December 2003 - cypherpunks-legacy

RE: Real-time surveillance of the police
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Sandy Sandfort <sandfort(a)crl.com> writes: > Michael also argued that it might be more easily sold to private > security firms for legal liability reasons. This argument is > even more persuasive for police officers. Cities routinely pay > astronomical settlements, or fight expensive law suits, arising > out of alleged incidents of police misconduct. Frivolous > lawsuits would be quickly thrown out of court. Rogue cops would > be identified and thrown off the force. Works for me. Works for me, too, and one would think that it would work for cities, but experience shows that individual cops can rack up millions of dollars in legal settlement costs and still remain on the force. I heard some figure - this is quite vague, but hey, it's midnight - that a small handfull of cops in San Francisco had cost the City tens of millions, with individual cops repeatedly causing lawsuits, without getting fired. Why? Police unions. Settling out of court without assigning blame. City politics. Mayors that are former police chiefs. A clueless populace. Promises to do better next time. Now, I heartily agree with you that the police should be more closely monitored, and certainly cities have ample reason to avail themselves of this, but most cities do not even avail themselves of citizen police review commissions, because of the resistance the police have to it. In Santa Cruz, a proposal to allow an independent citizen panel to review police internal affairs investigations faced threats of lawsuits from the police union, and took _years_ to adopt. The commission we got has considerably less authority than was originally proposed. This is in a city reknowned throughout the nation for its leftist politics. If the People's Republic of Santa Cruz couldn't get a review board with real authority implemented, I doubt you'll convince the LAPD to put radio beacons on their thumping arms. Much as I think they should. Sandy continues: > Even with all these arguments in favor of wiring, I have a > sneaking suspicion the cops will not want it. Why? Though few > police would admit it publicly, my conjecture ... Well, my knowledge is that at least one cop wouldn't go for it - the cop we caught jacking off to a magazine of ill repute, parked in his patrol car on Yerba Buena Island in San Francisco Bay. Those rhythmic wrist-movements would show an unmistakable frequency signature back at home base. He sure drove off quick. Didn't even say hello. I say, > Yes, that's right - keep surveillance cameras going on _yourself_. If > you're not doing anything illegal, you've got nothing to fear from taping > everything you do. tcmay(a)netcom.com (Timothy C. May) replies: > This scenario is a likely way that "position escrow" will evolve, from > a voluntary escrowing (incl. timestamping, etc.). "Those with nothing > to hide" will agree to escrow their movements...this will exculpate > them in suspected crimes, etc. A slippery slope. I reflected on this a bit, and decided that if one were to implement "personal surveillance", a decent solution would be to encrypt the tapes. Use DAT tape instead of a VCR, and save MPEG's or QuickTime movies that have been encrypted with IDEA. The idea here is protection _from_ the police, to demonstrate that an officer misbehaved in the vicinity of my car, rather than to provide a record for use by the government. Needless to say, I wouldn't advertise that I actually had such a thing until I pulled the tapes out in a deposition, or sent them, decrypted, to the TV news. Again, I'm not saying such surveillance should be imposed, supplied or encouraged by the authorities, but that one might find some benefit in installing it oneself. Cheerio, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Re: Real-time surveillance of the police
by Rich Salz 17 Dec '03

17 Dec '03

>After the Rodney King incident, I had the notion, (which I did not act on >to actually promote, I'm sorry to say), that organizations representing >people that feel persecuted by the law could issue disposable cameras to >all there members. A couple of years ago, when he was getting one of the first Rebok international humanr rights awards, Peter Gabriel talked about how one of the organizations he is affiliated with was planning on doing exactly this kind of thing. If you think about it, it's not unlike the driving thrust of Amnesty International.

1 0

Re: alt.anonymous.messages propagation
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- L. McCarthy <lmccarth(a)ducie.cs.umass.edu> wrote: >Hmmm, does MIT get alt.anonymous at least ? I understand alt.anonymous was >created to serve a purpose similar to that of alt.privacy.anon-server, but >at the moment it's a de facto equivalent of alt.anonymous.messages. >alt.anonymous is somewhat better propagated than a.a.m, from what I've heard. Nope, no alt.anonymous. 'Leastaways, not off the servers that the turist accounts use. And since I configured news on the machine, I'd love to hear if there are MIT servers that have a larger set than life.ai's. >You should request one or both groups from the MIT news admins. If users there >want to read the group, they'll likely be quite happy to carry it. Alas, I am but a turist at MIT, though one who helps maintain the turist machine. I'll be looking at getting a real newsfeed from elsewhere, but asking the MIT newsadmins for favors isn't in the cards. If anybody here has a bit of a stronger standing on campus, their asking would be way cool. >I'm a fairly well-known regular in alt.config, and I believe I can probably >recruit some prominent news admins to send booster newgroup messages for >alt.anonymous.messages. Apart from that, it's a matter of people asking their >local news admins to pick up the group if they aren't already carrying it. That would be a most excellent thing to do, regardless of how it affects my situation. - -- Todd Masco | It's difficult to be loud about keeping your enumerated cactus(a)hks.net | rights when you're busy exercising your unenumerated ones. cactus(a)bb.com | http://www.hks.net/~cactus/cactus.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwLBSoZzwIn1bdtAQHxqgGA3WuDp+3/5A8pqGNpFc5UqAVJafaSL7je bUpZDrHpYMXycfCUPAgh+HpxJpCTLWU1 =c8Gt -----END PGP SIGNATURE-----

