they will immediately prepare a check against the customers bank account. The checks can be shipped overnight express so that you have them in your hands ready to deposit into your bank account within 24 hours. You can still withhold shipment for bank clearance just as you might normally do with checks received in the mail or you can telephone your customers bank to see if funds are currently available to cover the check if that is your normal procedure. Your Cost...As Low as $1 Per Check Now...enjoy increased sales, payments, collections and donations at a very economical cost. Telephone Check Payment Systems' rates are only 1 3/4% of the amount of the check, with a $1 minimum. That means that a check for $57 cost you only $1. A check for $100 cost you only $1.75...less than a credit card order and less than the charges of any of our competitors that we know of. The one-time set up fee is $295 and you can use the service as much or as little with no monthly penalties, dues or statement fees like there is with credit card merchant accounts. There are over 65 million consumers who have checking accounts but do not have credit cards...plus millions of credit card holders with little or no usable credit currently available on their cards. You can dramatically increase your sales by tapping into this huge market with your ability to take check payments over the telephone. To order your check by phone system complete the order form below and fax to (405) 942-6553 along with your check for $295 or credit card information. CHECK BY PHONE ORDER FORM (Print and fax to (405) 942-6553) Company Name: Shipping Address: City/State/Zip: Telephone Number: Fax Number: Your Name: Title: Home Phone: TAPE YOUR CHECK HERE or Complete Credit Card Information Below Circle One: Visa MasterCard Amex Discover Card holders Name: Card holders Address: City/State/Zip: Card Number: Expiration Date: ____________________________ Signature

1 0

Re: Win95 Dialer?
by Support 17 Dec '03

17 Dec '03

If you're asking if our internet connection service is available in the Win '95 version, the answer is yes. Otherwise, I suggest you call our help desk at 1-888-229-4733 (option #1) for a more complete answer. If you want the Win '95 software, they can send it to you. cypherpunks(a)toad.com wrote: > Can you use Windows95 Dialup Networking with Access Atlanta? > > -Jim

1 0

Cryptobook: '98 update
by andrew fabbro 17 Dec '03

17 Dec '03

Joel McNamara (author Private Idaho) has updated his Cryptobook page, which now has information on newer software. The configuration works much better under Windows 95 now. Check out: http://www.eskimo.com/~joelm/cryptbk.html I have a text file full of notes comparing different hard drive encryption software, if anyone would like a copy. I settled on Best Crypt, which uses BLOWFISH (or GOST, or DES if you're insane). So far it works well...except I haven't found a way to have Windows' swap file encrypted. Have fun... -- Andrew Fabbro [afabbro(a)umich.edu] [andrewf(a)jesuswept.com] http://www-personal.umich.edu/~afabbro/ 313.647.2713

1 0

Warning: could not send message for past 4 hours
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

********************************************** ** THIS IS A WARNING MESSAGE ONLY ** ** YOU DO NOT NEED TO RESEND YOUR MESSAGE ** ********************************************** The original message was received at Mon, 2 Mar 1998 14:14:28 -0500 (EST) from ts35-10.homenet.ohio-state.edu [140.254.114.193] ----- The following addresses had transient non-fatal errors ----- <Remove(a)rmjent.com> ----- Transcript of session follows ----- 451 <Remove(a)rmjent.com>... rmjent.com: Name server timeout Warning: message still undelivered after 4 hours Will keep trying until message is 5 days old Reporting-MTA: dns; chemistry.mps.ohio-state.edu Arrival-Date: Mon, 2 Mar 1998 14:14:28 -0500 (EST) Final-Recipient: RFC822; Remove(a)rmjent.com Action: delayed Status: 4.4.3 Last-Attempt-Date: Mon, 2 Mar 1998 19:02:17 -0500 (EST) Will-Retry-Until: Sat, 7 Mar 1998 14:14:28 -0500 (EST) To: Remove(a)rmjent.com From: cypherpunks(a)toad.com Date: Wed, 02 Jan 1980 01:47:53 -0500 Reply-To: cypherpunks(a)toad.com

1 0

No Subject
by Luckey Promotions 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> Mothers day, Mothers day. ----------------------------------------------------------------------------------------------------------------------------------- NOW IS YOUR CHANCE TO WIN THE PRIZE BELOW --------------------------------------------------------------------------------------------------------------------------------------- Prize, A 9ct Gold diamond set heart shaped pendant with 18inch chain. Also a luxury bouquet of flowers along with a box of Belgium chocolates. Make your mums day special. To enter answer the question below. On which day of the week is Mothers Day? Now Simply Call The Number Below 0991 118801 The winner will be the first correct entry drawn at random by 11am on Friday 20th March 1998. This competition is promoted by Luckey Promotions. 333a Licoln Road Peterborough Cambs PE1 2PF. The closing date for the competition will be Friday 20th March 1998 at 10am. There will be one winner who will be the first correct entry drawn from the sack. The winner will be notified by phone on the 20th March 1998 between 11am-5pm. Please ask permission from the person who pays the telephone bill before calling. Calls cost £1.00 per minute Maximum cost of call £3:00 Minimum age to enter competition 18 years of age . Open to U.K residents only. The winners information can be obtained by calling 0181 2364221 To delete your e mail address from our database please inform via mail to the address above. </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Trial Class 1 VeriSign Digital ID
by VeriSign Digital ID Center 17 Dec '03

