December 2003 - cypherpunks-legacy

Re: CSE gets flak on TV
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 14 Nov 1995, Mark C. Henderson wrote: > On Nov 14, 16:47, s1113645(a)tesla.cc.uottawa.ca wrote: >> Subject: CSE gets flak on TV >> For those who care, the Communications Security Establishment has been >> getting some flak for spying on Mex. during NAFTA talks and on Korea to >> help us sell Can. nuke reactors: The CSE deserves all the flak that it can get ... especially the village idjit in "LMN Group", Barry de 'Artful. Gee is he full of it. His phone manners are atrocious, especially for someone *supposedly* in customer relations. I mean are these guys on their toes, or what?? I guess he was just trying to do a bad Lily Tomlin impression, or they're having a really bad day over there. My mistake for demonstrating a willingness to talk. It really was a waste of a quarter. I guess that I'm not supposed to taunt the poor people at the CSE via STU-III. I guess I should have used POTS. I mean Motorola's STU-III can't be spoofed, can it?? Especially when we go into SECURE MODE?? (btw, that's STRIKE THREE to my Ottawa friends ...) > Folks who are interested in the CSE should also check out the > "unofficial CSE home page" at Hmm, I think they mispelled some stuff on this page. It's STU-III ... not STY-III ... guess someone's finger slipped up on the Y and the U, or something. Then again, maybe we should be specing Alcatel over Motorola. Fewer chances for miscommunications. Or maybe Motorola has a couple of new products coming out. I'll bet whatever they are, they ain't Marrons Glaces, or Beaujolais Villages. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

No Subject
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Thanks for all who wrote with help re: FAQ file! I now have several other sources from which to download the file. Looks pretty interesting.... Cassiel

1 0

Re: Repeated Words/characters in Password/Phrase
by foodie＠netcom.com 17 Dec '03

17 Dec '03

>In the real world, where passphrases must be memorized, "long and random" >is an elusive goal, which has to be weighed against the risk of other ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >attacks (such as capturing keystrokes with a sofware monitor, or from afar ^^^^^^^ >with a van Eyk antenna, etc.). > >Me, I use a nonsense phrase which has meaning to me, with a few garbage >characters added to confuse things further. I don't think my passphrase is >the weak link. > >- --Tim May This is, of course, very good advice. Passphrases need only be as strong as every other component of the security system. I'd add that there is a moderately good reason to keep the passphrase _only_ as strong as every other component of the system for psychological reasons. The passphrase is what the user tends to think of when they think of their system. Even if that user is the designer of the system, a false sense of security an be an easy thing to develop. At a past place-of-work, someone there who prided themselves on using difficult passphrases was bitten pretty severely by a faulty .forward file. DES provides similar lessons - searching 56 bits of keyspace requires just barely less effort than that required to launch other attacks on the algorithm (in theory, at least). The system is, as far as anybody knows, secure, and no part of it is significantly more secure than any other. -j -- On the internet, nobody knows you're a diety. _________________________________________________________________ Jamie Lawrence <foodie(a)netcom.com>

1 0

Re: LACC: DEA Agents Accuse CIA of Tapping Phones
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I sent a copy of this post to a buddy of mine who retired from the CIA not too long ago ... these were his comments on the matter; FWIW. >>>But legal experts say it could be a difficult lawsuit to >>>win, especially since an employer - in this case the >>>government - generally has a right to listen to employee >>>conversation on office phones. > >They're right. > >>>It also doesn't help that national security was involved >>>and that courts have held that U.S. citizens don't have >>>constitutional rights overseas. > >Completely wrong. No court has so ruled; the writer is confusing >the Bern Convention, signed by almost every nation on earth, which >formally establishes the the rule of "lex loci," or law of the land >where the individual is found. This is only a common-sense >restatement of old principles of Roman AND common law, whereby a >national of country X can never act with impunity in country B. >It's as old as Hammurabi. There is NO "ruling" that establishes >that an American citizen forfeits his Constitutional rights >vis-a-vis the United States Government, and to claim otherwise is >to insult the truth. > >>>``It's an uphill battle. It's going to be a tough suit,'' said >>>constitutional law expert Paul Rothstein of Georgetown >>>University. > >Maybe so. But it'll be fun to watch. We've known for years now that >the jackbooted thugs of the DEA are by far the most law-abusing, >disrespectful, rights-sneering, down-and-dirty, life-threatening, >hair-raising agents of the entire US Government. Bar none. They've >got to be watched, because they're a nasty threat to individual >liberty, and because they routinely interfere with the legitimate >work of other American intelligence agencies. (And they've been >monitored, by the way, since at least 1984, to my knowledge.) > >>>"It is not the CIA's mission, nor is it part of the >>>operations of the agency, to surveil in any manner >>>U.S. officials, or other U.S. citizens at home or >>>abroad,'' Mansfield said. > >Well, that's the kind of in-your-face lying that brings deserved >contempt down on the heads of the intelligence community. I disdain >it, and have done so publicly. The sonofabitch needs to say openly >that you're damned right the CIA and NSA do this, and here's WHY we >do it... > >>>The only exception would be in counterintelligence >>>cases, he added, and then only in consultation with >>>senior Justice Department officials. > >Yeah. A GS-12 giggler. > >>>In Horn's previous case, Leighton said, the Justice >>>Department angered DEA agents by claiming they >>>have no Fourth Amendment constitutional right >>>against wiretapping when working outside the >>>country. > >See? The ignorance of DEA agents is legendary! > >>>Leighton, a former federal prosecutor, said the >>>lawsuit doesn't address the reasons for the alleged >>>electronic eavesdropping. > >Ever heard of Title 18 of the US Code, stupid one? > >>>"My assumption is because they want to know >>>what DEA is doing, they want to rip off DEA >>>informants, they want to know DEA contacts >>>within foreign governments,'' Leighton said. >>>``And with the Cold War over, these agencies >>>are looking for a new mission.'' > >Nice try, slick. But it ain't so much the desire for their network >as it is a desire to prove that a huge number of DEA agents have >been involved in drug-running and foreign government corruption for >at least 14 years now. Like that? > >>>Horn's residence ``was the target of a U.S. >>>Government Agency-sponsored electronic audio >>>intercept,'' it said. > >I'd love to be on the stand here. I'd LOVE to hear this arrogant >schmuck try and "prove" that the "tap" (if there ever was one) was >of US origin! What an ignorant ass... > >>>"Horn had occasion to see a cable containing >>>his words in quotation marks, that he had spoken >>>to another DEA agent, set forth exactly as stated...'' > >Tsk tsk. Imagine that. And of course it just never occurs to the >fool that we can also derive such intel from third-party sources >and governments. > >>>The suit, assigned to U.S. District Judge Harold H. Greene, > >Oh, yea! The same trigger-happy judge that fathered the infamous >AT&T dismemberment! > Hoo-boy! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNCGS/sdZgC62U/gIEQJRfwCgzM5bTHJx6L+oB4dIylrfSHPz8nIAoPh7 J9pGVrkG+cmaWZCyMtAFqtg1 =jc+B -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "It is one of the most beautiful compensations in life that no man can sincerely try to help another, without helping himself." -- Ralph Waldo Emerson

