December 2003 - cypherpunks-legacy

Re: An alternative to remailer shutdowns
by jim bell 17 Dec '03

17 Dec '03

At 02:12 AM 5/27/96 -0400, Black Unicorn wrote: >On Sat, 25 May 1996, jim bell wrote: > >> > Why the first in chain? If the anti-traffic-analysis provisions are >> >working properly, it should be impossible to prove that a given first remailer >> >was the first remailer for any particular message. I had thought that even >> >civil courts required that you be the person who committed some act, not the >> >person who _might_ have committed some act. Otherwise, all the remailers are >> >in danger. This is even if someone tries an entrapment by sending through some >> >illegal material - if the courts accept that they should be allowed to do this, >> >then all the remailers they chained are going to be hit. >> >> Likewise, I don't see why the first address in the chain is vulnerable, as >> long as the message subsequently passes through at least one trustworthy >> remailer, and probably a temporary output address. > >I repeat, all it takes is one person to send through only one remailer >(perhaps even a Co$ plant) and the first in chain remailer is toasted. > >Think before you type please. You should take your own advice. The mere fact that the first link in the chain is "known" doesn't mean that it is provably involved. Without a substantial amount of bugging that the COS hasn't the resources to do, there is a big difference between them _believing_ that a given message originated there, and being able to prove it in court. And notice my caveat: "As long as the message subsequently passes through at least one trustworthy remailer, and probably a temporary output address." Jim Bell jimbell(a)pacifier.com

2 1

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 11:44 AM 5/31/96 -0400, Moltar Ramone wrote: >On Fri, 31 May 1996, Lucky Green wrote: >> Where does this leave foreign vendors? Will Sun sign the 3DES package of a >> foreign vendor? > >Probably. But they won't be able to export the signed 3DES package :) >It leaves foreign vendors in trouble, is where. But why can't they just export the SIGNATURE, if it is detached from the software itself? Jim Bell jimbell(a)pacifier.com

2 1

new info-sec mailing list
by fc＠all.net 17 Dec '03

17 Dec '03

Info-sec heaven is introducing a new mailing list. Unlike many of the Internet's mailing lists, this is not an open forum for people on the Internet to exchange ideas. Rather, it is a monthly mailing used to inform readers of new information that can be found in info-sec heaven. If you would like to be informed of new information, services, search capabilities, protection software, articles, books, and other information that appears in info-sec heaven without having to come in periodically and look for yourself, please let us know by sending email to fc(a)all.net and we will add you to our monthly list. Thank you for your time. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: DCSB: Electronic Commerce: The State of the Art
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

The signature on the message attached below did not verify. Pronto Secure has the neat feature of doing signature checking on the fly. In the process of testing PSecure I have collected from the keyservers, the keys of most people on the list who pgp sign their messages. (Another neat feature of PSecure makes this a one click task) I could quite easily perform the service of bouncing messages with bad signature back to the list. Please let me know if people agree that this would be a useful service, or is it inappropriate ? My experience over the past few months is that around 10% of all signed traffic on the list checks with a BAD SIGNATURE! Geoff Klein Pronto Secure Product Manager.

3 2

No Subject
by Anonymous Remailing Service 17 Dec '03

17 Dec '03

E. Brian sed: >Unbelievable!!! To add to this distressing truth, I have learned that >the White House also subscribes to a number of newspapers and periodicals >which are reviewed for things of interest to the Administration and to >the President. I I I I I I ammmmmmmmmm shocked! mebbe tha Slickster just wants to know who orlin's "Deep Throat" is... Keep checkin' them fingerprints, Willie! >Ooops. Dog bites man. >And do you really think the White House couldn't hire a couple of net >gurus to sniff packets if they wanted to hide their "monitoring"(=reading). who sez they dont post, too? heh

2 1

Cash Is Dying
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-14-96: NYT ad for The New York Times Magazine: Cash is dirty. Cash is heavy. Cash is quaint. Cash is expensive. CASH IS DYING. "You believe in banks don't you? That's good, because ultimately money is backed by nothing but your own confidence, habit and faith -- a form of faith as powerful and essential to modern life as any religious belief. The coming digital era will make this plain to everyone, as never before." (Continued on Sunday) From "Dead as a Dollar" by James Gleick ...the cover article in this week's issue. --------- Yes, the James Gleick whose co-founded Pipeline is near dead as a dollar. Hope his multi-million-dollar PSI-buyout lives.

