December 2003 - cypherpunks-legacy

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 21 Sep 1998 23:37:06 -0400 > From: Lazlo Toth <lazlototh(a)hempseed.com> > Subject: Re: Stego-empty hard drives... (fwd) > >How do you propose to prompt the user for the correct time to type? > > Pressing an obscure key combination during bootup to trigger the password > prompt should do the trick. And just exactly how do you propose to spread this technology commercialy without alerting at least some members of the constabulary of its existance? Now if we are looking for a spin-loop in a POST that isn't there in a normal BIOS then I would say simply use sig-analysis on the machine during POST. You've got two options on labeling the BIOS. Either pick a ID that isn't a legitimate BIOS id or else scam a legitimate version number. In either case the police will have listings of the legitimate BIOS versions from the maker. The actual sig-analysis could probably be done with a standard AM radio as a technology demonstration. Since a spin-loop in the POST is going to sound much more consistent than the memory checks and hardware inits that take place. Now on a commercial basis what I'd do is get the BIOS manufacturers to sell me a copy of each of their legitimate BIOS'es and then create a library of signal envelopes (similar to the library of ship sounds subs carry) and it would be a trivial feat to build a detector that does a diff on the signal. If it doesn't match they yank you out of line and ask you some tough questions while a guy with some hardware savy, a BIOS listing, and a logic analyzer builds a case against you. No, I suspect you'll pull this off a few times and then they'll catch on, assuming the NSA or DIA doesn't give them a jump start. My guess is they already know how to do this sort of stuff and considering the budget being spent on neutron scanners, gas sniffers, etc. the lifetime for this technology won't be very long. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: 22 Sep 1998 03:11:01 -0000 > From: Anonymous <nobody(a)remailer.ch> > Subject: Re: Stego-empty hard drives... (fwd) > There's a third option, but it may be a bit more difficult (or not). I'm > not really a hardware person, and it's probably obvious. > > 3. Use a "crypto-dongle" similar to what someone here (Mr. Geiger, I > believe) has come up with. You plug it into the parallel port or > somewhere else, and the encrypted data is useless once the dongle > is removed. I would think that if we plugged this into the bus we > could have the BIOS remap the IDE routines to some EPROM in that > dongle. The cryptography could take place there too. If the spooks > are on to you, you trash the dongle. So you're proposal is not only to put the crypto in the BIOS but a set of hardware device drivers to drive this port during boot but won't interfere with regular OS device drivers? > This paradigm breaks down when we get into the operating system, though. > Linux, for instance, apparently disposes of the BIOS and uses its own IDE > driver. I assume that Windows 98 does the same thing. Linux is open > source, so modifications could be made, but Windows would be harder. That was an additional issue that I was going to bring up. I suspect that in both cases it would be feasible to do, though you'd need to use a special driver in Linux type OS'es to shadow the BIOS driver back into the memory map. The real issue with me about this whole scheme is the distribution mechanism. It is just too shakey and porous not to allow LEA's to know about it. If they can get a copy themselves then they have a perfect mechanism to build a virus-scanner style of program to look for the appropriate footprint. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: atheism (was: RE: Democracy... (fwd)) (fwd)
by Fred C. Moulton 17 Dec '03

17 Dec '03

In a recent message Jim Choate wrote: >However, yourself, pjm, & Mr. Smith are claiming that a belief that >something doesn't exist isn't a belief is simply a tricky play on semantics. >A belief in a negative is still a belief irrespective of how many people >believe it. Might doesn't make right (or logical). Mr. Choate please spend as much time working on reading comprehension as you do on logic. If you read my message you will see that I have not stated my view on the proper definition of atheism, I have not aligned myself with pjm or George Smith nor have I aligned myself against them. I did provide two quotations from scholarly sources that used definitions similar to that provided by pjm. I also provided a quotation that there several definitions of the term in usage and the various definitions each have their supporters and their opponents. My point was the definition I quoted are well established in the scholarly literature and demonstrate that pjm was not trying to introduce some new and unusual definition into the discussion. Also based on the portion of your message I quote above, it appears that you might have misunderstood the quotation I included from Mr. Smith's book. I am sorry that both space and copyright issues do not allow the entire book to be sent to you, but I do suggest that you read the entire discussion in the book if you are having difficulty with the short passage quoted previously. Regards Fred