1 0

NID_otp
by John Young 17 Dec '03

17 Dec '03

11-16-95. Washrag: "Pentagon Gaining Turf From the CIA." Pentagon agencies and officials are set to play a greater role than before in supervising key intelligence operations including doctoring spy satellite photos, and recruiting then ignoring bumbling agents overseas. There's even a proposal in Congress to create a new, national intelligence director hiding out in the Office of the President (OTP), and supervising nulls with equal job-fears at the CIA and Pentagon. Sen. Bob Kerrey worries about the trend because "in the world of the future, more and more secret garbage would not feed my national interest." He cited Deutch's proposed consolidation of intelligence imagery analysis in a new Pentagon-run advert agency, which would swallow up the CIA's National Photo Interpretation Center along with the Defense Department-based Central Exaggeration Office and Defense Entrapping Agency. "Clinton, Moynihan and Specter are hogs for slop," Kerrey spat, "I want my rep fattened." NID_otp (8 kb)

1 0

No Subject
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Hi All You were all so helpful with my last request, I figured I would go for broke and ask for more advice. The physical security of my computer isn't really that great, so I've been interested in finding utilities that would securely delete the files I want deleted (as well as temp files created, etc.). I run Win 3.1 on DOS 6. What do people think is the best free/shareware file wiping utility (now, there's a Freudian name...) out there? How about for deleteing that pesky Windows Swapfile? I know--best of all worlds I remain in DOS, but this isn't always practical. Any advice would be appreciated. Please cc me directly in your response as I've moved over to Cypherpunk-lite. Thanks again! Cassiel

1 0

Re: New Computer Security Act
by Blanc 17 Dec '03

17 Dec '03

Tim May wrote: >I doubt Clinton will be at the Fort Meade HQ for a ceremony, as he's on his >way to Stanford, where both of us will, amazingly enough, be tomorrow. Wish >me luck! ................................................. If you will both be there, I wish Clinton luck. But I missed the post wherein you explained what your visit to Stanford is about? .. Blanc

