December 2003 - cypherpunks-legacy

Re: Open Systems, Closed Systems, & Killer Apps
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:33 AM 4/9/96 -0400, Duncan Frissell wrote: >I should have known this before since it is implicit in my favorite article >from the Economist "THE INCREDIBLE SHRINKING COMPANY" 15 December 1990 > >(http://www.ios.com/~lroth/CLIPS/Bussiz.html) Try http://www.ios.com/~lroth/clips/bussiz.html instead. DCF

1 0

Background on Singapore net-censorship
by Declan McCullagh 17 Dec '03

17 Dec '03

Michael, here's the message I was forwarded. Thanks to Joon-Nie for corrections to the articles I included, mainly from the NYT/WP and the Reuters/AP wire. -Declan ---------- Forwarded message ---------- Date: Wed, 10 Apr 96 03:57:22 EDT From: Lau Joon-Nie <joonlau(a)pacific.net.sg> Subject: [Fwd: Re: International Net-Censorship Efforts Update] Spotted this in a newsgroup, but I would caution readers against wholesale reliance on its contents without some official verification as not all of it may be entirely correct (at least the Singapore bits weren't - which I have amended). rgds, joon-nie =========BEGIN FORWARDED MESSAGE========= In soc.culture.singapore, "Declan B. McCullagh" <declan+(a)CMU.EDU> wrote: >I've just doubled the number of international net-censorship efforts >that I track on my web page: <http://www.cs.cmu.edu/~declan/zambia/>. >Included are new updates reporting on Germany, France, Australia, >Singapore, Canada, and China, among others. Please send me reports on >countries I've missed! >-Declan >-------------------------------------------------------------------------- > > OTHER INTERNATIONAL NET-CENSOR EFFORTS > By Declan McCullagh > declan(a)well.com > http://www.cs.cmu.edu/~declan/zambia/ > > France, China, Germany, Singapore, Jordan, the U.S., and many other > countries are moving towards tighter control of the Internet. France > and Germany want to see an international agreement of information > controls emerge. Recently China required all of its estimated 40,000 > Internet users to register at the local police station. This > international crackdown marks a turning point in the development of > the Net. > > Germany > > Germany cuts off access to holocaust revisionist web site (1/96) > German Internet update, new laws planned (3/29/96) > Los Angeles Times on German vs. U.S. netcensorship (3/13/96) > German minister predicts collapse of governments (3/12/96) > Germany's CompuServe net-censorship (12/31/95) > > France > > French government bans controversial book (1/96) > French Jewish students sue ISPs for revisionist materials (3/14/96) > French Jewish students sue ISPs for revisionist materials (3/15/96) > France calls for "global Internet rules" (2/3/96) > > Europe > > Swiss statement on voice over Internet (3/16/96) > Sweden proposes CDA-type law to control Internet (4/3/96) > Italian net-censorship necessary, says Simon Wiesenthal Ctr (1/11/96) > Turkey cracks down on Internet (2/18/96) > Belgium bans non-escrowed encryption (1/10/96) > > Asia and Pacific Rim > > Singapore leader condemns Net (3/7/96) ^^^^^^^^^^^^^^^^^^^^^^^^ This phrase is at best vague. My guess is that he's referring to the news conference on 5 Mar 96 given by S'pore's Information and the Arts Minister Brig-Gen George Yeo where it was announced that S'pore would be implementing a regulatory framework to inter alia, block off objectionable sites, deem all content providers (except those "acting in personal capacity" - yet to be defined) as licensed, and requiring certain types of content providers (those publishing religious, political or racial content/discussions on websites, and certain online newspapers, in particular those already selling hardcopy versions in S'pore) to register themselves with the S'pore Broadcasting Authority. BG Yeo did not in any way "condemn" the internet. On the contrary, if my memory serves me correctly, he said S'pore was going full steam ahead with providing people with access eg. through schools, and that there were already an estimated 100,000 internet users in S'pore. For full text of the news release, see: http://www.antcrc.utas.edu.au/~kwe_chia/sef/SBA.html > Indonesia attacks Net (3/11/96) > Malaysia complains about uncensored Net, censors it (3/11/96) Again, this is not entirely accurate. If I recall correctly, Malaysian Information Minister said some censorship was necessary and agreed with S'pore that ASEAN should work tog to come up with some standards. A day or two later, M'sian Prime Minister Mahathir said something to the effect that censorship was not possible and that education was the key. No active measures by M'sia as far as I'm aware of. Perhaps TM Tan can enlighten us. :) > Singapore censors political, religious net.info (3/6/96) This was in relation to the news conference on 5 Mar 96 mentioned above on the *planned* regulatory framework. Details and legislation have yet to be tabled in Parliament so none of the proposals mentioned in the release have been carried out as yet although S'pore IASPs have, for several months now, been blocking off access to some 40-50 "objectionable sites" (read: pornographic) from a list given to them by the authorities. Framework details are expected within the next 2 months. Meanwhile a S'pore netter has submitted on 30/3/96 a petition supported by 40 signatories to the authorities against inter alia, regulation of political, religious, racial expression of ideas, and suggesting that govt ministries set up PR depts to counter such ideas if need be. > China > > China cracks down on Internet, "state security" cited (1/24/96) > China's anti-cyberporn efforts (2/4/96) > New York Times on China's net.crackdown (2/5/96) > China's history of Net-regulation, cyberporn concerns (1/1/96) > China requires Internet users to register with police (2/16/96) > U.S. State Dept criticizes China's net.censorship (3/8/96) > China applauds German net.censorship (1/11/96) > > Australia > > Australia considers net.legislation (2/13/96) > New South Wales tries net-censorship (4/3/96) > Australians upset by German Zundelcensorship (4/7/96) > > Canada > > Letter to Canadian minister (3/19/96) > Canada needs to regulate Net, says Simon Wiesenthal Ctr (2/20/96) > > Middle East > > Persian Gulf States reluctant to move online (4/6/96) > Jordan installs Internet screening facility (1/8/96) > Saudi Arabian government says no unrestricted Net access (1/10/96) >-------------------------------------------------------------------------- =========END FORWARDED MESSAGE========= *---------------------------* Lau Joon-Nie joonlau(a)pacific.net.sg "Even God has a Geiger-complex" - Dr Aaron Shut, Chicago Hope - *---------------------------*