2 1

Crypto Declaration of Independance
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a proposal for you all. I have started work on a Crypto Declaration of Independence, based on the famous American work which represents Independence. With the incoming batch of Congress and the new year approaching, I think that it's time we assert what we believe in. We need to let people know what we stand for, and why we think it's a good idea. And with the (quasi)-recent passage of the DigiTel proposal and Freeh's comments about banning encryption, we need to wake people up. However, asserting this to ourselves again would be akin to holding a one-person conference. We have rehashed these points amongst ourselves many times. Therefore, I propose that we spend some time revising this work, based off the writing I will post if there is support for this idea, then sign it, and email, fax and mail it to our respective news agencies, government officials and interest groups. However, without your support, this endeavor would be fruitless. Before I post the "beta version"/first draft of the CDoI (for lack of a better term), I want to know if you (the C'punks) will support it and help me. Overall, I'm looking for answers to four questions: 1) Will you support and help this endeavor. 2) A target date for sending it out. First idea which came to mind: Jan 1st, 1995 3) A list of groups/people which should receive it. Government officials, news agencies, HOTtired, CPSR, EFF, ACLU, etc and along with #3: 4) Ways for bringing it to people's attention. I intend to keep myself anonymous during this process, so please contact me by leaving a message on this list, or mailing everything within these cutmarks to remailer(a)jpunix.com: -- CUTMARK ( do not include )-- :: Encrypted: PGP - -----BEGIN PGP MESSAGE----- Version: 2.6.2 hIwD/nqSW1QDQfUBA/wI+tSk7CWd5u2dMywjv6oLosg3nm5ki/p8HhOg7VXHDk0S 6MpptLzWzUtkvL+EZEBS7NHORSTNRbo0K/Uvqgl0Rqaqig5Wx6i2VKve3ky9/Kbm I72casRMcyoBka+cOtKdU5JBVXF/YDWmCb3usnvAu0oDZGxBstTaTPgpJzMiV6YA AACTszK/wRKedt58GVDLQs7gNNUUyIxbKtUQNQGss2sbM7AZE0kaQ7B6Z1VXJy0t NKYzUQfk5LEJ1ko9ZbvDSgAWzTnZbmyfSszrpHpRN7ehFhgRCVf4YToMQa5eSOAg CHxmBMq01kDqIntHXZpWquU31+rfpPNNAT9pFHiYAj7biIRA3LWIRwvmy30j+QEv DaMODrdo =xtpD - -----END PGP MESSAGE----- < please put your message to me here> -- CUTMARK ( do not include ) -- I hope you will support me, and I will welcome any and all comments and criticism. Asynchronous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuq6yFG1rORFKstdAQH54wP/SaiMFKwz2UzjMdnhVK1HiBW2qSNs6NWC 5ENgEHod+n4ngfsx+miYMzmzDq2GmJ/KbvfMQjDFZiIcsirT2JPcu/YuvLG9AJvy GbO4pY0n/Mky8m1V66OxTxnVjb5CaGpRvbxrOKzAMx7CQMBGRfbdlHpPjtLWfpLf l0xwy9yoCVU= =Loxi -----END PGP SIGNATURE-----