2 1

Anonymity and Intellectual Capital
by Hal 17 Dec '03

17 Dec '03

Here is a draft article by David Post of Georgetown Law Center. He offered it on the Cyberia list and it includes permission to redistribute. I thought it had some interesting ideas on anonymity and pseudonymity, as well as our old bugaboo "reputation capital". I have reformatted it slightly to improve readability but made no changes to the content: Pooling Intellectual Capital: Anonymity, Pseudonymity, and Contingent Identity in Cyberspace DRAFT OUTLINE October 31, 1995 David G. Post [NOTE 1] Most discussions of "anonymity" in cyberspace focus on whether or not to regulate the availability of "untraceably anonymous" messaging functions -- anonymous remailer services and the like -- and the related question of how, in the special circumstances of cyberspace, one might accomplish such regulation). To be sure, this is an important perspective; although we are embedded in a world in which anonymous transactions are pervasive, we have never before been able to manipulate anonymity, or to undertake as wide a range of anonymous transactions, as cyberspace allows us to undertake (and we have, therefore, only begun to think about the implications of being able to do so). At the same time, however, the technology offers, it would seem, new prospects for eliminating anonymous communication, i.e., for requiring (and enforcing the requirement for) completely "traceable" communication. We need, in the first instance, to understand more about the costs and benefits of anonymity in this new environment before we can sensibly talk about the best way to regulate it (or whether to regulate it at all). Harms associated with an anonymous messaging regime include, notably, the inability of "law enforcement" (broadly defined to include both public and private enforcement) to obtain information on persons responsible for harm perpetrated by individual actors; benefits include the ability of individuals to engage in communicative activity without putting any aspects of their "identity" at risk (see below for additional discussion of the reasons for the quotation marks here). My thesis here is that, because of the close links between anonymity and pseudonymity in cyberspace, new elements need to be added to this equation -- primarily on the benefits side. This requires disentangling, at the outset, three related concepts: anonymity, pseudonymity, and traceability. We can define an "anonymous" communication as one in which the message itself contains (and hence the recipient of the message receives) no information regarding the identity of the sender.[NOTE 2] Although there can be truly anonymous messages even in this strict sense -- messages containing no information about the originator -- it makes more sense to talk about anonymity as a continuous rather than a binary attribute (present/absent) of messages: even messages we ordinarily think of as "anonymous," after all, contain some information about the author (e.g., graffiti scrawled on a subway platform informs us that the author was literate, and was geographically located in a certain place within the last x months/years, all of which probably effects a significant reduction in the reader's uncertainty about the identity of the author by ruling out the vast majority of individuals in the world as possible authors). Messages, however, rarely contain a fixed amount of information about the sender's identity; [NOTE 3] the degree to which a message may be considered "anonymous" is rarely (if ever) an inherent characteristic of the message itself. Relevant information about the originator's identity may well often be available, but only at some additional cost. For example, an "anonymous" note slipped under the door may be covered with fingerprints from which, were we able easily to access both a fingerprint reader and the FBI's fingerprint database, we could obtain significant information about likely originators. "Traceabililty" measures the cost of obtaining information about the identity of the sender in addition to the information that is "readily apparent" -- i.e., obtainable at (virtually) no cost -- from the message itself.[NOTE 4] Finally, we can define a pseudonymous message as one that contains information (of varying reliability, to be sure) about the identity of the originator -- the cognizable entity responsible for transmitting the message -- without simultaneously providing information about the actual, biological, individuals responsible for transmission of the message. Pseudonymity, like anonymity, shields aspects of the identity of the "real" actor from view; information that a book was written by "Mark Twain" by itself gives you no more (or less) information about the true identity of the author than does the information that it was written by "Anon." Indeed, if Samuel Clemens had chosen to publish each of his novels under a different pseudonym, that would have been the essential equivalent of publishing all of the novels under the pseudonym "Anon.," or "John Doe." Pseudonymity allows each message to carry additional information, cumulative over time, about the pseudonymous actor; i.e., the difference between pseudonymity and anonymity is that the former, but not the latter, allows the accumulation of reputational capital in the pseudonymous entity. The use of the a single pseudonym "Mark Twain" allowed Clemens to invest a single entity with reputational capital, built up over time and across different novels; "Anon." will not serve that purpose, primarily (if not exclusively) because it is unprotected and used by any number of other authors (many of whom might not be quite as talented as Clemens).[NOTE 5] In other words, pseudonymity, like anonymity, allows individuals to act without putting at risk any aspects of their own, personal identity (including their physical assets, reputational capital, financial capital, and the like); pseudonymity differs, however, from anonymity in that it allows the accumulation of reputational capital in the pseudonymous entity. Both anonymity and pseudonymity are thus forms of "limited liability," and the extent to which they serve that function effectively is determined, in both cases, by whatever traceability requirements are imposed. To illustrate, take the extreme case, e.g., a requirement that all messages contain certain information about specified aspects of the originator's "identity." This would not only eliminate anonymous messages (at least to the extent it could be enforced), but it would make certain forms of pseudonymity effectively unavailable as well; the reputational capital belonging to "Mark Twain" and to "Samuel Clemens" would be identical, and whatever aspects of Clemens' identity had to be revealed would no longer be shielded in the course of any transactions in which "Mark Twain" was involved. Most discussions of "the regulation of anonymity in cyberspace" are really discussions about traceability requirements. The potential benefits and harms that accompany an anonymous messaging regime are directly related not to the availability of "anonymity" per se, but to the availability of untraceable anonymity. I know of no serious proposals, for example, to prohibit individuals from leaving their electronic mail messages unsigned; the hard questions all concern the nature of the traceability requirements that will be put in place in regard to those messages, i.e., how easy or difficult will it be for the recipients of such messages, third parties, or law enforcement officials, to obtain additional information about the identity of the message originator. But traceability requirements will have an impact -- possibly a profound impact -- not merely on the availability of anonymous communication, but on the availability of pseudonymous communication as well. For example, a sufficiently high degree of traceability eliminates both anonymous and pseudonymous messages; requiring all authors to provide information about their "real" identity not only makes it impossible for them to communicate anonymously, it