December 2003 - cypherpunks-legacy

Re: So much for free speech...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:57 AM 11/6/95 -0800, Timothy C. May wrote: >Children are usually not accorded full constitutional protections, >especially not in public schools, but this does not mean the police should >arrest those who utter the wrong words! (Maybe suspending the student, >though I certainly wouldn't do that.) That's the rub. Kids can be kept locked up even with no crime. "Children don't have a right to liberty only a right to custody." An adult would probably not get arrested in the same circumstances (cops have more discretion to push kids around) or if arrested not prosecuted, or if prosecuted, case dismissed. It's a good thing the kid didn't engage in racist/Nazi acts like cutting government spending and taxes or they would have thrown the book at him. >This is the "safe and secure" world we are in, where bad thoughts and bad >words are punished. Or threatened with lawsuits. Anarchy seems infinitely >preferable to me. You got that right. DCF "Remind me to use an anonymous remailer in the future when indulging in racism."

1 0

BoS: Netscape 2.0b2 allows for invasion of privacy (fwd)
by bkuhn＠scientech.com 17 Dec '03

17 Dec '03

Talking of Netscape - this posting prompted me to forward it given the security and privacy implications inherent in the problem. Cheers Graeme ------- Start of forwarded message ------- >From: Scott Weston <scott(a)tripleg.com.au> >Subject: Netscape 2.0b2 allows for invasion of privacy >Newsgroups: aus.net.announce,comp.privacy >Date: Fri, 01 Dec 1995 11:09:06 +1100 Hi 'Net Dwellers, First off - I've posted this before (however not to this group) and only got a response from the Netscape Corp. They were glad I found the problem and said that they would fix it, however I feel that people should know about it. Also I would like people to help me spread this document around, i.e. if you know of a newsgroup (or people) that would find this interesting then please re-postit. On with the problem... I've recently got hold of the latest netscape, and was (at first) very excited about the new "LiveScripts" that it supports. If people don't yet know - these "LiveScripts" allow you to put small programs into your web page that is then executed by the Netscape client. There is no DIRECT way for these programs to send information back to the owner of the web page, however I was able to do it in a not-so-direct way. The "LiveScript" that I wrote extracts ALL the history of the current netscape window. By history I mean ALL the pages that you have visited to get to my page, it then generates a string of these and forces the Netscape client to load a URL that is a CGI script with the QUERY_STRING set to the users History. The CGI script then adds this information to a log file. Now if this hasn't quite CLICKED yet lets do a little example. Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 to start his daily "surf" session. First he decides to check his CD-NOW purchase and uses the handy Auto-Login URL. Then he decides to go to Lycos and do a search. In his search he find my page, which he decides to visit. Suddenly he is transported, not to my main page but to one of my CGI scripts, which in turn happens to have ALL the URL's he just been to in it. This means that in my log will be: - the URL to use to get into CD-NOW as Johnny Mnemonic, including username and password. - The exact search params he used on Lycos (i.e. exactly what he searched for) - plus any other places he happened to visit. I do this in a way that the user will KNOW that it has happened and will _hopefully_ email Netscape and tell them they are NOT impressed. But it would be EASY for me to change the CGI script so that the user is unaware that it has actually happened, unless they closely examine their URL history (in fact they'll probably just think its a netscape bug). If you're skeptical about this then do the test yourself. Get netscape 2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: scotts car boot sale which should return the URL - http://www.tripleg.com.au/staff/scott Click on the URL and sit back an watch. First my main page will show up but a little while later you should be transported to a CGI bin script that will show you your URL history. I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions and both have done the same thing. I would be interested in knowing if it happens for ALL versions of Netscape2.0b2. The log file does log the User Agent (i.e. the name of the platform you are using) so by simply going to the page I will know that your version of Netscape is also open to this form of attack. Currently I can find no way to configure Netscape2.0b2 to NOT run LiveScripts - and at the very least this option should be quickly added to the next version of netscape to be released. But a far better solution (IMHO) would be for netscape to pop up a window before running the LiveScript and let you know what the LiveScript wants access to, e.g. if it only wants to print out the current time then that's OK, but if it wants to read my history list and then transport me to a CGI script and add me to a logfile then maybe I would say NO. I think I've said enough.... If you've got any further questions, or want some more information just email me : scott(a)tripleg.com.au -- Scott. Quote from a car accident insurance claim: "I told the police that I was not injured, but on removing my hat, I found that I had a skull fracture." ------- End of forwarded message -------