1 0

Re: Enforcing the CDA improperly may pervert Internet architecture
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:44 PM 4/9/96 -0500, Mike McNally wrote: >Scott Brickner wrote: >> Given your position, io.com is only accessible to adults in the world >> of the CDA advocates. Just upgrade your IP software to refuse >> connections from minors. > >It's not "my" IP software. I pay io for an account. What you're saying >is that every ISP would have to decide whether to be completely G-rated >or else open to anybody. Then they go on about how every school in the country needs to be connected to the net... I am wondering where they got the idea that the net is someplece they want their children to be. They don't let them play in distant parks inhabited by scary old men and drunks, yet they want them to play on the "information Superhighway". The CDA types seem to view the net the same way that they view TV in the classrooms. They expect it to be as easy to control as well. Get them all staring at the box and they will quiet down and do as they are told. What these people do not seem to understand is what is going to happen when their kids are exposed to the diverse opinions present on the net. Forget the porno... What are the parents who believe in Creationism going to do when little Johnny runs into a good skeptical site debunking all that crap? What are they going to do when the little liberal kids are exposed to the works of conservitives? Or Biblical Inerentists kidlets are exposed to the debunkings of that faith? Or Dorthy Denning's kids (if she has any) get exposed to the writings of the subversive known as Tim May? The CDA proponents want the ideas presented to their kids be controled ones. The existance of freedom on the net is a threat to that control. Porno is used as the (net)scapegoat, but there are far more threatening ideas out there to that kind of mindset. They just know that if they tell you their true goals, then people will not go along with them. If you want to know their real fears, read the stuff they write for the "faithful". It is far more revealing. ("Remember: It is not a conspiracy if you can subscribe to their newsletter.") >Sigh. That's probably what the CDA crowd wants. It's hard not to become >consumed by hatred. When reading Lovecraft, i always wondered what could be written down that would drive men mad. Lovecraft always described it as some cosmic horror. The cosmic is too far removed for most people to understand. I have always thought that instead, it described how the world worked and the driving motivations behind it, with the firm understanding that there was not a damn thing you could do to stop it. The understanding that the world is driven by the forces of ignorance and stupidity is enough to drive you to the brink. The Necronomicon was not written by the Mad Arab, it was written by Scott Adams. --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: So, what crypto legislation (if any) is necessary?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Black Unicorn wrote: > >I didn't respond to this part originally because I grew tired of typing > >"Yadda yadda yadda" everytime Mr. Bell lapsed into another > >psycho-political babble session. To which Jim Bell wrote: > And the rest of us are tired of seeing those non-responses! Exactly for whom is Bell speaking? Jimbo, please let us know who has given you a limited powers of attorney to be their mouthpiece. It's sad when someone (correctly) deems their opinions too weak to stand without (dare I say it?) pseudo- spoofing by reference. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

onyma
by nobody＠replay.com 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: >Not meant to be snide, even if sounded that way. I just get confused by >your various nyms The term `nym' is erroneus: The Greek words are an-onym, pseud-onym, syn-onym, hom-onym pp, derived from `onyma', name.

2 1

Scientologists may subpoena anonymous remailer records
by John Gilmore 17 Dec '03

17 Dec '03

I thought that most or all of the cypherpunk anonymous remailers don't keep records. Not even on backup tapes. The whole idea is that there aren't logs. But maybe they have found some remailers that are non-cypherpunk. And I haven't verified the truth of what's in the msg below. If anyone hears anything, please let me (or eff(a)eff.org) know. John Gilmore Date: Tue, 9 Apr 1996 18:27:02 -0700 To: fight-censorship+(a)andrew.cmu.edu, eric(a)remailer.net, farber(a)cis.upenn.edu (Dave Farber) From: jwarren(a)well.com (Jim Warren) Subject: (fwd fyi - NOT verified!!) very urgent news Seems like it's just a tad overbroad, if true. Another example of, "all the 'justice' that one can buy"? --jim >Date: Tue, 9 Apr 1996 15:44:52 -0700 (PDT) >From: shelley thomson <sthomson(a)netcom.com> >Subject: very urgent news >To: jwarren(a)well.com > >Hello, Jim Warren: > > The church of scientology plans to subpoena the records of every >anonymous remailer in the USA. > > I publish a news/black humor magazine on the net called **Biased >Journalism**. As a journalist I have covered the collision between the >church of scientology and the net. My last three issues have focused on >legal action by the church against Grady Ward and Keith Henson. > > Today I had a note from Grady Ward, whose deposition was finished >today. He said that they asked him a lot of questions about me, and >warned me that they may issue a subpoena for me and a demand for my >email. > > The church presumably intends to claim that I am not a real >journalist because I only publish on the net. I need to prepare a legal >defense, and needless to say, can't afford a lawyer. If you can direct >me to any resources, I would appreciate it very much. > > On the basis of events today, Ward believes the church will >issue subpoenas for the records of every anonymous remailer in the USA. > > If these records are delivered to the church, our First Amendment >rights go with them. > > Shelley Thomson > > publisher, **Biased Journalism** > 800-731-0717 voice message

5 4

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 07:08 PM 4/9/96 -0700, Bill Frantz wrote: >At 3:21 PM 4/9/96 -0800, jim bell wrote: >>And the rest of us are tired of seeing those non-responses! > >I wish to state that Jim Bell does not speak for me. Tell me, what is the most exciting, interesting, and imaginative usage of "Yadda Yadda Yadda" that _you_ remember, Bill?

1 0

Re: [NOISE] Federal Bureau of Indigestion
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 09, 1996 14:24:47, 'jim bell <jimbell(a)pacifier.com>' wrote: >At 09:15 AM 4/9/96 -0700, Dave Del Torto wrote: >>[forwards mercifully elided] >> >>FBI agents conducted a raid of a psychiatric hospital in San Diego that was >>under investigation for medical insurance fraud. After hours of reviewing >>thousands of medical records, the dozens of agents had worked up quite an >>appetite. The agent in charge of the investigation called a nearby pizza >>parlor with delivery service to order a quick dinner for his colleagues. > >Funny stuff deleted. > >>PM: And everyone at the psychiatric hospital is an FBI agent? >>Agent: That's right. We've been here all day and we're starving. >>PM: How are you going to pay for all of this? >>Agent: I have my checkbook right here. >>PM: And you're _all_ FBI agents? >>Agent: That's right. Everyone here is an FBI agent. Can you remember >> to bring the pizzas and sodas to the service entrance in the rear? >> We have the front doors locked. >>Pizza Guy: I don't _think_ so... >click< > >I'm waiting for Unicorn to claim that the next phone call to the pizza shop >was from a judge, who was placing a subpoena on the next 19 pizzas that shop >produced, and ordered them delivered to the hospital for psychiatric >evaluation. B^) > >Jim Bell >jimbell(a)pacifier.com > > Never trust or wait for lawyers, Jim. Go directly to the psychiatric hospital. Go to the back door. Tell them you're only there to do research. --tallpaul