5 5

No Subject
by A5113643667＠attpls.net 17 Dec '03

17 Dec '03

Dear Cypherpunks and Tom, The ones I've heard about are SKIP, Photurus and ISAKMP(sp?). Peace --- NOTICE: This message originally included graphics and/or sounds which can only be received by AT&T PersonaLink(sm) subscribers. You received only the text portion(s) of the message. Please contact the sender for information that was deleted. To learn how to send and receive graphics, voice and text messages via AT&T PersonaLink Services, call 1-800-936-LINK. ---------------- Received: by attpls.net with Magicmail;12 Sep 95 10:34:32 UT Date: 12 Sep 95 13:05:43 UT Sender: owner-cypherpunks(a)toad.com (owner-cypherpunks) From: owner-cypherpunks(a)toad.com (owner-cypherpunks) Subject: Re: draft key mgmt props To: peace(a)acm.org (Tom Jones) cc: cypherpunks(a)toad.com (Cypherpunks) Message-Id: <199509121024.GAA15929(a)frankenstein.piermont.com> In-Reply-To: <Your message of "Tue, 12 Sep 1995 07:15:16 -0000." <3E79EDD0>> Reply-To: perry(a)piermont.com (perry) X-X-AUTHENTICATION-WARNING: frankenstein.piermont.com: Host localhost didn't use HELO protocol X-X-REPOSTING-POLICY: redistribute only with permission Tom Jones writes: > Does anyone here feel like explaining the situation between the three > key management proposals now at the internet draft stage? Which ones are you refering to? .pm ----------------

2 1

Re: Alternic.net (was domain zapping)
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 05:54 AM 6/26/96 -0400, you wrote: > >William Knowles writes: >> With all the talk about InterNIC zapping domains, there should be >> some talk about other registries, Alternic.net : http://www.alternic.net >> is offering an alpha test for registering new TLD's and the prices >> are considerably less expensive than the Internic. > <snip crap> > >They can offer to sell you anything they like, of course, and you can >pay them, but you don't get anything at all for the money. Domains >registered with them don't appear in the real DNS. > >.pm Perry, What constitutes "real DNS"? DNS server administrators need only add one line to their named.boot file to resolve .nic hosts. secondary nic 204.94.42.1 db.nic It's that easy! The concept of centralized name resolutions is flawed and only exists out of habit. J.

3 2

Degaussing a pile of 5.25" media
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I have 3 bags full of 5.25" diskettes (in NYC). Can someone please let me use their degausser before I get rid of them? (Anyone who wants them after they're degaussed is welcome to them :-) --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: Encrypted lists and ease of use
by E. Allen Smith 17 Dec '03

17 Dec '03

Where was the information on PGPdomo? That would seem appropriate for the input end, at least. -Allen From: IN%"scs(a)lokkur.dexter.mi.us" 26-SEP-1996 17:26:10.69 Subj: Encrypted lists and ease of use I'm considering sending someone off to work on a project, but wanted to sanity-check the idea and see if someone already has something similar. Recently I've been involved in a number of small (30 people or less) mailing lists which occasionally use PGP for encrypted mail. The hassle comes when one is encrypting a message to the list. With people coming and going, remembering who is on what list is impossible. We're always having to go back and re-send to someone who was left off of the encryption list. What I propose to do is have a second list, list-encrypted@host, for every list@host. Any mail sent to the list simply goes out in plaintext. List-encrypted is encrypted for everyone on list, then sent to the list with appropriate additional headers. To secure the mail as it travels from the sender to list-encrypted, we want to establish a public key for list-encrypted. All mail to the list *must* travel with the public key or be rejected. When mail arrives at list-encrypted, a deamon will process it. The daemon knows the secret key for -encrypted, and has a list of who is on what list. The daemon strips the -encrypted address, encrypts the message for all on the list. If there are other people on the To: or Cc: fields, the deamon will encrypt for them as well. If any of this fails, the message is sent to as many as possible and notification failure goes back to the original sender indicating who the failures were. The daemon then forwards it to the list real list. It preserves the From: field, but changs `To: list-encrypted' into simply `To: list.' Comments? Generally useful? Beta volunteers? :-) -- "Yea, the heavens shall open and the NP-complete solution given forth. ATT executives shall give birth to two-headed operating systems, and copyrights shall be expunged. The voice of the GNU shall be heard, but the faithless will be without transceivers." -- me

