December 2003 - cypherpunks-legacy

Re: US law - World Law - Secret Banking
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:55 PM 4/26/96 -0400, Black Unicorn wrote: >First of all, and as one of the only western powers to do so, the United >States taxes its citizens on _worldwide income_. While this in itself, >with a proper foreign tax credit system, is not offensive, when the Unites >States adds to this a very wide scope of extraterratorial jurisdiction and >compelled process, it becomes more than tax. Further, the United States >implements policy it cannot directly legislate constiutionally through >taxation. Just to make it perfectly clear... The US (and the Philippines) are the only countries in the *civilized world* that tax non-resident citizens. This means, par example, that if you are born in the US and leave at the age of 2 days, never return, never get any services from any US government, you are subject to full US federal taxation. If you happen to reside in a country with no tax treaty with the US, you will owe local country taxes *plus* US federal taxes simply because of citizenship. In any of the European countries, you can eliminate your tax liability for foreign (out-of-country) source income simply by moving overseas. They tax all residents but only non-resident citizens who have domestic source income. The US grabs everything even if you've had virtually no US contacts. This is why some rich Americans have renounced their citizenship to avoid taxes on their non-US income, rich Brits don't have to renounce they can keep their citizenship and just move. >It is partly the arrogance of many U.S. citizens, and the view that their >government knows the one single way to conduct economic and foreign >affairs, that empowers the United States to impose her tax and >economic policy on unconnected sovereigns thousands of miles away. Note the other areas this has applied as well. Roosevelt's outlawry of private posession of gold by Americans made it a crime for Americans to own gold anywhere on earth. And the proposed regs on licensing of space launches prohibited Americans from committing unlicensed space launches anywhere on earth. DCF "Note that no woman has ever conquered Europe but several men have. No point, I just thought it was interesting."

1 0

Re: WWW proxies?
by David Wagner 17 Dec '03

17 Dec '03

In article <Pine.SUN.3.93.960426191223.12146D-100000(a)polaris.mindport.net> you write: > > Has anyone developed such a beast yet? > > Will we have as extensive a WWW proxy network as remailer network? > Here's what I know of. You could get an anonymous www.c2.org account and websurf from it. You can also publish web pages anonymously from c2. See http://www.c2.org/anon.phtml It looks like there's an experimental anonymizing proxy up in France (if you can tolerate the link delay): http://hplyot.obspm.fr:6661/ http://hplyot.obspm.fr:80/~dl/anonproxy.txt I haven't tested it myself, though. CMU has a web anonymizer at http://anonymizer.cs.cmu.edu:8080/ Unfortunately, it's not useable by the public yet. (They promise to release it in early 1996.) Decense is a early prototype of a double-blind penet-style "re-webserver": http://www.clark.net/pub/rjc/decense.html Wei Dai has talked about PipeNet, a network of "re-routers" for general Internet traffic. Unfortunately, at this point, it's only a pipe dream on the whiteboard (as far as I know-- correct me if I'm wrong!). If I left any out, let me know. I hope to get a chance to play with these things (and possibly install one on my machine) during the summer, when I'll have some more free time. Whee!

1 0

Re: RSAREF dos not give you access to RSA
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:48 PM 4/26/96 -0400, David Mazieres <dm(a)amsterdam.lcs.mit.edu> wrote: >> 5) the price of RSA is fairly low, once free RSAREF came out >RSAREF does not give you RSA. Do not think that you can write and >distribute free software that uses RSA encryption in the US just >because of the existence of RSAREF. If you don't believe me, let me >tell you a little story. [ really atrocious story of RSA's non-responsiveness, deleted] >The RSAREF license strictly requires that you only use the documented >RSAREF interface, which does not include direct access to the RSA functions. Yeah, that's a good point, and it'd slipped my mind since the PGP permission was eventually granted. For some applications of RSA, you can use RSAREF to do them; you may have to not mind an extra DES layer thrown in where you really don't need it, and the resulting ugliness. (But at least encrypting a random session key with a random DES key doesn't provide much hook for a DES-cracker.) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