17 Dec '03

QUICK INSTALLATION INSTRUCTIONS ------------------------------- To assure that someone else cannot obtain a Digital ID that contains your name and e-mail address, you must retrieve your Digital ID from VeriSign's secure web site using a unique Personal Identification Number (PIN). Be sure to follow these steps using the same computer you used to begin the process. Step 1: Copy your Digital ID PIN number. Your Digital ID PIN is: 7278ce06ea0aedffb942b1b7468471a3 Step 2: Go to VeriSign's secure Digital ID Center at https://digitalid.verisign.com/getid.htm Step 3: Paste (or enter) your Digital ID personal identification number (PIN), then select the SUBMIT button to install your Digital ID. That's all there is to it! WELCOME TO THE CLUB ------------------- Congratulations on obtaining a Trial Class 1 Digital ID(sm) from VeriSign! As a Trial Digital ID holder, you join millions of users who can send and receive secure e-mail using the built-in features of the latest versions of Netscape, Microsoft, and other popular e-mail packages. You also gain easy access to popular websites using your Digital ID instead of passwords and one-step registration at websites requesting Digital IDs. Your Digital ID contains the following information: Name or Alias: RANDOM Q. HACKER E-mail Address: cypherpunks(a)toad.com To find out more about where and how to use your Digital ID, please visit us at http://www.verisign.com/ or visit our Help Desk at http://www.verisign.com/help/index.html. And don't forget that you can enjoy the benefits of a Full Service Class 1 Digital ID-including $1000 protection under the Netsuresm Protection Plan, directory services, and free replacement, renewal, and revocation of your ID 24 hours a day, 7 days a week --for only $9.95 (U.S.) a year. To upgrade, please visit our Digital ID Center at http://digitalid.verisign.com. Thank you for choosing VeriSign! We look forward to serving your future electronic commerce and communications needs.

1 0

New Customers for your Neighborhood Business, Church, Practice...
by 10510344＠30330.com 17 Dec '03

17 Dec '03

You know that new customers are the lifeblood of any local business; and WE CAN HELP YOU FIND MORE! That's because we know WHO'S NEW - those who recently came to live in your market or service area. We can tell you each month who and where they are, so that you can advertise to them (eg by mail) before they have time to get established with your rivals. Whether you own or manage a retail store, a clinic (medical, dental, veterinary...), a church, club, a private school, beauty salon, restaurant, professional office or bank - this is a prime opportunity to gain MORE new clients and so to increase growth. What we can help you do is MORE THAN to replace customers who move away; to get more than your "share" of new arrivals to Town, by putting YOUR name and special offer before them at the very time they are making decisions about whom to patronize. If you don't own or manage such an establishment, please pass this along to a friend who does. But if you do, find out more details now from our Web site, which you can reach at http://www.famailcrt.com/c-am.com Sincerely, Jim Davies

1 0

Is CDMF secure?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Is CDMF secure? and, What sort of algorithm is it? Thanks.

3 2

The Bioweaponeers
by John Young 17 Dec '03

17 Dec '03

The New Yorker magazine of March 9 has a long shattering essay on Ken Alibek, the former Soviet bioweapons expert, William Patrick, the US's counterpart, the state of Russian secret bioweapons development, and prospects for the spread and use of this WMD. It's far more disturbingly detailed than the New York Times and ABC PrimeTime reports, and presents a horrific spectrum of gruesome details of nearly unimaginable catastrophe fermenting in secret laboratories and deepest black storage tanks. If you thought nuclear weapons were terrifying, read this for a shocking introduction to evil which will give even thermonuclear warriors nightmares of helplessness. Where Strangelovian physicists once ruled, now reign Mad microbiologists. Richard Preston is the writer, featured on PrimeTime and author of The Hot Zone, on the Ebola virus. For those without easy access to the magazine we offer a copy: http://jya.com/bioweap.htm (62K)

1 0

Shave Slaughter '98
by Perrin . 17 Dec '03

17 Dec '03

I have shut down all paint factories in the area. Shaving cream war!! Pshhhhhh... splat! Ha ha! Who's laughing now?! I own all of the shaving cream companies! I own all of their stocks! Shave Slaughter '98 has started. Prepare to die. Hairface ------------------- I'm assuming it's the same rules as Paint War - Perrin ------------------ fixed by Perrin pleontks(a)hotmail.com http://members.tripod.com/~pleontks http://www.angelfire.com/az/69frank69 ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

COSTUME BALL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cypherpunks, It's that time again. My next gala costume ball is March 14th. You are invited. The full invitation is at: http://www.c2.net/~sandy/98mar.htm Please read the invitation carefully. The devil is always in the details. This notice is being sent via the Cypherpunks Announce List. If you don't want to be on the list, DON'T e-mail me. I can't get you off the list. To get off the list, send e-mail to: majordomo(a)toad.com As the first line of the message, write: unsubscribe cypherpunks-announce Hope to see you on the 14th. Regards, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Hard Drive Encryption Packages Comparison (Win 95)
by andrew fabbro 17 Dec '03