3 4

Re: Globe and Mail Article On Forged Posting
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Mark Terka writes: > Ok, here is the text of the story about the "Forged Bob Rae Posting" from > the Toronto Globe and Mail. An examination of the story only indicates how > far our journalists and politicians have to go in understanding the Internet! Indeed. Let's examine some of the apparent misconceptions.... [quoted text from here to the end is from Rusk & Mittelstaedt of the Globe & Mail] > A furious Mr. Rae criticized Mr. Harris outside the legislature, > accusing him of leading to the "Americanization of Canadian > politics" through the use of "dirty tricks. (ouch :) [...] > Ont.general is a computer bulletin board on which Internet users > discuss life and public issues in the province, said Larry Sherman, > president of Internet Seminars of Woodbridge. > A message can be removed from the board only by whoever posted it, No, anyone with a moderately flexible newsreader and a little bit of knowledge about news control message syntax can cancel someone else's article. Tying this in to the discussion about using a newsgroup as a message pool, notice that news articles are far easier to wipe out than mail messages. This is potentially a major vulnerability of any such system, given current news software. Widespread unauthorized cancellations (other than for spam) are greatly frowned upon, though, so a concerted attack would probably set up a major clash of powers on the net. [...] > The source of the message was an account that provides a service > that allows people anonymous access to the Internet, she said. mail forwarding =/= net access > Mr. Sherman said it is very easy to post a false message on a > bulletin board and to make it appear that it came from a computer > different from the one that sent it. True, but that's a claim about forgery, not remailing; this is a worrisome confusion of terms reminiscent of the hacker/cracker problem. > By going through a California bulletin board, "obviously someone > has gone way out of their way to send that in," Mr. Sherman > added. One hopes that Internet Seminars pres. Sherman isn't responsible for the absurd implication I infer from this: sending mail via a geographically distant site requires going out of one's way. Is there some more sensible interpretation ? It seems obvious that someone posting an article purporting to emanate from the Canadian PM would try to transmit it with some level of indirection. [...] > Last months, the Tories played pranks at an NDP convention > sending in a camera crew that shot pictures ridiculing Mr. Rae, > including a doctored video sequence that seemed to give the Premier > a stutter. The picture were broadcast as dinner-time entertainment > at a Conservative convention the same weekend. Who's learning slimy politics from whom ? - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwUnmf7YYibNzjpAQHqQAP+LPVNyr0dFCMDlSmF9GiLzK6ODmCgpopC Pke/Qk9esB+vWA5bPpxtbD1Z61rCGJgvZU++g1+vovmbcSzduoQMauEKKoX5+V9m oGEcfyvu1KqnsVL83jN6YHTMANs/DxHCPVf8jWusJOgQJ+LzZN9xPxlcKDBRFiS1 wyBTHvaOlaQ= =Lism - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwV9yoZzwIn1bdtAQHkUAF/QCXYBhzma2Y8rrT+hWnIeZYkjlNzi+8s Nf3pPrzjc34nCOsxcwz9aJ9AjhPvWJEV =wOms -----END PGP SIGNATURE-----

1 0

Re: News->Mail & CMU's Andrew Message System
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Todd Masco writes: > I don't see a problem. Broadly put, news is broadcast e-mail. There are > many sites which in fact do not distinguish between the two, the most > notable of which is CMU's Andrew Message System: the admins of such > systems believe the "experiment" to be an all-around success. Is the AMS software (or some similar system) available as freeware or shareware somewhere ? I'm considering the possibilities for anonymized subscription to newsgroups through a mechanism like this. Come to think of it, many newsgroups are gatewayed to related mailing lists for readers on BBSes and such; I need to search a bit for the software used to do this. I'm curious how such systems deal with cancellation messages; presumably they would simply have to drop them. This would partially eliminate the threat of spam-of-cancels attacks I mentioned earlier. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwcj2f7YYibNzjpAQEFgAQA0NujNGNOBBLyhPvCL09CmGn1atDbckX+ 98e5iSm+BMJNeD++m55uLl+8jk5HugNmu4M3/cYDq3fwff6d2lLczBQlHTPRxz3E JGKrB8Ho0scxHbvv70UL2SYHR22JQJk/GQWmx91wwdWb27maTW2QWVRtraQzLBaR EJJzpj29Iyo= =mIVa - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwdyioZzwIn1bdtAQEThAGAuTkPjJ+9wOwl5PnTJUnZ8BK1XDEcoKyY NR9OCOYqzWz3NWk944ypq4ZX1z8w5Eyw =0Fo0 -----END PGP SIGNATURE-----

1 0

Re: Broadcasts - Bandwidth Problem ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Jonathan Rochkind writes: > Many people seemed to think that a newsgroup for this sort of a thing was a > waste of bandwith. I don't really agree, and think that the bandwith is > neccesary for a distributed method of making the remailer net more robust > to remailers popping into and out of existence. In case the bandwidth on {alt.anonymous, alt.anonymous.messages} started to bother news admins, we could actively encourage them to put the groups on very short expiration periods, i.e. articles might expire after only a day. Assuming people are using automated sniffers to collect their anonymous mail, this shouldn't present any obstacle to the use of the groups as message pools. Keeping the ciphertext around in public for a shorter time sounds like a Good Thing (tm), anyway. I agree that bandwidth seems essential to foiling traffic analysis. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwe/Wf7YYibNzjpAQFK4AP/YFtRJMd0emeRJgZf4QaL4qPvMFKNn3Uv MYFhJ8GR2M4x1q/ZAwhJsP3NuIeRk5UAWc1Ti1OYKjDkNvoQ52DK3uOW6aCqxYp0 3REpK53F0PkuVL9EnfGImrUWAyeUr2oZOzp1O67hD0eCYhM4IdcdDudA/97Xh0R+ zRIhgC6/Gfo= =n6qM - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwgPSoZzwIn1bdtAQFFgAF+LXvBnjZEZxsMx9MU+fGX9ynuAnrqKs6S EFbgsBG8aFvul2skOsgIBrVW5luJm4c7 =iPbm -----END PGP SIGNATURE-----