1 0

Re: ArcotSign (was Re: Does security depend on hardware?)
by Greg Broiles 17 Dec '03

17 Dec '03

On Mon, 21 Sep 1998, Nick Szabo wrote: > I have consulted at both DigiCash and Arcot. I am still > under nondisclosure to Arcot, so I can't answer any > questions about this that go beyond the publicly available > information. Arcot has recently made available on their public > web site "Software Smart Cards via Cryptographc Camouflage", at > http://www.arcot.com/camo2.html. At the end of > this paper is referenced Rivest's "Chaffing and Winnowing" > paper. These give a good overview of how such a technology > can work, and the scope of its application. I'm certainly not a cryptographer, but I'm somewhat at a loss in trying to understand the purpose of using public-key (or asymmetric key) cryptography within a policy/technology system which won't allow the use of the strengths of asymmetric key crypto. As I understand the paper you reference above, to implement this system the public key must be kept confidential, and signed documents must also be kept confidential, or the system of the security as a whole is at risk. With those constraints, why bother with the overhead (computationally/technically/legally) of asymmetric key crypto at all? It seems like much of the security in the system described above comes from the server/other party's ability to thwart brute-force attacks by detecting and responding to multiple failed attempts at authentication; that seems like a very good thing, but not really a strength or a weakness of the protocol itself, but an additional practice/protocol which is useful in many contexts. Is it really necessary/useful to call the scheme "software smart cards"? If it were called "An improved system for user authentication", I don't think it would make people nearly so suspicious. From my perspective, one of the advantages of smart card technology is that I can carry my authentication material with me; a system which puts it on my hard disk is less attractive. Floppies are portable, but not durable. I didn't understand the relationship between this scheme and Rivest's chaffing and winnowing which you note was cited as a reference in the SSC paper - would you (or someone else) mind explaining the connection? The closest I can get is thinking that there's a parallel between trying to guess which PIN in the SSC system is valid and which isn't, and the "winnowing" part of the Rivest protocol; but that doesn't seem like an especially meaningful or illuminating relationship. It looks like maybe a footnote was dropped, which would've tied the Rivest paper to a particular passage in the paper. -- Greg Broiles gbroiles(a)netbox.com

2 1

Re: ArcotSign (was Re: Does security depend on hardware?)
by Colin Plumb 17 Dec '03

17 Dec '03

Doug, I'd just like to thank you for replying. Even without looking at your description, the fact that you are willing to talk to doubters and admit the limitations of your technique make me a lot more comfortable believing that you have something. You don't fit into either of the two standard types of snake-oil salesmen: The "I can't tell you because it's secret" sort, and the "it's totally unbreakable, cures world hunger and disposes of nuclear waste" sort. Not that people still don't wonder, but I thought I'd temper the technical grilling I see heating up with some appreciation for the fact that you've already managed a better impression than 95% of the crypto wannabes out there. -- -Colin