is, in effect, impossible for them to communicate pseudonymously as well. Analyzing the consequences of a "ban on anonymity" in cyberspace needs to take more than the benefits and costs of anonymous messaging into account; it needs to be evaluated in light of the benefits and costs of pseudonymous communication as well, considerations that have received less attention from those looking at these questions. So the question "what is the best traceability requirement to apply to electronic communication" needs to consider not only the harms and benefits flowing from anonymous communication but these additional considerations as well. Because all communication in cyberspace is entirely machine-mediated -- i.e., because the "identity" of the relevant actors in a biological sense is necessarily at one remove from the communication itself -- everyone acts "pseudonymously," at least in the sense that you can only be identified by a stream of bits when you act in cyberspace [NOTE 6]. The prospect for more creative uses of pseudonymous action -- the ability for individuals to pool their individual intellectual capital with great flexibility and with very low start-up or transactions costs, into a wide range of new kinds of actors and entities, each capable of accumulating reputational capital -- is a profound and exciting feature of this environment.[NOTE 7] The "limited liability" metaphor now becomes a bit more useful. Just as limited liability in the corporate context was designed to encourage the pooling of physical and financial assets into corporate entities, assuring investors that their personal assets would not be placed at risk, so, too, should protection against traceability (i.e., protection for pseudonymous action) encourage "investors" to pool their intellectual capital into pseudonymous entities, assuring those investors that only the reputation of the pseudonymous actor, and not their own personal assets, are at risk when the entity acts. This approach probably answers none of the hard questions about the proper scope of regulation; it may, hopefully, lead to a consideration of those questions that need to be answered before any regulatory actions are undertaken. If there are benefits to be gained from the actions of these entities -- if the pooling of intellectual capital into entities leads to new and valuable forms of intellectual undertakings (itself a question open to discussion) -- we should seek to design our rules of limited liability to simultaneously induce "investors" to form these new entities while minimizing the costs that may be associated with their formation? Analyses of corporate limited liability are useful analogues for this inquiry; when should "piercing the veil" of pseudonymity be permitted or required? Can we disaggregate the various aspects of personal identity that should receive more, or less, protection from disclosure? ************************************************ NOTES. 1. Visiting Associate Professor of Law, Georgetown University Law Center, and Co-director, Cyberspace Law Institute. Email: Postd(a)law.georgetown.edu or DPostn00(a)counsel.com. Permission is hereby granted to freely copy and distribute this paper; please retain the "Draft" designation as well as attribution to the author. 2. I use "information" in the information-theoretic sense, in which information is measured as a reduction in uncertainty; that is, a message that contains information about the identity of the sender is one that, by definition, lowers the recipient's uncertainty concerning the identity of the sender. 3. "Identity," of course, is not a static, context-less piece of information, but is, rather, a complex cluster of characteristics attributable to an individual, subsets of which may be more or less relevant in particular contexts (and information about which may be differentially transmitted in particular messages). Consider the graffiti again -- even assuming that this may be an "untraceable" message, in what sense is it an "anonymous" one? The reader may obtain a great deal of information relevant to (certain aspects of) the originator's "identity" -- information about the originator's political views, perhaps, or familiarity with certain historical events. On the other hand, the original message provides no information (i.e., it is "anonymous") with regard to the originator's state of domicile (or where the originator went to school, or how many children the originator may have -- all attributes relevant, in other contexts, to the question of the originator's "identity"). And while we ordinarily think of "identity" in the context of individual biological persons, that is far too restrictive a view. Consider my receipt of an (unsigned) notice from the Department of Motor Vehicles, or an (unsigned) advertising flyer from my local McDonald's restaurant. Each of these messages is "anonymous" in one sense: I obtain virtually no information about the "identity" of the (biologically-relevant) individual who typed the notice or otherwise caused it to be transmitted to me (if indeed there is any such person). But it is hardly anonymous in another (and probably more significant) sense: the letterhead clearly identifies the "identity" of the more relevant actor (the DMV or McDonald's). The relevant actor here, i.e. the DMV or McDonalds, has a reality unconnected with the physical "identity" of any of its individual constituents (employees, officers, etc.); indeed, a notice from the DMV that is mistakenly placed on non-letterhead stationery (but that is signed by the typist) surely has less reliable information about the originator's "identity" than the reverse (i.e., an unsigned note placed on DMV letterhead). 4. Traceability itself is highly context-dependent, insofar as both the cost of obtaining additional identification information, and the value of that information in reducing uncertainty regarding identity, will vary, possibly greatly, from one situation to another. It may, for example, be relatively easy for a law enforcement official to obtain information regarding the identity of the individual who placed a particular phone call; the same information may be prohibitively difficult for other individuals to obtain. Traceability is also affected by the (1) whether or not relevant identification information exists in the hands of third parties (i.e., parties other than the originator and recipient), (2) the third party's duty (or lack of a duty) to keep the information secret, and (3) the ease with which disclosure can be legally compelled (by process, subpoena, etc.). 5. Anonymity can thus be regarded as a subset of pseudonymity, with the critical difference being, for my purposes at least, that pseudonymity allows the accretion of reputational capital in the pseudonym. 6. This stream may have a high degree of traceability -- if my electronic mail address is "Postd(a)law.georgetown.edu," for example, there at least appears to be information allowing the message to be traced to a real individual (though query, as always, how reliable that information may be). Or it may not -- the use of a screen name on America Online, or, in the extreme, the use of anonymous remailers. 7. Examples: the Cancelmoose; the Cyberspace Law Institute. 8. I use "regulation" in the broad sense, to include not only State action but the "regulatory" activities of e.g., individual system operators. 9. Note, in this regard, that protecting the "limited liability" features of pseudonymity does not necessarily mean that harms imposed on third parties by pseudonymous entities must go unredressed (as is the consequence of limited liability in the corporate context); because reputational capital is not transferable, i.e., is not useful for the purpose of compensating victims of harms perpetrated by pseudonymous entities, redress can be achieved by exposing individuals' financial assets, though not necessarily their personal identities, to risk when the pseudonymous entity acts, and there are various insurance and authentication/certification regimes that I will discuss to accomplish this.

