December 2003 - cypherpunks-legacy

Re: Improvement of remailer security
by Black Unicorn 17 Dec '03

17 Dec '03

->\ I think the recent death-threat-to-Clinton desaster has made clear that the remailers we have are not very secure, mainly because incoming and outgoing mail seems to be monitored at many sites. <- Wait, the threat was posted with a remailer? I heard about the threat, not the remailer.... Details? -uni- (Dark)

2 1

ID Chips...
by Jim choate 17 Dec '03

17 Dec '03

As I understand it there was a proposal to install such chips in children to prevent kidnapping and such last year in Congress (don't remember if it was House or Senate). I question the validity of the chips use, seems to me that tatooing the ear of the pet and placing this in a database would be much more efficient and a LOT less expensive. It would not require the vet to buy any special equipment or buy access to special databases. Also, what about small towns and rural communities w/ insufficient tax base to purchase the equipment for general use by the community? I can see it now, a black van w/ tinted windows rolls slowly down your street interrogating all the pet transponders determining who lives where and then comparing this w/ the official records of residence... When you take this in concert w/ real-time (or even small delay) financial record searches, the loss of freedom of speech, limitations on assembly, criminalization of crypto, etc. you are building a realy spooky scenario... I think I would prefer to have my cat or dog tatood instead of transpondered.

1 0

Announce list?
by pat＠tstc.edu 17 Dec '03

17 Dec '03

What is the cypherpunks announce-list administrative address?

1 0

MAIL: and re: coming police state
by rperkins-remailer＠nyx.cs.du.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > I myself am very new to the net, and also to crypto, so I have not > seen these papers before. Is ther an archive where I could find them? > Or could you possibly mail me a copy of your "Remailers: The Next > Generation" if it is You can find this document via gopher to chaos.bsu.edu; look in the "Anonymous Mail" directory for "Next Generation Remailers". If the remailer is set up properly you should be able to receive your ordinary mail as well. Make sure though, the remailers I ran on rosebud dropped mail because the incoming mail directory was in a different place (something like /usr/mail instead of /usr/spool/mail). But I liked this behavior so I left it ;) Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLYCOBIOA7OpLWtYzAQHT/QP+MywPIgTPc+HX//IGANwDejJM5KrHS3Le a+nBTgEYBMiijjBwyuqsMyHpya4/jDWDAlnTEe9c0I5f3WIsa8ALNYoWFVysIN46 pfDO6lHevmkbxcgOEhOpfEUgOwayAtXpRLoIj2z00Splkz48bdGPWvvJ8AZzBrQt ukMEyfaP2ss= =C5Dc -----END PGP SIGNATURE-----

1 0

ID Chips...
by freeman＠netcom.com 17 Dec '03

17 Dec '03

Jim Choate says: > I question the validity of the chips use, seems to me that tatooing the ear > of the pet and placing this in a database would be much more efficient and a > LOT less expensive. I suspect the chip insertion uses vastly less expensive labor, and probably less expensive gadgetry, as well. There might also be a memory-size problem; I have a cat with an ID number tatooed in one ear -- about the only place where it is reasonably visible on casual inspection. The number is about nine years old, and has four digits. One or two more and there would be trouble reading it. (The cat is a survivor of feline leukemia research at U. C. Davis; the ID dates from that program. There's a program whereby surviving animals from the Davis labs are placed out.) -- Jay Freeman

2 1

Re: The Coming Police State
by smb＠research.att.com 17 Dec '03

17 Dec '03

<tcmay> writes: >> prepared me for my later role as a hunted CyberFelon. ("Shockwave" is >> also credited by many to be one of the first mentions of "worms" in >> computers....though Brunner may've been talking to folks at Xerox >> PARC...wormly cross-fertilization.) and I digress wildly: Mid-November, 1988, after the great Morris Worm Stomp[1], a bunch of people who'd helped hunt the Worm were invited to the NCSC[2] to give talks at a "Post-Mortem", as it were. The MIT and Berkeley crowds had the most real technical data on it[3], though at least one of the government labs had done a fair job at decompiling it. The relevant part was that while the NCSC didn't have much useful info on the Worm itself[4] they had *categorized* it, and among their spiffy color slides, they had a "taxonomy" slide which surprised me by including Brunner's worm. The NCSC seems to officially credit Brunner as the first literature reference to the idea... Personally, I give the credit to David Gerrold, in ``When Harlie Was One''. Here's a netnews posting of mine that explains my reasoning.