1 0

Re: BoS: Netscape 2.0b2 allows for invasion of privacy (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:33 PM 12/8/95, Bill Kuhn wrote: >Talking of Netscape - this posting prompted me to forward it given the >security and privacy implications inherent in the problem. > >Cheers >Graeme > >------- Start of forwarded message ------- >>From: Scott Weston <scott(a)tripleg.com.au> >>Subject: Netscape 2.0b2 allows for invasion of privacy >>Newsgroups: aus.net.announce,comp.privacy >>Date: Fri, 01 Dec 1995 11:09:06 +1100 > >Hi 'Net Dwellers, "'Net Dwellers" or "Det Weilers"? Hmmhhh.... In any case, this has already come up a couple of times on the Cypherpunks list, and was even commented upon by Jeff Weinstein of Netscape a couple of days ago. The bug was fixed in b3. I really encourage people who are not following the list more carefully to check the back traffic before posting bug reports. Forwarding messages is often the culprit in this, as the forwarder simply assumes we may be interested, but he has himself not been following the thread. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: The Elevator Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 12/8/95, Jerry Whiting wrote: >A group of us have been wrestling with a problem and I'd like to ask for some >outside help. We've come to call it the Elevator Problem. > >Alice and Bob want to establish a secret in from of Eve. In other words, >they want to agree on a secret key in an elevator full of Eve's. Isn't this just the "subliminal channels" scenario? Originally phrased in terms of prisoners under the watchful eyes of their jailers nevertheless establishing a private communication channel? Schneier describes this beginning on page 66 (of his 1st edition). Your scenario looks identical to this. So you should check out the papers on this in the Crypto Conference proceedings. As to whether you can implement this without using patented algorithms, I don't know. Not enough information given. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 6