www.WhosWhere.com selling access to my employer's passwd file
by rich＠c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If you are involved with the affairs of a large organization, I urge you to check www.whoswhere.com to see if they have a bunch of user email addresses that they shouldn't. Of course there is little that one can do about this kind of invasion of privacy. But they don't have to be so fucking blatant and stupid about it. They have the email addresses of DAEMONS from our password files in their database. There is no need for mailbombing, or anything like that. Our lawyers are simply going to nuke them from orbit. Please check them out before they go offline, so that you will have a shot at whatever is left. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYHku43DXUbM57SdAQGQpwP/U9TzWE2vEjHYZo4eniVctFe3pVe0KIQe FvdNOWTykqfgEyhagKuifmRwUgjjIcIZONzRDw1Hi7UrJbOghH3j9sW5wxsphbxU 3U0hHuKumAczUHn03IVkkF4JpobawEgHqqP1Y++PhNopAvqnVSu+hnf5aIS1R390 MlUiwpoo0OE= =+Mm2 -----END PGP SIGNATURE-----

5 4

Re: The Joy of Java
by Bill Stewart 17 Dec '03

17 Dec '03

>From my perspective, the biggest win of Java isn't the security, though that's certainly important. It's that it's a reasonably powerful virtual machine that doesn't need to run on Microsoft operating systems, though it can (except Win3.1, of course.) That means that decent small application software can be written that doesn't have to be locked into the far less secure/reliable DOS/Windows/95 architectures, and can run on Macs and Linux and Unix, a bit slowly, but with a lot less baggage. (Maybe 16-bit code is gone from NT 4.0, but it's not going to run on 386s!?!) Yes, you may want to be careful with code that autoloads from web pages, but you don't have to be quite as paranoid with Java from ftp sites as you did with MS binaries, and you can be more comfortable with applets like word processors and data-crunchers knowing they won't be doing all the "helpful" things MSOffice likes to help you with. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: trusting the processor chip
by Bill Stewart 17 Dec '03