17 Dec '03

Windows 95 Hard Drive Encryption Packages Comparison ---------------------------------------------------- by Andrew Fabbro <afabbro(a)umich.edu> 3 March 1997 I've had several requests to post this to the cypherpunks list, and I'm also posting it in the newsgroups where I originally asked for software suggestions. This list only compares FEATURES -- I have not done any independent analysis of these products' claims and have not even tried the evaluation copies of all of them. This was originally just for my own reference -- I've cleaned it up a bit but it isn't exhaustive, or necessarily fair. I'm sure there are other packages-- if you think I've left something significant out, please let me know. I'd also appreciate any corrections or giggles at obvious errors in thought. After getting some feedback/corrections, this will eventually be put on the Web. ---------- DISCLAIMER ========== I am just a Doc-Martens-and-earrings cypherpunk, not a security consultant! I am not a professional cryptologist, nor a Windows 95 expert. You should NOT take my opinions at face value -- you should evaluate these products yourself. This list is just designed to give you some starting points and save you some leg work. Of course, I take no responsibility, make nor warranties, blah blah... ---------------------------------------- INTRO: EXPLANATION OF LISTINGS AND TERMS ======================================== These packages all provide interface functionality beyond the simple file-by-file encryption available with, say, PGP. Either they provide a drive interface or they allow you to designate a list of files which are then transparently or automatically de/encrypted in some fashion. If you have only a few files or anticipate only temporary or infrequent de/encryption, then PGP or something similar would probably suffice. I've separated this list into two categories using my own made-up terms: Virtual Volume programs and File List programs. VV programs make a large file on your hard drive which is transparently available to Win95 as a drive (similar to the way DriveSpace/DoubleSpace works). Once you authenticate and mount the drive, everything else is transparent. With File List programs, you designate a list of files or folders that you want encrypted. The encryption package then en/decrypts these either on-the-fly as you access them, or in bulk at boot-time/ shutdown-time. Most offer individual file/folder manual operation as well. Unlike Virtual Volume programs, which pretty much all operate the same way, there is a greater variation in interface with File List programs, so evaluate closely before purchase. In practice, the difference between Virtual Volume and File List programs is not that great: you type your password once at login and everything else is handled by the software. The only difference is that with File List programs, you have to designate files or folders, which might be a more frequent task than designating a single drive. On the other hand, all of your sensitive files may live in only a few directories anyway, and File List programs let you place these files/folders anywhere on your system, mingled in with non-encrypted files. There were a few packages which appear to operate in a truly manual mode -- you decrypt before opening and then encrypt when you're finished with the file (assuming you don't forget, or become lazy). If you're going to do this, just use PGP, which is likely already on your system already, you little cypherpunk, you, and offers CAST, IDEA, and Triple-DES. Packages with manual-mode operation are under "Manual-Operation Packages" at the end. Norton is so vague about the operation of "Your Eyes Only" on their web page that it is listed in this section. "Preview" refers to an evaluation copy-- if one is available for download (be it crippleware or whatever), this field is marked Yes. ---------------- MY PERSONAL PICK ================ I'm still evaluating, but will likely settle on Kremlin. Even though virtual volumes seem easier to me, Kremlin has one must-have feature I haven't found elsewhere: it addresses the Windows swapfile issue. Windows' swapfile has raw hunks of memory swapped out to disk, which which could contain anything from any open file. These swapfiles are not reliably deleted at shutdown-time, or in the event of a system crash, and in any event Windows certainly doesn't securely (DoD-style) delete them. Some snooper with a boot disk, file recovery utility, and hex editor could stop by and read previous memory images...talk about data leakage. None of these packages allow you to encrypt the swapfile while Windows is running, but Kremlin's Sentry does the next best thing. At shutdown-time, it securely deletes the swapfile and other temp files, wiping the drive DoD-style. The fact that Kremlin's design was obviously thought out from the perspective of an integrated platform and took this issue into account gives me a warm fuzzy feeling. Also, Kremlin offers the most diverse array of algorithms and has some nice extras, such as a secure Recycle Bin, which is easier to use than having to remember to run a special secure delete command from the context menu. And it's only $35! If I were administering a site-wide encryption program, I might choose something that was designed for that environment and offered more administrative options. I've made notes on packages which address this situation and its issues. ---------- SIDE NOTES ========== BLOWFISH was specifically designed to be fast in software implementations on 32-bit processors and would likely be the fastest algorithm you can pick. I've not noticed any lag when using BLOWFISH-based systems on a 486-66 w/32MB RAM (hardly a fast machine). Some publishers only specified a "Genuine RSA Encryption Engine," displaying a RSA-licensed logo. This isn't snake oil, but I'd sure like to know more about the crypto. ----------------------- VIRTUAL VOLUME PACKAGES ======================= Product : BestCrypt Manufacturer : Jetico, Inc. Type : Virtual Volume Crypto : BLOWFISH, GOST, DES Features : timeout close, hotkey close, secure delete Cost : $89.95 Preview? : Yes - 30 day trial, after expiration, volume becomes read-only Web : http://www.jetico.sci.fi/np_new.htm Notes : Joel McNamara (Private Idaho's author) picks this for his Cryptobook specification (see http://www.eskimo.com/~joelm/cryptbk.html) A completely free and very well-designed DoD-spec file deletion utility is available at Jetico web site, too, as a separate freeware package (BCWipe - get it!) Product : SafeHouse Manufacturer : PC Dynamics Type : Virtual Volume Crypto : BLOWFISH, FAST, DES/Triple DES Features : Configurable passwords/expirations, optional key recovery, C++ developer's toolkit available. Cost : $79.95 Preview? : Yes - free trial version