3 5

CHALLENGE response
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQEMAzJEMpEAAAED/0jftmc14q6/r/pGe61N+QymMfQlUdrMNWSl9n9wnst1BGft /GztVfzwS5QDPc2vAvCJjeYFBj60BbJpILMC6rGH7pnc/GFcQjQDUJzHfGHASkDl 2jvDbzG8f7I5oM6NAC5thtjmMoe9FasHMW+lQ3B3IFNSFgIULM5WpAclQcU1A/0S K/k9FEU/SX93bC3SqTwwdaW9bvksN6Tqs8YSmVcRCoCAQQrTB9i0I+1y86gA9DnC UR0EuvalZ54+g/+4G0TOqLVoeSXYhyktqwrIFmwDyK3RPEU6OkwxzlBALNvEKzKB SsdTm7J6O+jg56yEI3YyyBJM6N+zKvmm7DGB8I2+IbQKVG90bywgdG9vP4kAlQMF EDYHKcPOVqQHJUHFNQEB7RID/0H14HGr6lB8bqWCxoZfoZ97oHFEURrYVxOGb5MP ZOOEKCk5d/Q/9d0D0imSZRrV6EQRsiuhA9d0LQy0DuLQC3/NguKFK0Z3fY9gT8/q xV9JJmmoYTjSEDke0RfexfvNDuOa9aISVxndwYGkkYlUcsZBmOeo1OKPdhWCLbnI CsB7 =cutG -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNED MESSAGE----- Interested readers may want to verify that the key above does give a valid signature when applied to the message below. (It will be necessary to remove any existing key with keyid 0x2541C535 before this key can be added to the keyring.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNgcq+c5WpAclQcU1AQHnZQP+NrThyaPmy8BDw21geFB3B1s59QJJ4Ycs i1yqu9p6NZfb6qD2pF8AnOSOUMA3KCs98fKMJU9S9TN9eTk5DRbIvXHHSdhMRhuw qDlmcpy4HggT9yHK0vjOTm6UUR/xkvt0WCheAQEe9ZeshFyPa5BAJ7Sqy2dcI1Xv X3DzB5pn2yk= =SmV7 -----END PGP SIGNATURE----- -----BEGIN PGP SIGNED MESSAGE----- "Contrary to one famous philosopher, you're saying the medium is not the message," Judge Thomas Nelson said, alluding to the media theorist Marshall McLuhan. http://www.nytimes.com/library/cyber/week/120997encrypt-bernstein.html Bullshit! The bits and bytes of email encryption are a clear message that I wish to exercise my right to speak freely, without those who wish to do me harm invading my privacy. The death of strong encryption on the InterNet will be the global death of free speech on the InterNet. Accordingly, I feel it is necessary to make a stand and declare that I stand ready and willing to fight to the death against anyone who takes it upon themselves to try to imprison me behind an ElectroMagnetic Curtain. This includes the Ninth Distric Court judges, if they come to the conclusion that the government that they represent needs to electronically imprison their citizens 'for their own safety.' The problem: Criminals with a simple encryption program can scramble their data beyond even the government's ability to read it. http://www.zdnet.com/zdnn/content/zdnn/1208/261695.html Fuck the lame LEA pricks who whine about not being able to stop someone bringing in a planeload of drugs without being able to invade the privacy of every person on the face of the earth. Am I supposed to believe that I have knowledge of when and where major drug shipments are taking place, simply by virtue of hanging out as a musician, yet the LEA's are incapable of finding out the same information by being competent in their profession? Barf City... [I will shortly provide information for any LEA which wishes to prosecute me for my coming 'physical' death threat, on how to hunt me down like the filthy dog that I am.] "Why are you saying that the fact that [encryption] is functional takes it out of the First Amendment context?" Myron Bright, one of the judges, asked the Justice Department attorney, who was still in mid-sentence. He answered that the regulations were not aimed at suppressing speech, but only at the physical capacity of encryption to thwart government intelligence gathering. The Spanish language has the same "physical capacity." So does (:>), (;[), and {;-|). Likewise, BTW, FWIW, FYI, and my own personal favorite, YMMV (You Make Me Vomit? --or-- Your Mileage May Vary?). <-- Ambidextrous encryption. An-cay e-way pect-exay ig-pay atin-lay usts-bay of ildren-chay? Whispering also has the "physical capacity" to "thwart government intelligence gathering." When does the bullshit stop? When do we stop making the use of the Spanish language over the InterNet illegal? When do we stop making whispering, pig-latin, anagrams and acronyms illegal? When do we stop saying that our government is such a piece of crap that it is a danger to let its citizens communicate freely, in private, and share their private thoughts with one another? At one point Fletcher called the government's case "puzzling." http://www.news.com/News/Item/0,4,17114,00.html Only because her mom taught her that it was unladylike to say "Bullshit!" In arguments Monday, a Justice Department lawyer, Scott McIntosh, said the government's intent was to preserve the ability of intelligence agencies to eavesdrop on foreign governments and citizens. http://www.nytimes.com/library/cyber/week/120997encrypt-bernstein.html Let's see if I have this right... The U.S. government needs to destroy the right to free speech and right to privacy of its own citizens in order to infringe upon the human rights of the governments and citizens of other countries? Countries which already have strong encryption? Countries like Red China, which is currently engaged in encryption research with an American company who got permission to export much more diverse encryption material (after making a huge campaign donation to the Whitehouse) than Professor Bernstein will ever likely share with others? Apologies to Judge Fletcher, but