December 2003 - cypherpunks-legacy

Foiling Traffic Analysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:35 AM 1/2/96, Jon Lasser wrote: >The potential for traffic analysis is the danger here. If an "FBI >International Data Laundering Expert" testifies in court that said data >came from a site known to be frequented solely by so-and-sos, all the >strong crypto in the world won't stop the average jury from convicting you. > >Carl Ellison (among others, I'm sure) has suggested various means of >foiling traffic analysis among a group of trusted conspirators, using a >token-ring-like routing scheme. I'm not completely convinced that it's >robust enough, but a variation on it is probably adaptable. How does this differ from Dining Cryptographers approaches? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Guerilla Internet Service Providers (fwd)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 9:43 1/3/96, jim bell wrote: >Interestingly enough, my primary objection was NOT really commercial >encroachment on an existing amateur structure (though that is an important >consideration!); rather, it was the fact that because we're talking really >short-range communication (way less than a kilometer, in most cases) using >frequencies below a gigahertz would be a counter-productive shame. Here, we >WANT "line of sight"! And, of course, the bandwidth issue is inherently >better: It would be FAR easier to get 100 MHz width at around 2.5 GHz than >under 1 gig! There are several vendors offering 2.4GHz wireless with ranges up to 20 miles. Though the 900MHz stuff is much cheaper. Unless you have a pager cell on your roof, 900MHz should serve you fine. >I get a free (bingo-card) magazine industry magazine called "Microwaves and >RF," which is sort of the EDN for the high-frequency communication crowd. >You'd be amazed at the level of technical (chip) development there. Chip >sets that do frequency synthesis/full RF/IF on surface mount chips. If you don't want to build your own, there are various vendors that use the NEC 900MHz bridge card in their products. Or just buy the card, get an old 486, and round up the software from somone. >(BTW, I use Eudora, and I have PGP. Could somebody explain how to PGP-sign >messages, ideally EASILY?) Assuming Eudora for Mac: Download MacPGP Control. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Guerilla Internet Service Providers
by Jeff Simmons 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jim Bell writes: >It seems to me that phone line costs are turning into a floor price for >Internet access, when they shouldn't really be. The main asset telephone >companies have, right now, is in RIGHTS OF WAY. Put an ISP in a business >park that allows you to run your own dedicated copper pairs, and you've >bypassed $25/month/line business phone line charges. > >At some point, individual urban and suburban blocks could easily be >"guerilla re-wired" for ISP access without serious trenching, etc. The >phoneco would still be involved, but in a far lower-profit mode, as the >supplier of a single T1 to a multi-block area. That's assuming the phoneco cooperates. Punknet is a 'Guerilla ISP'. Twenty of us share a 128k ISDN line, distributed via high-speed modems. It's been running fine for over a year now, but Pacific Bell has evidently decided to get rid of us. How? Simply by refusing to either repair or replace our 25 pair trunk line, which is rapidly degrading. We've offered to replace it ourselves, but according to them, it's illegal. Right now, we've got three dead lines, and two others that only will do 1200 baud. We've been told that what they're doing is probably illegal, but it's the old problem: Where does an 800 lb. gorilla sleep? We're fighting this like all hell, but who knows? After they get rid of us, I wonder who's next ... - -- Jeff Simmons jsimmons(a)goblin.punk.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOnOnuL8IP70uJJBAQF3EwP9He5bWGBRcYv3LZDAB7XJt34zr+Pi/WWp a2NjFdDuxxc7VwO1tcSvqq+PX23OtJnay9yWkcpRBUissyJ5CPzqGQv4dX8vqN0R F1EK8zTSuEnQpiMVSqduknusVeQYOq2tP6b+iDtGKgCu2veDSLS10SY82qOPmQ8j OjxkfDcxJjI= =xJeV -----END PGP SIGNATURE-----