InfoWarCon
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

P L E A S E D I S T R I B U T E W I D E L Y InfoWarCon (Europe) '96 Defining the European Perspective Brussels, Belgium May 23-24 1996 Sponsored by: National Computer Security Association Winn Schwartau, President and CEO, Interpact, Inc. Robert David Steele, Chairman & CEO, OPEN SOURCE SOLUTIONS Information Warfare represents a global challenge that faces all late-industrial and information age nation states. It also represents the easiest and cheapest way for less developed nation-states and religious or political movements to anonymously and grieviously attack major nations and international corporations. Not only are the definitions of InfoWar unclear, but they span many areas and disciplines. This conference will examine the European perspectives on all three classes of Information Warfare while contributing some American lessons learned, mistakes made and successes enjoyed. Class I: Personal Privacy Class II: Industrial and Economic Spying and Warfare Class III: Global Conflict, Terrorism and the Military As at all other InfoWarCon, this special European Conference encourages active audience participation, contribution and debate. May 22, 1996 17:00 - 20:00 Pre-Registration 18:00 - 21:00 Hosted Cocktail Party with Music Most conference speakers will be in attendance. Meet Mr. Schwartau and Mr. Steele. May 23, 1995 07:00 - 08:30 Registration 07:00 - 08:30 Sponsored Continental Breakfast PLENARY SESSIONS 08:30 - 09:00 Keynote Speech Major General William Robbins Assistant Chief Of Staff, Command, Control, Communications, Computing, and Information Ministry of Defence, United Kingdom (Invited) 09:00 - 10:00 "Information Warfare: Chaos on the Electronic Superhighway" Winn Schwartau President and CEO, Interpact, Inc., USA An overview of Information Warfare from the civilian perspective by one of the world's leading experts on the subject. This will be an eye-opening presentation with time reserved for questions from the audience. Mr. Schwartau will be available throughout the conference for personal and private discussions as well as book signings. 10:00 - 11:15 Military View of Information Warfare Moderator: Captain Patrick Tyrell Assistant Director, Information Warfare Policy, Ministry of Defence, United Kingdom Panel: The German View The Russian View The Croatian View 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Law Enforcement in Cyberspace: Cooperation is the Key: Panel Moderator: Winn Schwartau, Interpact, Inc. Panel: Interpol Surite FBI Netherlands How will global partners respect each other's laws and cooperate in their enforcement? Will extradition for cyber-crimes become necessary? Leading experts will walk us down the paths to success and offer lessons learned on failures and risks. 13:00 - 14:30 Lunch 13:30 - 14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Threats to European Civil Prosperity Moderator: Admiral Lacoste/General Heinrich, France (Invited) Panel: Belgium Germany United Kingdom Europe is becoming as dependent upon its econo-technical infrastructure more than ever with the design and construction of the European Space Initiative. Communications systems create the basis for global commerce, transportation systems permit the distribution of goods, the financial infrastructure is a requisite component of any information based economy and the power grid glues it all together. But, the threats to their stability and integrity are many and must be dealt with on a continent that has a history of war and more recently terrorism. What are the risks? The rewards? And the solutions? Breakout II: Information Warfare: Support for Conventional War Fighting Moderator: TBD Panel: US - Gen. Jim McCarthy USAF (Ret) Russia Netherlands Conventional Wars and regional conflicts are replacing the fear of East-West conflict. Advanced Industrial and Information Age societies will supplement their armed forces with enhanced information processing capabilities. What are they and will they change the face of war? 16:00-16:30 Sponsored Break PLENARY SESSION 16:30 - 18:00 "Hackers: National Resources or Merely Cyber-Criminals?" Moderator: Mich Kabay, Ph.D. Director of Education, NCSA and Robert Steele, President, OSS, Inc. Panel: Hactic and The Digital City Experiment: Amsterdam, Netherlands (Invited) Hacker, United Kingdom CHAOS Computer Club, Germany Are hackers merely criminals operating under the guise of Internet freedom? Or are they national resources to be cultivated and who have served as an early warning system for Cyberspace? One group of American hackers have threatened to "Declare War on France" on behalf of American interests. How do we as nations deal with this? Mich Kabay and Robert Steele will debate the issue and then you will meet the hackers in person. The first Information Warriors invite your questions, comments and interaction. Learn first hand who they are, what they believe and how they function. 18:00 - 21:00 Hosted Reception 21:00 - 23:00 "Dutch Dinners" for Birds of a Feather Rallying points will be provided. May 24, 1996 07:00 - 8:30 Sponsored Continental Breakfast 08:30 - 9:00 Keynote Speech "Efforts to Maximize Information As New Age Weapon" (TBD) PLENARY SESSIONS 9:00 - 10:00 "Creating Smart Nations Through National Information Strategies: Intelligence And Security Issues" Robert David Steele, President, OSS, Inc. US Planning for the future requires new thinking and a new "triad" of defense: Open Source Intelligence, Electronic Home Defense and Information Warfare. 21st Century realities invite dozens more players whom must be monitored and controlled. Governments and the military should avail themselves of the publicly available open source information as part of their ongoing intelligence operations. Mr. Steele has suggested that nations should "draft" the civil sector by requiring 'due diligence' and very high standards of private sector communications and computing security. 10:00 - 11:15 "The Convergence of Military and Commercial Vulnerabilities" Moderator: Winn Schwartau, President and CEO, Interpact, Inc. Panel: Bob Ayers, DISA, Department of Defense, US Holland / Belgium UK France Much of military success depends upon the reliable operation of civilian and commercial systems. No longer do the government and military and private sector function in isolation. What levels of cooperation are required to assure proper defense and war fighting capability? How much of the private sector must be viewed as a national security asset - to be protected as much as is a forward deployed military unit? 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Societal Impact of Information Warfare Moderator: Winn Schwartau, President and CEO, Interpact, Inc. Society is absolutely dependent upon technology; without networks and computers and communications, portions of society can collapse within days. If major systems fail, what will the reaction of a techno-reliant society be? And, what are the ethics of a military who instigates the collapse of an adversary's civilian infrastructure rather then resort to bombs and bullets? Is a techno-phobic society psychologically prepared for the consequences? 13:00 - 14:30 Lunch 13:30-14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Legislation & Personal Privacy: A Global Electronic Bill of Rights? Moderator: General Pickering, Canada (Invited) Panel: Electronic Privacy International (Invited) Sweden The Vatican This panel will examine the different approaches governments take to protect the personal privacy of their citizens and what steps need to be taken to create a global consensus. How do differing privacy laws affect countries ability to do business? How will authoritarian regimes counter the perceived threat of free and open information flow? Breakout II: "Industrial Espionage: An Update" Moderator: DST, France (Invited) - (RS) Panel: Surite tells all Kroll Associates US Germany 122 Countries are actively engaged in industrial and economic espionage to the benefit of their respective states. It's a lot easier for a third world or agrarian society to steal intellectual and proprietary property than to invest time and resources develop their own. Who's involved and what are they doing? What steps need to be taken to defend such actions? 16:00 - 16:30 Sponsored Break PLENARY 16:30 - 18:00 Defining War in the Information Age "The New National Security" Brief comments by Winn Schwartau and Robert Steele - and then a lively interactive audience debate. An enemy bomb landing in any country can be easily construed as an act of war. However, in Cyberspace, anonymous acts of aggression that lead to war or replace conventional attacks are not so simple to classify. This highly charged subject will consider what war is and what it isn't: - Is an attack against a financial institution an act of war? - What about the intentional collapse of a communications infrastructure? - Is human lethality a necessary pre-requisite for war? - Do we need to redefine national security for the post Cold-War world? 18:00 - 18:10 Closing Comments 18:00 - 20:00 No-Host Reception Hotel Information: Hotel Palace rue Gineste 3 1210 Brussels Belgium +32 2 203 62 00 +32 2 203 55 55 (Fax) InfoWarCon (Europe) - 96 Registration Form: Name: ___________________________________________________________ Title: ___________________________________________________________ Org: ___________________________________________________________ Address: ___________________________________________________________ Address: ___________________________________________________________ City: ___________________________________________________________ State: _______________________________ Zip: _____________________ Country: __________________________ Email: ________________________ Phone: __________________________ Fax: _________________________ FEES: Payment made BEFORE March 1, 1996: ( ) $845.00 NCSA Members/OSS Attendees ( ) $895.00 All others ( ) $795.00 3 people from same organization ( ) $745.00 5 or more people from same organization Payment made AFTER March 1, 1996: ( ) $895.00 NCSA Members/Paid OSS Attendees ( ) $995.00 All others ( ) $845.00 3 people from same organization ( ) $795.00 5 or more people from same organization Make checks payable to NCSA, or Charge to: ( ) VISA ( ) MasterCard AMEX ( ) Number: ___________________________________________ Exp date: ___________________________ Signature: ___________________________________________ MAIL OR FAX OR EMAIL REGISTRATION TO: National Computer Security Association 10 South Courthouse Avenue Carlisle, PA 17013 Phone 717-258-1816 or FAX 717-243-8642 EMAIL: conference(a)ncsa.com To obtain the latest edition of this program, send EMail to: euroinfowar(a)ncsa.com For more information about NCSA: WWW: http://www.ncsa.com CompuServe: GO NCSA EMail: info(a)ncsa.com Sponsorships for various InfoWarCon (Europe) 96 events are still available. To find out how to sponsor portions: Contact Paul Gates at the NCSA: pgates(a)ncsa.com To reach: Winn Schwartau: Winn(a)Infowar.Com Robert Steele: ceo(a)oss.net V 1.1/12.7.95 Peace & Happy Holidays Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: GAK and Self-Incrimination?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 8-DEC-1995 13:28:32.69 Given that GAK means one never knows if the government is listening, could a person claim protection against self-incrimination as a reason to not use GAK, and get away with it? (This is different from the phone system, which may also be tapped. The analogy would be the same if the government forced one to pick a telephone it could tap over one it could not, which so far has not been the case, but which soon may be if switching systems which are not compliant with Digital Telephony Act provisions are shut down.) Consider this hypo: I send an encrypted message to a partner in crime containing plans for future crimes and descriptions of past crimes. I don't GAK the message. The government prosecutes me under the Anti-Terrorism and Child Protection Act of 1997. My defense? That GAKKing the message would be tantamount to incriminating myself, which the Fifth Amendment protects me against. ------------------- There is the problem with this argument that personal diaries have recently (Packwood) been found to not fall under the Fifth amendment. However, IA(most definitely)NAL. -Allen