that's not "puzzling." That's the same-old-same-old Bullshit! OFFICIAL 'PHYSICAL' DEATH THREAT!!! The pen is mightier than the sword. Thus, I prefer to wage my 'war to the death' against those who would stomp on my basic human rights *"in the interests of National Security"* with my electronic pen, on the InterNet, using encryption when I have reason to fear persecution by Facist, Nazi motherfuckers. [* ~~ TruthMonger Vernacular Translation ~~ "so that the government can maintain its authority over the citizens by use of force and violation of human rights, rather than going to all of the trouble of acting in a manner that will garner the citizens' respect."] I will continue to express my thoughts through the words I send electronically over the InterNet, both publically and privately. I will fight to the bandwidth death against anyone who wants to deny me my right to express my opinions and access the opinions of those who also wish to express their own opinions and share their true thoughts with their fellow humans. If the ElectronicMagnetic Curtain slams down around me, then I will have no choice but to continue my current fight in MeatSpace. And I am not alone... I will share the same 'DEATH THREAT!!!' with Judges Fletcher, Nelson and Bright that I have shared with the President and a host of Congressional and Senatorial representatives: "You can fuck some of the people all of the time, and all of the people some of the time, but you are going to end up in a body bag or a pine box before you manage to fuck all of the people all of the time." Am *I* going to whack you out? Maybe... I would prefer just dumping some tea in Boston Harbor, if that will get my message across in MeatSpace, but if it won't, then I guess I will have to take stronger action. There are undoubtedly a plethora of LEA's ready and willing to prosecute and imprison me for agreeing with Patrick Henry, who said, "Give me liberty, or give me death." The irony, of course, is that I do not pose a great danger to anyone but myself as long as I continue to have my human rights and my liberty unthreatened. The chances of me actually getting off of my fat butt and going out into the real world to whack out the enemies of freedom are probably pretty small (unless I run out of cigarettes and beer, and wouldn't have to make an extra trip). I fully understand that this does not lessen the potential of any LEA who gets a wild hair up their butt to throw a mountain of taxpayer resources into prosecuting me and imprisoning me for their own professional/political gain. However, if you are performing actions so outrageously against basic human rights and freedoms as to get me off of my lazy ass, then I am the least of your problems, because there undoubtedly are millions of people more functional than myself (who get out of the house and go further than the liquor store) who are less willing than myself to put up with increasingly heavy chains placed around their hands and feet 'in the interests of national security.' Feel free to have the Federales break down my door and imprison me for pointing out the obvious. After all, I fit the profile of a domestic terrorist--I quote the Constitution and the Bill of Rights, and I speak out against increasingly big government. But remember...it's the quiet ones you've got to watch... If you force everyone to 'be quiet', then you've got a world of trouble on your hands. Sincerly, John Gilmore <gnu(a)toad.com> ~~~~~~~~~~~~~~~~~~~~~~~~~~~ p.s. NOTICE TO LEA AGENTS IN NEED OF A CAREER BOOST! Yes, I'm just a troublemaking asshole, trying to get John <spit> Gilmore <fart> in trouble. However, if you want to go to the trouble of tracking me down, I will give you some hints, since it seems likely that anyone who has trouble finding a ton of cocaine at an airport might not be competent in CyberSpace, either. You might want to check with the Webmasters at the sites quoted above to see who has accessed their web sites this morning. The anonymous remailer I will be using is an open secret to CypherPunks around the world as a really bad attempt at disguising my true MeatSpace identity. This alone ought to be enough for some aggressive young LEA and/or federal prosecutor to earn themself some brownie-points, since I am a sorry enough son-of-a-bitch that they would not have much trouble convicting me in front of a jury of 'their' peers, assuming that they can make certain that I am not tried by a jury of my own peers. Bonus Points: I can also be tied into Jim Bell's Worldwide Conspiracy to assassinate government authorities, through my implementation of an Assassination Bot. (I am willing to 'rat out' Jim for two bottles of Scotch. If he is willing to rat _me_ out for less, then I guess it's just my hard luck, eh? <--that's another hint!) p.p.s. You can also charge me with use of 'conventional' encryption in the commission of a crime. Must be your lucky fucking day, eh? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNI24Hs5WpAclQcU1AQFaggP8CPTVy8EAY3JbIG94frc3C70MW0hUznmp fRgBrq7m5tLGjX7fh3/s4fpTnQi+xUvRUroFETlR6KhM3srSy456wovpFlcLp7uc xk31cRPEroFhO9NRVBUjzToCj78iDvdGm9QXUwLctbbohpdId/KKLTAUM6//4mCB i/9oezfegWc= =4/6E -----END PGP SIGNATURE-----