1 0

Re: Compuserve *hasn't* banned newsgroups
by Vincent Cate 17 Dec '03

17 Dec '03

It seems to me that posting this widely on Compuserve (or at least on alt.online-service.compuserve) and then contacting CNN and making comments about how "the Internet interprets censorship as damage and routes around it" is the best way to handle this. We want the public to get the idea that censorship does not work on the Internet. Are you up for this Duncan? Or do you want to call for volunteer, or should this get posted anonymously. :-) Seems better if someone does it who is willing to talk to reporters, and who is a Compuserve user. Makes a better story on TV etc. -- Vince Duncan: > I grabbed a copy of the Free Agent newsreader: > > http://www2.interpath.net/forte/agent/freagent.htm > [...] > I grabbed the latest list of open NNTP Servers from: > > http://dana.ucc.nau.edu/~jwa/open-sites.html

1 0

Re: Compuserve *hasn't* banned newsgroups
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Duncan Frissell 1/3/96 1:02 PM: >You mean that the thirty-some odd open news servers listed on >http://dana.ucc.nau.edu/~jwa/open-sites.html might get swamped. Then the >CIS refugees will be forced to pay Sameer the massive $12.50 (?) a month for >a net-access-only account and read off of c2.org's server. (Or any of the >thousands of sites worldwide one can open a shell account on.) CIS refugees aren't the only people who use or need free NNTP servers: > Here's what you can do for $208: get a used XT with two floppy drives for > $70; a 2400-baud internal modem (new at a local computer show) for $18 > (it comes with free communications software); and an e-mail and Usenet > news-reading account for $10 per month. Sound familiar? Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMOrWzb3g0mNE55u1AQEH5AH8D6P1BPIMpLTq0JWiwLz3na4Rgv3QeymK zeNbKnbtyDkJ2h9MW8+GiPKY7uOsdZsU34eOdFtmP7/+OV0naO8AAw== =fAWj -----END PGP SIGNATURE-----

1 0

Re: What to do about Germany
by Michael C. Peponis 17 Dec '03

17 Dec '03

On Wed, 3 Jan 1996 11:52:34 +0100 (MET) Cees de Groot wrote >> What the German goverement threatned to do was inexcusable, but >> something can be done about it. >Sorry, but the "German government" did not threaten to do anything at >all. A (conservative-ish) prosecutor started an _investigation_, which >in his eyes was nothing more than executing the law (and sorry, >that's what the guy is paid for). So what does the above paragraph mean, it was not the goverment that threated, it was a procecutor who was acting on behalf of the govement to enforcese the laws of that body which is what he is paid to do. Gee, that's what I said, only alot more complicated and detailed. In the end, the party at fault is the some division of the German goverment, the procecutor is not an individual person acting on his/her own behalf. >If the German government did something wrong, it was accepting a law >for the protection of minors (Jugendschutzgesetz), which says that >minors should not be allowed to have access to booze, dope and porno. But that's a GERMAN law, the Internet is an INTERNATIONAL community. If we have to respect the laws of Germany, and their customs and archaic belief systems, them we have to give the same consideration to anyother countries backwords, morality-based, mentality. There are hundreds of countries on the planet, most of them backwards. Respect everybodys sence of decency and right and wrong and nobody will be able to transmit anything the least be vulgar becasue it would violate some countries law some where on the planet. >Please tell me such laws do not exist in your country... They do exist, but I have been breaking them since 13, I don't care to be protected by some "moral" and "ethical" person, I can decide for myself what I can and can not do. >If anything, this whole bussiness will be one step in the correct >direction: >- Either some modus operandum is found which makes it clear for >everybody > how to offer pornographic material and comply with the law at the > same time (cf. the First Virtual account ID's you have to enter at > all those sites pointing to www.infohaus.com - in the US, this >modus > operandum seems to be ``proof of having a credit card''); That's just brilliant exhange one evil for another. Instead of censorship, we take away people's rights to autonymity and privacy. Sorry, not an option. > Or the German Government learns about the lack of frontiers on the >Net, and gives up (which is highly improbable). Or they can be given consequences for their actions. Let it be known that people will not tolerate them enforcing their laws on everybody. The weaker any goverment, the more ineffective it is in imposing it's will, the better off individuals are. >considering that German prosecutors don't have the option of not >prosecuting when they hear about a felony, like for example Dutch >prosecutors. No the prosecutor does not have a choice, that's why you attact the people that make the laws, or the governing body as a whole. They try to impose there will on me, I will unlease my dirty tricks on them. Fair is fair. I have the ablity to impose my will on ohters, I have done so when certin persons have gotten on my nerves by posting things to newsgroups that were blatently off topic and they had been told and warned about it on serveral occasions. But when you go to a sexualy explicit newsgroup, what do you think you will find, what is the purpose of such a group? Protection of children is a parents responsiblity, if they can't handle that responsiblity, that is thier problem, not mine. Given my experiencewith the German government, >however, it will take some time for them >to realize that they need >a set of rules in this area. Again, that is Germany's problem, not mine, make it an issue and suffer the consequences. -- >OpenLink Software Tell Kinsley I said hello Regards, Michael Peponis PGP Key Avalible form MIT Key Server