1 0

NSA flying disk follow-up [Extremely Frivolous]
by cman＠communities.com 17 Dec '03

17 Dec '03

I spoke with Dennis Cisco at the NSA today, and he is unwilling to sell or otherwise distribute the NSA flying disk promotional items "except at trade shows where we are promoting our technology transfer program." Since they are not planning on attending any such conferences in my area in the near future, it is unlikely I'll be able to help any of the (numerous) people who expressed an interest in obtaining one of these fine flying disks. (http://www.communities.com/foo/NSAfris.gif) If you'd care to discuss this matter with Mr. Cisco yourself, he can be reached at: (301) 688 0701. Note that this is in Maryland. Also, the (301) 688 0606 number listed on the frisbee seems to be either always busy or not answered -- I'm assuming it's the # for the NSA tech transfer office. Please let me know if any of you have better luck.

3 2

Re: Free calls to Govt (fwd)
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

I did and it did not work. At 04:22 PM 12/10/95 EDT, you wrote: > I've been told that number is out of date. Since I forgot to save it, >would someone who did check and find out? > Thanks, > -Allen > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: Still more on the Digicash protocol
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 PM 12/8/95 -0600, Mark Twain Bank Ecash Support wrote: >>There's no need to send that payment info in the clear -- why not encrypt? > >DigiCash agrees that it is desirable to encrypt the payment request. The >problem is how? You can't use the payor's public key, since the payor is >anonymous to the payee. There are other, high overhead, protocols that might >be used, but after taking MIM into account, securing the payment request >from within Ecash while retaining acceptable latency is much harder to >acomplish than one might think. Obviously if the payer is the one transmitting the message, she doesn't use her public key to encrypt; hers would be used for signature if appropriate. She should use the payee's public key, or some negotiated key like DH. It doesn't lose any privacy, because she already knows an address to send the money to, and the payee can create a public key for that address, or some other public key he makes available to payers. >The best solution at this time seems to be to use the already existing https >connection to transmit the payment request. The next version of Ecash will >offer this feature as an option to the user. I had assumed that the payment information wasn't encrypted because that's a separate problem from the basic digicash, and because if the payer wants to keep the transaction private, she probably also needs to encrypt the other side of the transaction - e.g. the request for n widget at $d/widget. https or other ssl connection, or an encrypted telnet, or encrypted email, or some other protected mechanism all would seem to be appropriate. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 # Anybody notice that Microsoft's Wide Open Road ad has barbed-wire fences # on both sides of the road?