1 0

No Subject
by anonymous＠nowhere 17 Dec '03

17 Dec '03

Borrowing inspiration from May, a page from Scheier and some code from Gutman... Hard disk space being cheap now, Bob creates several distinct disk partitions and uses Peter Gutman's Secure File System, or equivalent, to encrypt all of them. First, Bob fills all of them with innocous data. Next, Bob writes one or more partition with secrets. Bob arranges that no one knows the pass phrases for some of the innocous partitions by luring the cat across the keyboard or having his six year old punch something in while he is out of the room. Bob carefully and publically documents the fact that he did this without indicating which partitions and how many partitions are actually useful. In addition to regularly using the secret partitions, Bob periodically updates the innocous partitions, who's pass phrases he does know, with more uninteresting but contemporary data. When ordered to do so, Bob could reveal the pass phrases to the innocuous data and to as much of the secret data as he felt necessary. Bob could not be forced to reveal all of the pass phrases as he does not know all of them. Naturally, the disk encryption routines would not store pass phrases but only a validating hash, that even Bob could not reproduce for all of the partitions. Practically, Bob cannot be forced to reveal the pass phrases to any alleged remaining secret data, since this might not exist. To further encourage this belief Bob might associate innocous data with a first pass phrase, mildly embarrasing data with a second, and so on, and then, after revealing the first, gradually allow himself to be be coaxed into revealing the second and disclose a third only after the rubber hoses came out. Since all of the partitions have similar content, no statistic should reveal which is which. Bob might have a bit refresher routine periodically nibble read and rewrite the whole disk so that no electronic characteristic exists that reveals record age. No doubt, a judge might whimsically keep Bob in jail for a while, trying to assure that he has revealed all of the pass phrases, but the judge can never be certain, even when Bob has disclosed everything. This situation creates doubt that Bob is in contempt, even when he is, and makes a prison term relatively pointless, unless for revenge.

1 0

CoS supoenas records of all anonymous remailers? (Unverified)
by Declan B. McCullagh 17 Dec '03

17 Dec '03

[FWIW, Biased Journalism is a reasonably reputable source. --Declan] ---------- Forwarded message begins here ---------- Date: Tue, 9 Apr 1996 18:27:02 -0700 To: fight-censorship+(a)andrew.cmu.edu, eric(a)remailer.net, farber(a)cis.upenn.edu (Dave Farber) From: jwarren(a)well.com (Jim Warren) Subject: (fwd fyi - NOT verified!!) very urgent news Seems like it's just a tad overbroad, if true. Another example of, "all the 'justice' that one can buy"? --jim >Date: Tue, 9 Apr 1996 15:44:52 -0700 (PDT) >From: shelley thomson <sthomson(a)netcom.com> >Subject: very urgent news >To: jwarren(a)well.com > >Hello, Jim Warren: > > The church of scientology plans to subpoena the records of every >anonymous remailer in the USA. > > I publish a news/black humor magazine on the net called **Biased >Journalism**. As a journalist I have covered the collision between the >church of scientology and the net. My last three issues have focused on >legal action by the church against Grady Ward and Keith Henson. > > Today I had a note from Grady Ward, whose deposition was finished >today. He said that they asked him a lot of questions about me, and >warned me that they may issue a subpoena for me and a demand for my >email. > > The church presumably intends to claim that I am not a real >journalist because I only publish on the net. I need to prepare a legal >defense, and needless to say, can't afford a lawyer. If you can direct >me to any resources, I would appreciate it very much. > > On the basis of events today, Ward believes the church will >issue subpoenas for the records of every anonymous remailer in the USA. > > If these records are delivered to the church, our First Amendment >rights go with them. > > Shelley Thomson > > publisher, **Biased Journalism** > 800-731-0717 voice message >

2 1

No matter where you go, there they are.
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Location-based System Delivers User Authentication Breakthrough By Dorothy E. Denning and Peter F. MacDoran Copyright(c), 1996 - Computer Security Institute - All Rights Reserved Top - Help Existing user authentication mechanisms are based on information the user knows (e.g., password or PIN), possession of a device (e.g, access token or crypto- card), or information derived from a personal characteristic (biometrics). None of these methods are foolproof. Passwords and PINs are often vulnerable to guessing, interception or brute force search. Devices can be stolen. Biometrics can be vulnerable to interception and replay. A new approach to authentication utilizes space geodetic methods to form a time- dependent location signature that is virtually impossible to forge. The signature is used to determine the location (latitude, longitude and height) of a user attempting to access a system, and to reject access if the site is not approved for that user. With location-based controls, a hacker in Russia would be unableto log into a funds transfer system in the United States while pretending to come from a bank in Argentina. Location-based authentication can be used to control access to sensitive systems, transactions or information. It would be a strong deterrent to many potential intruders, who now hide behind the anonymity afforded by their remote locations and fraudulent use of conventional authentication methods. If the fraudulent actors were required to reveal their location in order to gain access, their anonymity would be significantly eroded and their chances of getting caught would increase. Authentication through geodetic location has other benefits. It can be continuous, thereby protecting against channel hijacking. It can be transparent to the user. Unlike most other types of authentication information, a user's location can serve as a common authenticator for all systems the user accesses. These features make location-based authentication a good technique to use in conjunction with single log-on. Another benefit is there is no secret information to protect either at the host or user end. If a user's authentication device is stolen, use of the device will not compromise the system but only reveal the thief's location. A further benefit of geodetic-derived location signatures is that they provide a mechanism for implementing an electronic notary function. The notary could attach a location signature to a document as proof that the document existed at a particular location and instant in time. The use of geographic location can supplement or complement other methods of authentication, which are still useful when users at the same site have separate accounts and privileges. Its added value is a high level of assurance against intrusion from any unapproved location regardless of whether the other methods have been compromised. In critical environments, for example, military command and control, telephone switching, air traffic control, and banking, this extra assurance could be extremely important in order to avoid a potential catastrophe with reverberations far beyond the individual system cracked. How it works International Series Research (Boulder, CO) has developed a technology for achieving location-based authentication. Called CyberLocator, the technology makes use of the microwave signals transmitted by the twenty-four satellite constellation of the Global Positioning System (GPS). Because the signals are everywhere unique and constantly changing with the orbital motion of the satellites, they can be used to create a location signature that is unique to a particular place and time. The signature, which is computed by a special GPS sensor connected to a small antenna, is formed from bandwidth compressed raw observations of all the GPS satellites in view. As currently implemented, the location signature changes every five milliseconds. However, there are options to create a new signature every few microseconds. When attempting to gain access to a host server, the remote client is challenged to supply its current location signature. The signature is then configured into packets and transferred to the host. The host, which is also equipped with a GPS sensor, processes the client signature and its own simultaneously acquired satellite signals to verify the client's location to within an acceptable threshold (a few meters to centimeters, if required). For two-way authentication, the reverse process would be performed. In the current implementation, location signatures are 20,000 bytes. For continuous authentication, an additional 20 bytes per second are transferred. Re- authorization can be performed every few seconds or longer. The location signature is virtually impossible to forge at the required accuracy. This is because the GPS observations at any given time are essentially unpredictable to high precision due to subtle satellite orbit perturbations, which are unknowable in real-time, and intentional signal instabilities (dithering) imposed by the U.S. Department of Defense selective availability (SA) security policy. Further, because a signature is invalid after five milliseconds, the attacker cannot spoof the location by replaying an intercepted signature, particularly when it is bound to the message (e.g., through a checksum or digital signature). Continuous authentication provides further protection against such attacks. Conventional (code correlating and differential) GPS receivers are not suitable for location authentication because they compute latitude, longitude and height directly from the GPS signals. Thus, anyone can report an arbitrary set of coordinates and there is no way of knowing if the coordinates were actually calculated by a GPS receiver at that location. A hacker could intercept the coordinates transmitted by a legitimate user and then replay those coordinates in order to gain entry. Typical code correlating receivers, available to civilian users, are also limited to 100 meter accuracy. The CyberLocator sensors achieve meter (or better) accuracy by employing differential GPS techniques at the host, which has access to its own GPS signals as well as those of the client. DGPS methods attenuate the satellite orbit errors and cancel SA dithering effects. Where it works Location-based authentication is ideal for protecting fixed sites. If a company operates separate facilities, it could be used to restrict access or sensitive transactions to clients located at those sites. For example, a small (7 cm x 7 cm) GPS antenna might be placed on the rooftop of each facility and connected by cable to a location signature sensor within the building. The sensor, which would be connected to the site's local area network, would authenticate the location of all users attempting to enter the protected network. Whenever a user ventured outside the network, the sensor would supply the site's location signature. Alternatively, rather than using a single sensor, each user could be given a separate device, programmed to provide a unique signature for that user. Location-based authentication could facilitate telecommuting by countering the vulnerabilities associated with remote access over dial-in lines and Internet connections. All that would be needed is a reasonably unobstructed view of the sky at the employee's home or remote office. Related application environments include home banking, remote medical diagnosis and remote process control. Although it is desirable for an antenna to be positioned with full view of the sky, this is not always necessary. If the location and environment are known in advance, then the antenna can be placed on a window with only a limited view of the sky. The environment would be taken into account when the signals are processed at the host. For remote authentication to succeed, the client and host must be within 2,000 to 3,000 kilometers of each other so that their GPS sensors pick up signals from some of the same satellites. By utilizing a few regionally deployed location signature sensors (LSS), this reach can be extended to a global basis. For example, suppose that a bank in Munich needs to conduct a transaction with a bank in New York and that a London-based LSS provides a bridge into Europe. Upon receiving the location signatures from London and Munich, the New York bank can verify the location of the Munich bank relative to the London LSS and the London LSS relative to its own location in New York. The technology is also applicable to mobile computing. In many situations, it would be possible to know the general vicinity where an employee is expected to be present and to use that information as a basis for authentication. Even if the location cannot be known in advance, the mere fact that remote users make their locations available will substantially enhance their authenticity. In his new book, The Road Ahead, Bill Gates predicts that wallet PCs, networked to the information highway, will have built-in GPS receivers as navigational assistants. With the CyberLocator technology, these PC receivers can also perform authentication while being a factor of ten less expensive than conventional code correlating receivers (most of the processing is executed in the host rather than the remote units), which only achieve 100 meter accuracy, and a factor of a hundred less expensive than conventional DGPS receivers. Location-based authentication is a powerful new tool that can provide a new dimension of network security never before possible. The CyberLocator technology is currently operational in a portable demonstration. Dorothy E. Denning is professor of computer science at Georgetown University (Washington, D.C.) and consultant to ISR. She can be reached at 202-687-5703 or denning(a)cs.georgetown.edu. Peter F. MacDoran is president and CEO of International Series Research, Inc. (Boulder, CO). He can be reached at 303-447- 0300 or pmacdorn(a)isrinc.com. $0$AD