2 1

Re: Unmuzzy Explained
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

>So is the idea beyond this that if file or a group of files were to >be distributed over many computers (possibly hundreds or more) then >none of the computers would be "responsible" for their content? I would >think that any participant in the network would have to claim full >responsibility for the content, assuming the file(s) could be accessed >from any of the participating servers. > Okay. So what if serveral groups of computers, in public FTP directories, allowed anonymous ftp uploads of "parts" of a file that would be construde as bad content. The only way to assemble the file is to download several parts of it from serveral diffrent servers and assemble the file on your system. Thus the illegal file isn't illegal until its assembled. Sorta like switchblade knives. Lots of places can sell the parts legally, they just can't sell the assembled product. Would the servers that contain "parts" of the file be responsible for the content? (andr0id(a)midwest.net callsign: N9XLM) ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: Foiling Traffic Analysis
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 7:02 1/3/96, Fred Cohen wrote: >You seem to be missing an important point about foiling traffic >analysis. It is essentially the same problem as the covert channel >problem and its solution has the same challenges - it consumes a great >in the way of resources. In order to eliminate traffic analysis, you >essentially have to always use the full bandwidth available (although >you can have pseudo-random burst behaviors). This in turn means that >instead of gaining the low cost resulting from sharing bandwidth, you >end up having far more utilization and (depending on what portion of the >world does this) increasing the price of the resource. So it costs a >lot more and uses a great deal of bandwidth. You are correct. A network of encrypted links that allways move packets at full bandwidth is the basis of Wei Dai's Pipenet. If anyone ever codes this, I am willing to sponsor a node. Other nodes may be set up if some payment mechanism using Ecash is integrated with the system. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Compuserve *hasn't* banned newsgroups
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Vincent Cate, 1/3/96 10:41 AM: >It seems to me that posting this widely on Compuserve (or at least on >alt.online-service.compuserve) and then contacting CNN and making comments >about how "the Internet interprets censorship as damage and routes around >it" is the best way to handle this. We want the public to get the idea >that censorship does not work on the Internet. If you do this, you'll find out very quickly just how empty (or at least how slippery) slogans like "the Internet routes around censorship" are: if your efforts pay off and you steer even a fraction of CIS's traffic toward the remaining open newsservers, they'll close faster than you can say "alt." So before you do it, think about how the net will route around sysops closing their servers off from the net. Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMOqvAb3g0mNE55u1AQGG1AH/cGlgviaPIn2oDQ+QS7HJdkyeo0sRmHEO ALtF08CmBIPK4hqcxd/3ESWi7IwoaJtEPyAMvwigPtvdTxO/q4ubMg== =H5rs -----END PGP SIGNATURE-----