with 40-bit DES Web : http://www.pcdynamics.com/SafeHouse/ Notes : key recovery is optional- you can choose to "brand" the volume or not. Product : Private Disk (in beta) Manufacturer : Private Data, Inc. Type : Virtual Volume Crypto : Not specified - "strong" versions for US/Canada Features : Cost : not listed Preview? : Beta participation program Web : http://www.privatedata.com/ Notes : I mention this only for die-hard cypherpunks who want to try new toys and might be interested in beta participation. ------------------ FILE LIST PACKAGES ================== Product : Kremlin Manufacturer : Mach5 Type : File List Crypto : CAST, IDEA, BLOWFISH, RC4, Safer SK-128, DES, and NewDES Features : Automatic Decrypt/Encrypt at Login/out, includes a secure text editor/e-mail package, secure Recycle Bin, Sentry program to automate swap/temp/other-file wiping. Cost : $35 Preview? : Yes Web : http://www.mach5.com/kremlin/ Notes : This is a very nice package and my personal pick -- see my notes in the intro. Product : RSA SecurePC Manufacturer : Security Dynamics, Inc. Type : File List Crypto : RC4 Features : Trustee threshold key recovery system, boot lock, screen lock, network support, password expiration/rule management Cost : Not listed, and I was too lazy to make a phone call to find out Preview? : Yes Web : http://www.securitydynamics.com/solutions/products/securpc.html Notes : The key-recovery system is very well-thought out and involves trustee thresh-holds -- i.e., you can decide that three (or seven or whatever) administrators' signatures are necessary to recovery a key...prevents malicious admins' snooping. The admin support (for site-wide usage) is also nice. This product was formerly published by RSA, who now licenses it to Security Dynamics. This looks like a very well-designed package with many extras for group-use situations, though more crypto options would be nice. Product : SecureWin Manufacturer : Cipher Logics Type : File List Crypto : RSA Public. No further details were specified. Features : SecureWin is more of an integrated security environment than just a hard drive encryptor -- it also includes secure deletions, e-mail integration, a password keeper, etc. There is an extensive access-control facility. Operates via a "secure Start menu," a taskbar add-on. Network support. Cost : $29.95 Preview? : Yes - 30 day evaluation download. Web : http://www.securewin.com/ Notes : Very well done from a user interface point of view and has numerous cool add-ons. I wish more information was given on the crypto and its implementation. Product : F-Secure Desktop Manufacturer : Data Fellows Type : File List Crypto : Triple-DES ("168-bit"), BLOWFISH Features : Cost : $99 Preview? : No Web : http://www.datafellows.com/f-secure/desktop/ Notes : Normally, you specify a set of folders/files to be de/encrypted at login/out. Alternatively, you can list files as "Top Secret," which means you must manually de/encrypt them via context menu. Product : DataGuard Manufacturer : Secure Services Link, Ltd. Type : File List Crypto : IDEA, SEAL Features : extensive class-based access control, trustee-threshold key recovery system Cost : $69 Preview? : No Web : http://www.sls.net/dataguard_v2.html Notes : The class-based access control lists appear to offer highly configurable access control: classes of data (e.g., workgroup or by sensitivity or whatever), with access rights offered by right to select users. You can also set "minimum eyes" thresholds for groups-- e.g., all members or certain members must be present for access to be given. Encryption or decryption rights can be separated. This would be very nice for site-wide situations, except...the basic package does not offer network support. "Pro" and "Net" packages which do are slated for April '98 release. ------------------------- MANUAL-OPERATION PACKAGES ========================= Product : SAFE Folder Manufacturer : GlobeTech Catana Type : File List, Semi-Manual Crypto : BLOWFISH Features : Cost : $58.75 Preview? : Yes - password fixed to "DEMO" Web : http://www.globetech.se/safe/ Notes : From the web page, I infer that you have to manually de/encrypt files. It can operate at a folder level, which is at least some improvement over file-by-file operation. I didn't see any reason why this product would be better than any of those listed above. Product : Your Eyes Only Manufacturer : Norton (Symantec) Type : File List, Manual? Crypto : It uses a "Genuine RSA Encryption Engine". Features : boot-time lock, screen lock, uses context menu, network support Cost : $89.95 Preview? : No Web : http://www.symantec.com/yeo/index_product.html Notes : I couldn't tell if this operated in some sort of transparent or automatic fashion like other file list programs, or if you had to encrypt/decrypt each folder manually. A screen shot shows a user using a context meny that has "Enable SmartLock Folder" and "Disable SmartLock Folder," which implies some non-manual mode of operation. E-mail to Symantec asking for more information (and details on their crypto) went unanswered. There is also an administrator's version of this program. Product : Stealth Encryptor Manufacturer : Tropical Software, Inc. Type : File List Crypto : BLOWFISH, DES ("64-bit") Features : installable crypto modules (via .DLL, development kit available), secure delete, e-mail integration Cost : $34.95 Preview? : Yes Web : http://www.tropsoft.com/stealth/ Notes : This package's unique feature is its support for drop-in crypto modules. Theoretically you could write your own .DLL with another crypto system of your choice and Stealth Encryptor would integrate it. If you have a burning desire to do this, you might look into this. SE also features "Stealth Media Encryption" which is "super speed" for image files, executables, etc...presumably with weaker crypto. Product : SecureStore Manufacturer : Selom Ofori Type : Manual Crypto : BLOWFISH, DES/Triple-DES, CAST, RC4, Diamond2 Features : Cost : $30 Preview? : Yes Web : http://www.freeyellow.com/members/renegade/ Notes : SecureStore creates archives into which you can place files. From what I saw on their web site, to access aid files, you have to pull them out of the archive again. While the screen shots show some nice displays (e.g., which crypto used, compression ratio, etc.), this mode of operation does not appeal to me. Product : Pretty Good Privacy (PGP) Manufacturer : PGP, Inc. (well, Network Associates now, I guess) Type : Manual Crypto : CAST, IDEA, Triple-DES Features : Too many to list. Cost : Free Preview? : Yes Web : http://www.pgp.com/ Notes : Listed just for the sake of completeness. And it's not at all bad for manual encrypt/decrypt -- version 5.5 has a nice toolbar and tray interface. But you'll want it for all the other messaging features anyway...