3 2

RISKS: Compuserve "secure" login
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Thu, 04 Apr 1996 19:34:12 +0200 From: Heinz-Bernd Eggenstein <eggenste(a)noether.informatik.uni-dortmund.de> Subject: CompuServe's "secure login protocol": two steps forward, one back Summary: a new CompuServe Information Service (CIS) logon protocol was designed to prevent passive and active attacks (where the attacker impersonates a CompuServe node) but a flawed implementation in the WinCIM 2.0(.1) client software still allows active attacks. Version 2.0 of the "WinCIM" access software introduced a new logon protocol. Previous versions of the software had transmitted the user's UID AND his/her password in plaintext during logon. The risks are obvious, especially when connecting via the Internet to CompuServe (e.g. to save long distance telephone charges). The new, "secure logon protocol" is a challenge-response type protocol where the "challenge" is to compute a keyed hash-function, the key is derived from the shared secret, the user's password: 1) The client (WinCIM) generates a pseudorandom string of bits, its "nonce" (RB) 2) The client transmits the user's UID (e.g. 12345,6789) and the additional parameter "/secure:1" to request a secure login. 3) The host transmits its pseudo random nonce (RA) (The old protocol would instead prompt for the password) 4) client sends RB to the host 5) client computes UR:=MD5(S|Z|RA|RB|S) and sends it to the host (where S (128 bits) is a function of the password, "|" stands for concatenation, Z is a 128bits block of 0s and MD5 is the well known message digest function.) 6) The host performs the same calculation with it's copy of the user's password. If the results match, the host sends HR:=MD5(S|Z|RB|RA|S) (Note the symmetry in the calculation of HR and UR) 7) The client software verifies HR with it's copy of the password to make sure the host is really a CIS node (!) (See the script-files cserve.scr and seclog.scr in the subdirectory SCRIPTS of a WINCIM 2.0(.1) installation, WinCim is available via anon. ftp at ftp.compuserve.com) Weaknesses: a) The scriptfile cserve.scr (versions 3.8 & 3.8.1) has the following bug: even after requesting a secure logon, the client software will fall back into the old protocol when receiving a "Password" prompt (Client: "I want a secure logon" Host:"OK, but anyway, give me your password" Client "Well ok then, here it is ..."). It will send the password in plaintext! This makes the protection against active attacks (see step 7) obsolete. b) A timeout condition or even an invalid HR response form the host will (seclog.scr & cserve.scr version 3.8.1) restart the protocol (it won't disconnect!), using *the same* client-nonce RB again, instead of generating a new one. If a spoofing host can predict RB as in this situation, it can pick the same nonce, leading to HR=UR=MD5(S|Z|RB|RB|S), so the host can just send back UR as HR. Note that unlike a), b) does not compromise the user's password. There may be other ways to predict the client software's nonce e.g. *if* the PRNG used by WinCIM is predictable (this calls for further investigation). Note that *offline* dictionary attacks to guess the password are possible after a passive, eavesdropping attack (so you still have to pick a "good" password). It's debatable whether CIS's password recommendation (<word><non-alphanum. char.><word>, both words unrelated, e.g. apple@battery) is adequate in this context). I notified CIS about these weaknesses and I was informed that they are "fixed" now, no details were given about the fix (source: Britta Herbst, German customer support (11111.754(a)compuserve.com)) Risks? The new protocol is obviously an improvement over the old, plaintext-password-only version. It's debatable whether protection against active attacks is at all necessary for access to an online service. However, CIS itself designed it's protocol to prevent spoofing attacks. Anyway, I think this a good example how to half-ruin a good protocol by embedding it into carelessly written code. Credits: Thanks to Gary Brown (70003.1215(a)compuserve.com) for sending me information on the implementation of the new protocol). Heinz-Bernd Eggenstein [usual disclaimers] ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: why compression doesn't perfectly even out entropy
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-08 21:04:26 EDT, Perry Metzger writes: >Jon asked why it is that I contend that a compression algorithm won't >in the general case even out the entropy of a semi-random stream. I am not talking about any "general case," I proposed compressing spinner data, which has sequences of repeating numbers interspersed with occasional quasi-random fluctuations. I am not saying that compression is a "magic wand" that will fix data streams with a lot of "fake" entropy, such as the RND() function available in many BASIC's, which I think most of us will agree blows chunks. >The answer can be obtained by simply trying to run gzip over an image, >preferably one that hasn't been compressed. The results are, in >general, very bad, even though images are highly compressable (even >losslessly). I leave the why up as an exercise to the reader. I have ZIPed the aforementioned spinner data with the built-in ZIP routines in the PC Tools for Windows file manager. Except for some very slight banding (which appears to be caused by the ZIP headers) the noise sphere plots look pretty good. All files are available upon request for independent verification. >I have said before and I will say again that the only reliable way of >dealing with a stream that has some amount of randomness mixed in with >it that you wish to distil down into pure random bits is to use solid >reasoning to figure out how many bits of entropy per unit of input you >can actually expect to see, add a large fudge factor to cover your >ass, and then distil down using a cryptographic hash. I have no disagreements with this. I merely proposed using the compression function as a means of roughly estimating entropy and preventing the seeding of the hash/PRNG with potentially "weak key" type data. >Anything else >makes me highly nervous. If you can't estimate the amount of entropy >in an input stream from first principles, then you are probably in >trouble and should seek an input stream that you have a better handle >on. Would anyone like to propose a means of measuring entropy that we can all agree on? I haven't seen anything yet that everyone likes. Jonathan Wienke