5 5

Re: credit card conventional wisdom (fwd)
by Simon Spero 17 Dec '03

17 Dec '03

Date: Wed, 15 Nov 1995 18:07:25 -0800 From: Tom Wills <twills(a)eit.COM> To: Simon Spero <ses(a)tipper.oit.unc.edu> Subject: Re: credit card conventional wisdom (fwd) The printed digits above the embossed account number are the first four digits of the BIN (on Visa cards) or ICA (on MasterCards). They are there to discourage re-embossing of the card with another account number. Original Message: > >Wow, you learn something every day. I've never in >my whole life (well, my American Express life, >over 15 years) noticed those four digits. I've >never been asked for them by anyone, or noticed >them being written down, either. Exactly when and >how are they used?

4 4

Utilize This Valuable Information and It Will Pay For Itself Right Away
by 49268935＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> UTILIZE THIS VALUABLE INFORMATION AND IT WILL PAY FOR ITSELF MANY TIMES OVER! That tiny little ad can make you wealthy! Have you ever bought anything from a classified ad? If you're like most, the answer is yes. It's a fact of life, that we as a society crave the need for information. The tiny little classified ad can effectively and efficiently deliver the information to a potential customer base that is mind boggling. A simple classified ad can fill your mailbox with orders or make your phone ring off the hook with interested prospects. Have you ever seen the same ad running over and over again in a paper? It's because it's making money. In fact the chances are good that it's in a whole lot of other papers also. Classified ads can and have made many people very wealthy. How do you think all those late night info-mercial millionaires started? ***Nationwide Newspapers V2.0 TM*** Powerful New Reference Software - The First of its Kind, Classified Advertising Tool! - Electronic Directory of over 3,600 newspapers! - Sources for Over 6,000 newspapers! - Daily, Weekly, Shoppers, Community Papers and More! - Find Hard to Reach People to Respond to Your Offer! - Advertise by City, State, Regionally, or Nationwide! - Statewide and Network Advertising, Including Pricing! - Discount Advertising Less Than $1 Per Paper! - Powerful Tool for Building Huge Downlines! - Save Time and Money with Network Advertising, 1 Call, 1 Payment & you're in 100's of Papers with Millions of Readers, at a Big Discount Over Individual Rates! SPECIAL FEATURE- Built in Sort Tool Enables Sorts by State, City, Circulation, Phone Number & More! Proof is in the Results! Here's just a few: " Thank you for your 3,600+ newspaper directory! We have built a downline of 1,800 people in 6 months & a check for over $12,000 using this directory to advertise! It contains the small town papers as well as the big ones so we can target the audience & stretch our advertising dollar. I recommend it for anyone in network marketing." S & J Linden, Sequim, WA " I just wanted to let you know how much your program has saved me time and energy, now I can place ads with ease. I think your program is simply one that anyone who has a business must have, because time is money." Andrea Hurst-Harry, Arlington, TX There is no doubt that this information can and will be a valuable asset to your business. It's the perfect product, at the perfect time, at the perfect price. We've seen similar information costing 100's of dollars. Companies charge these high fees because they know that people who understand the value of the information will easily pay for it. Our products are more advanced and we make them affordable. They say that information is power, well we look forward to supplying you with all the power you need for years to come! Price: Other companies marketing half the information we offer are charging $249 For a limited time , You pay only $49 plus shipping for this revolutionary new product. To Order Send to: S. Press PO Box 11511 New Brunswick, NJ 08906 ***Please Add $6 for shipping and handling Name:_________________________________________ Address:______________________________________ City:_____________________State:____Zip:______ Payment Method: __CHECK __MONEY ORDER Total Enclosed: $_49 + 6 =$55 _____________ </FONT><FONT COLOR="#000000" SIZE=3>

1 0

politics aren't all or nothing
by Mark Hedges 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My problem with the "it's hopeless, politicians are idiots" approach is the same as my problem with Tim May's approach --- it predisposes one to think that a revolution and possibly violence are the only way to change the laws. It is an attitude which constructs an obstacle which may or may not be there. I get really sick of the inane "nuke DC" talk. Call me a naive optimist, or an idiot; I believe there's hope to wage and win the battle politically, and I think there's actually hope for real democracy without the memetics bullshit and the control and the manipulation. I got a personal reply from a Senator to whom I sent that last release (the one interviewing Michael Wilson of 7Pillars). It wasn't one of those autoresponders -- it just said "Thank you for your views" with bad text formatting. At least it did get someone's attention. It might be negative attention, but dammit, if they're going to look Wilson's reputation in the face and not at least consider that they might be wrong then they've obviously all been killed and government programmed clones installed in their place. They're really well educated people, for the most part --- somewhere along the line they must have gotten that stuff about "considering that you are incorrect" and the rest. While skimming their web pages looking for information, I found one or two senators and congress reps who actually offer PGP keys on their web pages! Senator Leahy, for one, is a vocal proponent of strong crypto. There is hope! Some of those people do see "the light" on this issue. It's a matter of getting the heavy-handed ones to just for a second consider the other side's view. I think this particular release hits hard because shit, Wilson's the virtual incarnation of Ares, and the warmongers may listen to him. I think a lot of them know they're being manipulated, but they get only a limited set of information from the "authoritative" defense and intelligence people who give them the "secret classified briefings", and they simply can't confront the spooks because they think they'd get kicked from their positions of power in a few years. If they have in their possession a testimony that a defense and intelligence _scholar_ says that the spooks are wrong, they may be able to start turning the tide. Mostly, I just don't want to get nuked. I don't want the people in Washington to get nuked. I don't want to be ostracized because a disjointed group I'm associated with has members who support nuking political opponents. "Nuke DC" is crap. "Ecash Assassination Politics" is crap. The loss of faith in one's ability to convince other people with rational discussion is crap. That whole attitude reminds me of the guys in early grade school who beat up on me because I was a nerd. I refuse to sink to their level. Mark Hedges -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNCGn+hVo2SUWMp6NAQH7lwP/dEWDmzEgx9LEs3m68KGWcKNGVUCSjFjd qOjkBKQQo9Ib+8CefheigwRPXh8J5s4aBJPDVvJbTnvJJ2F7Olr1VpvmhzDwMt8g A99iSuvn/Dn7cJUmcc5M9aeVhRtXFcl0LRsfOiHQO4eGXia3fWA6BM1pAybIzHAp 4sj8MyE+ZpM= =8r8K -----END PGP SIGNATURE-----