3 3

Exact quotation from Freeh on banning unapproved crypto ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Can anyone point me to a source of verbatim quotations of Louis Freeh's now- legendary comments about the possibilities of banning unapproved cryptography ? All I have been able to find thus far are vague paraphrases. Thanks. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwh+2f7YYibNzjpAQHp+wP9F2tGTtTYg+QRlDQVkrgfQh6YSbKRXNW1 OJX22BcuhAFsMX1LUTZQ5unYiwXi8pu9jdyeCV5nGU/PSKO3noSEunBFlSPCm0nm yW5UEiWGWjRuDUJNEEB81W9KVdB8JPvTgsBANv4skQpT8pNPumQz54uPvEaFJ8O3 bt+zxTB6dc8= =ATOv - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwjSCoZzwIn1bdtAQFs5wF/c6t636S1GnUKygE2/UBJGwyoSnubAYJ6 5+Ck9KIrIavZ7n/7qLWhYX+7jp8Xkq54 =MM0m -----END PGP SIGNATURE-----

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 12 Dec 94 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- xs4all remailer(a)xs4all.nl ***+*-+***** 9:24 99.99% usura usura(a)xs4all.nl ***-*-++**** 10:38 99.99% alumni hal(a)alumni.caltech.edu +*+**+**+*** 7:33 99.99% penet anon(a)anon.penet.fi ++**+******* 29:39 99.99% c2 remail(a)c2.org +++-_--+++-+ 58:05 99.99% flame tomaz(a)flame.sinet.org +*++******+- 14:55 99.98% nately remailer(a)nately.ucsd.edu ++++++++++++ 32:43 99.98% portal hfinney(a)shell.portal.com ************ 4:17 99.97% jpunix remailer(a)jpunix.com +*++***** +- 14:42 99.96% myriad remailer(a)myriad.pc.cc.cmu.edu **+********* 5:32 99.94% vox remail(a)vox.xs4all.nl ---------..- 14:16:12 99.99% rahul homer(a)rahul.net *********** 5:06 99.88% bsu-cs nowhere(a)bsu-cs.bsu.edu *+-***-**++ 22:31 99.82% mix mixmaster(a)nately.ucsd.edu -+-+-++**+++ 32:50 99.80% ideath remailer(a)ideath.goldenbear.com ******-*++ 29:24 99.82% desert remail(a)desert.xs4all.nl -------.--- 10:57:50 99.99% extropia remail(a)extropia.wimsey.com --+++---.-+ 5:00:06 99.68% rebma remailer(a)rebma.mn.org *-..-.-*--- 10:34:53 99.71% soda remailer(a)csua.berkeley.edu .-......_. 11:45:06 96.63% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

Re: Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

> > Ian Farquhar writes: > > Around the mid 1980's a rather interesting device appeared. It was > > essentially an automated scanner for high-density barcodes. > > A recent mini-article in "WiReD" mentions a barcode-like encoding > mechanism being promoted by (I think) Xerox. It's apparently denser > than barcode and it survives copying well. The Xerox technology is essentially a series of tiny slashes and backslashes. The slashes stand for a 1 and the backslashes a 0 - or vice-versa. This gives you a binary data stream that you can work with. From what I understand, without looking at them closely, the area with these slashes looks like a gray screen. When I first read about this technology a couple of months ago, it was given as a way that sufficiently smart color copiers could restore original color to a black and white copy. Of course there are all kinds of other applications.... ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