4 4

Re: GAK
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:25 PM 9/3/95 -0400, Brian Davis wrote: >I, of course, know of the "dislike" of GAK here. I am curious to know, >however, if the "dislike" is because government would have access under >any circumstances or if the primary worry is that government will cheat >and get access when most would agree that they shouldn't (either by the >judge "cheating" or a TLA stealing it). Individuals will have their individual objections. My objections are that I don't like governments spending tax money that they don't absolutely have to. Their own survival is *not* a necessity. I think controlling people's speech is a waste of money. Very few Common Law crimes (ie real crimes) are dependent on wiretap evidence for solution. Only phoney bureaucratic crimes (the retail pharmaceutical trade, insider trading, gambling, conspiring to overthrow the government, etc) need wiretaps. My second objection is the control of people's speech. If I communicate with someone, I want to communicate with *them*. I don't want to communicate with the Feds. The Supremes have held that the right to speak includes the right not to be forced to speak. By implication, I would argue that I have the right to choose my own channels of communication including my intended audience (and this has been upheld by the Supremes in other contexts). If the Feds want to know what I've written or said (non-publicly) let them subpoena me and I will be happy to tell them to go to hell. If we can deploy technologies to protect our freedom to communicate the way *we* choose to, then we have the right to do so. Beyond rights, we have the power to do so --- which is worth even more. >In other words ... if it took agreement by a review board composed of >non-LEA members of this list, would the escrow be acceptable?? I don't think many of us would feel better if a private party had to approve the invasion of our privacy. DCF "You can ignore all of the rest of bullshit. All that you need to know about an enemy is how many guns and men does he have and can they stand fire."

3 2

Eternity's 15 Minutes of Fame
by Mike Duvos 17 Dec '03

17 Dec '03

There is a short piece by "Wired News" on the Eternity servers. http://www.wired.com/news/news/technology/story/5778.html I should add that all Eternity servers... http://www.zipcon.com/~enoch/eternity http://www.replay.com/~aba/eternity and http://eternity.insync.net/eternity now have pretty icons and a more attractive format. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

1 1

generating hash.curve in eliptic.src
by Mike Rosing 17 Dec '03

17 Dec '03

Among other comments, it was pointed out that I had not included "hash.curve". To generate this file I did the following main() { POINT point; CURVE curve; init_opt_math(); init_rand(); rand_curv_pnt(point,curve); save_curve("hash.curve",curve,point); close_rand(); } This was done during development and I forgot about it. A simpler patch is to fix an error finding the file with a call to rand_curv_pnt to generate it. Kind of interesting that way for hashing your secret key. If everyone uses a different curve to generate their secret key, access to the machine is necessary to even begin to think about cracking any pass phrase. Don't know if actually adds any security, but it is an interesting concept. As for why I didn't put up a tar file, no particular reason. It's source for a particular machine (MachTen on a Mac) and I figured every C compiler is different so some hacking will be required by anyone interested. Once more bugs are fixed such as the one above, I'll put it up in a more easily compilable form. And thanks for the comments so far. I'll do my best to keep up with them. Patience, persistence, truth, Dr. mike

1 0

Mixmaster posting poll
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am about to release Mixmaster 2.0.2 This version will not contain the Socket code, but will have a bunch of bug fixes. One of the things I am modifying is the posting to news feature. Mixmaster supports posting through either a local inews program, or through a mail-to-news gateway. There seem to be two flavors of the latter: group.name(a)gateway.com and mail2news(a)gateway.com Newsgroups: group.name I really only want to support one of these standards. Which is more standard? Is there a trend towards one becoming the dominant standard? The next version should be out within 48 hours. -Lance -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFZ+PvPzr81BVjMVAQEa2Qf/d9a3UTzan5gLB/GN/n+DaMSvDLRVJ96V JpH4F+5SO+UQgdxoSAup9+/l+Q11A4O1ZjxpELVEh6e/7U8HjzrGQHCXGIMfzxkt DufouYDViio8cQ7w1Y4OLqlqaD10OUJ5Chrzm013mc7PzFBgF5eb6rf8S4TdGEYg Ly92xWgYHHk8EwhviYxqdBAGnSSTykEkY9E5WHLca+Lt+5ejox1uMEirq6I4rRVZ UBhfiVQhRsD2eKRUx/a3D3eVnuj0jS8+4i3ibcpUDxm+8WY76zGzmz67y66MzaDo 0E0fFK1VeCwrBoNqFJSLYY5e17c7T6hI3mWJYaZFOLL7H3rGsYUcHw== =BdWR -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