6 9

Re: e$: Come aaaannnndddd Get it!
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: rah(a)shipwright.com (Robert Hettinga) Sameer's done it, I'm going to do it, and I'm hoping that everyone who *can* do it *will*. Lumpy though MTB may be, they're taking a risk that no one else in the financial community would, and they deserve whatever support we can give 'em. If they do it and it works, there will be others. Come on, people, let's make it work. Put your e$ where your mouth is, or at least on a hard drive somewhere... ------------------- I will as soon as someone comes up with a _fully_ private digital cash system and starts using it for something. As I understand it, Chaum's ecash system is not one (i.e., non-privacy to the sender and of amounts to the bank). If I'm incorrect, please tell me and I'll set up an account with MTB immediately (if there's a text-based interface). -Allen

2 1

COE Recommendation No. R (95) 13
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

This is that Council of Europe "Ban Crypto" paper. It is of course nothing like what it is claimed to be http://www.privacy.org/pi/intl_orgs/coe/info_tech_1995.html In particular: 6. The law should permit investigating authorities to avail themselves of all necessary technical measures that enable the collection of traffic data in the investigation of crimes. "COLLECTION" - not comprehension 8. Criminal procedure laws should be reviewed with a view to making possible the interception of telecommunications and the collection of traffic data in the investigation of serious offenses against the confidentiality, integrity and availability of telecommunications or computer systems. This is simply to fix the German data protection laws and similar, some of which might prevent a sysop monitoring a hacker on a system they were hacking. I think the majority of the text is well thought out and very much in line with what we would want. The piece on encryption is a cop out to please the French and Dutch. Read it carefully and you will see it says absolutely nothing. We have been had again... Rule number one of politics, always assume that the enemy are misrepresenting their case. Council of Europe declarations are almost always implemented because they say almost nothing. It is a very clear statement of some concerns which it would be nice if the US authorities understood - separation of search and seizure. This is not a trend in which Europe is following the US. We are simply thinking about the effect of technology on law enforcement rather than reacting to its effects. Found this written up in cipher, well worth a visit. http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/ -- Phillip M. Hallam-Baker Not speaking for anoyone else hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet!

3 2

Re: ALERT: On Monday, call Congress to stop Big Brother amendment!
by Declan McCullagh 17 Dec '03

17 Dec '03

I just got off a phone with an industry lobbyist. The conversation went something like this. "Can there be a compromise?" I asked. "I don't think there can be one that will satisfy all three or four parties involved." (I was thinking: law enforcement, national security, business, and privacy interests.) The answer: "I don't think compromise is the right word. But we need to give something to law enforcement." -Declan

2 1

THE FRONT PAGE
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

I've edited this down, for fair use reasons, you can get the idea... Worth subscribing to this paper BTW. > The Electronic Telegraph Thursday 16 November 1995 The Front Page > > [The Front Page] > > 'Black Baron' computer virus writer jailed for 18 months > > By Robert Uhlig, Technology Correspondent > > Devils in disguise that preyed on computers > > [Image] THE man who wrote computer viruses which could cause millions of > > pounds of damage, was jailed for 18 months yesterday. > > Christopher Pile, who called himself the Black Baron, not only spread his own > viruses, Exeter Crown Court was told, but also distributed across the world his > program which let other hackers disguise their own viruses. > The viruses have made the "Black Baron" notorious among British companies. > Microprose estimated it lost up to £500,000 and used more than 480 staff hours > checking more than a million files. The computer firm Apricot had to shut down > and check many of its machines. It found that 22 out of 60 had been infected by > Pathogen. -- Phillip M. Hallam-Baker Not speaking for anoyone else hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet!

1 0

Professional interview wanted for report
by byerr＠netcom.com 17 Dec '03

17 Dec '03

Hi. I'm a freshman at the Thomas Jefferson High School for Science and Technology in Fairfax County, Virginia. I am writing a (general) report on cryptography for school, and I was wondering if anyone on this list that works with cryptography in their job would be able to give me a short interview over email. Thanks a lot! -- Ben Byer byerr(a)netcom.com I am not a bushing GCS d-- s: a--- C++ UL++++ P++ L++ E+ W+ N++ o K-- w-- !O M-- !V !PS !PE Y+(++) PGP t+ 5 !X R tv(+) DI+ G e- h! r !y

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rich Salz 17 Dec '03

17 Dec '03

>are specifically designed for the insertion of cryptographic materials, >or is it the fact that they could be used to support cryptographic >enhancements? Everything is decided on a case-by-case basis. I was in a meeting with some NSA export-control people (Dept Z03) and asked a few questions on this topic trying to nail down the angle of this slipper slope. Basically, generic buffer-manipulation is okay. "Keyed compression" where you explicitly passed something called a key to a DLL routine would be looked on suspiciously. An abstract set of open/modify/close routines (where open returned a pointer to opaque state, say a session key :) would be fine. The technical guy quickly grasped that I was talking about anonymous remailers, but they "conceded" there's nothing they can do about it. I say "concede" because that implies more political/control-issues then were really present at the meeting. /r$

2 1

Need advice on video
by combee＠techwood.org 17 Dec '03

17 Dec '03

Hello, fellow cypherpunks. This is my first post here on the global CP list, although I've been working with the just-reformed Austin chapter for the last couple of months. Us Austinites are working on a video for public access television on cryptography. We are looking at a one-hour format, similar to a science program, that will introduce cryptography, its history, the basic ideas of modern crypto, and what applications there are for it today and in the future. Now, this might turn into a series, but for now, we are concentrating on the overview episode. What I'm fishing for here are any suggestions for ways to present some of this content in an interesting video setting. We've already decided on doing some algorithm animation, and maybe some simple moving graphics illustrating the various protocols. Any ideas you might have would be appreciated. BTW, once we finish this and show it locally, we are considering doing some duplication to send out to interested bodies. Do you think there is demand for a good, clear intro to all this in video form? Thanks, -- eebmoC .L nimajneB | Benjamin L. Combee (REVERSE) gro.doowhcet@eebmoc | combee(a)techwood.org (ENGINEERING) \eebmoc\ten.kay.www\\:ptth | http://www.yak.net/combee/ (RESERVE)