1 0

Re: Clarification of my remarks about Netscape
by Kipp E.B. Hickman 17 Dec '03

17 Dec '03

In article <9412111620.AA41983(a)eldamar.walker.org>, you write: > Several people have asked me to clarify my recent comments about Netscape. > I am more than happy to oblige. > > First of all, let me begin by saying that I am a biased observer, and that > all of this is my personal opinion. My annoyance with Netscape is also closer > to the surface this week than it normally is, due to a variety of factors > (including having just returned from the San Jose IETF meeting). My initial > comment, and the ones that follow in this message, are thus more frank than is > my usual style on, say, public Usenet newsgroups. > > That being said, here are some of the data that has gone into my impressions > of Netscape so far. > > (1) Netscape plays very fast and loose with HTML. Rather than participating > in the existing standardization efforts, they have indiscriminately added > "extensions" to it that are not supported by any other client software, > and which in some cases go directly against HTML's markup-oriented > structure. This only adds more confusion to an already muddy area, > delays the prospects for a standard HTML specification, and divides the > WWW into "WWW Classic" and "Netscape-compatible". Personally, as a > strong proponent of universal interoperability, I find this reprehensible. > There is no need to bypass existing efforts just to add cosmetic value to > your own software. This has nothing to do with security... > (2) The Netscape Secure Sockets proposal has an extremely poor security model. > It is not an end-to-end security model, but rather relies on transport > level security, which is in my view dangerously inadequate for reasons > which should be obvious to most of the folks on this list. Clearly I'm an idiot. Explain it to me. And while you are at it, why don't you email me your comments on the spec? I put my email address in there for that very reason. Jeesh. > It is also > tied directly to the RSA certification hierarchy. Now, for those of us > who have X.509 certificates rooted in the RSA Commercial Certification > authority, that's fine, but it also means that any other WWW client that > wishes to interoperate with Netscape's "secure servers" must license > TIPEM from RSA Data Security, and consequently pay RSA's rather high > royalties, unless the software is free (in which case RSAREF can be used). > This serves as a direct barrier to competition from other commercial > vendors. This is not all bad--I happen to like RSADSI's products and > technology--but promoting a transport-level security system instead of > an end-to-end one is to my mind simply irresponsible. This is an outright lie. We don't use TIPEM. You could build a conformant SSL implementation using RSAREF and the freeware IDEA cipher code. As for a barrier to competition. So what else is new? We all have barriers to overcome before we can compete. Should we get rid of TCP/IP as a barrier to using the web? > There has been no peer review of Netscape's security model--it was simply > implemented by fiat, without regard for the IETF standards process. I > find that this leaves a very bad taste in my mouth. I also heard similar > sentiments from a wide variety of other attendees at the IETF, including > members of the IP Security working group, people who attended the Secure > HTTP BOF, and others. This leads me to believe that it's not just a > matter of me leaping to wild conclusions. You are somewhat right here. In fact, this was done because we are a company interested in surviving long enough to withstand the eventual attack by microsoft. Instead of waiting several years before anything was agreed upon and ending up with a kitchen sink protocol as all others these days do, we took a simpler approach. And instead of hiding in a closet with it, we brought it out to light. As a result we received critical review from some decent members of the crypto community, including: Martin Abadi Mike Burrows Alan Schiffman Matt Robshaw Burt Kaliski to name a few. As for the IETF standards process, we are pushing the document into the RFC process. > (3) Netscape is viewed as a "loose cannon" by most of the other commercial > players in the WWW arena, mainly because they have introduced a fair > amount of FUD into the HTML standardization effort, while simultaneously > promoting themselves as being standards-based. Members of Apple's > "Cyberdog" project and Microsoft's web projects, who *are* trying to > contribute to the standards process, had particularly excoriating things > to say in this regard. This is a matter of opinion. However, I believe that our opinions don't matter in the long run because of the 800 pound gorilla Microsoft. They will push something out, it will be proprietary, and they will name the tune and ask us to play along. Now we can either just sit back in our current comfy cozy standards based processes and languish for a few years, and then SIGH and say "Gee wasn't that fun, too bad microsoft shoved yet another piece of excrement down our throats" or we can be "loose cannons", get something out there, try it out and see what happens. The market will decide one way or the other. > Now, as I said, I am biased and my comments about Netscape are strictly my > person opinions. I will be perfectly willing to revise these opinions as I > receive more data. For example, if Netscape takes a more active part in > the standards process, works with RSA to secure wider availability of the > underlying technology required by their proposals, and generally demonstrates > a willingness to play nicely with other children, that would be great, and > I'll just as strongly defend them as I am panning them now. > > However, in my view, they have not shown a good initial track record. > Only time will tell. > > > Amanda Walker > InterCon Systems Corporation > > --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html -- --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

8 23

Re: Real-time surveillance of the police
by doumakes＠netcom.com 17 Dec '03

17 Dec '03

The technology of monitoring location is interesting, of course, but why on earth would the police, who will not consent to civilian review, ever go along with something orders of magnitude more extreme? ObCrypto/Privacy: I suspect there would be an immense amount of radio traffic involved in keeping track of a substantial group of people, say, over 1000. I don't doubt the ability of the device(s) to transmit the information, but the ability of the receivers to digest it all in real time. -- ______________________________________________________________________ Don Doumakes Finger doumakes(a)netcom.com for PGP public key Foxpro databases built to your specifications. Email me for details.