1 0

Guerilla ISPs
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

On LECs attacking ISPs, it is interesting to note that several medium-sized ISPs in Maryland which have over 100 phone lines are now getting them delivered by fiber direct to the ISP. This is nothing new - what is news is that some of these fiber setups use a form of SLC-96 systems which are incapable of carrying data traffic over 21 kbps with modern 28.8 kbps modems. Nobody new what the problem was for a long time, until finally Bell Atlantic admitted that there were some bandwidth limitations in some SLC-96 setups. They went on to note that the tarrif required them to carry only acceptable voice and 4800 bps communication, nothing more, and that these ISPs were basically stuck with substandard lines. The ISPs involved are now looking into alternative local dialtone, but it is few and far between. Bell Atlantic is looking to get into the Internet business...perhaps they will engineer their own dialups properly, while giving low-data-rate fiber connections to ISPs? And on the radio-last-mile service, I used to be enthusiastic about it, but I am no more. It is pretty impractical to discuss VHF or UHF frequencies for real net connectivity, there just isn't enough bandwidth to be practical. 900 MHz and higher appear to be the best solution, using CDMA spread-spectrum in a microcellular environment. Metricom (http://www.metricom.com) has CDMA microcellular modems which get 14.4 kbps equivalent throughput in the 900 MHz region, and they have a large microcellular network already set up in the Bay Area with Internet connectivity. Once 2 GHz technology becomes cheap enough (that's GaAs chips instead of Si), I can imagine wide-scale 56kbps service over microcellular networks. But how can these things compete with @Home, which is promising 10 Mbps in and 128 kbps out of homes with cable modems? -Thomas Edwards

2 1

Re:US calls for measures against Internet porn
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>> WASHINGTON DC (Reuter) - The US called Sunday for improved >>management of the Internet to prevent people seeing pornographic >>material on the world computer network. I feel so much better, having the burden of deciding what I can see or read lifted from my weary shoulders. Maybe a ban on politicians appearing in the media? (Some might consider it an obscenity.)

2 1

Someone wanted to give PGP lecture at CSI conference
by Bruce Schneier 17 Dec '03

17 Dec '03

I'm looking, on behalf of the COmputer Security Institute, for someone who is willing to give a 1.5 hour PGP primer at their summer conference in SF. They don't pay, but they will give you free admission into the conference (and two bad hotel conference meals). I speak at their conferences; they're not a bad lot. Interested parties should email me directly. Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)counterpane.com **************************************************************************

1 0

FCC require ISDN?
by David K. Merriman 17 Dec '03

17 Dec '03

At 07:46 PM 01/2/96 -0600, Jim Choate bespake thusly: >The FCC is enacting a new regulation that will cause every phone company to >provide 100% of their service areas with ISDN (you should have received some >kind of notice last week, I did). This also sets some minimum standards as >well as to the type and quality of service the phone company must provide. Citation? Here in Amarillo, if it rains, the phone lines start caving in, and I'd like to beat up SWBT for ISDN service :-) Dave Merriman PS - sorry for posting this to the whole list, but couldn't get this past my ISP to Jim directly :-( ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: Massey, CEO of Compuserve, on Internet
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 23:03 1/2/96, John Goerzen wrote: >CompuServe is not location-dependant. The network operates exactly the >same regardless of calling location (indeed, the system doesn't even know >where you're calling from I believe). It is a worldwide CompuServe >Network that people use to access it. This network just allows dialups >and then gets the users connected to the CompuServe computers. The main >computers handle all traffic. They don't are location-independant, >making it impossible to block access based on location. CIS always knows where you are dialing in from. Here is the start of a typical connection (using the Mac Program NAVIGATOR). >0001NUH > >Host Name: CIS > >User ID: xxxxx,xxx/INT >Password: >[Navigator: Logged on] > >Welcome to CompuServe Information ServiceT01NUH @38400! > >Last access: Mon, Dec 18, 1995 23:11 >Connected to port CIS T01NUH @38400 That NUH identifies that I am calling in via a V34 Node in NYC and the T01 says I got the first modem on the Rotory. If CIS wanted to restrict access via the NYS nodes, that NUH would be an adequate flag to trigger this action.