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. I notice you gave no examples. Why is that? Jim Bell jimbell(a)pacifier.com

4 3

Re: WWW User authentication
by David E. Smith 17 Dec '03

17 Dec '03

> I just finished writing a cgi script to allow users to change their login > passwords via a webpage. I currently have the webpage being authenticated > with the basic option (uuencoded plaintext). MD5 would be nicer, but how > many browsers actually support it? A straight MD5 probably isn't supported by any of them, but then again MD5 is not necessarily going to help too much. The sort of people that need a web page to change their password aren't likely to use overly complex passwords (mixed-case, scrambled-in numbers, et al.) So if a snoop can get the MD5, her chances of getting a password aren't all that bad. > When the user changes their password, the form sends their name, old > password, and new password with it, in the clear. This is no worse than > changing your password across a telnet connection, but I'd like it to be > more secure, but useable by a large number of browsers. Your best bet is to try to implement it via SSL, but as I understand it that limits you on your server options quite a bit. Netscape and Apache have it, as I understand; I think that's about it actually. But that's far from my areas of expertise. dave

2 1

Re: Bulletin: Cypherpunks say no taxes owed by moneychanger
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

I know Frankin and will see him next week. His argument, which I have around here somewhere if I could get my paper life organized, realtes to gold and silver in certain situations. If I find it I will reference it, otherwise I'll ask if he will post to this group. FOT > Date: Tue, 9 Apr 1996 21:48:17 -0400 (EDT) > From: Alan Horowitz <alanh(a)mailhost.infi.net> > To: "Frank O. Trotter, III" <fotiii(a)crl.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Bulletin: Cypherpunks say no taxes owed by moneychangers! > > Date: Mon, 8 Apr 1996 22:43:55 -5 > > From: Frank O. Trotter, III <fotiii(a)crl.com> > > Aside from ecash, helping people to exchange currency is my day job > > so I see this all the time, especially this month each year. > > There is a guy in Tennessee who publishes a newsletter called _The > Moneychanger_. He is one of those Constitutionalists. He did put himself > through hell to get acquited of an IRS charge - he is a dealer in gold > and silver and claimed that he wasn't selling anything, only changing > denominations of Money, with no profits. He won the federal case; the IRS > called their buds at the Tenn Dept of Revenue and had him indicted on a > failure-to-remit-sales-tax charge. He was convicted on that by the Jury > but he is appealing; meanwhile he only deals with out-of-Tenn people. > > Which just goes to show that convictions/acquitals under a jury system > have a lot of random-walk flavor. Further reference at the OJ Simpson > newsgroups. > > Frank O. Trotter, III - fotiii(a)crl.com www.marktwain.com - Fax: +1 314 569-4906 --------------------------------------------

1 0

DC-area cypherpunks physical meeting with Saturday
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

As advertised, the next DCCP meeting will be this weekend, April 13, at 3:00 at Digex. see http://www.isse.gmu.edu/~pfarrell/dccp/ for a tiny bit more info. As usual, topics and speakers welcome. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Re: Enforcing the CDA improperly may pervert Internet architecture
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:09 AM 4/9/96 -0500, Mike McNally wrote: >I sent a letter to the Economist last year pointing this out after reading >an article containing the offhand statement, "... and of course it is >entirely feasible to control Internet content" (or something like that). >I don't have those magic two letters at the front of my name though. It >seems so utterly obvious. When you connect to an ISP via PPP or SLIP, >all the ISP is doing is routing packets. Or as I said in my letter to the Economist on their article "Censoring Cyberspace:" ******************* You suggest that Internet Service Providers might be required to employ "stop lists" supplied by their national censors to block objectionable material. The current focus is on banning smut. But no doubt many nations will want to ban various political and religious views as well. Surely, you know that anyone with a direct (TCP/IP) connection to the Internet (all Windows95 owners, for example) is not dependent on service providers for anything beyond a physical connection. Everyone who has such a local dial-in account is able to link to any site in the world at no additional cost. No long distance phone calls are necessary. ********************* A lot of people who know nothing of the nets think that they can be controlled "like magzines and newspapers" in the words of a Bell Atlantic exec. Like the Bavarian prosector, they will learn. DCF

1 0

Re: So, what crypto legislation (if any) is necessary?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:21 PM 4/9/96 -0800, jim bell wrote: >And the rest of us are tired of seeing those non-responses! I wish to state that Jim Bell does not speak for me. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Watch your language, Shabbir.
by jim bell 17 Dec '03