2 1

Getting started with crypto
by GERSTEIN＠SCSUD.CTSTATEU.EDU 17 Dec '03

17 Dec '03

Hey there all. I've been lurking here for a while, and I wanted to know if any of you can recomend some books for me to read so I can get started with crypto. Reason A) So that I can understand more of what you are saying. Reason B) Because I find the topic fascinating and want to learn more about it, as well as maybe (only possibly) write my own encrytption program (for personal use and the like) Any info would be greatly appreciated.... Adam Gerstein GERSTEIN(a)SCSU.CTSTATEU.EDU =-=-=-=-=-=-=-=-=-=-= OPPOSE CLIPPER-=-OPPOSE CLIPPER-=-OPPOSE CLIPPER-=-OPPOSE CLIPPER-=-OPPOSE CLIPP

1 0

newuser
by student 17 Dec '03

17 Dec '03

send info please concerning cypherpunks. I am a student in Arthur Chandlers "Cyberspace" class.

1 0

2nd CJ update
by Phil Karn 17 Dec '03

17 Dec '03

Looks like the stalling tactics have begun. I just got a phone call from "Susan Shea" from the National Security Agency. She said that to "make a better determination" she would need a copy of the diskette. I explained (as I had in my written request) that the diskette in question contained exactly the same source code as was printed in Part 5 of the book Applied Cryptography, byte for byte. But she claimed that as she did not have a copy of that, she would still need the diskette. Right. The NSA doesn't have a copy of Applied Cryptography, and has never seen one. Yet, apparently, they signed off on my original CJ request to export the printed book (the State letter mentions comments from the Department of Defense, which is always a code phrase for the NSA in such situations). Sigh. I will send it off to them. This should buy them about two days, unless I get really extravagant and switch from Priority Mail to Express Mail... Phil PS. Does anybody consider it odd that someone from the NSA would actually identify themselves as such?

3 2

Re: 2nd CJ update
by smb＠research.att.com 17 Dec '03

17 Dec '03

Looks like the stalling tactics have begun. I just got a phone call from "Susan Shea" from the National Security Agency. She said that to "make a better determination" she would need a copy of the diskette. I explained (as I had in my written request) that the diskette in question contained exactly the same source code as was printed in Part 5 of the book Applied Cryptography, byte for byte. But she claimed that as she did not have a copy of that, she would still need the diskette. Right. The NSA doesn't have a copy of Applied Cryptography, and has never seen one. Yet, apparently, they signed off on my original CJ request to export the printed book (the State letter mentions comments from the Department of Defense, which is always a code phrase for the NSA in such situations). It's not that ``NSA'' doesn't have the book; it's that that office may not. Or at least, making that claim isn't totally beyond the realm of possibility. As for the original request -- they *don't* want to rule that a book needs a license, of any sort; it opens them up to judges who understand books but not floppies. (Let me commend to this audience Kenneth Pierce's paper ``Public Cryptography, Arms Export Controls, and the First Amendment: A Need for Legislation'', Cornell International Law Journal vol. 17, 1984, pp. 197--236 -- it's a very good summary of the legal issues. Though the details of the ITAR have changed, the underlying legal theories have not.) Sigh. I will send it off to them. This should buy them about two days, unless I get really extravagant and switch from Priority Mail to Express Mail... Phil PS. Does anybody consider it odd that someone from the NSA would actually identify themselves as such? My impression is that they've realized that that game is a bit stupid at this point, and that they're giving up on unnecessary secrecy.

1 0

What's so bad about a Surveillance State?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

It is obvious to me that many people in the government wish to turn the US into a surveillance state. What wrong with that? Seems like a lot of good could come from it. Now that I have you're attention... E-mail me your reasons why a surveillance state is a good thing or a bad thing. I will summarize both the pros and cons and repost them to the list. Jim_Miller(a)suite.com

1 0

No Subject
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> > if the clipper chip passed. what's stopping > > corrupt government people from selling access > > to the encryption to the highest bidders to spy > > on competitors communications. > Nothing. > --Dave. What stops a *corrupt* government from shooting you if you dissent? You have to assume *some* degree of respect of laws or the constitution; the fact is that those in power, *when* in power, could possibly ignore all laws. Obviously, there's no point discussing such situations; obviously however pro- Clipper etc a government may be, it is still very far from any such situation. ----------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -----------------------------------------------------------------------