2 1

Re: Starting an e-cash bank
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:25 1/3/96, Alex Strasheim wrote: >> What does it take to be called a bank? > >Is it necessary to be called a bank? To get a license for the bank software from DigiCash, you have to convince them that you are a major player in whatever country you are in or have to offer some exceptional additional value to the service. >I've got a storefront in Chicago. >What would prevent me from opening up a Mark Twain account and buying and >selling ecash on floppies, in person? You touched on a very important issue: the party converting currency into Ecash does not have to be the Ecash bank. There have been discussions that in the future one should be able to buy Ecash on floppy at the local supermarket, similar to today's prepaid calling cards. I certainly would like to see that happen rather sooner than later. It is my understanding that you would be welcome to issue MT Ecash for USD. Here is another business opportunity: MT Bank does not allow the purchase of Ecash by credit card, since they consider the risk of chargebacks unacceptable. This might be a market for a third party. >Do account holders have to agree >not to do that before Mark Twain gives them an account? Is it illegal? MT Bank doesn't mind. IANAL. <speaking only for myself> -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Windows Eudora and PGP
by jim bell 17 Dec '03

17 Dec '03

At 10:24 AM 1/3/96 -0800, you wrote: >At 09:43 AM 1/3/96 -0800, Jim Bell wrote: > >>(BTW, I use Eudora, and I have PGP. Could somebody explain how to PGP-sign >>messages, ideally EASILY?) > >I use Eudora as well. It is not as easy as I would like. You have a couple >of options: > >1) Use cut-and-paste into Private Idaho. Private Idaho will allow you to >paste back into Eudora. (Or you can send out from Private Idaho directly.) >This option is useful becuase it supports nyms and chaining of remailers. > >2) Get one of the standard Windows PGP shells and paste into that. After >signing, you will have to repaste into Eudora again. > >These seem to be the only options. I am not certain if there is a standard >DDE or OLE interface that could be used to feed message information back and >forth between Eudora and some other app. There have been a number of >promises of Eudora/PGP integration, but nothing has materialized yet. [sigh] Just what I thought, no easy solutions. Well, for now I'll just skip signing; I haven't had any problem (that I know of...knock on silicon) with forged messages, and my normal posts are so enthusiastically anarchical and inflammatory that the only way anybody could really embarrass me is to forge a message, ostensibly from me, saying I agreed with some governmental activity somewhere. >There are no easy answers I know of... > >If you need a copy of Private Idaho, I can point you to a web site or bring >a copy along to the meeting on the 20th. Please do...

1 0

crypto (semi-)export issue
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

It's been a while since this went 'round, and my memories are hazy of the details. Isn't it the case that there are loopholes or explicit exceptions in crypto export regulations that allow American businesses to supply their overseas operatives with tools for secure communication back home? We were discussing today some stuff about our web server, and there's some desire to provide secure access for our sales people to internal junk. Nobody was sure whether it'd be OK for our people in the Evil Empire (Europe) to have the 128-bit-RC4 Netscape for that purpose. (If so, I wonder if the exceptions apply to other munitions too? Like, maybe it's OK to take a medium-range missile overseas if you're just going to use it to blow up your manager's office :-) (No, I don't hate my manager.) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