17 Dec '03

When the Leahy bill was proposed, BTW was one of the organizations that came out in favor of it. Despite later substantial criticism and direct contacts, Mr. Safdar never defended his original position on this bill against these objections. I just saw something which may explain a bit about VTW's positions: VTW BillWatch #41 VTW BillWatch: A weekly newsletter tracking US Federal legislation affecting civil liberties. BillWatch is published at the end of every week as long as Congress is in session. (Congress is in session) BillWatch is produced and published by the Voters Telecommunications Watch (vtw(a)vtw.org) (We're not the EFF :-) Issue #41, Date: Wed Apr 3 12:41:46 EST 1996 Do not remove this banner. See distribution instructions at the end. ___________________________________________________________________________ TABLE OF CONTENTS Introduction from the Editor (Steven Cherry) A tragic story about a wiretap (Shabbir J. Safdar) [stuff deleted] A TRAGIC STORY ABOUT A WIRETAP by Shabbir J. Safdar, VTW Board (New York, NY) This week most of VTW's staff attended the Computers, Freedom, and Privacy conference in Cambridge Massachusetts. I go to the conference every year to recharge my batteries, put names to faces, and enjoy the synergy that can only come with face-to-face dialogue. [stuff deleted] One, while wiretaps have probably been effective in other cases, they were not effective in this one. While we can grant law enforcement the benefit of the doubt in other cases, the existence of this one shows that a wiretap is not the "silver bullet" of law enforcement that we have been led to believe. Another observation that can be made is that this parallels the key escrow debate very closely. No reasonable person is objecting to the FBI's right to conduct a wiretap. However what is being debated is the extent to which individuals and law enforcement can go to accomplish their duties. The Clinton Administration is striving for a world where everyone is forced to speak in a form of encryption that is easily decoded by law enforcement. The public and industry is striving for a world where they continue to have private conversations. [end of quote] Look, very carefully, at the last paragraph quoted above. Mr. Safdar says, "No reasonable person is objecting to the FBI's right to conduct a wiretap." Huh? "FBI's right"???? Maybe this is a bit too basic for comprehension, but governments have no "rights" by any definition I've ever heard. "Rights" are the possessions of individuals, and occasionally individuals authorize governments to do things. But that does not mean that those governments possess a "right," especially not one on such a flimsy and transitory principles as wiretaps. Government certainly does not possess a "right" that supercedes the wishes of the public, or the Constitution. Safdar's note appears to pre-date my commentary where I pointed out that before 1968, wiretaps in America were illegal, but were done anyway simply because the cops wanted to. That doesn't sound like a "right," now, does it? If it were a "right" then it couldn't be given by law, or taken away by law. But nobody I've ever met claims that the cops aren't at least legally obligated to follow the law, whether or not they actually do. I don't like sloppy rhetoric. Even worse, claiming that "no reasonable person" would object to a non-existent "right" is truly outrageous. I know _plenty_ of people who would claim that the government, and by extension the FBI, possesses no "right" to do wiretaps (this position would be echoed by essentially every libertarian). I know many people who think that the government shouldn't be able to do wiretaps at all. VTW's header above claims "We're not the EFF," but it's hard to tell this from Mr. Safdar's propaganda. Now I understand why he didn't defend his position on the Leahy bill against criticism. VTW is sounding more and more like "EFF" all the time. Jim Bell jimbell(a)pacifier.com