NYT on GAK
by John Young 17 Dec '03

17 Dec '03

The New York Times, September 11, 1995, p. D7. Technology / Peter H. Lewis On The Net. Privacy for computers? Clinton sets the stage for a debate on data encryption. In terms of its ability to raise the nation's blood pressure, the debate over data encryption has not yet reached the same levels as gun control. But last week the Clinton Administration appeared to set the stage for an equally divisive debate over the degree to which businesses and individuals have the right to keep secrets when using telephones, computers and other forms of electronic communications. In two days of public hearings last week in Gaithersburg, Md., home of the National Institute of Standards and Technology, the Administration introduced its long-awaited proposals to relax restrictions on the export of cryptographic software. The Administration drew a line in the virtual sands of cyberspace, signaling that it is willing to permit Americans to put stronger cryptographic locks on their electronic data only if a spare key to those locks is made available on demand to law-enforcement agencies. There looms the conflict. Although the debate is about export controls the "export" issue is irrelevant in today's era of global electronic networks. Placing a common privacy program on an Internet computer in Austin, Tex., is effectively no different from sending a shrink-wrapped copy of the program to Moscow. The real issue is how much privacy the Government is willing to allow its own citizens, and the latest word from the Clinton Administration is that the right to electronic privacy, like the right to bear arms, is not absolute. Cryptography is the science of secret writing. In this digital era, it applies not just to notes, but also to telephone calls, money transfers, bank and credit card records, electronic mail, faxes and other computer files. The Clinton Administration's goal is to allow Americans to use the strongest possible cryptographic technology, while at the same time preserving the ability of law-enforcement agencies to perform court-authorized wiretaps as part of the effort to catch drug dealers, terrorists, child pornographers and other miscreants. In other words, it favors strong cryptography, but not too strong. The strength of cryptographic software is measured by the length of the software key necessary to encode and decode a message. The longer the key, the harder it is for an unauthorized user to decipher the message. In recent years, the Government has generally permitted Americans to export cryptographic software with key lengths up to 40 bits. Experts say that 40-bit keys are secure from casual snooping, but will fall quickly to a determined codebreaker. Last week, after more than a year of intense analysis, the Government introduced what it said was the best possible compromise. Under the new policy, companies can export encryption algorithms using 64-bit keys, which are much more secure, but only if spare keys are given to "escrow agents" who would make them available to lawenforcement agents under standard legal procedures, similar to legal wiretaps authorized by a judge. Otherwise, the 40-bit limit continues to apply. Such a "key escrow" scheme is anathema to many privacy advocates who fear Government abuses. The Government first proposed a key escrow system with its so-called Clipper Chip, a technology that failed to win acceptance even as a voluntary standard. The new scheme is somewhat more palatable than Clipper. Key escrow is still unpopular with American computer and software companies, which say it prevents them from competing against foreign companies that have no similar constraints, and with many multinational corporations, which say it prevents them from working with foreign companies that do not especially care for the idea of Uncle Sam holding the keys to their data banks. "If this was intended to be any sort of compromise, I don't think it achieved its end," said Whitfield Diffie, a Sun Microsystems enginePs who attended the meetings. "I didn't see anybody who was enthusiastic." Raymond G. Kammer, deputy director of N.l.S.T., suggested that the hearings last week were intended to elicit public comment, and that the Administration's final position on cryptographic policy were still under analysis. But the emergence of key escrow issues at the N.l.S.T. proceedings suggests that key escrow is emerging as a nonnegotiable demand by some factions of the Clinton Administration, especially the Justice Department and the Federal Bureau of Investigation, led by Louis Freeh. "If this fails," said a figure familiar with the Administration's thinking on the proposed change in cryptographic policy, "it's going to lead to a very divisive debate. And the irony, for libertarians who oppose key escrow, is that if it fails, I am convinced that Louis Freeh cannot be true to his job without proposing domestic controls on data encryption." "He's not going to give up without a fight, and neither is the Justice Department," said the figure, who spoke on the condition he not be identified. Others say they do not think the Clinton Administration has yet arrived at a concrete position, even after more than a year of study and debate. "I don't think it's a final offer," said John Gilmore, an engineer at Cygnus Support, a computer company in Mountain View, Calif. "It looks to me like a weak strawman, a first offer, a proposal to dance." The question is whether American citizens and businesses have the patience to wait for the music to start. And the issue may be moot, anyway because the Internet is no more controlled by the United States than is the United Nations. "The Internet Architecture Board has specifically decided to ignore export controls in designing the security infrastructure for the next generation of Internet protocols," Mr. Gilmore said. "The Internet of 1998 will provide automatic, secure, and fully private communication, without key escrow, internationally." In other words, the Internet community is already planning to jump over the new line in the sand drawn last week by the Administration. Cryptogrophy that is stronger than the Government's proposed system will be built into the Internet by a dozen countries, and American companies and individuals would be foolish not to use it. At that point, millions of Americans will come into direct conflict with Government policy, and the popular gun-control bumper sticker may be replaced by one that says "If cryptography is outlawed, only outlaws will have cryptography." [End]