3 2

Re: The Agency Whose Name May Not Be Spoken
by lefty＠apple.com 17 Dec '03

17 Dec '03

>(Prior to the 1980s, mention of NSA was rarely made. Employees of NSA >didn't mention it, and "Fort George Meade" was the only thing >mentioned. Prior to the mid-70s, the NSA name never even appeared in >Congressional budgets or reports. Its existence was very widely known, >though.) As Bamford mentions in _The Puzzle Palace_, it was, in fact, a Federal offense for NSA employees to state that they worked for the NSA up until, I believe, the mid-to-late-70s. The standing joke in Washington was that "NSA" stood for "No Such Agency". -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Surveillance cameras
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: "Timothy C. May" <tcmay(a)netcom.com> : Most American airports, especially those with international : connections, routinely videotape all passengers. I can't cite a source : for this, but I think it's common knowledge (not that this means its : true). : The recent film "The Pelican Brief" has this as a plot device, with a : terrorist captured on tape on his departure to Paris. : Paranoid note: Ear shapes are said to be a fairly unique : characteristic, hard to disguise, and easy for computers to process ( : a line scan). This may mean the return of long hair. (No wonder Biometric technology, unfortunately, is advancing too rapidly :-( New Scientist this week ran a story on how the US is investing in a new system which takes a 'heat print' of your face. You can be sure your face will go on file next time you enter the US through immigration. They say that the IR photo of your face is much much harder to fool even with cosmetic surgery. I guess you'd have to implant popsicles under your forehead or something :-( G

1 0

Re: ID Chips...
by frode＠toaster.SFSU.EDU 17 Dec '03

17 Dec '03

Jim choate <ravage(a)bga.com> writes: > As I understand it there was a proposal to install such chips in children > to prevent kidnapping and such last year in Congress (don't remember if it > was House or Senate). > ... Do you remember who the representative was? (Or does anyone else?) This is good material to make sure the person does not get re-elected! F.

2 1

2nd CJ update
by mpd＠netcom.com 17 Dec '03

17 Dec '03

From: Phil Karn <karn(a)unix.ka9q.ampr.org> writes: > (the State letter mentions comments from the Department of Defense, > which is always a code phrase for the NSA in such situations). > PS. Does anybody consider it odd that someone from the NSA would > actually identify themselves as such? Maybe the agency is getting less paranoid now that it is more publicly known. Back in the early '80s, everyone working there used to say only that they worked for the Department of Defense. I also recall that they used to get quite upset if you called someone's phone inside the agency and said the words "National Security Agency" while talking to them. They answered their phones by simply saying "Hello" and gave no other identifying information. Now they probably have a public relations department. :) -- Mike Duvos $ PGP 2.3a Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: money...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Sandy writes: > On Wed, 9 Mar 1994, David L Womack wrote: > > . . . The rumor is > > that it is possible to detect, at a modest > > distance, the existance of and the amount > > of currancy being carried. Thus, if a person Seems nonsensical. Detectors of money containing trace amounts of magnetized metals would have real trouble with other magnetized metal going by, and they're not going to stop people at airports to check whether they're carrying lots of currency or a book snuck out of the library without getting *lots* of abuse from business travellers. Once we've had our National Health ID Smart Cards upgraded to non-privte digicash, maybe they'll think about adding transponders... > *IF* this is true, you will probably still have > the "Taco Bell" solution available to you for the > foreseeable future ("Run for the Border"). > When that gets shut down, there will still be > private aircraft and private yachts. About 5 years ago, the government put a "luxury tax" on boats; you had to get a registration sticker for any size boat that a rational individual might use to get in/out of the country. My immediate reaction was that it was for identifying who might be escaping or smuggling drugs or illegal immigrants. The tax was small, maybe $25, but they could ding you for not having the sticker on your boat. There was some effort by boaters to get rid of it, but I think it's still there. ("Rational individual", above, doesn't count people immigrating from Cuba on windsurfers :-) Bill