2 1

More elveator problem
by Jerry Whiting 17 Dec '03

17 Dec '03

More on The Elevator Problem: I'll confess that we're working on a new private key encryption product. Free and clear of existing claims on intellectual property, I'd like a protocol that answers the elevator problem: how can Alice and Bob agree on a private key via a compromised channel? I don't want them to meet under a street lamp and whisper in each other's ears _before_ trying to establish a secret on a crowded elevator. I'm willing to accept that the basic question is undoable without stepping on DH et al., I just don't want to give up until all parties are convinced it can't be done. As I stated in my original post, we're willing to consider less-than-perfect implimentations if we can quantify mathematically the risk involved. In some scenarios, Alice and Bob might not expect any Eve's in the crowded elevator or value the content at such a price that they're willing to live with less than 100%. As long as we can document the risk, the end user can make the decision as to whether the risk is worth it. Something that I neglected to mention before is that Alice and Bob do have a unique ID within this system, not that they necessarily know each others. If one assumes that they do, they then share a secret: the knowledge of each other's unique ID. Another segment of our attention is being spent daydreaming about the potential applications of a secondary channel in the cleartext portion of a crypto "package" or "bundle". The comment about secondary channels that I believe Tim made regarding the inmates and the warden is something we discuss in our spare time. Then again the wheels of justice doth turn and patents ain't forever... Jerry Whiting jwhiting(a)azalea.com

1 0

Rally in SanFran meatspace to protest censorship in cyberspace!
by John Gilmore 17 Dec '03

17 Dec '03

Spread the word! *** NETIZENS!! RALLY AGAINST CENSORSHIP *** Amendment I: "Congress shall make no law ... abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble." **PROTEST ** PROTEST ** PROTEST ** PROTEST ** PROTEST ** PROTEST ** It's like illiterates telling you what to read. On December 6 members of the House Conference Committee on Telecommunications Reform approved a proposal to censor free speech in cyberspace. If the measures are adopted, the Net and online media will become the most heavily regulated media in the United States. They *will not* enjoy the First Amendment freedoms now afforded to print media. Instead, online publishers and users will be held to a vague and patently un-Constitutional "indecency" standard. "Violators" will be subject to fines of up to $100,000 and prison terms of up to five years. In response, ALL members of the Bay Area media, online, Internet, new media, and telecommunications communities are invited to participate in a protest rally to express our outrage that the politicians in Congress (which is not even connected to the Internet!) are attempting to destroy our First Amendment rights in cyberspace, and directly attack our livelihoods. Help stop the demagogs in Washington! There is nothing "decent" about denying free speech to us, our children, and our children's children. Preserve our Constitutional rights! Join us! WHEN: Monday, December 11, 1995 12:00 - 1:00 PM WHERE: South Park (between 2nd and 3rd, Bryant and Brannon) San Francisco. SPEAKERS: To be announced [including John Gilmore, Jim Warren, Dave Winer, Mike Godwin, Howard Rheingold] BRING: Attention-grabbing posters, signs, and banners that demonstrate your committment to free speech and expression, and your feelings about Congress. FOR UPDATED INFORMATION: http://www.hotwired.com/staff/digaman (Although this event is being organized in the offices of Wired magazine and HotWired, we are *actively* seeking participation and support from all members of the local community. Please forward this message to anyone you think should attend, and to all relevant news groups.) CONTACT: Todd Lappin -- 415-222-6241 -- protest(a)wired.com

1 0

Oracle of Man
by oracle1＠shell02.ozemail.com.au 17 Dec '03

17 Dec '03

Whatever your Newsgroup interest may be, The fact that you are using the Internet, means that you are part of the greatest explosion of information technology (IT) in the history of mankind. Computer developments are well documented but the future of artificial intelligence is limited only by our imagination. Paul Phillips, owner of one of the largest IT companies in Australia, has written a compelling book which is raising controversy and arguments throughout the world. His disturbing and unnerving prediction is that we are now close to a breakthrough in the race to give computers a conscious intelligence. This will give them the ability to interface with human beings. This giant leap forward brings the incredible possibility of being able to "download" our whole psyche. This will include our personality, intelligence and knowledge transfering into Technological Life Forms" or "TLF's", to give ourselves eternal life. For further information, please visit our Web page on http://www.oracle_of_man.aust.com

1 0

Netscape speaks with a forked tongue:
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

Netscape speaks with a forked tongue: Jim Clark, top guy and owner of netscape, has issued a statement in support of government access to keys: "To secure Net communications, the government will need to have access to private data exchanges using what is known as a key escrow security system " and he has issued a statement that Jeff (a netscape employee) has very generously interpreted as anti GAK. (Government access to keys) The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. Jim Clark's supposedly anti GAK statement was incomprehensible to me. Perhaps he needs a punchier ghostwriter: I offer my services free of charge. :-) If Jim Clark wishes to persuade us that his heart is in the right place, he should put something like the following somewhere on the Netscape web pages: "Our customers do not want government access to their cryptographic keys. Mandatory government access to keys violates the rights of our customers. Therefore we will not foist government access to keys on those customers who have freedom to communicate securely. We will only build government access to keys into our products for those customers whose governments force them to provide such access. " If that really is Netscape's policy, then they should tell the world that that really is Netscape's policy, thus instantly relieving the fear, uncertainty, and doubt created by the unfortunate widespread misinterpretation of Jim Clark's original statements. The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