1 0

Need to get your shop setup before friday?
by sameer 17 Dec '03

17 Dec '03

If you need to get your shop setup before Friday, and don't have the time yourself to figure out how to install the CGI things, etc. Community ConneXion can do it for you, at our standard CGI web design rate. Call me at the number below, or page 510-321-1014. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

1 0

Re: credit card conventional wisdom
by wiltship＠iccu6.ipswich.gil.com.au 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Gidday Greg You wrote.. >Most consumer-level transactions are based on a general sort of >trust-in-human-nature sort of policy, backed up by the knowledge that a single >failed transaction (or even a constant low level of failed transactions, where >failed == "didn't get paid but gave the stuff away") isn't likely to kill off >a business or even make it unprofitable. Failed transactions are more likely to affect consumer confidence than trader confidence. I have yet to find a site on the net where goods are shipped before receiving payment, therefore the 'at risk' party is the buyer. Cybertraders will need to establish a level of credibility and reliability on a par with their terrestrial cousins. Cyberbuyers will need to be confident in their ability to call upon yet unwritten international laws to gain a refund or replacement when goods and services don't arrive as advertised. BTW do you want to buy a really big rock way out in the middle of nowhere? [:>) cheers Peter -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKsP0uvjRao+WEx9AQGq5wP9EicYrEbW3wDoLZ8FcPSvp9b9qk3GhoQH H7pmHq3OvXr++DZHZqqzL2whvz24BvEA4DQ0mwPa1Te9EtIn/VGqbdv2UO23iI9H ysGX80T3wokORgKay157KC70aykgiafpHYb0t+hQxClN2FY/jTA5FiheGTaNERQc UkhP+wOg7zY= =qewX -----END PGP SIGNATURE----- Flight to Quality Wiltshire Productions Pty Ltd Brisbane, Queensland, Australia Intl Voice 61 7 3376 3535 Intl Fax 61 7 3279 4027 Email wiltship(a)gil.com.au PGP Key ID 3E584C7D PGP Fingerprint 01 03 FB F4 BE F8 2B F3 5D 84 6B 69 37 80 FE 10

1 0

Re: Java & Netscape security [NOISE]
by Rich Salz 17 Dec '03

17 Dec '03

><plonk>! I'm so tired of listening to this no-researching, ... Why do people some to insist on telling the list when the killfile someone? Overall, isn't that just adding to the crap one has to sift through? /r$

1 0

Re: e$: Come aaaannnndddd Get it!
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:57 PM 11/15/95, E. ALLEN SMITH wrote: >------------------- > I will as soon as someone comes up with a _fully_ private digital >cash system and starts using it for something. As I understand it, Chaum's >ecash system is not one (i.e., non-privacy to the sender and of amounts to the >bank). If I'm incorrect, please tell me and I'll set up an account with MTB >immediately (if there's a text-based interface). Ahhh. Next year in Jeresalem... Tell me, are you actually selling something on the net yet? How many customers do you have? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

unsuscribe
by charles＠europages.com 17 Dec '03

17 Dec '03

unsuscribe

1 0

-No Subject-
by Andrew Barrett/CheckFree Corporation 17 Dec '03

17 Dec '03

Over 2000 years ago, Nostradamus predicted that on Tuesday November 14, 1995, Phil would say: ><...>Or at least there is a requirement for the >assistant to enter the extra four digits in certain cases. The precise >nature of the circumstance when they are required to be card present I >am not sure (in fact I would bet they vary). I'm betting your bet is right. When you set up your persona/nym for use with the CheckFree wallet, the software does ask for those four, non-embossed numbers on the Amex card - which I had never really noticed 'til then. And I frequently pass the amex number on the phone for business stuff. Just last week, I had flowers sent to some partners of ours that we had just completed a deal with (sorry...should have odered them over the net), and the 4 "flat" numbers were not required. Hmmmm ....