17 Dec '03

>> By NSA standards, it is simple. NSA has probably had its own >> semiconductor fabs for 30+ years. >Yep. Regardless of whether the fabs are government property or not, >it's a sure thing that some contractors have appropriately SCIFfed >fabs and appropriately cleared staffs. There's an interesting Moore's Law wrinkle to this. Not only does processor speed double every 18 months, but the cost of the chip fab plant for each generation of technology also doubles. Intel's building some $2B plants now, and who knows what the x886 CPU and 256MB memory fab plants will cost. While the costs are somewhat lower for a low-volume plant than a high-volume one, at some point it will be much harder (as a percentage of their total budget) for the NSA to stay ahead of the power curve, and they'll have to switch over to designs like highly-custom applications on commercial FPGAs and such. And "appropriately cleared staffs" are also harder to find as the chip business internationalizes. Back when I was a tool of the military-industrial complex, I was working on an RFP that had a heavy-duty "buy American" policy, not only for economic protectionism but to make sure that UnAmerican Foreigners didn't subvert the designs for critical components to add security leaks. For instance, the controller chips for disk drives, and raw EPROM. We eventually got them to let us use imported commercial products as long as any design and construction that was actually specific to the customer was done in the US, on the assumption that the Singaporean Espionage Service wasn't going to put back-doors in all the disk drives their city exported, and the Korean CIA wasn't going to put extra pins in their EPROMS that would replace the contents with hacked versions designed to steal US Secrets :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: WWW proxies?
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:13 PM 4/26/96 -0400, Black Unicorn <unicorn(a)schloss.li> wrote: >Has anyone developed such a beast yet? Good timing for the question! As Perry pointed out, the CERN httpd provides basic proxy functions, but it doesn't do the anonymizing job of deleting/replacing information your browser may output to a CGI script, so it's only a partial solution. The pre-beta-test anonymizer proxy Sameer mentioned does the main protocols, though doesn't anonymize https: yet; doing the job right is difficult or impossible without support in the browser for features such as double-encrypted SSL sessions (one layer of encryption between the browser and proxy, and an end-to-end connection between the browser and the destination server.) [Jeff - any chance of this unlikely feature being supported?] I tried doing an https: connection to the proxy, but something wasn't in the directory it expected; that's what betas are for :-) Alternatively, maybe an SSH connection could work? >Will we have as extensive a WWW proxy network as remailer network? That's partly a technical question, and partly a social/economic one. The technical parts are whether it's easy to install an anonymizer on your web server (at least for Unix and maybe NT users), and whether there's a big drawback if you do, like performance hit or extra charges from your ISP. There's also a technical issue of whether anon-proxies will be quiet underground things, or whether there'll be some convenient coordination mechanism, such as random.anonymizer.com being a DNS hack that picks a random anonymous server that can be temporarily registered by just starting an anonymizer application. The social parts of the question are how we get people to _want_ to install it, and how we get them to keep running it once it gets annoying. A good PR job can help, especially if installation+registration is a one-or-two-button thing; using one anonymizer nags you to install your own. Perhaps somebody will find a convenient way to add only-mildly-annoying advertising to the anonymizers, or to collect digicash without discouraging users, giving some tradeoff between social responsibiity and crass profit motives, and allowing a spectrum of anonymizers to operate. Of course, especially with some profit-making services (e.g. the Anonymous Porn Proxy or the Hemp Buyers' Privacy Connection) the server may have trouble convincing customers that the anonymity is really being preserved, whether from government subpoenas, junkmail and credit card fraud, or future resale to Blacknet. The other side of the propagation problem is keeping proxy providers willing to run their services after they have problems because of how their service is used. One problem is spammers and other abusers. Suppose somebody uses your anonymizer to connect to a web-posting page or mailto: and spams a big mailing list or newsgroup with objectionable material, like the <perjorative deleted> spammer who sent hate mail from my remailer to the various gay newsgroups signed with some innocent bystander's name. At best you get flamed; at worst your ISP drops your service. Or the spammer signs the guestbook at whitehouse.gov in an interesting manner. Another problem is users whose behaviour attracts attention. Maybe it's the highly legitimate user who checks out the tax forms on irs.gov for taxable activities the IRS didn't know were involved in, like overseas banking and stocks when _your_ tax returns all said "broke college student" (just _try_ explaining anonymizers to the compuer-illiterate IRS clerk.) Maybe it's the user who wants to avoid junk email when she checks out the Make.Money.Fast.multilevel.religious.technology stockbroker service. Guess who's now on Their lists. Maybe they used the anonymizer to view child pornography from kidporn.sting.postalinspector.memphis.usps.gov, and the Post Office Police come kick your door down. Or maybe they were checking out the schedule at the Cannabis Buyer's Club using your anonymizer just in case the FBI wiretappers wanted to enforce laws that the S.F. Police don't bother people about. Some of these problems can be helped by things like transient proxy servers, if we build a convenient way for them to hook in for a while and drop back out. On the other hand, if you're waiting for me to write all this code I'm suggesting we need, you'd be better off hacking some more easy partial solutions that can be deployed, tested, and replaced with the next edition :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: Click here to become an International Arms Trafficker
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:46 PM 4/26/96 -0700, Sandy wrote: >> Well, I'm ITAR violator # 6 :-) >I am #3. Who is #1? Gee, that sounds sorta familiar. I hope >we don't end up as Prisoners. You are in the Village. A low crawl leads off to the north.... I was #21 and #22, though the first one didn't actually export crypto, and the second one exported code for rot13 instead of perl. So there's now some rot13 hanging out in the Caribbean, waiting for Hostile Foreigners and NarcoTerrorist Tax Evaders to protect their privacy with it. (This is _illegal_??) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Cell Kill 2
by John Young 17 Dec '03

17 Dec '03

4-27-96 NYT op-ed claims: On April 21, two Russian laser-guided missiles reportedly zeroed in on the cellular phone of Dzhokhar M. Dudayev, leader of the Chechen rebels, and killed him. According to the Russian newspaper Izvestia, Mr. Dudayev died while phoning an aide to King Hassan II of Morocco, who had been asked by President Yeltsin to help mediate an end to the war. Will any leader ever again be so gullible?