New Mitnick Book
by John Young 17 Dec '03

17 Dec '03

Jonathan Littman, an investigative reporter, has published "The Fugitive Game: Online With Kevin Mitnick," Little Brown, 1996. 381 pp. $23.95. ISBN 0-316-52858-7. It is a dramatic recount of Mitnick's exploits; the pursuit by Shimomura, Markoff, telcos and Feds; the bust and Markoff's tales; The Well controversies aand disputes about what really happened; suspicions of Shimomura and Markoff - - their complicity with TLAs, their movie and book dealings, their disputes with hackers and journalists. What Mitnick was telling Littman while a fugitive. Littman ends with this letter from Markoff and Shimomura: October 8, 1995 Jonathan Littman 38 Miller Avenue Suite 122 Mill Valley, California 94941 Dear Jonathan, This is in response to your separate letters to us. We apologize for not being more prompt, Tsutomu was travelling on business and did not receive your September 5 letter until recently. As you know we have a contract with Hyperion for Tsutomu's account of his participation in the arrest of Kevin Mitnick, and at the request of our publisher we have decided not to participate in other books on the same subject. First, in response to your September 7 request to John Markoff, for permission to reprint his March 14 Well posting, he is not willing to give permission. However, we do think it is appropriate to respond to several points where you have received inaccurate information. Our responses are not intended to be a comprehensive answer to your list of questions, but only to protect you from including libelous material in your book. Tsutomu was not asked by any governmental, military or intelligence representative to assist in the capture of Mr. Mitnick. All of his actions were taken in response to requests for assistance from both The Well and Netcom to deal with extensive and persistent break-ins. Tsutomu's decision to tell John Markoff that he was travelling to Raleigh on Sunday morning was done without contact with any law enforcement agency. Markoff flew to Raleigh independently six hours later after discussing the possibility of a story with his editors at the New York Times. Markoff did not at any time assist or participate in any aspect of the investigation into Kevin Mitnick's activities; Markoff was there only as an observer in his role as a newspaper reporter. Moreover, in Raleigh on Sunday evening the Cellscope equipment was never placed in Markoff's car, and there was never any discussion about taking it out of the Cellular One engineer's van or about placing it in Markoff's car. Markoff parked his car near the cell site that night and then later drove back to his hotel. Tsutomu never told anyone from law enforcement that anyone had authorized or cleared Markoff's presence in Raleigh. Tsutomu was informed by the Justice Department that his actions on behalf of the Internet providers and the cellular telephone company during the course of the investigation were covered under their fraud detection and prevention exception granted to these organizations under the ECPA. Tsutomu did have discussions with the National Security Agency about funding computer security research, the results of which were to be placed in the public domain, however no research grant was ever made. Tsutomu was not aware of any statements made in the search warrant until many days after the arrest. Tsutomu did not lure Mitnick or anyone else into breaking-in to his computers. The attack was entirely unprovoked. No copies of any files allegedly stolen by Mitnick were provided by Tsutomu to anyone other than the legitimate owners. The first discussion of the possibility of a book on the subject of Kevin Mitnick's arrest took place on Thursday February 16, when John Markoff received a telephone call from John Brockman, a New York City literary agent, proposing a collaboration between Markoff and Shimomura. You will remember, we hope, that after his July 4, 1994 article about the hunt for Mitnick, Markoff did not wish to pursue the subject of Mitnick's life as a fugitive and referred a free-lance article on the subject proposed by Playboy to you. Also please note that you are inaccurate in stating that Tsutomu requested immunity before testifying before Congress on April 1993. We realize this is a delicate issue for you because of your involvement and communication with Kevin Mitnick during the period he was a fugitive. However, since your questions suggest you believe there may have been something inappropriate in Tsutomu's cellular telephone software development work, if you do include material in your book along this line, journalistic ethics require you to include the following: Tsutomu, unlike Mitnick, in all of his computer security research over a fifteen year period, has always, whenever he has found a vulnerability, made it known to the appropriate people, whether CERT, or a private company at risk, or the United States Congress. Sincerely, (signed) John Markoff Tsutomu Shimomura