2 1

Re: Still more on the Digicash protocol
by Andrew Loewenstern 17 Dec '03

17 Dec '03

David A Wagner writes: > >Tough!? It's trivial for an active attacker, in the stream cipher case. > >He just xors some bits: no clever cryptanalysis needed. (Or did you mean > >it's tough to mount an active attack? I agree: that requires significant > >knowledge or motivation.) Rev. Mark Grant responds: > Exactly.. once you have an active attack set up, it's trivial, but > setting that up is quite hard. But setting up an active attack is probably a hell of a lot easier than breaking 128-bit RC-4 (or even 64-bit). andrew

1 0

SpeakFree (Internet real-time voice w/encryption?)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Has anybody seen, used or hacked with SpeakFree? Supposedly it's a kind of internet-phone that has IDEA/DES encryption options, plus another option to exchange encryption keys with PGP... The URL is http://www.fourmilab.ch/speakfree/windows/

1 0

Windows .PWL cracker implemented as a Word Basic virus?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Just an idea. It would be huge, but can anyone think of a reason it would not be technically feasible? Also, does NT use the same algorithm for saving network passwords? -rich

1 0

Re: Netscape announces position against GAK
by James A. Donald 17 Dec '03

17 Dec '03

At 04:27 AM 12/9/95 -0800, Timothy C. May wrote: >Credit where credit is due. > >I for one am satisfied--and even pleased--with the Netscape position on GAK. Well I for one, am serious unsatisfied, but it is not so bad as to merit a campaign against Netscape. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Windows .PWL cracker implemented as a Word Basic virus
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Fri, 8 Dec 1995 19:51:55 -0800 you wrote: > >Also, does NT use the same algorithm for saving network passwords? > No, but they're doing something that makes me very uncomfortable: As I read this, they're hashing the password and some other user information using MD4 then doing some proprietary permutations on that. Given their record with security, I'd rather they used straight MD4, rather than throwing in something that we can't analyze. Dan Bailey >From the Microsoft Knowledge Base article Q102716 Storage of the Passwords in the SAM Database -------------------------------------------- User records are stored in the security accounts manager (SAM) database. Each user has two passwords with which it is associated: the LAN Manager compatible password and the Windows NT password. Each password is stored doubly encrypted in the SAM database. The first encryption is a one-way function (OWF) version of the clear text generally considered to be non-decryptable. The second encryption is an encryption of the user's relative ID (RID). The second encryption is decryptable by anyone who has access to the double-encrypted password, the user's RID, and the algorithm. The second encryption is used for obfuscation purposes. [snip] The Windows NT password is based on the Unicode character set, is case sensitive, and can be up to 128 characters long. The OWF version (called the Windows NT OWF password) is computed using the RSA MD-4 encryption algorithm, which computes a 16-byte "digest" of a variable length string of clear text password bytes. *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

6 6

Re: CP: Mailing List Subjects
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 8 Dec 1995, Michael Handler wrote: > Learn procmail. It'll save you hours upon hours of time. > > :0: > * (^From owner-cypherpunks(a)toad\.com|^Sender: owner-cypherpunks(a)toad\.com) > lists/cypherpunks Would the following work?? :0 * (^From|^Sender).*owner-cypherpunks(a)toad.com |/usr/bin/contrib/procmail -m ~/.punk_rc Does anyone know where the procmail archives are?? That might help some of us out, especially those of use who are lousy at managing our very, very precious resources. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

[FYI] Corp.Spooks Outed + W3 Proxy Filters
by Dave Del Torto 17 Dec '03

17 Dec '03

PRIVACY INTERNATIONAL's BIG BROTHER INCORPORATED. A Report on the Int'l Trade in Surveillance Technology and its Links to the Arms Industry. <http://www.privacy.org/pi/reports/big_bro/> "WebFilter" (formerly "NoShit") <http://emile.math.ucsb.edu:8000/~boldt/NoShit/index.html> <http://pubs.iworld.com/ww-online/Nov95/news/noshit.html>

1 0

Re: Netscape speaks with a forked tongue:
by Tim Cook 17 Dec '03

17 Dec '03

> > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Given Clark's position, I believe it is a reasonable assumption. Unless of course you hold that the Corp. as a legal entity could have a seperate position. In that case then WHO speaks for the corporation? Some lower level PR person? I don't think so...<s>. Tim Cook, Mindsource(tm) Librarian. "The World is a Database - Mindsource is the Search Engine." ______________________________________________________________ M I N D S O U R C E (TM) I N F O R M A T I O N N E T W O R K Send a blank Email to:mindsource@memo.net for full information Visit our W3 Site http://www.ultimate.org/mindsource/main.html D E S T I N E D FOR G L O B A L D I S T R I B U T I O N! Concept:"The Greatest Untapped Resource is Human Resource(TM)" Mindsource is a Reg. Trademark Copyright(c)1995 by Mindsource

