December 2003 - cypherpunks-legacy

TRI_cks
by jya＠pipeline.com 17 Dec '03

17 Dec '03

7-2-96. FiTi: "A Japanese engineer's box of tricks is helping detect forged banknotes." Counterfeit dollar bills are judged on a scale of one to nine, with the crudest at level one. The detector machines that existed before Matsumura's could only pick out bills at around level five or six. Supernotes are ranked between seven and nine and have been almost impossible to detect. Matsumura says supernotes do have flaws, though, and his machine can spot differences in the printing by referring to a histogram, or statistical graph, of patterns on real US notes. Each supernote tends to have two or three minute aberrations. Consequently, sensors check for any variations at 12 points on the note. A 0.9-second scan also monitors the thickness of the paper and the printing ink. The company can only produce 500 units a month, but already has orders for 45,000. http://pwp.usa.pipeline.com/~jya/tricks.txt (4 kb) TRI_cks

2 1

PROMISe them anything (was Re: whitehouse dossier database?)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 1 Jul 96 at 23:39, Vladimir Z. Nuri wrote: > holy cow, is this real? Grabbe cites several credible references. Ask Phil Resuto. [..] > ------- Forwarded Message [..] > Conspiracy Nation -- Vol. 8 Num. 30 > ====================================== > ("Quid coniuratio est?") [..] > THE WHITE HOUSE "BIG BROTHER" DATA BASE > ======================================= [..] > The White House "Big Brother" Data > Base & How Jackson Stephens > Precipitated a Banking Crisis Jackson Stephens? Why am I thinking of Steve Jackson Games, operators of the Illuminati BBS that were raided by the SS a few years back... [..] > What Deutch failed to mention was that this > "banking crisis" in large part was itself created by one of > the U.S. intelligence agencies--the NSA in cahoots with > Stephens' software firm Systematics. The Citibank heist > by Russian hackers, for example, took advantage of a back > door in Citibank's Systematics software. (The Russian > hackers were apparently aided by the son of one of Jim > Leach's House Banking Committee investigators.) Have > any major banks thought of instituting lawsuits over this > deliberate breach of security on the part of a software > supplier? Huh? I thought the Russian 'hackers' helped write the software, and used one of their own backdoors. [..]

2 1

Paper: "A Socially based Identity Model"
by Christian Wettergren 17 Dec '03

17 Dec '03

Hi! I've written a paper where I introduce a "name spectrum" as a identity model. The name spectrum has increasing levels of identification; anyone, anyone with alias, established pseudonym, well-reputed pseudonym, escrowed pseudonym, identity and True Name. I try to show how law enforcement still can find criminals, even though they (we) have privacy. I argue that the power balance between the individual and the law enforcement should be approximately the same as it is in ordinary life. I talk quite a lot about the analogy between real life and cyberspace when it comes to power and trust. I have a suggestion for how to deploy traffic mixers (DCnet) without tilting the power balance too much to the advantage of the user as well. I suggest reputation servers where an efficient reputation market can be maintained. I'd appreciate any comments on the paper. It is still preliminary, though. It is available at http://www.it.kth.se/~cwe/phd/ in a number of formats. -Christian Wettergren, cwe(a)it.kth.se

1 0

Re: The Net and Terrorism
by jim bell 17 Dec '03

17 Dec '03

At 03:23 AM 7/2/96 -0700, Lucky Green wrote: >At 0:54 7/2/96, snow wrote: >>On Mon, 1 Jul 1996, Simon Spero wrote: >> >>> I want my, I want my, I want my Atropine >> >> No, you don't. > >Simon, you got to be more careful when synthesizing that Sarin. Always >check that the vent is working first. Also, you don't want JUST that atropine; trimedoxime and benactyzine are also helpful. BTW, the first symptom of sarin poisoning is a tightness in the chest... Jim Bell jimbell(a)pacifier.com

1 0

Re: LOS_tit
by jim bell 17 Dec '03

17 Dec '03

At 01:22 PM 7/2/96 GMT, John Young wrote: > 7-2-96 UST, page one: > The Clinton administration is to announce, as early as > this week, a commission to determine the federal > government's role in securing cyberspace, from terrorism > to petty crimes. > http://pwp.usa.pipeline.com/~jya/lostit.txt (13 kb) A commission which will probably be made up of government, ex-government, and industry people, totally ignoring ordinary citizens yet again. Jim Bell jimbell(a)pacifier.com