4 4

CryptoAnarchy: What's wrong with this picture?
by mkj＠october.segno.com 17 Dec '03

17 Dec '03

Please forgive what may be a stupid question, but I've been wondering about this for a long time, and today I'm tired of wondering. A consistent theme here is "crypto-anarchy", which appears to be essentially the idea that widespread cryptography will make tax collection impossible, bringing down governments. I don't see how this will work. The logical flaw in this argument seems so obvious (and at least some of the people who buy into it seem so obviously intelligent), that I can't help but think I must be missing something. Certainly the widespread use of cryptography will frustrate modern systems of taxation, such as income taxes, sales taxes, etc., which are based on the monitoring of financial transactions. But these systems are a mere flash in the pan; taxes existed, and governments sustained themselves perfectly well, long before these systems arose. Why then shouldn't we expect that modern governments, in the face of widespread cryptography, will simply revert to more traditional (and brutal) systems such as head taxes, land taxes, travel tolls, etc.? --- mkj

6 5

[;)]
by Dave Del Torto 17 Dec '03

17 Dec '03

<http://www.well.com/user/ddt/info/jet-reply.html>

1 0

Re: Cell Kill 2
by David K. Merriman 17 Dec '03

17 Dec '03

At 07:27 AM 04/27/96 -0400, John Young <jya(a)pipeline.com> wrote: > 4-27-96 NYT op-ed claims: > > On April 21, two Russian laser-guided missiles > reportedly zeroed in on the cellular phone of Dzhokhar > M. Dudayev, leader of the Chechen rebels, and killed Okay, I'll play: are we supposed to believe that a laser(optically)-guided missile homed in on a cellular(RF) phone? C'mon now. Who was driving the *real* targeting laser? Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:30 AM 4/27/96 -0700, Mark Allyn 206-860-9454 wrote: >They are gone now. > >mark.allyn.com% lynx http://www.WhosWhere.com Try http://www.whowhere.com/ . (Rich Graves mistyped the address.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

8 12

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:12 AM 4/27/96 -0700, Rich Graves wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >If you are involved with the affairs of a large organization, I urge you >to check www.whoswhere.com to see if they have a bunch of user email >addresses that they shouldn't. They also have some information that is seriously outdated. They have two e-mail addresses for me that are about 2-3 years out of date. (I wonder how some of this information was collected. One was from my Fidonet point address of years back. Not something accesable from finger.) >Of course there is little that one can do about this kind of invasion of >privacy. But they don't have to be so fucking blatant and stupid about it. >They have the email addresses of DAEMONS from our password files in their >database. I wonder if those addresses are from a "finger @sitename.org" hack. It becomes worrysome when the methods of hackers intersect with those of database compilers. >There is no need for mailbombing, or anything like that. Our lawyers are >simply going to nuke them from orbit. Please check them out before they go >offline, so that you will have a shot at whatever is left. Keep us informed as to the fireworks. it will be fun to watch. --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

3 2

Re: trusting the processor chip
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 9:53 AM 4/25/96, Jeffrey C. Flynn wrote: .... > >It looks like I may have no other option than to give some processor some >degree of trust. Which processor I should choose, and why that one? .... In the days of microcode this was my best (worst?) scenario. Setting up for fast divide has been an art long before Pentium divide fame. In microcode you don't spend time testing for cases that you can prove won't happen. Some obscure cases can arise only with a rare combinations of two 48 bit operands. The microcode flaw would be to put the processor into privileged mode even while getting the right answer. There would plausible deniability even if the flaw were discovered. (Gosh, I didn't test for this fall thru case because here is the proof that it can't happen.) Of course there is a bug in the proof but no one reads proofs. This can now be exploited by anyone that knows what division leaves the machine in privileged state. This is an attack on those systems that are rated to run untrusted machine code, using privileged mode code to limit the operation of the untrusted code. Only one person is necessary to pull this off. He must be trusted to produce microcode and the implementer of the divide algorithm. Test code will not find the transition to privileged code just because you can't test the whole machine state after every tested instruction. Normally the bogus privileged state of the machine will quickly expire (on the next interrupt) and will cause no permanent state change even in those few cases where a magic division occurs naturally.