1 0

Crypto Law Survey updated
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

I have just updated my survey of existing and envisaged cryptography laws and regulations. See the Crypto Law Survey at http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm This update includes: -update on European Union (ETSI on TTP; Eckhert statement; COM (97) 503 "not important"; Birmingham conference), Council of Europe (PC-CY), Belgium (law amended), Canada (crypto policy discussion paper), France (Lorentz report), Gemany (Sandl statement; no backdoor in Pluto), Israel (export revision), Netherlands (proposals to extend decryption command; TTP project; encrypt to "seize"; use remains free), Scandinavia (PSS no longer Nordic), United Kingdom (policy announcement delayed; SfL resolution), United States (interim export rule; California resolution; czar travels; Compsec Enhancement Act; Kerrey McCain revised; AES conference) -corrections on Estonia (controls were reported), Switzerland (telecom > radio) -clarification on Wassenaar Arrangement (General Software Note), Germany (export), Israel (case-by-case decisions), Sweden (Internet export), US (SAFE versions) -URL added to Canada (gov PKI), Hong Kong (export) Kind regards, Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

1 0

Medical Privacy Alert
by JWRCLUM 17 Dec '03

17 Dec '03

AMERICAN CIVIL LIBERTIES UNION OF MASSACHUSETTS 99 Chauncy Street, Suite 310, Boston, MA 02111 (617) 482-3170 Fax (617) 451-000 CONTACT: John Roberts (617) 482-3170 http://users.aol.com/mcluf/home.html BENNETT-JEFFORDS BILL PLACES MEDICAL RECORD PRIVACY AT RISK The confidentiality of the doctor-patient relationship will be totally undermined as medical records become widely available without patient knowledge or consent. BOSTON - February 27, 1998. On Thursday 2/26/98 the United State Senate's Labor and Human Resources Committee heard testimony concerning a bill proposed by Senators Bennett and Jeffords that, if passed, would license the widespread disclosure of personal medical information contained in files held by doctors, hospitals, employers, educational institutions, and others. The bill which purports to be a privacy bill is, in fact, just the opposite. It places virtually no restrictions on the disclosure of personal medical records within health care entities (no matter how large and geographically widespread) or to a long list of other entities and agencies including the following: - any agents or contractors of the health care entities - Public Health Agencies, Oversight Agencies - Health Care Accreditation Agencies - State Health Care Databases There are major loopholes in access provisions for - Health Care Researchers - "Outcome" analysts ("cost/benefit" analysts for hospitals, HMO's, insurers, etc) Even law enforcement agencies will have easy access to browse computerized medical record systems for so-called "legitimate" investigatory purposes. This will make every American's medical record part of a new massive law enforcement database. The bill will destroy the confidential "doctor-patient relationship" and replace it with a new "patient-health care industry relationship." "This bill serves only the interests of the burgeoning health care industry," said John Roberts, Executive Director of the ACLU of Massachusetts. "It allows the transfer of your medical records to many entities that stand to profit from its information. Gone is doctor-patient confidentiality. Your doctor cannot protect your most sensitive medical information from many entities outside your medical facility. Even employers who have health plans are considered 'health care providers' in the Bennett-Jeffords bill. How many of us want our employers to have access to any of our medical records without our knowledge or consent?" The bill will also - Impose requirements that patients sign blanket consent forms for release of information as a condition of getting treatment, even for self-pay patients - Redefine "treatment" to make the patient's record a subject of continuous research - Blur the boundaries between individual patient care and the so-called "Population Management" and "Disease System Management" The bill will pre-empt all state laws which may be more protective of the confidentiality of medical records. The bill will not apply even its own minimal privacy protections to so-called "non-identifiable" medical records information. But...interestingly, the bill also refers to issuing "keys" to re-identify previously purportedly "non- identified" information. A formal logical analysis of this reveals that the bill itself admits that what it calls "nonidentifiable" medical record information is actually identifiable (i.e. containing patient information). The ACLU of Massachusetts believes that what is really needed for medical privacy protection would be the following: - Federal law should set a foundation or floor of privacy protection - State laws which are more-protective of patient's rights should not be preempted - No "Unique Patient Identification Numbers" - No electronic "linkage" of patient records stored in various sites - Computerized patient records must be encrypted with keys provided only to those directly involved in the individual patient care - The right of the individual patient to contract directly with physicians and health care providers regarding the privacy of the patient's medical records. -end-