1 0

No Subject
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

cowen(a)glia.biostr.washington.edu: though joe 6-pack might not vote, and likely won't even understand about the crypto of it all. he would understand the police listening in on his conversations with jill 6-pack. and not like it to well. i do think The police can listen in anyway... In fact, so can anyone. And it's much easier for the police to listen in now, than it will be after Clipper. Joe 6-pack may not really worry about Clipper. In fact, Joe 6-pack may even be persuaded by Dr. Denning that Clipper will only be bad for criminals. As much of the public does not necessarily share our objection to Clipper, which is a matter of *principle*, really. The only people who might be adversely affected by Clipper *in practice* are those who are lulled into a sense of false security that Clipperphones are secure, when they're not. Joe 6-pack is not even likely to *buy* a Clipperphone, he's quite happy talking to Jill over plaintext lines, and hasn't yet raised a furour over the LE right to (after 'due procedure') listen in to the *plaintext* lines. ----------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -----------------------------------------------------------------------

3 2

No Subject
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich > Partners, two-thirds said it was more important to protect the privacy of > phone calls than to preserve the ability of police to conduct wiretaps. > When informed about the Clipper Chip, 80% said they opposed it." Reminds me of the hilarious "How to lie with statistics". What 1000 Americans? The sort who read Time magazine? These are probably much more likely to be against Clipper anyway. Any Joe 6-packs? Probably not. "When informed" - what, and how was the information presented? Clipper can be described as an NSA plot to listen in to everyone. Or a measure against drug dealers and mafia that happens to provide more privacy to everyone using ordinary phones at the moment. It's not a good idea to take this debate to the ordinary public. The Congress, yes, Time readers, yes, but not Joe 6-pack, who quite happily gave up his gun is not likely to be concerned about principles of privacy. Particularly as an open debate could easily swing towards, and focus on, possible and current misuses of crypto technology, rather than any benefits. Joe is not as untrusting of governments as cpunks are, nor is he likely to appreciate digicash, anon posting or the Blacknet article. ----------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -----------------------------------------------------------------------

6 6

mo money woe
by Mark Hittinger 17 Dec '03

17 Dec '03

> G writes: >But the fact is, people can strip a bill down and *look* at these things >for themselves. I seriously doubt any such technology would remain >invisible to some lab hack who in an idle moment put it under his SEM >for a quick peek. (*any* school that fabs its own ICs could do it >trivially in seconds.) > Then anonymous writes: > On a slightly related topic, I know of an instance where the > Secret Service located a stolen color copier with somewhat > greater speed than one might have expected. > >Is it possible that these machines either: >(1) contain transponders >or >(2) hide a "signature" in their output ??? I was watching CNBC today and saw that some european banks were having trouble with counterfeit 100 dollar bills. They are calling them "super bills" because they only seemed to have three minor flaws that most experts would not detect. They said that a magnifying glass would not be enough to detect these flaws. Cut to your friendly secret service guy looking at two 100 dollar bills under a microscope. The SS said that they would figure out who was doing it and bust them. The guy actually had a smirk on his face. I suppose the quality of the work is so good; that alone narrows down the field of possibilities. The interpol was speculating that over 1 billion of these superbills were now in circulation. Wow. And I figured the US government was going to drive the dollar into oblivion all by itself! Perhaps they will have help along the way. Perhaps people may be driven to Sandy's (et al) digital cash simply because the technology to counterfeit paper cash is becoming more reliable and available with each passing day. It would be one of those weird things that happen if people were driven to bin-bucks not because of the desire for anonymity - but rather the desire to maintain money's store of value function. Gold coins are looking better every day. Superbills - gimme a break. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