2 1

Re: Massey, CEO of Compuserve, on Internet
by Michael C. Peponis 17 Dec '03

17 Dec '03

> On Wed, 3 Jan 1996, Robert A. Rosenberg wrote: > > > CIS always knows where you are dialing in from. Here is the start of a > > typical connection (using the Mac Program NAVIGATOR). > > > > >0001NUH > > > > > >Host Name: CIS > > > > > >User ID: xxxxx,xxx/INT > > >Password: > > >[Navigator: Logged on] > > > > > >Welcome to CompuServe Information ServiceT01NUH @38400! > > > > > >Last access: Mon, Dec 18, 1995 23:11 > > >Connected to port CIS T01NUH @38400 > > > > That NUH identifies that I am calling in via a V34 Node in NYC and the T01 > > says I got the first modem on the Rotory. If CIS wanted to restrict access > > via the NYS nodes, that NUH would be an adequate flag to trigger this > > action. > > Wouldn't this require some software routines added to check for this? I > expect the decision to build or buy is what CIS is now weighing. Also, I > would imagine that a German could always call a POP outside the country if > they wanted to pay for it..... (note that I am still not in favor of the > action, but these are probably CIS's considerations.) Well, this could be away for compuserve to cover it's rear in a realy slick fashion. If they chose to do it this way. Most CIS subscribers use their proprietary interface, which puts a GUI front end over what is going on with them modem, what they amount to are scripts. Anyways, CIS could add a script that would check the NUH identifier, if it is in Germany, it goes to one newsfeed, if it's outside of Germany, it would go to another newsfeed. They could even market the service here in the US to those who like censorship. What could be "Accidentaly" leaked is a different version of the same file, that would not contain the check. That way, Compuserve could claime that the offending parties tampered with the software, and they can not be help responsible for the tampering. I highly doubt that Compuserve would go for such a resolution, but it's worth throwing into the mix Regards, Michael Peponis PGP Key Avalible form MIT Key Server Key fingerprint = DD 39 66 3D AE DE 71 C2 B6 DA B2 3F 47 2A EB AC

1 0

Re: Massey, CEO of Compuserve, on Internet
by Steve14571＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-01-03 00:34:25 EST, you write: >CompuServe is not location-dependant. The network operates exactly the >same regardless of calling location (indeed, the system doesn't even know >where you're calling from I believe). It is a worldwide CompuServe >Network that people use to access it. This network just allows dialups >and then gets the users connected to the CompuServe computers. The main >computers handle all traffic. They don't are location-independant, >making it impossible to block access based on location. I see two possible ways to censor German users only (but I still believe censoring anyone is wrong). First, the "main computers" could be told where they are, and "censored" material could be filtered at that level before it is sent to individual users. Or CompuServe could release a software update for German users. The software would not recognize banned newsgroups. How difficult could that possibly be?

1 0

Re: Guerilla Internet Service Providers (fwd)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 1:08 1/3/96, Steve Gibbons wrote: >I'd be interested in seeing your numbers and cost breakdowns. I'd really be >interested in the up-front costs that would be associated with the equipment >and set-up time/training that will help "insure" data privacy over wideley >broadcast media. The up-front costs for ~T1 capable tranceivers isn't >insignificant either. I figure ~$10K up front (maybe half of that, maybe twice >when you include management overhead) Amortize over 3 years, and compare. You can get by with one base station per five remote receivers. This is no different than the 5/1 to 12/1 oversale ratios common to the T1 ISP business. As long as you prohibit resale of bandwidth and specialize in hooking up business lans you'll have no problems with this layout. Latency, which really is more important than bandwidth in many cases, is actually better using wireless than using traditional T1s. The set-up costs are also less to the customer than if they used a regular ISP. Only difference is that by paying the set-up fees they are buying the equipment for _you_. So once they leave your ISP, you still have all the hardware :-) >All of this is assuming that the bandwidth is available on the airwaves to >handle ~200 ~T1s. (If we're talking $200.00/mo. for T1, sign me up tomorrow, >and my neighbor, and his, and hers, and... *poof* no more bandwidth in a >"decently" populated metro area or even a downtown. 900MHz spread spectrum can get a bit crowded, but you don't need to sell 200 connections to make money. Breakeven based on competitive montly fees (in my original calculations that ment less than the lowest priced local ISP) is about 10 customers. Of course this is not at <$200 per customer. That figure is the lowest possible if you max out a T3, but still, no landline based ISP will be able to deliver bandwidth that cheap. Remember that the fees _include_ the cost for the pipe. Breakeven based on the set-up fees (meaning zero dollars investment by you) is about 18 customers. >I apologize if this is off topic, but the crypto part still applies (moreso, >even!) to broadcast over the airwaves. All major wireless vendors offer DES encryption at about $300 per node. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: New Mitnick Book
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