1 0

No Subject
by Michael Camp 17 Dec '03

17 Dec '03

help b093161c(a)bc.seflin.org

2 1

Original Sources for Echelon
by John Young 17 Dec '03

17 Dec '03

Duncan Campbell has posted the message below on Echelon. Would anyone happen to have a copy of the 1988 New Statesman article? If not, I'll dig it out of a library. More importantly, as Duncan asks, does anyone know of other original info on Echelon? ---------- Date: Mon, 02 Mar 1998 23:35:59 To: ukcrypto(a)maillist.ox.ac.uk From: Duncan Campbell <duncan(a)gn.apc.org> Subject: Original sources regarding the ECHELON sigint network >>The New York times has recently run a story regarding a "telecommunications >>interception network" operating in Europe. >>My recollection is that news broke about this some time last year, thanks >>to revelations in New Zealand. Sorry, I don't have a good reference to >> hand. The original and primary source for information on ECHELON is an article I wrote in New Statesman magazine ten years ago : NS, 12 August 1988 : "They've got it taped". In 1991, a UK World in Action programme added an important new detail about the network, namely the presence of a DICTIONARY computer (a key part of the system) at GCHQ's processing centre in Westminster. In 1993, I produced a documentary for Channel 4 - "The Hill" which related ECHELON to the work of the Menwith Hill NSA field station near Harrogate in Yorkshire. In 1996, Nicky Hager in New Zealand described in his book "Secret Power" the presence of DICTIONARY computers at two New Zealand sigint stations, and gave extensive details of the local programming and tasking of the ECHELON "dictionaries". Apart from these sources, so far as I am aware all the reports that are around are derivative and reprocessed. The European Parliament STOA committee report from the "Omega Foundation" is in this category and was in fact submitted rather more than a year ago. If anyone is aware of any other *original* publication on this topic, could they post it. The arrival in the public domain of original information in this area is a rarity, yet is the foundation for the only things we "know" about the scale of NSA/GCHQ surveillance and processing. Duncan Campbell

1 0

Fwd: Thoughts
by Perrin . 17 Dec '03

17 Dec '03

Not So Deep Thoughts Should vegetarians eat animal crackers? If at first you don't succeed, skydiving is not for you. The pen is mightier than the sword -- if the sword is very small and the pen is real sharp. If you throw a cat out a car window, does it become kitty litter? Call me insane one more time and I'll eat your other eye! I didn't fight my way to the top of the food chain to be a vegetarian. When it rains, why don't sheep shrink? The two biggest problems in America are making ends meet and making meetings end. Stupidity got us into this mess. Why can't it get us out? The trouble with doing nothing is that you never know when you are finished. Money isn't everything, but at least it encourages relatives to stay in touch. If a stealth bomber crashes in a forest, does it make a sound? A single fact can spoil a good argument. Growing old is mandatory, but growing up is optional. I do whatever my Rice Krispies tell me to. Why do we sing "Take me out to the ball game" when we're already there? ---------------- fixed by Perrin pleontks(a)hotmail.com http://members.tripod.com/~pleontks http://www.angelfire.com/az/69frank69 ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Fwd: Taglines
by Perrin . 17 Dec '03