1 0

Re: www.WhosWhere.com selling access to my employer's passwd fi
by Lou Zirko 17 Dec '03

17 Dec '03

DNS lookups fail currently for www.whoswhere.com and whoswhere.com. Gee, this is quick work. Who are those masked men, opps lawyers? > Date: Sat, 27 Apr 1996 02:12:20 -0700 > From: rich(a)c2.org (Rich Graves) > To: cypherpunks(a)toad.com > Subject: www.WhosWhere.com selling access to my employer's passwd file > Organization: Uncensored Internet, http://www.c2.org/uncensored/ > -----BEGIN PGP SIGNED MESSAGE----- > > If you are involved with the affairs of a large organization, I urge you > to check www.whoswhere.com to see if they have a bunch of user email > addresses that they shouldn't. > > Of course there is little that one can do about this kind of invasion of > privacy. But they don't have to be so fucking blatant and stupid about it. > They have the email addresses of DAEMONS from our password files in their > database. > > There is no need for mailbombing, or anything like that. Our lawyers are > simply going to nuke them from orbit. Please check them out before they go > offline, so that you will have a shot at whatever is left. > > - -rich > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBMYHku43DXUbM57SdAQGQpwP/U9TzWE2vEjHYZo4eniVctFe3pVe0KIQe > FvdNOWTykqfgEyhagKuifmRwUgjjIcIZONzRDw1Hi7UrJbOghH3j9sW5wxsphbxU > 3U0hHuKumAczUHn03IVkkF4JpobawEgHqqP1Y++PhNopAvqnVSu+hnf5aIS1R390 > MlUiwpoo0OE= > =+Mm2 > -----END PGP SIGNATURE----- > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:51 AM 4/27/96, Dan Busarow wrote: >At Usenix 96 in San Diego it was pointed out that applets are an abberation. >This is a complete language designed to displace C++, Visual Basic and >other OO languages. Thinking of Java as simpy a Web enhancement tool >is short sighted. > >Personally it is more attractive than C++ for product development and >we are trying to get it on FreeBSD, SCO UnixWare and SCO OSR5. Using >Java for applets _only_ is like fucking your mother... Most of us are >not into it. Ignoring the gross violation of the CDA, I agree. I think of it (and so do a lot of others) as: - a cleaned-up C++, with features of Smalltalk, Objective-C, and Lisp - a tool with built-in hooks for Net-centric computing - some safety features that distinguish it from C++ and the like - a bytecode/virtual machine approach that means the same code can be run on any platform for which a VM exists (the key to applets, but also the key to portability...what the world might have looked like for the past 15 years has the UCSD p-system succeeded instead of MS-DOS) Is it safe to run untrusted applets on your machine? Probably not. Running strange programs probably is never safe. I don't view this as something any new language is likely to solve, unless it's a language with such limited expressability as to be "safe and boring." As Perry has noted, financial institutions can ill afford to have applets being dropped into their main computers unless they are safe and secure. Not too surprising. But, then, they also have other security issues they constantly have to deal with that others don't. I suspect the safety issues will continue to crop up, but will be dealt with in other ways. The signed classes approach, the approaches used in E, etc. Netscape's limits on what applets can do, for example, may be extended in other ways (a kind of firewall approach?). To borrow a viewpoint, I don't expect the Java-based gargoyles in "True Names" to be "trustworthy"...TANSTAAFL. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