2 1

Re: Netscape speaks with a forked tongue:
by James A. Donald 17 Dec '03

17 Dec '03

At 03:11 AM 12/9/95 GMT, Dan Weinstein wrote: > You are quoting a reporter and attributing it to Jim Clark, do you > understand what is wrong with that? Jim Clark has had ample opportunity to clarify his statements. He has not clarified his statements and he has not disowned the reported version of his comments, despite repeated requests to do so. Once again I request him to do so. Once again I ask what he means, once again I complain that if that is not what he meant, he should now say something that is unambiguously different from what he was reported as saying. >It has been reported by those that attended the Clipper II meeting on >Monday(?) that the Netscape representative read an official statement >very much in opposition to GAK. I have not seen this statement, and I have asked for it: Once again I ask for it. In particular I ask that it be placed on their web if it says what they say that it says. > > Jim Clark's supposedly anti GAK statement was incomprehensible to me. > > Perhaps he needs a punchier ghostwriter: > Clark's statement was certainly something less than clearly in > opposition to GAK, but I think at worst he could be said to be resigned > to GAK, not a supporter of it. It was worse than that: he said nothing at all, the "clarification" statement was a cloudy fog. > > If Jim Clark wishes to persuade us that his heart is in the right > > place, he should put something like the following somewhere on the > > Netscape web pages: > > > > "Our customers do not want government access to > > their cryptographic keys. Mandatory government > > access to keys violates the rights of our > > customers. Therefore we will not foist > > government access to keys on those customers > > who have freedom to communicate securely. > > > > We will only build government access to keys > > into our products for those customers whose > > governments force them to provide such access. > > " > > > > If that really is Netscape's policy, then they should tell the world > > that that really is Netscape's policy, thus instantly relieving the > > fear, uncertainty, and doubt created by the unfortunate widespread > > misinterpretation of Jim Clark's original statements. > Jeff Weinstein has promised that when the representative from the > conference returns to Mountain View, they will publish his statement > on web. Still waiting. I am sure that by now Netscape knows what its policy is on government access to keys: I ask them to tell the world, and to tell the world in such a way that they cannot retract their words without some embarrassment. > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Clark is not a Netscape employee. Clark owns a controlling interest in Netscape and is chairman of the board. Netscape's policies are whatever he says they are, except in the highly unlikely event that he is opposed by both Jim Barksdale and Kleiner Perkins plus a substantial majority of the lesser shareholders. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Netscape speaks with a forked tongue:
by James A. Donald 17 Dec '03

17 Dec '03

At 03:11 AM 12/9/95 GMT, Dan Weinstein wrote: > You are quoting a reporter and attributing it to Jim Clark, do you > understand what is wrong with that? Jim Clark has had ample opportunity to clarify his statements. He has not clarified his statements and he has not disowned the reported version of his comments, despite repeated requests to do so. Once again I request him to do so. Once again I ask what he means, once again I complain that if that is not what he meant, he should now say something that is unambiguously different from what he was reported as saying. >It has been reported by those that attended the Clipper II meeting on >Monday(?) that the Netscape representative read an official statement >very much in opposition to GAK. I have not seen this statement, and I have asked for it: Once again I ask for it. In particular I ask that it be placed on their web if it says what they say that it says. > > Jim Clark's supposedly anti GAK statement was incomprehensible to me. > > Perhaps he needs a punchier ghostwriter: > Clark's statement was certainly something less than clearly in > opposition to GAK, but I think at worst he could be said to be resigned > to GAK, not a supporter of it. It was worse than that: he said nothing at all, the "clarification" statement was a cloudy fog. > > If Jim Clark wishes to persuade us that his heart is in the right > > place, he should put something like the following somewhere on the > > Netscape web pages: > > > > "Our customers do not want government access to > > their cryptographic keys. Mandatory government > > access to keys violates the rights of our > > customers. Therefore we will not foist > > government access to keys on those customers > > who have freedom to communicate securely. > > > > We will only build government access to keys > > into our products for those customers whose > > governments force them to provide such access. > > " > > > > If that really is Netscape's policy, then they should tell the world > > that that really is Netscape's policy, thus instantly relieving the > > fear, uncertainty, and doubt created by the unfortunate widespread > > misinterpretation of Jim Clark's original statements. > Jeff Weinstein has promised that when the representative from the > conference returns to Mountain View, they will publish his statement > on web. Still waiting. I am sure that by now Netscape knows what its policy is on government access to keys: I ask them to tell the world, and to tell the world in such a way that they cannot retract their words without some embarrassment. > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Clark is not a Netscape employee. Clark owns a controlling interest in Netscape and is chairman of the board. Netscape's policies are whatever he says they are, except in the highly unlikely event that he is opposed by both Jim Barksdale and Kleiner Perkins plus a substantial majority of the lesser shareholders. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Netscape announces position against GAK
by Jeff Weinstein 17 Dec '03