17 Dec '03

*** Some Funny Taglines ***** 2 rules to success in life. 1. Don't tell people everything you know. A good pun is its own reword. A penny for your thoughts; $20 to act them out. After silence, music comes closest to expressing the inexpressible. Alcoholic: Someone you don't like who drinks as much as you do. All things are possible, except skiing through a revolving door. Any man who can see through women is sure missing a lot. Apathy Error: Don't bother striking any key. Blessed are the censors; they shall inhibit the earth. Budget: A method for going broke methodically. Can you think of another word for "synonym"? Circle: A line that meets its other end without ending. Civilized people need love for full sexual satisfaction. Cole's Law: Thinly sliced cabbage. Conscience is what hurts when everything else feels good. Consider what might be fertilizing the greener grass across the fence. Death and taxes are inevitable; at least death doesn't get worse every = year. Defeat is worse than death because you have to live with defeat. Despite the high cost of living, it remains popular. Does Time pass? Yes, it does. How else can you explain Visa bills? Don't use no double negatives, not never. Don't sweat the petty things, just pet the sweaty things. Don't eat the yellow snow. Down with categorical imperatives. Either I'm dead or my watch has stopped. =20 Electricity comes from electrons; morality comes from morons. Everything in moderation, including moderation. Familiarity breeds children. Fast, Cheap, Good: Choose any two. Fools rush in -- and get the best seats in the house. Give me chastity and continence, but not just now. -- St. Augustine Have an adequate day. He has the heart of a little child... it's in a jar on his desk. He who dies with the most toys is nonetheless dead. He who laughs last didn't get the joke. Honesty is the best policy, but insanity is a better defense. Horse sense is the thing a horse has that keeps it from betting on = people. Hospitality: Making your guests feel at home, even though you wish they = were. How come wrong numbers are never busy? I bet you have never seen a plumber bite his nails. I do a lot of thinking in the john. Says a lot for my thoughts. I have had a perfectly wonderful evening. But this wasn't it. -- = Groucho Marx I have seen the future and it is just like the present, only longer. -- = Albran I like work; it fascinates me. I can sit and look at it for hours. I may not be the world's greatest lover, but number seven's not bad. -- = Allen I never forget a face, but in your case I'll make an exception. -- Marx = I will meet you at the corner of Walk and Don't Walk. I never made a mistake in my life. I thought I did once, but I was = wrong. I used to be lost in the shuffle. Now I just shuffle along with the = lost. I want to die in my sleep like my father, not screaming like his = passengers. I will always love the false image I had of you. I would give my right arm to be ambidextrous. I would like to help you out. Which way did you come in? If at first you don't succeed, destroy all evidence that you tried. If at first you don't succeed, you probably didn't really care anyway. If at first you do succeed, try to hide your astonishment. If it wasn't for muscle spasms, I wouldn't get any exercise at all. If it were truly the thought that counted, more women would be pregnant. If there is no God, who pops up the next Kleenex? -- Art Hoppe If time heals all wounds, how come bellybuttons don't fill in? If today is the first day of the rest of your life, what was yesterday? Illiterate? Write for free help. In order to get a loan you must first prove you don't need it. It doesn't matter whether you win or lose -- until you lose. It is a miracle that curiosity survives formal education. -- Albert = Einstein It is better to have loved and lost than just to have lost. It is not an optical illusion, it just looks like one. -- Phil White=20 It was a brave man that ate the first oyster. I'll procrastinate...tomorrow. I'll race you to China. You can have a head start. Ready, set, GO! Keep a very firm grasp on reality, so you can strangle it at any time. Keep stress out of your life. Give it to others instead. Knocked; you weren't in. -- Opportunity=20 Know what I hate most? Rhetorical questions. -- Henry Camp=20 Laugh at your problems; everybody else does. Laugh, and the world ignores you. Crying doesn't help either. Lead me not into temptation. I can find it myself. Life is like a fountain... I will tell you how when I figure it out. Life is like an analogy. Make a firm decision now... you can always change it later. Male zebras have white stripes, but female zebras have black stripes. May you die in bed at 95, shot by a jealous spouse. Money DOES talk -- it says good-bye. Most of us hate to see a poor loser. Rich winners, though, are worse. Mr. Bullfrog sez: Time is fun when you're having flies. My name is Annie Key. Ouch! Why are you hitting me?! My mother is a travel agent for guilt trips. My opinions might have changed, but not the fact that I am right. Never deprive someone of hope; it may be all they have. Never put off till tomorrow what you can ignore entirely. Never forget: 2 + 2 =3D 5 for extremely large values of 2. Never hit a man with glasses. Use your fist. Next time you wave at me, use more than one finger, please. No prizes for predicting rain. Prizes only awarded for building arks. Nobody ever goes there, it's too crowded. (I've actually HEARD this!)=20 Nothing cures insomnia like the realization that it is time to get up. One good turn usually gets most of the blanket. Our policy is, when in doubt, do the right thing. -- Roy Ash=20 Out of the mouths of babes does often come cereal. People who think they know everything greatly annoy those of us who do. Politics: n. from Greek; "poli" - many; "tics" - ugly, bloodsucking = parasites. Quidquid latine dictum sit, altum viditur. (Anything in Latin sounds = profound.) Radioactive cats have 18 half-lives. Some people would not recognize subtlety if it hit them on the head. Someday you will get your big chance -- or have you already had it? Sometimes you're the bug, and sometimes you're the windshield. Sometimes a cigar is just a cigar. -- Sigmund Freud=20 Stealing a rhinoceros should not be attempted lightly. That was Zen; this is Tao. The generation of random numbers is too important to be left to chance. The trouble with political jokes is that they get elected. The secret of success is sincerity. Once you can fake that, you have it = made. The death rate on Earth is: .... (computing) .... One per person. The most enjoyable form of sex education is the Braille method. The number watching you is proportional to the stupidity of your action. The trouble with being punctual is that no one is there to appreciate = it. There are 3 kinds of people: Those who can count and those who can't. There must be more to life than sitting wondering if there is more to = life. They laughed when I said I'd be a comedian. They aren't laughing now. This aphorism would be seven words long if it were six words shorter. This will be a memorable month -- no matter how hard you try to forget = it. This is the sort of English up with which I will not put. -- Winston = Churchill This sentence contradicts itself: no, wait, actually it doesn't. To err is human. To admit it is a blunder. To err is human. To blame someone else for your errors is even more = human. Toe: A part of the foot used to find furniture in the dark. -- Rilla = May=20 Two wrongs don't make a right, but three lefts do. Under capitalism, man exploits man. Under communism, it is just the = opposite. We aren't sure how clouds form. But they know, that is what counts. What is mind? No matter. What is matter? Never mind. -- Thomas Key=20 What if there were no hypothetical situations? --Andrew Kohlsmith=20 When you are in it up to your ears, keep your mouth shut. When professors want your opinion, they'll give it to you. Where there is a will, there is an Inheritance Tax. Why don't "minimalists" find a shorter name for themselves? Why is "abbreviated" such a long word? Why take life seriously? You're not coming out of it alive anyway! Why isn't "phonetic" spelled the way it's said? Winning isn't everything, but losing isn't anything. You simply *must* stop taking other people's advice. You can fool some of the people some of the time, and that is = sufficient. You have the capacity to learn from mistakes. You will learn a lot = today. Your lucky number is 364958674928. Watch for it everywhere. ---------- fixed by Perrin pleontks(a)hotmail.com http://members.tripod.com/~pleontks http://www.angelfire.com/az/69frank69 ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Barry Smith (FBI) to speak this Friday at 3:30pm
by Dr. Alan Sherman 17 Dec '03