> Also please note that you are inaccurate in stating that > Tsutomu requested immunity before testifying before > Congress on April 1993. I don't know anything about the accuracy of the rest of the post, but I was there at this hearing. Immunity was granted, but it wasn't the same type of immunity granted to someone like Oliver North. My recollection is that the immunity was granted to allow Tsutomu Shimomura to convert an ordinary cellular phone into a scanner by typing in the magic combination of numbers. Ordinarily, this would break the law. The immunity prevented this from happening. The act was simply done to demonstrate just how easy it is to do this. They quickly switched channels several times and then turned off the phone. Nothing salicious or interesting came over the air, alas. It would have been funny if some bribe deal involving the chairman of the committee filled the room, but that only happens in movies. I don't know who requested the immunity. It could have been John Gage of Sun Micro who seemed to be running the show. There were probably transcripts made of the session and for all I know the Government might even have them around. That would allow us to get to the bottom of this important detail. -Peter

2 1

RE: crypto (semi-)export issue
by Pat Farrell 17 Dec '03

17 Dec '03

m5(a)dev.tivoli.com (Mike McNally) writes: > Isn't it the case that there are loopholes or explicit exceptions in > crypto export regulations that allow American businesses to supply > their overseas operatives with tools for secure communication back > home? We were discussing today some stuff about our web server, and > there's some desire to provide secure access for our sales people to > internal junk. Nobody was sure whether it'd be OK for our people in > the Evil Empire (Europe) to have the 128-bit-RC4 Netscape for that > purpose. At the December NIST Key Escrow/GAK export meeting, Mike Nelson said that there are rules that allow US companies to "easily" export strong encryption to their overseas operations. The important (key :-) idea is that the export is to protect the corporate assetts of US companies. He seemed to imply that exporting, say PGP, for internal corporate use was fine and easily done. Other folks later claimed that this wasn't quite as easy as he claimed. For more, see, http://www.isse.gmu.edu/~pfarrell/nist/pdf.nist2.html Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: New Mitnick Book
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>From the Littman book: > Shimomura likes his computer-controlled cellular phone, but > its use for tracking is limited. Its main purpose is to > lock on a call and eavesdrop. It is illegal to use it to > eavesdrop on calls. That's why Shimomura needed immunity > from prosecution when he demonstrated his Oki scanner > before Congress a couple of years ago. (p. 6) > Well, here's another minor error. At the hearing, Shimomura just used a new, shrink wrapped cell phone. I think it was an AT&T model, but my memory is faint on these details. I'm pretty sure it wasn't an off the shelf Oki 900. Half the point was to show just how easy it was. He didn't even bother to hook the cell phone up to a laptop or palmtop. Just a few button pushes and instant scanner. I tried to get him to tell me the right buttons afterwards, but he was too busy and didn't answer. Sigh. But aside from the brand name of the phone, Littman's sentence seems accurate according to my recollection. The transcript should settle all of this. -Peter

1 0

Re: New Mitnick Book
by John Young 17 Dec '03

17 Dec '03

Responding to msg by pcw(a)access.digex.net (Peter Wayner) on Wed, 3 Jan 7:39 PM Here's Littman on immunity for Shimomura (describing telco tracking Mitnick): Shimomura's brought along his own hacker's scanning rig. It's pretty basic, just an Oki 900 cellular phone and a hardware interface to his tiny HP Palmtop. One of Shimomura's friends -- who happens to be under federal indictment for illegal hacking -- cooked up the interface and helped write the software. Shimomura likes his computer-controlled cellular phone, but its use for tracking is limited. Its main purpose is to lock on a call and eavesdrop. It is illegal to use it to eavesdrop on calls. That's why Shimomura needed immunity from prosecution when he demonstrated his Oki scanner before Congress a couple of years ago. (p. 6) ------ [Still reading ... ]

2 1