1 0

BEAT COPS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Michael Crawford wrote: ... individual cops can rack up millions of dollars in legal settlement costs and still remain on the force. I heard ... that a small handfull of cops in San Francisco had cost the City tens of millions, with individual cops repeatedly causing lawsuits, without getting fired. True, but that's without embarrassing videotapes. The clueless populace doesn't stay clueless for long when they seen the police "blooper" tapes. Police unions won't have much clout compared to an enraged public. ... at least one cop wouldn't go for it - the cop we caught jacking off to a magazine of ill repute... Gives whole new meanings to "night stick," "the long arm of the law," "stop and frisk," "pat down," "pounding a beat" and going to the "policeman's ball." (Anyone else want to jump in on this one?) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Misunderstanding of Remail Headers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 2:13 AM 12/12/94, L. McCarthy wrote: >Hal writes: >> There was also a misperception that my remailer was an official effort >> endorsed by Portal (again, despite the disclaimers). Note that it was >> they who were contacted, not me (yet). This might suggest that it will >> not be possible to cleanly separate the remailer operators and service >> providers when problems like this arise. Both may end up being hassled >> (time will tell whether I am). > >This is all too familiar to me. Although I still haven't heard the official >line on the shutdown of Underdog following the Scythe spam, at least some >people locally (including, crucially, my advisor) received the impression that >I had forged (and authored !) the offending news articles in spite of the >disclaimer headers. Maybe the remailers should put bogus "From:" lines in, to avoid this? Make it "From: nobody", or "From: Anonymous", or even something odd like "From: AnonUser!hfinney(a)shell.portal.com". Put in some other lines telling the actual address of the remailer, as well as a complaints-to: address. Maybe "Sender: hfinney(a)shell.portal.com", or "Remailer:hfinney@shell.portal.com". The "From:" line seems to be confusing people. The author of the article quoted from the Globe & Mail appearantly didn't even understand the disclaimer. The article was worded in such a way to make it seem the disclaimer was saying that Bob Rae didn't really write the message, as opposed to saying that Hal Finney didn't really write the message! Something needs to be done so that even the most internet clueless will understand that the message _isn't_ from Finney or McCarthy or Joe Random RemailerOp, which appearantly isn't clear to many people currently.

2 1

extra dashes in PGP-related blocks?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

When people have been posting their public keys, or encrypted address blocks, to various lists I'm on, all of the "-----BEGIN whatever..." lines seem to have a "- " preppended to them. So, for instance, they look like: - -----BEGIN PGP MESSAGE----- Version: 2.6.2 [stuff] - -----END PGP MESSAGE----- I'm guessing if I really sent a block like that to a remailer, the remailer would hork because of the prepended "- "s. I know that sometimes people's public keys they've posted to a list look like that, and when I try to add them to PGP, it horks, and I've got to go into a text editor and remove the "- ", and then add it to my keyring. Does anyone know what it is that's putting in these "- "s, why it's putting them in, and how to stop it?

4 8

Re: extra dashes in PGP-related blocks?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> I'm guessing if I really sent a block like that to a remailer, the > remailer would hork because of the prepended "- "s. I know that > sometimes people's public keys they've posted to a list look like > that, and when I try to add them to PGP, it horks, and I've got to > go into a text editor and remove the "- ", and then add it to my > keyring. PGP does this... Not only does it complicate nested PGP signed messages, but if you pgp-sign an entire MIME message (i.e. by sending it to the autosigning service) instead of placing the signed doc inside the MIME boundries, it can cause mail readers to not recognize the MIME boundries and display the letter as normal ASCII-Mail. andrew

1 0

re: real time surveillances
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Mark Hittinger had several thoughts about real-time surveillance. He wrote: ... The technology to fabricate video evidence is there is it not? Big problem with self-surveillance; not a problem with a properly set up system of police surveillance. The critical element is a trusted third-party agency to archive the tapes. There was a relatively recent sad case of two officers that had a video camera installed in their patrol car.... the occupants of the car murdered the policemen and the *entire* scene was obtained on video tape.... It is possible that they might have been saved had this been real-time video rather than taped. Yes, and real-time video monitoring would be a good upgrade when the technology allows it (real-time location monitoring is possible now). In the meantime, *obvious* video recording would also help protect officers in that some perps would think twice before killing someone *on camera*. ... Another great idea would be anonymous real-time monitoring of vital signs along with position data. Auto-911 if you will. We know somebody at this corner had a heart attack 5 minutes ago where is he? The developers of the localizer technology I mentioned in my article have anticipated you. Their equipment can do real-time vital sign monitoring. There are some obvious benefits for wired cops plus some subtle drawbacks for bad cops. (I leave discovery of said drawbacks as an exercise for the student.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 3

Re: News->Mail & CMU's Andrew Message System
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- L. McCarthy <lmccarth(a)ducie.cs.umass.edu> wrote: >Is the AMS software (or some similar system) available as freeware or >shareware somewhere ? I'm considering the possibilities for anonymized >subscription to newsgroups through a mechanism like this. AMS is pretty strongly tied to AFS (now known as part of DCE) and is geared towards sites with users in the thousands. It's probably not what you want, even if it were available (CMU is in the process of phasing it out, since their user base usage has exceeded the design limitations of AMS). >Come to think of it, >many newsgroups are gatewayed to related mailing lists for readers on BBSes >and such; I need to search a bit for the software used to do this. Take a look at newsgate, available somewhere on ftp.uu.net. All you have to do is set up a pseudo-site in your news server's newsfeeds file and send the messages through news2mail. >I'm curious how such systems deal with cancellation messages; presumably they >would simply have to drop them. This would partially eliminate the threat of >spam-of-cancels attacks I mentioned earlier. It totally depends upon the configuration of the gateway and the format of the message. If your gateway passes Control: headers, then cancels will be forwarded to the user and perhaps even be effective if they have another mail-to-news gateway up (that allows Control: headers). Even more so for cancels of the "Subject: cmsg cancel" format, since everything passes Subject: headers. - -- Todd Masco | It's difficult to be loud about keeping your enumerated cactus(a)hks.net | rights when you're busy exercising your unenumerated ones. cactus(a)bb.com | http://www.hks.net/~cactus/cactus.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuyoqSoZzwIn1bdtAQH4gQGAqbROjwEHW6VVYwawXtzeTitdkpWXoytC UNEMT8FPQ49MqbwWnWMJfZDY1CGZoRpU =Yrr9 -----END PGP SIGNATURE-----