17 Dec '03

The UMBC Security Technology Research Group presents A Law-Enforcement Perspective on Encryption Policy Barry Smith Supervisory Special Agent, FBI moderated by journalist Peter Wayner 3:30pm - 5:00pm Friday, March 6, 1998 Lecture Hall III University of Maryland, Baltimore County http://www.cs.umbc.edu/events/spring98/crypto.shtml The second lecture and discussion in a two-part forum on encryption policy. Journalist Peter Wayner will introduce and moderate the event, which is free and open to the public. In Part I, freedom activist John Gilmore and Fritz Fielding (Ex-Associate General Councel, NSA) gave their divergent views, focusing on the Burnstein case. Barry Smith will articulate the needs of law enforcement to conduct lawful wiretaps; he will advocate the use of key-recovery techniques to achieve this end as a way that provides adequate privacy to law-abiding citizens. Schedule: The event will begin with a brief (10 minute) introduction by Peter Wayner. Following Barry Smith's talk, which will last approximately 45 minutes, there will be an opportunity to ask questions for approximately 20-30 minutes. Questions: Attendees are encouraged to ask questions in advance by sending email to sherman(a)cs.umbc.edu Directions: Take Exit #47B off interstate I-95 and follow signs to UMBC. LH III is in the Administration Building, adjacent visitor's parking lot near the I-95 entrance to UMBC. Host: Dr. Alan T. Sherman Associate Professor, Computer Science sherman(a)cs.umbc.edu http://www.umbc.edu (410) 455-2666 This event is held in cooperation with the UMBC Intellectual Sports Council Honors College Phi Beta Kappa honors society CMSC Council of Majors IFSM Council of Majors ACM Student Chapter at UMCP

1 0

Re: DDJ Crypto CD has arrived!
by Unicorn 17 Dec '03

17 Dec '03

--- On Mar 02, Random User apparently wrote ----------------------------------- > On Mon, 23 Feb 1998, Peter Trei wrote: > > > Well, it's finally here. > > It has also arrive in Canada. So when will it arrive outside of the US and Canada? ;-) --- and thus sprach: Random User <mctaylor(a)privacy.nb.ca> --------------------- Ciao, Unicorn. -- ======= _ __,;;;/ TimeWaster (GSM: +31 653 261 368) ========================= ,;( )_, )~\| A Truly Wise Man Never Plays PGP: 64 07 5D 4C 3F 81 22 73 ;; // `--; Leapfrog With A Unicorn... 52 9D 87 08 51 AA 35 F0 ==='= ;\ = | ==== Youth is not a time in Life, It is a State of Mind! =======

2 1

Senator plans to ban .gov porn-parodies; new crypto-campaign
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 4 Mar 1998 13:15:35 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Senator plans to ban .gov porn-parodies; new crypto-campaign More on Gates in NYC and the FBI's antihacker crusade is at the URL below. --Declan =========== http://cgi.pathfinder.com/netly/afternoon/0,1012,1782,00.html The Netly News / Afternoon Line March 4, 1998 Loin-cloth One lawmaker who doesn't seem to have much of a sense of humor about titillating web sites is Sen. Lauch Faircloth (R-N.C.). When his presumably technology-impaired staffer stumbled across whitehouse.com and found not Hillary Clinton's child care proposals but a doctored photo of Hillary in leather, Faircloth decided to take action. "I plan to introduce legislation that would ban the assignment of popular government agency names to anyone," he told The Netly News after speaking at an Internet child safety seminar this afternoon. "Can you imagine how many people have thought they were contacting the White House only to see that?" A better question might be which site is the more popular one. --By Declan McCullagh/Washington Might Makes Right Congress rarely does the right thing for the right reason.Instead, lobbyists vie to make voting the wrong way too politically costly for legislators. Now a new coalition, called Americans for Computer Privacy, is trying out this strategy on encryption legislation. The group of high tech firms and nonprofit groups aims to convince lawmakers that supporting restrictions on either the domestic use or overseas shipment of encryption productions is too politically painful. "We would not turn the keys to our front doors over the government. Why should we have to turn over the keys to our computers?" asked ACP counsel and former White House lawyer Jack Quinn. To convince Americans that ACP's answer is the right one, the coalition has gathered together an advisory panel of former spooks and law enforcement agents. Quinn told the Netly News that his strategy has already won results: "Senior officials at the National Security Council and the vice president's office" this morning signaled they're willing to sit down at the table for a friendly chat about crypto-laws. --By Declan McCullagh/Washington

1 0

DES bitslice S-boxes
by mkwan＠preston.net 17 Dec '03

17 Dec '03

I've been a bit out of touch with the subject for a while, so could someone please bring me up to speed in the state of the art of DES bitslice. In particular, what are the best gate counts for the S-boxes? About a year ago I produced S-boxes with the following counts S-box S1 S2 S3 S4 S5 S6 S7 S8 Gates 95 84 89 77 96 87 86 88 (You can download them from http://www.cs.mu.oz.au/~mkwan/bitslice) However, I was recently told that these have now been beaten by a significant margin. I thought about it for a while, and came up with some ideas that should improve the count, but I'd like to know what I'm aiming for. Any improvements I make will also be made freely available, so you have an incentive to help me ;-) mkwan

1 0