3 2

Community ConneXion & its new look
by sameer 17 Dec '03

17 Dec '03

Community ConneXion is in the process of upgrading its web presence and image. If you'd like to keep abreast of developments, check http://www.c2.org regularly-- most of the changes are in terms of focus & marketing angle, but new services should be appearing soon as well. -- sameer Voice: 510-601-9777 Network Administrator FAX: 510-601-9734 Community ConneXion: The NEXUS-Berkeley Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Whitehouse "dissident
by damion.furi＠the-matrix.com 17 Dec '03

17 Dec '03

TCM|We don't believe in "security through obscurity," do we? The notion that we |are "safe" if the White House, or (horrors!) Janet Reno herself, are not |reading our list or the Web sites on various issues, is the same kind of |security the ostrich thinks he has with his head in the sand and his butt |in the air. Maybe so, but we don't have to like it. And I don't. But it's not so much their access, per se, that I object to. It's their potential intentions, all things considered, and the fact that they aren't at all open about such monitoring. TCM|If you want to be unheard by the Feds, and the White House, and the FBI, |and GCHQ, and Mossad, etc., then don't post publically. If you want your |own access to Web sites kept private, push for the development of Web |proxies ("Web remailers"). Mix or Flame is fine. :) furi(a)the-matrix.com pgp-public-key(a)demon.co.uk C1225CE1 RADical 1 Systems - Multi-Platform Custom Programming, Service, & Support