2 1

Re: Stego-empty hard drives... (fwd)
by Neels Kriek 17 Dec '03

17 Dec '03

I have bee using Encrypted magic Folders for a while now. it gives you the option of encrypting all files in a specific folder. it can also do file name scrambling and even hide all the files in a directory from the OS. It activates through a hot key combination. You work on the files you want and when you exit emf the whole dir is hidden again. probably not the most secure system but it will certainly fool most them if you disable booting from a stiffy/floppy.

1 0

BXA Crypto Export Rule
by John Young 17 Dec '03

17 Dec '03

BXA issued today an interim rule on encryption exports and easing of limits for select institutions announced in the summer: http://jya.com/bxa092298.txt (83K) Quote: SUMMARY: This interim rule amends the Export Administration Regulations (EAR) by clarifying controls on the export and reexport of encryption items (EI) controlled for ``EI'' reasons on the Commerce Control List. This rule incorporates public comments on an interim rule published in the Federal Register on December 30, 1996, and implements new licensing policies for general purpose non-recoverable non-voice encryption commodities or software of any key length for distribution to banks and financial institutions in specified countries.

1 0

problems with pgp 5i for solaris
by Steve Mynott 17 Dec '03

17 Dec '03

I am having problems with PGP 5i for solaris. I am aware of http://www.pgpi.com/bugs/bugs50i.shtml I have tried setting HAVE64 to 0 and the *** src/lib/pgp/include/pgpUsuals.h~ Sat Aug 9 22:44:58 1997 --- src/lib/pgp/include/pgpUsuals.h Tue Aug 12 16:57:16 1997 patch but neither solve my problem. I get "Received signal 10." after entering my pass phrase when trying to decrypt a message encoded to my PK. Has anyone got it to work? -- pgp 1024/D9C69DF9 1997/10/14 steve mynott <steve(a)tightrope.demon.co.uk>

1 0

one-time pad
by Anonymous 17 Dec '03

17 Dec '03

Where can I get the one-time pad in perl? The one I have I can't figure out how to input data into it: #!/bin/perl vec($_,0,1); open(P,shift); read(P,$p,length),print $_^$p while<> Can anyone help?