17 Dec '03

I've included below the official Netscape position against GAK. This page is now available on our web site at the URL below. I'm sorry that we were not able to get this out earlier in the week, but we ran into some delays due to travel schedules (people attending the NIST meeting), and some logistical problems due to large changes on our web site. There is a link to this document on our home page, http://home.netscape.com/, which gets accessed more than 1 million times per day. I would appreciate it if people who forwarded parts of the recent Netscape/GAK discussion to other forums would at least send them the URL for this page. --Jeff http://home.netscape.com/newsref/ref/encryption_export.html > NETSCAPE PRESENTS POLICY ON ENCRYPTION EXPORT TO KEY MEMBERS OF THE > ADMINISTRATION AND CONGRESS > > ---------------------------------------------------------------------- > > This week Netscape representatives attending a government presentation > of the administration's proposed Key Escrow Policy for Export detailed > the company's firm opposition to the proposed policy. Netscape is > opposed to this type of proposal for a number of reasons including its > failure to adequately address the issues of acceptability by foreign > governments and corporations, significant personal privacy concerns, > and the mandatory nature of tying the Exportable Key Size to the Key > Escrow Proposal. > > At present the proposed Key Escrow Policy for Export states that a > U.S. Government-approved key escrow process must be used by U.S. > software manufacturers if they wish to export commodity encryption > products of a key length up to 64 bits. Currently, Netscape can only > provide its non-U.S. customers with products containing a 40-bit key. > It has been Netscape's experience that non-U.S. customers demand > products as cryptographically strong as those that are available to > U.S. customers (i.e., at least 128-bit key length). Hence, the current > U.S. Government proposal is compelling software companies like > Netscape to manufacture two different versions of its products - an > inefficient and noncompetitive posture that does not meet the needs of > the foreign markets. > > Netscape believes that this division in the global marketplace is not > compatible with the nature, structure, and history of the Internet and > its users. In addition, the 64-bit key length size in the U.S. > Government proposal is inadequate for security purposes; recent > experience in the United States and other countries demonstrates that > a 64-bit key can be compromised. Therefore, Netscape believes that the > U.S. Government's proposal does not support the needs of industry. > > In particular: > > 1. The U.S. Government proposal imposes regulations that will not > scale up to the speed at which the information > technology/Internet software industry continues to develop. The > proposed process represents a regulatory burden that is not > consistent with the decentralized and agile nature of the > IT/Internet business. The proposal puts at risk significant > economic stability not just for U.S.-based IT firms but for the > U.S. economy as a whole as every sector's growth is fueled by the > increasing availability and innovative use of information > products and services. > > 2. The U.S. Government proposal would in effect result in the > mandatory use of these export-grade products within the United > States. The proposal includes a non-interoperability criteria > that would make it impossible for a non-escrowed software product > to talk to an escrowed software product. Thus, consumers inside > the United States would be forced to use a government-approved > key-escrow product if they value the ability to communicate with > others outside the United States. > > 3. Corporate and individual rights to privacy are placed in question > by the current U.S. Government escrow proposal and process. This > is so because of the mandatory nature of the proposal resulting > from the key escrow requirement itself and the oversight role > government proposes to play in the accreditation process and > business practices of an escrow agent. > > Netscape will continue to work with industry organizations, partners, > and customers who are in similar opposition to the government's > proposal to ensure that the current administration understands the > unacceptability of this plan. > > ---------------------------------------------------------------------- > > Find out more about Netscape at info(a)netscape.com, or call > 415/528-2555. > Copyright © 1995 Netscape Communications Corporation -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Re: Netscape speaks with a forked tongue:
by Tim Cook 17 Dec '03

17 Dec '03

> he is speaking for Jim Clark. It is possible to not believe in > something ethically, yet see a financial advantage in supporting it. > Their is a distinction that must be made, though admitedly the line > does become fuzzy when a senior person makes a statement, this is > because he is often the one driving the policy. > I think you've made our point. <g> He has to make that distinction at the time he says it, or most of us will ASS-U-ME it's company policy as well. Especially when the statement deals so directly with the company's product. Tim Cook, Mindsource(tm) Librarian. "The World is a Database - Mindsource is the Search Engine." ______________________________________________________________ M I N D S O U R C E (TM) I N F O R M A T I O N N E T W O R K Send a blank Email to:mindsource@memo.net for full information Visit our W3 Site http://www.ultimate.org/mindsource/main.html D E S T I N E D FOR G L O B A L D I S T R I B U T I O N! Concept:"The Greatest Untapped Resource is Human Resource(TM)" Mindsource is a Reg. Trademark Copyright(c)1995 by Mindsource

1 0