2 1

brainstorming on cpunks' eve
by Matt Thomlinson 17 Dec '03

17 Dec '03

As is mentioned in tims' latest Rant(tm), I've been working on ideas for creating other cypherpunk services that would be possible to deply to the net. I've come up with a few, but they are of dubious quality. I'm hoping that by posting ideas I know are flawed/of little use that followup disscussion might refine them. We saw a use for remailers -- to gain a certain anonymity not present in cyberspace. How about information drops? How about digital cash drops (alt.cash.drop anyone?) I know digicash isn't the rage, and such a group would probably do zero good for some time, but I'd like to start talking about the ideas. With payments in digicash, you could supply a public key (newly created, of course). After the cash is generated/remitted by the other party, it would be encrypted and posted to the group. Noone could use the cash as it sat there, since they can't unwrap the cash. (I like to think of it as dropping the cash in a sealed envelope). I'm trying to think of both uses and problems this exhibits. Lots of extra "session keys" is the only drawback I see. Other possible net services: random number services, which don't keep logs of the numbers it produces -- have it spit a statistically-correct random stream each time a port is opened? Would this be that useful? Also, one could set up a hashing/signing service, more akin to a time stamp service. Mail would be sent to your service, which would attach the output of 'date' to the bottom of the msg and then +clearsig it. I'm thinking that chains of two or maybe three reliable machines should be used, since all it takes to break this is to change the clock on the machine you're signing with. With a few (>1) machines, it becomes very clear that the message was sent at a certain time. Perhaps this could be used in the future for "Registered Mail" type exchanges, or perhaps as part of a "Digital Notary" system? As for our media coverage, I'm happy with it so far. I'm willing to bet digicash that we'll see _television_ coverage re: clipper in the next few months. EFF, among others, should be working on that; we've already been able to get the word out via newspapers/magazines and radio. I wouldn't be at all suprised to see a blip on 20/20 or maybe a 15-second spot by Tom Jennings & co. before July. And projects! I'm currently in the middle of finals, but I'm looking forward to getting back to work on the things that _really_ matter. I was wondering what people were thinking about putting together a page for WWW? Would it be useful? Would people browsing around look at it and would it be a medium to disseminate info? Maybe divide it up... RSA, DES, IDEA, 3-DES, etc. Clipper, Capstone, Skipjack, Tessera PGP, stego programs available, RIPEM, etc. EFF, CPSR, Cypherpunks---- |media coverage |remailers |stego |voice pgp |clipper projects-FOIAs, bigbro inside, etc. other sources of info: sci.crypt, alt.pgp, alt.whistleblowers, alt. privacy, alt.security. Ideas and suggestions appreciated. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

6 5

Seattle Cypherpunks Physical Meeting
by Matt Thomlinson 17 Dec '03

17 Dec '03

When: Tomorrow, March 11, 1pm. Where: Espresso-Roma Cafe, University Way and ~42nd; University District. Since we haven't been able to secure a site where we can use MBONE, we'll be conducting a first physical meeting in a coffee shop. We'll be discussing possible options for next month's meeting tomorrow. Bring questions, topics of conversation, etc. Hope to see you there -- Contact me or blanc for more info: blancw(a)microsoft.com. ---- Also, we're thinking of setting up a cypherpunks-seattle list. Let me know if you'd like to be included. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

2 1

Re: The Coming Police State
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

A VIRUS program and a WORM are two different kinds of programs. THEY ARE NOT EQUIVILENT. For more clarification may I suggest "Compuyter's under Attack" by Denning.

2 1

Re: MAIL and Coming Police State
by mcb＠remarque.berkeley.edu 17 Dec '03

17 Dec '03

Karl Barrus writes: > I mention this because I have asked and been told repeatedly by an > attorney friend of mine that running a remailer on a system where you > don't have authorization to do so is a violation of the ECPA. (i.e. > access beyond what the system administration intends for you to have). I would be interested in what legal research your attorney friend engaged in in order to come to this conclusion. Possibly it would be a violation if running a remailer was specifically prohibited by the operator (though this sounds more like a contract problem than an ECPA one), but I don't see anything in ECPA that would require affirmative authorization in order to do so. There is plenty of language about unauthorized access to others' communications, but it seems to me that in the case of a remailer you (the remailer operator) are authorized access to the communication BY THE SENDER for the limited purpose of re-sending. Holding this to be a violation is also particularly silly since it would make unlawful the doing of something by instrumentality of software an act which can easily be done (and was done, before the current era of software remailers) by hand. One would solicit for messages to be remailed, receive them normally in your mailbox, manually remove the headers and signature lines, then send them out again to a destination specified by the sender (possibly via out-of-band communication). This has gone on for year on mailing lists and Usenet groups. The example that comes to mind is soc.motss, where several posters offered to repost anonymous or pseudonymous messages for people who were not out of the closet, or would be embarrassed by gay-themed postings from their work or school account. -- Michael C. Berch mcb(a)postmodern.com / mcb(a)net.bio.net / mcb(a)remarque.berkeley.edu

1 0

Re: Seattle Cypherpunks Physical Meeting
by joshua geller 17 Dec '03

17 Dec '03

anyone else in the la area? josh

1 0