3 3

CDA Court Challenge: Update #5
by Declan B. McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- The CDA Challenge, Update #5 ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- In this update: Yet Another CDA Lawsuit: Fred Cherry v. Janet Reno Deception and deceit from DoJ's Jason Baron URLs for the DoJ's dirty picture list The true identity of Grey Flannel Suit April 9, 1996 PITTSBURGH, PA -- Fred Cherry wants a Federal court to uphold his right to flame. Lambasting "homonazis" on USENET is his inalienable right under the First Amendment, argues the notorious netizen in his anti-CDA lawsuit filed yesterday in New York City on behalf of "Johns and Call Girls United Against Repression, Inc." Cherry's beef with the law is that under its ban on "indecency," when he gets flamed by "Australian homosexual nazis" he won't be able to flame back. His complaint charges that his "Australian opponent will have MORE freedom of speech" than he does -- unless the CDA is struck down. The self-taught amateur lawyer attached 20 pages of net.flamage as his sole exhibit. One example that was spammed all the way from soc.men to alt.christnet.second-coming.real-soon-now: "Your ass is so blocked up that you do need some therapeutic relief for your constipation -- a condition which has backlogged all the shit right back up into your head, Fred." The indefatigable Cherry replied: So, ramming a huge dick up my ass would be a therapeutic measure, would it? You homos are the chief cause of AIDS in the United States with your huge dicks being rammed up each other's asses. And then you homos go around whining that the government isn't doing enough to find a cure for AIDS. [12/22/95] Ya gotta love this guy. He sent me mail describing his legal strategy, concluding: "Can anyone deny that I am indeed the greatest amateur lawyer since Caryl Chessman?" Of course Chessman -- California's "Red Light Bandit" rapist -- was executed in 1960, his jailhouse lawyering failing him in the end. Cherry's lawsuit was easy to prepare. He grabbed the ACLU's complaint from their web site, printed it out, added a few grafs about his net.nazi adversaries, and trotted off to Federal court. When Cherry filed his suit, which he's moved from Brooklyn to Federal court in Manhattan, he wrote: I am primarily a political activist, working for the repeal of laws criminalizing adult prostitution and the patronizing of adult prostitutes. Over the past thirty years I have found that, in the United States, homosexuals are the worst enemies of the civil rights of women prostitutes and their male clients. The Cherry v. Reno case, refiled at docket number 96 Civ. 2498, most likely will be consolidated with the American Reporter case, which is also moving forward in the U.S. Second Circuit Court of Appeals. A.R. editor Joe Shea will probably fight it. Shea refused to join our lawsuit because he can't stand the ACLU and wants to do his own thing, so he'll probably try to keep Cherry's case from being joined with his. In fact, he accused the ACLU of putting Cherry up to it. +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ I would never have suspected the DoJ attorneys of trying to deceive Federal judges, but now I wonder. The DoJer I've had the most contact with is Jason Baron, a short, portly guy who tries to land roundhouse punches during cross-examination but instead keeps slipping up on technical terms. He also wrote the Justice Department's reply to our initial complaint. In that brief, the Civil Division lawyer uncritically cited Marty Rimm's cyberporn study -- featured last summer on the cover of TIME magazine -- as an authoritative reference on net.smut: This article describes material located primarily on USENET newsgroups, i. at 1865-76, and on adult commercial bulletin boards (BBS), i. at 1876-1905. Defendants offer this as an initial reference of the availability and nature of obscene and indecent material from some on-line sources, such as USENET and BBS. [sic] Maybe Baron thought nobody would notice. But there's no excuse for not knowing that the study was deliberately fraudulent: The New York Times printed an editorial exposing it; Rimm's connections with "family values" groups have come to light; Donna Hoffman and I run extensive web sites debunking the study; Carnegie Mellon University claims to be investigating the ethical misdeeds of their former undergraduate. Even attorneys who used to work within Baron's division of the Justice Department complain that Baron deliberately foisted this fraud off on Federal judges: I'm embarrassed... They should have mentioned that the "study" came under heavy critical fire almost immediately upon release. I trust the opposition will make hay of this omission. In this context, this "study" is not just another controversial report, but one whose provenance is well known to be in doubt among the relevant actors. That much should have been ackowledged in the quoted footnote, at least along the lines of, "While the methodology of this study has been challenged, defendants believe it to represent..." etc. [4/7/96] By citing this study and appending its complete text without informing the court that it was a hoax, Baron revealed the impoverished ethics of the Justice Department. Interestingly, the Code of Professional Responsibility and the Rules of Professional Conduct make it a disciplinable offense for a lawyer to "knowingly use perjured testimony or false evidence." Under Title 11, attorneys can be sanctioned for introducing false evidence. Perhaps we shouldn't be too surprised by all this. After all, Baron is the same attorney who confuses EFF with IETF -- not to mention his additional duties as the DoJ's courtroom-cop. Recall that when I was asking the mysterious Grey Flannel Suit a question, Baron came over and interrupted us. Now I've learned that he's threatening to report me to "higher authorities" if I talk to his witnesses again. (!) Yeah, Grey Flannel Suit is going to take the stand. He's none other than the DoJ's cybersexpert witness -- Special Agent Howard A. Schmidt from the Air Force Office of Special Investigations. Guess that explains why Baron was so desperate to keep me from talking with him the other day. Baron's authoritarian streak showed again during the March 21 hearing, when I joined some members of the press in paging through the ACLU's copy of the DoJ's dirty pictures binder. Baron charged over and snatched it away, snarling: "Not available to the public." Well, the URLs ended up in my mailbox anyway, so here they are for your amusement: http://www.pu55y.com/hotsex/join.html http://shack.bianca.com/shack/misc/terms.html http://www.intergate.net/untmi/obbs1.html http://www.whitman.edu/~burkotwt/pornpics/lady941.jpg http://www.wizard.com/~gl944vx/gifs/01_21.jpg http://www.vegaslive.com/sgguests/ginger.html news:4hrs89k%24oap@what.why.net http://monkey.hooked.net/monkey/m/grinder/nikkita/graphics/nikki36.jpg news:313F56FD.3F19@access.mountain.net news:4hb94m%24sij@asp.erinet.com http://www.sexvision.com/web2.htm news:314048f.1657746@news.netwalk.com The DoJ has full-color printouts of these images, which are sexually explicit but *not* obscene -- Baron wanted to remind the court that placing these JPEGs online publicly would not be a criminal act without the CDA. For someone who's defending a ban on smutty stuff on the Net, Baron is surprisingly embarrassed to talk about it. Vanderbilt Professor Donna Hoffman reports: [Baron] deposed me for over 7 hours, beginning on a Monday morning at 9am. The most interesting part of the deposition was when he brought out several large binders and started going through some of the material in them and looking increasingly uncomfortable. Eventually, he spoke and started to apologize saying he might have to show me some materials and his New England background made him feel uncomfortable about it. He honestly was squirming and sweating a bit and then, after a brief lunch, we resumed and he did eventually show me some materials, but they were not surprising or of the type that I would have thought would make him squirm like that. I did wonder if it was some sort of "act," but he seemed genuinely embarassed. In hindsight, I wonder if it was because I am a woman and that was really the part that made the idea of showing me sexually explicit materials uncomfortable for him. I guess that Baron is a true "gentleman" who believes that certain topics like dirty pictures are unmentionable in mixed company. Avoiding embarrassment is just another reason to censor the stuff! On April 12, Grey Flannel Suit (aka Special Agent Schmidt) will take the stand and snarf around the net for dirty pix. He'll be followed by our last witness, MIT's Albert Vezza, and then BYU/CMU's Dan Olsen. Stay tuned for more reports. ----------------------------------------------------------------------------- We're back in court on 4/12, possibly 4/15, 4/26 for rebuttal, and 6/3 for closing arguments. Mentioned in this CDA update: DoJ's brief citing Marty Rimm's cyberporn study: <http://www.law.miami.edu/~froomkin/seminar/ACLU-Reno-TRO-Justice-brief.htm> Text of complaint from Fred Cherry v. Janet Reno: <http://fight-censorship.dementia.org/fight-censorship/dl?num=2108> Flamewar attached as exhibit to Fred Cherry v. Janet Reno: <http://fight-censorship.dementia.org/fight-censorship/dl?num=2109> Fred Cherry's reasons why he filed his lawsuit: <http://fight-censorship.dementia.org/fight-censorship/dl?num=1911> Relevant excerpt from Fred Cherry's original complaint: <http://fight-censorship.dementia.org/fight-censorship/dl?num=1891> Rimm ethics critique <http://www.cs.cmu.edu/~declan/rimm/> Censorship at CMU <http://joc.mit.edu/> The American Reporter <http://www.newshare.com/Reporter/today.html> Grey Flannel Suit <howardas(a)aol.com> Previous cases DoJer Jason Baron worked on: <http://www.eff.org/pub/Legal/Cases/Armstrong_v_President/> <http://snyside.sunnyside.com/cpsr/government_info/info_access/PROFS_CASE/> Joe Shea's complaints about ACLU wanting to "stand alone in the limelight": <http://fight-censorship.dementia.org/fight-censorship/dl?num=2014> <http://fight-censorship.dementia.org/fight-censorship/dl?num=2036> <http://fight-censorship.dementia.org/fight-censorship/dl?num=2037> This report and previous CDA Updates are available at: <http://www.epic.org/free_speech/censorship/lawsuit/> <http://www.eff.org/pub/Legal/Cases/EFF_ACLU_v_DoJ/> <http://fight-censorship.dementia.org/top/> To subscribe to the fight-censorship mailing list for future CDA updates and related net.censorship discussions, send "subscribe" in the body of a message addressed to: fight-censorship-request(a)andrew.cmu.edu Other relevant web sites: <http://www.eff.org/> <http://www.aclu.org/> <http://www.cdt.org/> -----------------------------------------------------------------------------

2 1

Re: Tense visions of future imperfect
by frantz＠netcom.com 17 Dec '03

17 Dec '03

> Financial Times, April 9, 1996, p. 13. > > > Tense visions of future imperfect > > Victoria Griffith eavesdrops on writers at a conference > about privacy and the Net > >... > > Martha's Vineyard-based author Simson Garfinkel, for > instance, came up with a few terrifying scenarios about Net > crime for a discussion group with David Chaum, the founder > of the electronic money group DigiCash. In one, a thief > went on an electronic spending spree with stolen digital > cash. In another, an elderly woman was electronically > robbed of her life savings. In the third, the stability of > the US economy was at stake. > > Garfinkel described it like this: "My name is Agent > Jenkins. I'm an investigator with the secret service, > working on a counterfeiting case. And it's tough. Last > year, my office got a priority call from an economist at > Stanford. The economist was looking at something called the > money supply and velocity and both were increasing a little > too fast. They just didn't add up. The economist finally > figured an organisation was printing its own electronic > money -- just like the US government does. > > "This counterfeit currency looked just like the real thing, > except it was a fraud. She even found some of it -- a > digital dollar that was signed and sealed by the US > government's secret key, yet had a serial number that had > never been issued. The money that was being made was on the > Net. It was everywhere and nowhere. And it was encrypted, > so that we wouldn't even know it if we found it. Last > month, we estimate, the total fraud was up to $900,000 a > month, and it is increasing still." I don't see how this third scam would work in a system such as DigiCash which uses online clearing. Unissued serial numbers would be refused when presented for clearing. One scenario which would work (and could be used for scams 1 and 2) is either stealing digital cash, or counterfeiting issued, but unredeemed serial numbers. In either case, if you spend it before the rightful owner does, that rightful owner gets, as a minimum, a lot of hassle, and might lose the cash. If this kind of scam, particularly the counterfeiting scam, occurs too often, public trust in the cash will disappear, and people will refuse to buy it. Note that people trying to maintain anonymity are particularly vulnerable since they have to hold cash for a period of time to defeat traffic analysis attacks. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