2 1

Re: Whitehouse "dissident" and net monitoring
by Kari Laine 17 Dec '03

17 Dec '03

> From: lindat(a)iquest.net (Linda Thompson, American Justice Federation) > > The National Security Agency presumably can monitor > >subversive communication on the Internet without leaving any > >trace by "sniffing packets" at traffic nodes. Well they are just doing what their charter says they should be doing - gathering information. > > It turns out that computers from inside the White House have > >kept pretty good tabs on information available on Whitewater, > >Vince Foster, and Mena at a few key repositories on the World- > >Wide Web, a subset of the Internet. I think that's because White House workers has access to net and of course they are surfing like all the rest of us - they are just people you know :-) If that would be part of something hard level information gathering I assure you they would not leave so clear traces. > >Office of the President between August 28 and August 31. If the > >White House is showing a similar interest in other sites on the > >World Wide Web, that would amount to a monitoring operation of > >considerable magnitude. So are you saying White House by itself checked out those places or are you saying that *people* working inside the White House happened to be interested issues available on those sites and accessed them. And so what it is public information when it is on the WWW - isn't it? > > In light of this information, I have the following questions: My guesses are > >(1) Does this constitute "casual browsing" by White House staff, or > > is it, in light of the considerable time and effort spent during > > regular business hours, part of a monitoring or intelligence operation? Probably both > >(2) For what purpose is the information transferred to the White House used? Probably to read it and maybe learn something from it :-) > >(3) Does the White House keep information from these web sites on file, > > and does the White House keep a file on the persons responsible for > > these web sites? Hell I am keeping my own records and on the other hand I am in the process to get/buy/snatch/built a system where I could automatically scan all the newsgroups with some kind of AI system and to keep an eye on certain FTP, GOPHER,WAIS, WWW and so on to keep me bether informed. This partly because this information from interne is getting out of proportion AND quite a big part of it is just rubbish and wasting your time. > >(4) Is the April 9 statement by David Lytel of the White House Office of > > Science and Technology to Amy Bauer of Copley News Service that the > > administration does not monitor anti-Clinton activity on the web still > > operative? Probably they do and they really should. If I was Mr. Clinton (which I luckily am not) I would want my adjudats to prepare a report for me each morning summing up all the possible comments round subject Clinton and The USA from NET: That would be very precisious source of feedback to finetune your acts. And that information is real time. Totally another thing which somehow belongs to this subject should intelligence bodies watch for the net. I am middle reading Spycatcher book. Btw I don't understand all the hype rouund it and I would say in that book there is not enough substance to ban it's printing in certain countries. Anyway again in that book it becomes clear that the most riskiest part of the agent and therefore on of the best way to unweil them is to concentrate on their communications with the coordinators in that particular country or on the communication directed to country behind the operation. So clearly to make agents more succesfull their coummication is the one needing new techniques - how about internet? It is accessible almost everywhere and you can get an account without giving your real identity. By using certain sites you just call in from telephone box give few information or in some places none and you are ready for almost totally untraceable communication. I bet they are using it already a lot to replace clumsy readio communication. Don't get me wrong I vote for freedom of speech(whitch is getting slimmer), privacy (witch there is not much left), no regulation on encryption (which is not going to be) but I don't like these things used against my country's security and steal our intellectual property. Based on this I tend to think every self respecting intelligence organization must have those taps otherwise they are not doing their job properly. > "When even one American -- who has done nothing wrong -- is forced by fear > to shut his mind and close his mouth, then all Americans are in peril." > Harry Truman Truman might have been one of the best presidents US ever had but talk is talk and deeds are deeds. Comments and reasoning is totally my own imagination my employer would propably disabprove them and certainly not they don't represent my employers opinions. Be carefull out there ... Best Regards Kari Laine Kari Laine buster(a)klaine.pp.fi LAN Vision Oy Tel. +358-0-502 1947 Sinikalliontie 14 Fax +358-0-524 149 02630 ESPOO BBS +358-0-502 1576/1456 FINLAND

2 1

ADMIN: How to find out if you have been culled from the list
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

If I (or any software I write) remove a user from the <cypherpunks(a)toad.com> list the users entry now gets appended to the culled.users file. Since I was keeping a list anyway, I have set it up so that anyone can email/download the list of recently culled cypherpunks via majordomo. If you stop getting your CP drug for too long, before sending a note to the list(shame!) ask for this file to see if I culled you. If you forget how to get a file send a help message to <majordomo(a)toad.com>. Here is a quick (emacs) example of how to get the file: To: majordomo(a)toad.com --text follows this line-- get cypherpunks culled.users end and the file will show up soon. This is a very boring file (dates and email addresses). You might want to save this message away, so you will have it to reference if need be. Now, you get back to writing that great crypto/UI package! ||ugh Daniel Sometimes Postmaster Always Majordomo Potty Trainer <hugh(a)toad.com>

1 0

Re: GAK/weak crypto rationale?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by futplex(a)pseudonym.com (Futplex) on Wed, 13 Sep 2:11 AM >Your paraphrase of Nelson's statement strikes me as >remarkable. Doesn't "we are not concerned with bad >people using crypto among themselves" run completely >counter to all the hyperbole about terrorists planning >OKC II with PGP ? Does anyone have an exact quotation >? At any rate, sign me up as a "bad person".... "Bad people" is my euphemism for Mr. Nelson's "terrorist" -- which brought snorts from the audience. Yes, his statement about not being concerned with crypto use among terrorists was surprising. On a verbatim transcript: Mr. Ed Roback of NIST, the KE meet director, said that a complete transcript of the proceedings will not be published, only a summary report at some point, and then, after the September 15 session, some version will appear in the Federal Register for public comment. The summary report should appear eventually at the NIST web site -- the CSSPAB site has reports for prior KE sessions in the annual reports. See <http://csrc.ncsl.nist.gov/csspab/94-rpt.txt> for 1994, and similar for earlier years, on key escrow documents. To amplify what Tim said, the CSSPAB site has very interesting docs.