First, there ain't no way that electromagnetic radiation is going to be detected coming from the surface of a ULSI chip. Radiated power levels are going to be in nanowatt or picowatt level from any one metal or poly line, and of course will be undetectable at any distance. Not to mention the size of the radiator implies inefficient launch of pulses (the lines are likely to be rarely longer than a millimeter). At 11:04 AM 4/27/96, David Lesher wrote: (quoting someone else) >> > More likely,I think, an organization like the NSA >> I thought that most (all?) chips already radiated on the >> electromagnetic spectrum? Isn't that what tempest is about? TEMPEST is not about emissions from the surface of a ULSI chip, for example, but about the emissions (and controlling them, shielding them, detecting them) from equipment in general. Most of the "van Eck" radiation (so-called because he wrote the first major public papers on this mode) comes from the deflection circuitry for CRTs, where the radiated power levels (and lengths of radiating elements) are considerably larger than what I mentioned above. It is the CRTs that mostly cause problems. The PCBs inside modern computers also emit wideband pulses, and this may be detectable and usable to an adversary. Good shielding practice helps (those little FCC stickers....). TEMPEST deals with suppressing the emission even more. >B) Sure the Fort has Fab facilities. But Acme Gas & Grocery fixes >cars, yet they do NOT have the diagnostic computer for my [in my >dreams..] new BMW. > >Preventium & leading edge chips requires MASSIVE amounts of >money for the infrastructure, and yesterday's versions do not cut >it. [Tim, got any real $$ here?] I suspect it's like monitors: 14" >SVGA's cost $200; 16" $650; 19" $1200 & 21", don't ask. Sure, >tomorrow the 16" is $500, but you need it TODAY. I hate to say it, but all this stuff has been covered extensively in the past, in the archives. Yes, the NSA has its own wafer fab. Or, more precisely, the most recent example I know of is that National Semiconductor accepted a contract to build a fab at Fort Meade. This is not surprising, as the NSA is responsible for supplying coding and ciphering materials to U.S. forces worldwide, and so must generate ROMs, PLAs, and other special chips to cipher machines around the world. Having the fab at the Fort helps security. (Sandia Labs also makes such gizmos for them, and has pretty good security, I suspect.) These wafer fabs are probably 1.25 micron fabs, far from the .35 micron fabs now being used to make the 166 MHz Pentiums you can buy at Price Club. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Click here to become an International Arms Trafficker
by Lou Zirko 17 Dec '03

17 Dec '03

# 37 > At 02:46 PM 04/26/96 -0400, Vince Cate wrote: > > > > "Click here to become an International Arms Trafficker" > > > > Well, I'm ITAR violator # 6 :-) > > Dave Merriman > ------------------------------------------------------------- > "Giving money and power to government is like giving > whiskey and car keys to teenage boys." > P. J. O'Rourke (b. 1947), U.S. journalist. > <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> > http://www.shellback.com/personal/merriman/index.htm > > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: US law - World Law - Secret Banking
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"ml3e+(a)andrew.cmu.edu" "Michael Loomis" 26-APR-1996 07:40:10.88 > I have been reading this list to get an idea where Declan gets some >of his lunatic ideas and what Rich Graves says when he is not up to >Holocaust fetishism. Despite Timothy's claim to the contrary, it seems >that the basic point of this list is some libertarian notion that tax >evasion is a good thing. Well, actually it's on a lot of other things also, including ones that those against censorship (I assume you're on the fight-censorship list, and thus encountered both Declan and Rich?) should favor. Examples include anonymous remailers and web pages (the deceanse (sp) project). Moreover, anonymous digital cash has applications to fighting censorship. Applications include paying someone to remail information or to put it on the web. c2.org, for instance, accepts even the present semi-anonymous digital cash and offers anonymous web page hosting. >While I am not clear how serious of threat, if one at all, to a system of >fair taxiation, That depends on how one defines "fair." >since much of the talk could be simply bluff, I have been made glad for the >first time for the War on Drugs. This silly war--tragic in terms of its >economic cost and its assault on liberty--at least has forces some >government agencies to take you seriously enough to figure out how to derail >your plans of tax evasion. Most of the tracking and other mechanisms discussed are even more of a threat to liberty - most significantly privacy, although there are other ones involved as well - and, indeed, to economic efficiency. A lot of the proposed and/or instituted regulations can also be used to discourage various politically unpopular but economically efficient operations; an example is "capital flight." In other words, unless you really want to live under a set of laws as restrictive as those in Communist China, support the cypherpunks. -Allen