1 0

MEDIA RELEASE! Washington DC office opened
by Marita N�sman-Repo 17 Dec '03

17 Dec '03

The following press release for your information. Regards Marita Nasman-Repo ############################################# Data Fellows Opens Regional Sales Office in Washington, D.C. Helsinki, Finland, September 21, 1998 -- Data Fellows, the leading developer of data security solutions, announces the opening of a regional sales office in Washington, D.C. The new office is located to better serve Data Fellows current and future clients in the federal government and in the Eastern portion of the United States. Data Fellows is no stranger to the Washington area. The companys client base includes the Federal Reserve Bank, the Internal Revenue Service, the Department of Defense, NASA, and other government agencies. The new office is the first of several planned regional offices designed to further enhance the companys relations with its North American customer base. Technology industry veteran Joe Arcade has been appointed the sales director for the new Washington office. Mr Arcade has been involved in Washington-area technology for the past 15 years and has held executive positions with companies including Unisys, British Telecom, Sun Microsystems, Cabletron and Litton. Mr. Arcade has a Bachelors degree from Youngstown State University and a Masters degree from Catholic University. With offices in San Jose, CA, and Helsinki, Finland, privately-owned Data Fellows is the leading technology provider of data security solutions for computer networks and desktop computers. The company's F-Secure data security product line includes F-Secure Workstation Suite, consisting of malicious code detection and removal, unobtrusive file and network encryption, and personal firewall functionality, all integrated into a policy-based management architecture; F-Secure Anti-Virus, with multiple scanning engines (including F-PROT and AVP), is the most comprehensive, real-time virus scanning and protection system for all Windows platforms; F-Secure VPN+ provides a software-based, IPSEC-compliant Virtual Private Network solution for large corporate networks as well as remote and small office networks; F-Secure FileCrypto is the first and only product to integrate strong real-time encryption directly into the Windows file system; FSecure SSH provides secure remote login, terminal, and other connections over unsecured networks. It is the most widely used secure remote administration tool; and F-Secure NameSurfer is the solution for remote Internet and Intranet DNS administration. Its easy-to-use WWW user interface automates and simplifies DNS administration. The company's products are relied on by many of the world's largest companies, governments, universities and institutions. The products are available worldwide in more than 100 countries through Data Fellows and its business partners, and the company has experienced 100% annual growth during each of the past three years. For more information, contact Data Fellows, 675 North First Street, 8th floor, San Jose, CA 95112; tel 408-938-6700; fax 408-938-6701; http://www.DataFellows.com or info(a)DataFellows.com. ###################################### -- Marita.Nasman-Repo(a)DataFellows.com, World-Wide Web http://www.DataFellows.com

1 0

RE: atheism (was: RE: Democracy... (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 11:06:26 +0200 (MEST) > From: Heinz-Juergen Keller <hjk(a)dip.de> > Subject: RE: atheism (was: RE: Democracy... (fwd)) (fwd) > > We're doing Boolean Algebra here not Algebra, the rules for transitory > > functions are different. > A natural language is *not* boolean. > It is a Peano-Algebra.(with some more restrictions) > [R.Montague: Universal Grammar] Irrelevant, we're analysing the truth or falsity of a statement, that is Boolean Algebra. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Peano Algebra and it's base theorem
by Jim Choate 17 Dec '03

17 Dec '03

Peano Algebra's are based on the following: If a unary predicate P holds for 0, and if P holds, together with an element x, also for it's succesor x', then P holds for all natural numbers. The question under consideration is NOT an attempt to describe a language in a Sigma structure/algebra/model. We are NOT trying to analyze the language but rather a specific mathematical statement made IN that language. They are not the same problem and hence Peano Algebra's do NOT apply. Nice straw man, I had to drag a math book out to refresh what a Peano Algebra was (don't think I've ever had to deal with one). ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Neels Kriek" <kriek(a)bigfoot.com> > Subject: Re: Stego-empty hard drives... (fwd) > Date: Tue, 22 Sep 1998 01:52:03 -0500 > I have bee using Encrypted magic Folders for a while now. it gives you the > option of encrypting all files in a specific folder. it can also do file > name scrambling and even hide all the files in a directory from the OS. > > It activates through a hot key combination. You work on the files you want > and when you exit emf the whole dir is hidden again. probably not the most > secure system but it will certainly fool most them if you disable booting > from a stiffy/floppy. The problem is this approach is detectible with a suitable 'virus scanner' technology. Even if the encrypted folders and such don't appear in the file system you have various other pieces of the processing agent that must sit around on the drive and hence are open to signature attacks. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