1 0

Re: Misunderstanding of Remail Headers
by mclow＠coyote.csusm.edu 17 Dec '03

17 Dec '03

>At 2:13 AM 12/12/94, L. McCarthy wrote: >>Hal writes: >>> There was also a misperception that my remailer was an official effort >>> endorsed by Portal (again, despite the disclaimers). Note that it was >>> they who were contacted, not me (yet). This might suggest that it will >>> not be possible to cleanly separate the remailer operators and service >>> providers when problems like this arise. Both may end up being hassled >>> (time will tell whether I am). >> [ stuff deleted ] >The "From:" line seems to be confusing people. The author of the article >quoted from the Globe & Mail appearantly didn't even understand the >disclaimer. The article was worded in such a way to make it seem the >disclaimer was saying that Bob Rae didn't really write the message, as >opposed to saying that Hal Finney didn't really write the message! >Something needs to be done so that even the most internet clueless will >understand that the message _isn't_ from Finney or McCarthy or Joe Random >RemailerOp, which appearantly isn't clear to many people currently. While I'm all for having clear disclaimers, the facts remain: 1) You can't force people to read. 2) Even if you could, you can't force people to understand. Improve the disclaimers, sure. But don't think that this problem is going to go away because of it. -- Marshall (who has just blown his lurker status) :-) Marshall Clow Aladdin Systems mclow(a)san_marcos.csusm.edu

1 0

remailer list
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

What's the ftp site where I can obtain the latest copy of the list of remailers? Thanks, -RH- --------------------------------------------------------------------------------- Reuben Halper I'm not growing up, I'm just burnin' out." Montclair High - Green Day - Montclair, NJ E-mail: fhalper(a)pilot.njin.net PGP 2.6ui Public Key available upon request ---------------------------------------------------------------------------------

1 0

oh, and by the way...
by perry＠imsi.com 17 Dec '03

17 Dec '03

I forgot one element of my proposed alternative to SSL. For securing HTML documents themselves, use something like the new IETF security multiparts standard, which is suitable for protecting MIME encapsulated documents. .pm

1 0

Re: Real-time surveillance of the police
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Don Doumakes wrote: ... why on earth would the police, who will not consent to civilian review, ever go along with something orders of magnitude more extreme? (1) There are civilian review boards; the consent of the police is not a prerequisite. If they don't like it, they can get a real job. (2) It is in their best interests to be protected from false accusations, and to be able to be quickly located under emergency conditions. ObCrypto/Privacy: I suspect there would be an immense amount of radio traffic involved in keeping track of a substantial group of people ... [I doubt] the ability of the receivers to digest it all in real time. (1) My suggestion was for (probably local) recording, not real time monitoring of video; therefore, no bandwidth problems. (2) Tim might want to comment, but my understanding of the localizer technology is that it too is somewhat "local" and that polling or burst transmission keeps the bandwidth requirements at manageable levels. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Re: Clarification of my remarks about Netscape
by Amanda Walker 17 Dec '03