1 0

Re: Fwd: RSAREF dos not give you access to RSA
by Christopher Allen 17 Dec '03

17 Dec '03

At 1:48 PM on 4/26/96 , David Mazieres <dm(a)amsterdam.lcs.mit.edu> wrote: >After many many messages, I got bounced around from RSA to Consensys >Corp. and back to RSA. Just an FYI, Consensus Development (not Consensys) can only offer a commercial licenses to RSAREF. Some such licenses we can grant waivers to user lower-level routines -- to date we've granted waivers for SSL and PGP compatible software. >Conclusion: You can't use the RSA algorithm in free software. The >RSAREF interface is too restrictive, and when RSA says in the license >that "RSA will grant all reasonable requests for permission to make >such modifications" to the interface, it is either an outright lie, or >something that only happens after so much delay that they might as >well not give you such permission. The problem is that only RSA Labs (not RSA Data Security) can offer this permission (as they have all the non-commercial rights) and they are not set up to handle such requests. I'll see what I can do as the commercial licensee to influence making this happen. RSAREF was released "to support standards" and SSH is a beginning of a standard, so I think it should be possible. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<ChristopherA(a)consensus.com> 1563 Solano Avenue #355.. .. Berkeley, CA 94707-2116.. ..<http://www.consensus.com/> o510/559-1500 f510/559-1505..

1 0

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 12:25 AM 4/27/96 -0500, Snow wrote: >On Thu, 25 Apr 1996, jim bell wrote: >> >> This analysis seems to assume that the entire production run of a standard >> product is subverted. More likely,I think, an organization like the NSA >> might build a pin-compatible version of an existing, commonly-used product >> like a keyboard encoder chip that is designed to transmit (by RFI signals) >> the contents of what is typed at the keyboard. It's simple, it's hard to >> detect, and it gets what they want. > > I thought that most (all?) chips already radiated on the >electromagnetic spectrum? Isn't that what tempest is about? There's a difference between trying to find a needle in a haystack, and finding a day-glo, red-hot needle that plays music at 110 decibels in that same haystack. Digital logic chips do radiate EMI, but some radiate very little (because their are few logic transitions or they occur relatively infrequently) or are buried within other circuitry and they don't have a particularly good antenna. The Trojan horse chip I'm hypothesizing would be specifically designed to radiate a fairly loud, continuous signal, on wires that are long enough to make a good antenna. Ideally, the chip would have a crystal to produce a very constant frequency, so that other noise not on that frequency could be ignored. The best place to put such a chip would be a location outside the computer's case, or at least it would have access to the outside. I think that a keyboard controller would be optimum, because I suspect that there are a relatively small number of different designs. Jim Bell jimbell(a)pacifier.com

3 2

You're Invited
by JavaOne 17 Dec '03

17 Dec '03

1 0

You are now an International Arms Trafficker (#1) ???
by William Knowles 17 Dec '03

17 Dec '03

Yikes, Tell me that conspiracy to break ITAR isn't grounds for becoming arms trafficker #1 I don't even have the latest version of the shortened Perl-RSA code back from the screenprinters. Coming Soon! New fashionable Perl-RSA shirts! You are now an International Arms Trafficker Thanks for the munitions package. You are trafficker number: 1 Offshore Information Services Ltd. -William Knowles erehwon(a)c2.org --

1 0

Re: The Joy of Java
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Perry writes: > Scott Brickner writes: > > True. It's still lacking a couple of (non-language) features. The > > most important (and most cpunks relevant) is a mechanism to pay people > > to run programs for you. This sort of thing is dangerous without a > > safe environment. This is not as far away as you might think. Trust me... :) > You can do that safely without making it dangerous for your machine. I > know how I would build a restricted execution environment for such > markets. However, Java is 1) too slow, since if you are selling > rendering cycles or such you don't want to be running an interpreter, > 2) insufficently safe, and 3) paradoxically, insufficiently powerful > for the sort of code you would want to run in such an environment. Wow, three incorrect assumption in a single sentence, another hat-trick for Perry. Speed of execution is not a major problem given JIT compiler and interpreter improvements; this has been broadcast far and wide on the net so your presumed ignorance of this is a bit hard to believe. Additionally, if you are buying cycles off the net you can set things up to run in parallel and accomplish more than you ever could without the ability. To farm out code. This is absolutely trivial when it comes to tasks which are inherently easy to break into chunks which can be run in this fashion (like rendering and ray-tracing, etc.) As far as safety goes there are a lot of people working on this problem and for tasks of this type it is not as difficult as you assume. As far as it being insufficiently powerful for running distributed computation and cycle serving I know know for a fact that this is not the case. Rather than trying (and often failing) to prove that unsolvable problems exist in Java why don't you present the net with an alternative that does not suffer from these limitations. jim

2 1