CHALLENGE response (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 08:01:07 +0200 > From: Anonymous <nobody(a)replay.com> > Subject: CHALLENGE response > "Contrary to one famous philosopher, > you're saying the medium is not the > message," Judge Thomas Nelson said, > alluding to the media theorist Marshall > McLuhan. > http://www.nytimes.com/library/cyber/week/120997encrypt-bernstein.html > > Bullshit! > The bits and bytes of email encryption are a clear message > that I wish to exercise my right to speak freely, without those > who wish to do me harm invading my privacy. If you're going to take that tack then you need to invoke freedom of the press and not freedom of speech. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Peano Algebra and it's base theorem (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 10:02:23 -0500 > From: Mark Hahn <mhahn(a)tcbtech.com> > Subject: Re: Peano Algebra and it's base theorem > At 07:42 AM 9/22/98 -0500, Jim Choate wrote: > >Peano Algebra's are based on the following: > > > >If a unary predicate P holds for 0, and if P holds, together with an element > >x, also for it's succesor x', then P holds for all natural numbers. > > Didn't you over simplify this theorem somewhat. It's taken word for word from VNR. Send 'em a letter. The point is that we were discussing binary not integer mathematics. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 15:33:18 +0100 > From: Mok-Kong Shen <mok-kong.shen(a)stud.uni-muenchen.de> > Subject: Re: Stego-empty hard drives... (fwd) > > I am ignorant about hardware. Question: Wouldn't it be possible to > somehow put information on a music CD? > Absolutely, though the fact that it's r/w'able is going to set some flags off. Now if you can find somebody who makes R/W CD's that aren't blue, green, yellow, etc. and instead the clear that is normaly expected you might pull it off. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2

Re: Clinton's fake apologies (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 10:28:01 -0400 > From: Duncan Frissell <frissell(a)panix.com> > Subject: Re: Clinton's fake apologies (fwd) > Ladies and Gentlemen of the Jury, we just conducted a > favorable/non-favorable public opinion survey about the ADA over there and > found out that 3% had a favorable opinion of him 3% unfavorable and 94% > were DK or No Opinion. I therefore plead that he has insufficient personal > popularity to conduct this prosecution. I like that one, talk about 'jury of their peers'... ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 08:54:57 -0500 > From: Mark Hahn <mhahn(a)tcbtech.com> > Subject: Re: Stego-empty hard drives... (fwd) > As I recall, this thread is about customs officials booting your laptop > from *their* floppy and scanning your hard drive. I suggest two > practical solutions to avoid this incursion: That's where we started, we're miles away and deep in the woods now.... ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 23 Sep 1998 00:01:31 +1000 > From: Reeza! <howree(a)cable.navy.mil> > Subject: Re: Stego-empty hard drives... (fwd) > At 07:45 AM 9/22/98 -0500, Jim Choate wrote: > >Forwarded message: > >> From: "Neels Kriek" <kriek(a)bigfoot.com> > >> Subject: Re: Stego-empty hard drives... (fwd) > >> Date: Tue, 22 Sep 1998 01:52:03 -0500 > >> I have bee using Encrypted magic Folders for a while now. it gives you the > >> option of encrypting all files in a specific folder. it can also do file > >> name scrambling and even hide all the files in a directory from the OS. > >> > >> It activates through a hot key combination. You work on the files you want > >> and when you exit emf the whole dir is hidden again. probably not the most > >> secure system but it will certainly fool most them if you disable booting > >> from a stiffy/floppy. > > > >The problem is this approach is detectible with a suitable 'virus scanner' > >technology. Even if the encrypted folders and such don't appear in the file > >system you have various other pieces of the processing agent that must sit > >around on the drive and hence are open to signature attacks. > > > > The first assertion is not entirely accurate- Which first assertion, his or mine? Youre quoting leaves me confused (not that it is necessarily your fault...;). > I played with Magic Folders > for a while- it relies on a command, usu. in the autoexec.bat or win.ini > file (dos/windows environment) to load, with a bootable floppy disk these > commands would would be bypassed and the so-called "hidden" folder is in > plain sight. One thing is clear, you can't mundge the base OS or else the catch is going to be trivial. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