17 Dec '03

[I'm sending this to the list because it does have some crypto content] "Kipp E.B. Hickman" <kipp(a)warp.mcom.com> writes: > > There is no need to bypass existing efforts just to add cosmetic value to > > your own software. > This has nothing to do with security... Agreed. My annoyance with Netscape is not based solely, or even primarily, on security concerns. In fact, my only annoyance with your security proposal is that it is at the wrong layer (or, more accurately, at layer which should be secondary). In my view, you picked the right technology, but applied it to the wrong problem :). > Clearly I'm an idiot. Explain it to me. SSL is a mechanism whereby a client and a server can establish a secure, authenticated transport channel. The problem is that this isn't what I want to secure and authenticate. Most of the time, in fact, I don't care about the transport: I may be talking through a proxy (like the current CERN httpd), or bringing things in from a cache, or talking to a load-balanced server array. I want the *documents* I'm accessing to be secure and/or authenticated. I want my HTML documents signed and certified by the *author*, not the server. I couldn't care less about the server if I can verify that I've got the right document in response to my query. Similarly, if I send the contents of a form containing, say, my Amex number, I want to encrypt the session key with the public key of the merchant, not the service provider. This is what I (and many others) mean by an "end to end security model." Transport security is a nice secondary ability (it helps defend against traffic analysis, for example, and casual snooping by students with packet sniffers), but without end-to-end security, it's simply a way of providing a false sense of security. I wouldn't want to do away with the TCP checksum field simply because the modem I use for my SLIP link is "error-correcting," and I feel the same way about security. > I put my email address in there for that very reason. Jeesh. I'd rather that technical feedback occur in a public forum like the IETF. I have no pretensions about being a security expert, and I want people to shoot down my bad ideas too. Heck, I *like* having my competitors tell me what's wrong with my ideas :). > > This serves as a direct barrier to competition from other commercial > > vendors. > This is an outright lie. We don't use TIPEM. You could build a > conformant SSL implementation using RSAREF and the freeware IDEA > cipher code. Nope, not if I want to sell it (note the word "commercial" in my comment). RSAREF cannot be used for commercial software, nor can IDEA under the PGP license. There is no feasible way to license the RSA patents for commercial use except by licensing TIPEM. I have been told this outright by Kurt Stammberger of RSADSI (their VP of marketing, I believe). This is not secondhand information. All commercial software that I know of using RSA public key encryption and RSA stream ciphers (such as RC2 and RC4) uses TIPEM and BSAFE, including Lotus Notes and Apple PowerTalk. RSA's royalty structure is based on a percentage of revenue, with the percentage on a sliding scale based on gross corporate revenue (not just on products which use RSA's patents). If you keep your margins low to compete in the marketplace, you lose. Even you folks are making your money on high-margin products (servers) rather than low-margin ones (clients), I'd wager at least in part because it's a way to make money despite having to pay RSA royalties. The RSAREF license has been loosened up some recently, but it's still restricted to freeware. > As for a barrier to competition. So what else is new? We > all have barriers to overcome before we can compete. Should we get rid of > TCP/IP as a barrier to using the web? I don't have to pay royalties to sell an implementation of TCP/IP. Your analogy fails. > You are somewhat right here. In fact, this was done because we are a company > interested in surviving long enough to withstand the eventual attack > by microsoft. You've already got your eggs in the right basket on this one--sell servers and services, not client software. Microsoft has a miserable track record in the server arena (witness the underwhelming success of Windows NT :)). It's also less of a commodity market, which is where Microsoft excels (no pun intended). > As a result we received critical review > from some decent members of the crypto community, including: > > Martin Abadi > Mike Burrows > Alan Schiffman > Matt Robshaw > Burt Kaliski Mostly RSADSI people, by my count. Great technical background, but I wouldn't call relying on one of your technology vendors "peer review"... > As for the IETF standards process, we are pushing the > document into the RFC process. Precisely. Rather than working with others in the industry and research communities, you are trying to push your proposal into the standards track. > The market will decide one way or the other. On this I agree completely. Amanda Walker

4 3

Herbert S. Zim dies
by Philip Zimmermann 17 Dec '03

17 Dec '03

Herbert S. Zim, author of over 100 children's books, including "Codes and Secret Writing", died at age 85 on December 5th in Plantation Key, Florida, where he has lived for many years. He had Alzheimer's disease. I mention his passing because he wrote the first book I ever read on cryptography, which I read in 4th grade in 1964. If it weren't for Zim, I might not have created PGP. -Philip Zimmermann

1 0

Re: extra dashes in PGP-related blocks?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 5:03 PM 12/12/94, Andrew Brown wrote: >but is a remailer (or pgp) smart enough to take the output from checking >a signature and run pgp over it again? is it going to know to take something >and pass it through pgp until pgp can't do anything with it any more? i think >that's the problem that jrochkin was addressing. he has a pgp encrypted >message and then signs it and then wants to mail it to a remailer so that the >remailer can decrypt the message but it won't ecause the encryption is >nested... > >wasn't that it? Well, no, not really. My problem was that a user would send me their public key, inside of a signed message, and the "BEGIN PUBLIC KEY" stuff would have the "- " on it. Which means that before I can add it to my keyring, I've got to edit out the extra "- "s, and then save it in a file, and then pass it through PGP, instead of just passing the original message though PGP, or using the Mac "copy" command on a part of the message and sending that through PGP. Or someone sends me an encrypted address block inside a signed message, and I've got to do the same before I can use it. I now understand why PGP does what it does, but it's still a pain. Perhaps the ideal mail reading program would run my incoming mail through PGP before I even saw it, so I wouldn't have this problem. Well, actually not. My ideal mail reader would check the signatures before I saw them, but would also leave them intact on the message, so I could re-check them myself manually if I wanted. Oh well. It's not a limitation on functionality of any kind, just on convenience.

1 0