1 0

Scientology tries to break PGP - and
by Henry W. Farkas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 12 Sep 1995, S. Keeling wrote: > I would just like to point out that, when a LEA comes to you > to get at the contents of your computer, (s)he is not going to > patiently wait while your system wipes the offending evidence off your > hard disk. The first thing they do is make a copy of everything, so > they can work from the copy. Besides, you do have backup tapes laying > around all over the place, don't you? Acutally, I have *everything* laying around all over the place but I suppose that's off-topic. They have to decrypt the file sometime if they want it's "contents". I use the -w option when encrypting. After encryption, the "dummy" file (would be) embedded and the plaintext is wiped. The only "secret" key is the "fake" key. The "real" key is under the blender in the kitchen. (If I get busted and they search under the blender I will write back if I'm in a position to do so. Not that I have anything to get busted for of course. :) Don't back up plaintext and what is the problem here? Where will they get the "real" data from? What does it matter where the decryption takes place? And no, I don't have backup tapes laying around; I use a Zip Drive! :-) =========================================================================== Henry W. Farkas | Me? Speak for IBM? Fat chance. hfarkas(a)ims.advantis.com |------------------------------------------------ hfarkas(a)vnet.ibm.com | http://newstand.ims.advantis.com/henry henry(a)nhcc.com | http://www.nhcc.com/~henry - --------------------------------------------------------------------------- PGP 6.2.2 Key fingerprint: AA D0 F5 44 C1 8C 11 52 B3 80 34 1C CE 38 EC 53 Public key at: pgp-public-keys(a)pgp.mit.edu, and other popular key servers. - --------------------------------------------------------------------------- Brought to you by Henry's Hardware: Home of the Pretty Good Hack "We're not fast, but it's not bad, and we're cheaper than the guy down the street!" =========================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta iQCVAwUBMFbWVqDthkLkvrK9AQFxlAP+P3blN7wD42aUNctsCF9QALqsRdGHPsdo B6ALA72dqVYXGIsW9M3DVxXAM2WAosHl2rDKXbTrXwirxCJQBPkYQLT9Vdzl8nyJ hb0uNb2zo9xQ8ImM/dCuUqGazW2tnnAXuHZ9KkwDAQFDwDpNtjkHYCSDRgKmPmWO fUjGpsVViU8= =3JI5 -----END PGP SIGNATURE-----

1 0

Re: Scientology tries to break PGP - and
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Henry W. Farkas <hfarkas(a)ims.advantis.com> writes: >On Tue, 12 Sep 1995, S. Keeling wrote: > >> I would just like to point out that, when a LEA comes to you >> to get at the contents of your computer, (s)he is not going to >> patiently wait while your system wipes the offending evidence off your >> hard disk. ... >> they can work from the copy. Besides, you do have backup tapes laying >> around all over the place, don't you? > >They have to decrypt the file sometime if they want it's "contents". > >I use the -w option when encrypting. After encryption, the "dummy" file >(would be) embedded and the plaintext is wiped. ... And the idea is that on decrypting with the 'wrong' key, it outputs the dummy file rather than the real plaintext, correct? > ... Don't back up plaintext and what is the problem here? >Where will they get the "real" data from? What does it matter where the >decryption takes place? ... Why would they use your copy of the program to decrypt the file? They could just use a version that lacked this 'feature'. Of course, they still couldn't get at the real plaintext unless you gave them the key, but you are right back to the same old standoff where they say, "Give us your key," and you (try to) say, "No." -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

4 3

Majordomo results: (NOISE) Re: White House MONITORS Web Pag
by majordomo＠europages.com 17 Dec '03