CHALLENGE response (fwd)
by Anonymous 17 Dec '03

17 Dec '03

The whole point of the CHALLENGE response went straight over his head, didn't it? It's almost as though there are two mailing lists here: the one for dolts, where Jim Choate gets into his idiotic little arguments with his fellow fools, yammering back and forth on totally off-topic matters, and the one for people interested in cryptography and its implications. We have here the first known case where a key was constructed ex post facto to validate a signed message, in response to Adam Back's challenge. No longer can you assume that just because you posted a signed message on a certain date, and you hold the public key which signed that message, that you can later prove authorship. It challenges some of the implicit assumptions which have been made in using public key cryptography. And all Jim Choate can do is take issue with a snippet of Toto's ravings which were included purely to illustrate the signature validity. He is completely unaware of what is really happening. Jim Choate writes: > Forwarded message: > > > Date: Tue, 22 Sep 1998 08:01:07 +0200 > > From: Anonymous <nobody(a)replay.com> > > Subject: CHALLENGE response > > > "Contrary to one famous philosopher, > > you're saying the medium is not the > > message," Judge Thomas Nelson said, > > alluding to the media theorist Marshall > > McLuhan. > > http://www.nytimes.com/library/cyber/week/120997encrypt-bernstein.html > > > > Bullshit! > > The bits and bytes of email encryption are a clear message > > that I wish to exercise my right to speak freely, without those > > who wish to do me harm invading my privacy. > > If you're going to take that tack then you need to invoke freedom of the > press and not freedom of speech.

1 0

CHALLENGE response (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

> Subject: CHALLENGE response (fwd) > The whole point of the CHALLENGE response went straight over his head, > didn't it? It didn't go over my head at all. What amazes me is that it took you this long to figure out that one could munge signatures. > We have here the first known case where a key was constructed ex post > facto to validate a signed message, in response to Adam Back's challenge. Um, I don't believe that is true. It may be the first time members of this list have managed it. > No longer can you assume that just because you posted a signed message > on a certain date, and you hold the public key which signed that message, > that you can later prove authorship. It challenges some of the implicit > assumptions which have been made in using public key cryptography. No, it challenges basic assumptions regarding the importance of identity. In no way does it effect the basic math of crypto, public or otherwise. And people wonder why I don't sign my messages... > And all Jim Choate can do is take issue with a snippet of Toto's ravings > which were included purely to illustrate the signature validity. He is > completely unaware of what is really happening. I've taken no issue with Toto or his ravings. Have a nice day. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

CTIA Daily News from WOW-COM - September 22, 1998
by CTIA Daily News 17 Dec '03

17 Dec '03

========================================== Welcome to today's edition of the CTIA Daily News from WOW-COM. Please click on the icon / attachment for the most important news in wireless communications today. Your company just formed a partnership in a country you never heard of. Are you worried about international roaming fraud? You should be. CTIA's Wireless Security '98 - It's Just Smart Business ORLANDO, FLORIDA · NOVEMBER 9 - 11, 1998 http://www.wow-com.com/professional/ Team WOW-COM wowcom(a)ctia.org ===========================================

1 0

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 09:38:18 -0500 > From: Petro <petro(a)playboy.com> > Subject: Re: Stego-empty hard drives... (fwd) > If you do (1), and simply have _no_ prompt, just a small space in > time AFTER the POST (say, immediately after) to type in your passkey, and > things are > set up that if you type the wrong keys, it goes straight into hidden space > mode, then there would be no suspicion, other than a slightly long boot > sequence (and if the wait time were only 2 or 3 seconds, it might not even > be noticable.) If we are discussing only the customs inspector doing a visual inspection this will certainly work. It won't hold up to TEMPEST analysis where they fingerprint a known un-mod'ed unit and then compare that to yours. The POST shouldn't change from laptop to laptop, irrespective of the filesystem or OS that is actualy installed. The point is that this is a weak approach with a variety of attacks open. When one considers the amount of work required to collect BIOS'ed , reverse engineer them (unless you got lots of mullah), develop the crypto, develop the camouflage code, distribute the code, burn the ROM's, distribute the ROM's, cost of suitable TEMPEST monitors, etc. the benefit seems questionable at best. Even if they can't crack it in may places (eg France) such actions would be prosecutable in and of themselves. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: Stego-empty hard drives... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 22 Sep 1998 09:32:49 -0500 > From: Petro <petro(a)playboy.com> > Subject: Re: Stego-empty hard drives... (fwd) > Why prompt, you installed it, just have the startup stop at a > certain point, just simply pause. You hit a couple keys (4-8) and go on. > Given this case you don't really need the security of a long passphrase > since if they are looking to get in, you've lost already. You'll probably not want it to stop, simpy wait a few seconds. Also, if the passphrase is incorrect you'll not want to issue any error messages. Stopping the boot may be a good indication of a problem. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2