RISKS: Social Security (sic) Administration fraud
by stevenw＠best.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------------- Date: Sun, 7 Apr 1996 22:12:30 -0500 (CDT) From: Sean Reifschneider <jafo(a)tummy.com> Subject: The weakest link: Social (In)security Administration The URL "http://www.nando.net/newsroom/ntn/info/040696/info5_14984.html" reports "one of the biggest breaches of security of personal data held by the federal government". Apparently several employees of the Social Security Administration sold information including SSNs and mother's maiden names of more than 11,000 people to a credit-card fraud ring. The fraud ring was able to use this information to activate cards which were stolen from the mail. Citibank had implemented a scheme which required customers to "activate" their credit cards when they receive them by calling a phone number and providing personal information like their mothers maiden name. It seems that while systems are being designed to protect our property, it's just causing the crime to move closer to the person. If someone steals your credit card from the mail or your car from the parking lot, you're probably at a safe distance. Instead, they are forced to carjack your car at a stoplight because of your alarm system, or find out personal information about you. Similarly, I heard about home breakins on alarmed houses in which the burglar would regularly trigger the alarm and be careful to leave no traces. Once the police stopped coming (because the alarm was faulty), they were free to break in and swipe whatever they like. No matter how secure the system, the weakest link can be the clerk who's paid $12K/year to work on the system. It doesn't take much money to convince this person to hand out our personal information. This sort of thing kind of makes the hassle I went through in keeping my SSN from my insurance company. If you've never tried it, for me it was a huge hassle... Apparently, all of my claims needed to be handled by hand by one of the supervisors. Of course, if everyone did it, their $4/hour clerks could take care of it. Sean Reifschneider, Inimitably Superfluous <jafo(a)tummy.com> URL: <http://www.tummy.com/xvscan> HP-UX/Linux/FreeBSD X11 scanning software. [Also noted by Monty Solomon <monty(a)roscom.COM> quoting from Edupage, and WOODWARD(a)BINAH.CC.BRANDEIS.EDU (Beverly Woodward), who cited the article in "U.S. Workers Stole Data on 11,000, Agency Says" in *The New York Times*, 06 Apr 1996, p. 6, from which most other reports seem to have been drawn. PGN] ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

2 1

RE: NSA Budget - NOT!
by etu2＠cegep-sept-iles.qc.ca 17 Dec '03

17 Dec '03

cool|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!At 10:04 09/04/1996 -0700, Anton Rager wrote: >Wouldn't it be great if it were true!!!!!!! -- sorry folks -- doesn't seem to >exist > >1. - No domain of dod.gov -- there is info for nsa.gov...just not dod.gov >2. - No valid URL of http://nsa.dod.gov/~reports/quarterly.txt -- no page >returned > > >This must be a joke....I was gullible enough to try anyway. > > >____________ Original Message Follows _____________________________________ > > > Yes, there are annual and quarterly reports released to the > public which describe in meticulous detail expenditures for > the agency's program, personnel and equipment: > > 1. The program of services and information supplied to > government and other intelligence organizations, US and > foreign, with terms of each client contract. > > 2. US employees, their organization, skills, duties and > longevity of service; their names, ranks, identification > codes, secure communication methods and home addresses; > the location of workplaces; the continued training each > is scheduled to receive; leaves of absence and > destinations while absent. > > 3. Foreign nationals covertly employed worldwide, with > information on each as per 2. > > 4. A comprehensive listing of all types of world-wide > equipment operated; its detailed design, function and > output; where it is located; its designers, > manufacturers and purchase cost; its schedule of > amortization; and its schedule for replacement and/or > upgrade, with fifteen-year projected procurement. > > 5. Special short- and long-term contracts with governmental > and non-governmental organizations, US and foreign for > one-time projects, by goal, personnel and equipment. > > 6. Special projects with other US and foreign counter- > intelligence to issue disinformation about the agency. > > 7. Special section on world-wide US and foreign cryptology: > cryptanalysis, cryptography, steganography, codes, > cyphers, glyphs, mimes; each ranked for security and > ease of cracking; governmental and non-governmental > parties using each; names of cooperative and resistant > cryptographers and cooperating pseudo-cryptographers. > > 8. Sub-section on methods of Internet traffic and language > analysis; operation and surveillance of anonymous > remailers, bulletin boards and mail lists; lists of > cooperative and resistant educational institutions and > commercial organizations. > > 9. Appendices on: black operations; transparent operations; > methods for managing cooperative and resistant > governmental and non-governmental persons. > > The public is invited to study and/or download these > reports anonymously at: > > http://nsa.dod.gov/~reports/quarterly.txt > > > > > > A la prochaine, Gilles

1 0

Re: questions about bits and bytes
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:33 PM 4/8/96 -0400, Jack Mott wrote: >This may be a bit of a no brainer, but everything I have read sorta >skips over this point. a bit is 1 or 0. 8 bits make up a byte (0-255). Be careful writing code - sometimes a byte is -128 to 127 instead of 0 to 255. Also, there are machines (mostly old kinky ones) that use bytes of sizes other than 8 bits. >If I have a 5 byte key, does that make it a 40 bit key? Not always; bytes may have extra baggage with them such as start&stop bits (when you're transmitting async), or parity bits. DES uses 56 bit keys, but they're really 8 bytes with the high bit of each byte ignored. But, yeah, 5 bytes is normally 40 bits. >The only reason this doesn't make sense to me is it seems useless to use 5 byte >keys, yet that is what companies export since the government limits keys >to 40 bits. What's bothering you about it? The fact that it's not a multiple of 4? (No problem, think of it as a character string.) The fact that it's way too short to protect any real information, and you've always been taught to use passwords longer than that, even for computer accounts without real money in them? Well, yeah, it is - so what? A 40-bit key would take few days to crack with general-purpose 486 or Pentium PCs, though a gate-array would make it easy to use the right kinds of logic operations to crack it much faster. Are you puzzled that the government doesn't care about your ability to protect your money or your information? Think if it from their perspective - if special equipment makes it cost 8 cents to crack a key, they'd probably have to only crack semi-interesting-looking messages, as opposed to hoovering down anything they could find, and wouldn't that be a shame for National Security.... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0