17 Dec '03

-- >>>> This is NOISE ! **** Command 'this' not recognized. >>>> >>>> DAMION FURI writes: **** Command 'damion' not recognized. >>>> > Maybe so, but we don't have to like it. And I don't. But **** Command '>' not recognized. >>>> > it's not so much their access, per se, that I object to. **** Command '>' not recognized. >>>> >>>> Why the hell do you care ? Someone has a home page for something on the Web. **** Command 'why' not recognized. >>>> Someone at the White House looks at it. So what ? You object to the fact **** Command 'someone' not recognized. >>>> that somebody in the government has a Web browser and *gasp* uses it to read **** Command 'that' not recognized. >>>> stuff on the WWW ??? **** Command 'stuff' not recognized. >>>> >>>> > It's their potential intentions, **** Command '>' not recognized. >>>> >>>> You take moral offense to what you think someone else _might_ be thinking ? **** Command 'you' not recognized. >>>> Sounds like you believe in thoughtcrime. Banned any good books lately ? **** Command 'sounds' not recognized. >>>> >>>> > all things considered, and **** Command '>' not recognized. >>>> > the fact that they aren't at all open about such monitoring. **** Command '>' not recognized. >>>> >>>> This is absurd. You expect the White House to issue a press release every time **** Command 'this' not recognized. >>>> a staffer clicks on a URL ? **** Command 'a' not recognized. >>>> >>>> "WASHINGTON (UPI) The Clinton Administration unveiled plans today to **** Command '"washington' not recognized. >>>> add several new sites to the White House bookmarks list. At a hastily **** Command 'add' not recognized. >>>> arranged press briefing this morning, Defense Secretary William Perry **** Command 'arranged' not recognized. >>>> told reporters that the changes would be implemented in close **** Command 'told' not recognized. >>>> consultation with NATO allies. There was little immediate reaction **** Command 'consultation' not recognized. >>>> from Capitol Hill. Members on both sides of the aisle said they **** Command 'from' not recognized. >>>> needed time to study the proposal in detail." **** Command 'needed' not recognized. >>>> >>>> Someone please tell me this is just an extremely premature April Fool's joke... **** Command 'someone' not recognized. >>>> >>>> -Futplex <futplex(a)pseudonym.com> END OF COMMANDS **** Help for majordomo: This is Brent Chapman's "Majordomo" mailing list manager, version 1.93. In the description below items contained in []'s are optional. When providing the item, do not include the []'s around it. It understands the following commands: subscribe <list> [<address>] Subscribe yourself (or <address> if specified) to the named <list>. unsubscribe <list> [<address>] Unsubscribe yourself (or <address> if specified) from the named <list>. get <list> <filename> Get a file related to <list>. index <list> Return an index of files you can "get" for <list>. which [<address>] Find out which lists you (or <address> if specified) are on. who <list> Find out who is on the named <list>. info <list> Retrieve the general introductory information for the named <list>. lists Show the lists served by this Majordomo server. help Retrieve this message. end Stop processing commands (useful if your mailer adds a signature). Commands should be sent in the body of an email message to "majordomo". Commands in the "Subject:" line NOT processed. If you have any questions or problems, please contact "Majordomo-Owner".

1 0

Re: Whitehouse "dissident" web site monitoring?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:03 PM 9/12/95 -0400, Brian Davis wrote: >Unbelievable!!! To add to this distressing truth, I have learned that >the White House also subscribes to a number of newspapers and periodicals >which are reviewed for things of interest to the Administration and to >the President. I I I I I I ammmmmmmmmm shocked! The government, as you no doubt know, sometimes operates under different rules. Thus when the "Red Squad" (Intelligence Division) of the New York City Police (located in that big building on the North side of Vandam between Greenwich and Houston BTW) was sued for maintaining files on "lawful protest groups" they entered into a consent agreement to refrain from this sort of thing. Later, the courts said that this agreement meant that the cops couldn't even listen to WLIB radio (NYC's favorite radical African-American station) to find out in advance where rallies were going to be. Since the White House is doing this reading of sites with public funds and since that institution is the most powerful in the world --- it can nuke its enemies, for example --- people are naturally interested to discover if they are the subject of an investigation. This is a demonstration of the unintended effect of electronic surveillance technology. The fact is that it can do more harm to the authorities than to the public. The Nixon Tapes/The Thompson Square Park Riot Video/The Rodney King Video. Since those in power are more interesting than ordinary people, they represent a more "target-rich environment." Information about their activities has greater commercial value and is thus more likely to see the light of day. DCF "There are more of us than there are of you."

2 1

Dirty Jobs Ad
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, Sept 13, 1995. For the outawork: C.I.A.'s Chief Calls Covert Action a Must Washington, Sept. 12 -- The Central Intelligence Agency will maintain, and perhaps increase, its covert operations abroad and continue to hire informers from terrorist cells, military regimes and drug syndicates, the new Director of Central Intelligence said today. The Director, John M. Deutch, called espionage "the core mission of the Central Intelligence Agency." That mission has been questioned by critics of the C.I.A. in Congress and the foreign-policy establishment, who wonder whether the rewards of secret information are worth the risks of undertaking covert operations and recruiting murderous and corrupt foreign agents. -----

1 0