1 0

Re: CSE gets flak on TV
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 14 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > For those who care, the Communications Security Establishment has been > getting some flak for spying on Mex. during NAFTA talks and on Korea to > help us sell Can. nuke reactors: > (This rather mirrors the trouble their sister agency, the NSA, has been > getting into) > (sorry the online newscasts were rather vague) Hmm, actually the news tape is reading a little strange here in Canada. Not AP, or REUTERS, but simply the Canadian Press newswire. Let's see ... over the last couple of days, we've had one provincial Premier resign over "BingoGate" -- kickbacks from bingo games, another premier is under some pretty heavy fire for some insider trading in a company he promoted in Hong Kong, (actually his wife got stock she never had to pay for), while Canada in conjunction with the normally very neutral Swiss have frozen accounts pertaining to about $20 million or so in kickbacks from Airbus Industries to a "senior Canadian politician". And all these stories ... coincidentally ... broke back to back. It's almost as though the country is disinfecting itself, or has taken one particularly powerful laxative. But the CSE story is really, really smelly. The worst of the whole lot. I think that there might be more to this than appears on the surface. Maybe filling in some details might help our friends on this list. You listening, Perry??? * * * On Tue, 14 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > Electronic snooping part of the game > > > OTTAWA (CP)--Intelligence experts say it's no big secret that Canada's > high-tech spy agency snoops on friendly countries for financial gain. No big secret?? It was news to me. ;-) > Increasingly, intelligence agencies around the world are using their > antennas, computers and codebreakers to gather economic information, > Wesley Wark, a University of Toronto history professor, said Monday. > > Some of Canada's largest trading partners--including the United > States, France and Japan--comb the airwaves for useful information, so > Canada would be foolish not to join the game, said Wark. Wark actually continued here. He said: "I don't know what a friendly power in the economic sphere is, exactly, these days. That seems to be a very ambiguous term." (Of course, this is diplo-dodo-speak for something ... I think ... but I'm not sure what.) > Canada's secretive Communications Security Establishment--an arm of > the Defence Department--collects and analyses communications traffic > on the activities of foreign states, corporations and people. > > Jane Shorten, a former CSE employee, told CTV News in an interview > Sunday the agency spied on Canada's allies and trading > partners--including Mexico and South Korea--by eavesdropping on > embassies, consulates and diplomats. There was also a followup segment, broadcast Monday. I think that "Jane Shorten" said that the CSE intercepted telephone conversations and faxes of Canadians working at FOREIGN embassies in Canada. But Prime Minister Chretien, in ... New Zealand ... at a meeting of the Commonwealth did not deny Canada is spying on allies, but he did say that "This is an organization that works within the law of Canada". He also said, "They do not report to me on a daily basis and I cannot make any comments on if they are spying on anybody. I don't know. But they have the mandate to check a few things around the world. Probably somebody is listening to us at this moment." Later the Prime Minister said that if any laws have been broken, "somebody will have to pay the price." Ottawa maintains that the CSE, the NSA and their counterparts in Britain, Australia, and New Zealand have all agreed not to spy on each other. He also said that the CSE does not target Canadians and scrupulously abides by Canadian laws. "Jane Shorten" said in her Sunday broadcast, "I have lived with this information for so long and I just think that it is time that Canada knows what the CSE is doing." "Shorten" worked as an analyst for the CSE from 1986 to 1994 when she was laid off. "Shorten" said that the agency spied on Canada's allies and trading partners, eavesdropping on friendly embassies, consulates, and diplomats in Canada and around the world. Ottawa denies it. "Countries like Canada have understandings that they don't carry out these activities against each other." Solicitor General Herb Gray said earlier this year in response to claims that the US Central Intelligence Agency had spied on the Japanese delegation during auto trade talks in Geneva. "Shorten" however replied: "He does not know what's going on because CSE is certainly doing that ... I spied on the (South) Korean government for the Canadian government." [I think she was referring to Atomic Energy of Canada's sale of nuclear power plants ... possibly ... but I don't know, about AECL.] Today, it was reported by the deupty prime minister -- since the Prime Minister is away at an economic conference in Japan -- that there will be a review of operations to make sure that the Communications Security Establishment is obeying the law. "And if, in fact, there has been illegal activity going on, we'll want to deal with that in as public a way as possible," said Sheila Copps. The Mexican government has presented a diplomatic note to Canada expressing "surprise and concern" over the report that it was spied on during the North American free-trade talks. South Korea is looking into the matter as well. The head of the Canadian Civil Liberties Association wants an independent committee to oversee CSE operations. Alan Bovoroy, angered by the suggestions of spying on Canadians, said a watchdog could put pressure on politicians to make changes if the CSE steps over the line. International diplomacy experts said the allegations of economic espionage wouldn't damage Ottawa's relations with the countries. -- E N D -- And I guess ... that's all of the news that I've got to this hour. Except for one brief note, that Prime Minister Chretien tried to call the States, but the Government shutdown meant that his call couldn't get through. I think he tried to call NASA. Speaking personally, I just think that something is a bit fishy. I mean "Jane Shorten" is a nym if I ever heard one ... probably married to "Dick Lengthen" or something. But putting my wry sense of haha, aside there are some serious questions. How does someone cleared for TOP SECRET UMBRA, like our dear "Jane Shorten" say, "I have lived with this information for so long and I just think that it is time that Canada knows what CSE is doing." And then later say: "I feel so strongly that its time that people learned what CSE is all about." I mean ... HELLO .... GiGGle TesT ... what on earth did she think the CSE did?? Made snowmen and skated on the Rideau Canal?? "Shorten" apparently is quite distraught, over the stepped up CSE operations in 1991. Operations targetted at foreign embassies in Canada. She recalled overhearing conversations of Canadians employed there -- even one woman's phone call to her doctor. She was appalled and confronted her boss, who assured her that the practice was legal. I mean, whop dee doo ... "Shorten" overheard a patient/doctor telephone call that a Canadian made from their place of work -- a foreign embassy. Did she listen with great intent and intererst, or did she simply try not to listen?? If "Shorten" was so disraught at listening in on personal information, she should have closed her ears. I mean, this is Canada, what is the problem if we listen to people who work in embassies?? The agency IS obligated to destroy information about Canadians it scoops up in its electronic net. A rare exception might be a phone call describing a terrorist plot, but that would truly be exceptional, I think. I mean its not like one big fishing expedition. In any event, "Jane Shorten" returned to Canada from New York, this last evening. She told CTV she was aware her revelations could result in prosecution under the Official Secrets Act but she felt the risk of prison was worth it. And that's the fleshed out version of the story. I'm just sorry that our Prime Minister is in such a bad position because of the timing of this "Jane Shorten's" revelations. She also revealed that Canada spied on Japan. To think ... Canadian Prime Minister Chretien is a guest of the Japanese people today. Talk about some awkward moments. I mean, what on earth do you talk about?? George Bush and Sushi?? Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0