1 0

Re: Net and Terrorism.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:58 AM 7/2/96, snow wrote: >T.C. May wrote: > >Can anything be done? To stop the likely effects of lots more >surface-to-air missiles, lots more nerve gas available on the black market, >and so on? > >In a word, "no." >/* > I disagree. Terrorism, political terrorism is fear. There are ways to >protect military targets that are quite cost effective, unfortunately they >are politically unpopular. (What just happend in Saudi is on my mind. >STUPID military commanders getting the same pie in the face time and time >again. There is NOTHING so unchanging as the military mind set.) Well, attacks on military targets are almost, by definition, not "terrorism." (I'll spare the list a debate about the semantics; U.S. journalists tend to refer to anything done to "us" as "terrorism," whether the target is military or civilian.) The focus of my comments was really on civilian or non-military targets. (Including destruction of government buildings, maybe. I'm not sure whether the Oklahoma City bombing and the recent Phoenix/Viper Militia case is "terrorism" in a formal sense, or counter-government action, but my point is that such things are likely to be happen.) >Civilian targets are harder to protect, but certain steps can be >taken to lessen chances of a sucessful attack. Sure, any particular "soft target" can be hardened to some extent. But not all of them, and even harder sites can be reached. This is left as an exercise for the reader. (Hint: The Japanese cult's Sarin gas attack on the subways...there are tens of thousands of comparable targets in the U.S. alone. Look around, and ask what it would take to harden each one. A minor cryptographic connection is that hardening N of M sites makes the remaining M - N sites all the more tempting.) >Another method, and this would be very unpopular (and >hypocritical of the US) would be simply to announce that we (the Country) >are going to hold the _manufacturing_ nation responcible for the use of >weapons of mass destruction. So if Soviet Nerve Gas is used, we gas a >city in the Soviet Union. MAD carried to a lower level. You are essentially making my point, that the biggest danger of the current responses to terrorism is that nations will turn to national terrorism and police state tactics. >A third option is quite simply to buy as much of it as possible. No, wouldn't work. As with the "War on (Some) Drugs," all this does is raise the price a bit, actually making it a more tempting market for many to get into. (And various CBW agents are incredibly cheap to make, with the precursors available in common products. How ya gonna buy up all the peach pits, for example? Or "buy up" all the fertilizer and fuel oil?) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 4

Re: Message pools _are_ in use today!
by jim bell 17 Dec '03

17 Dec '03

At 08:28 PM 7/1/96 -0700, David Wagner wrote: >If folks have better ideas for how to achieve really good recipient >anonymity, I hope they'll speak up! Once they start offering Internet news/email/USENET feeds (one way) by DSS-type dish antenna from satellite, it'll be mighty hard to figure out who's receiving the data. They could probably easily provide 10 megabits per second, which I assume would be more than enough for what's needed. (BTW, for a few years a company called "Planet Connect" has been providing FIDOnet data feeds, although they use the older-style, large antenna systems, and their data rate is 19.2kbps, not even close to enough for Internet service.) Jim Bell jimbell(a)pacifier.com

3 2

Re: But what about the poor?
by jim bell 17 Dec '03

17 Dec '03

At 06:37 AM 7/2/96 -0400, Duncan Frissell wrote: >At 11:25 PM 7/1/96 -0700, Bill Frantz wrote: > >>Current government "Key Escrow" systems cost $200/key/year. [Craig Mundie] >>These systems can best be described as key-rental systems. > >This is shocking, shocking. Oh, but what a business opportunity! I assume a floppy can hold 1000 keys. Even if I undercut the going rate of $200 per year by a factor of 10, that's a potential income of $20,000 per floppy per year. A box of 20 floppies on the shelf, and I'm set for life! >This argument against key escrow never made it onto that long list of >questions we made up in the Spring of '93 when Key Escrow was first proposed >by the Admin (it was probably Vince Foster's fault). We showed a lack of >imagination. There's no doubt that the government will want to bribe the escrow agents, first to tolerate the system at all, and second to foster enthusiastic cooperation later on, and possibly even ILLEGAL cooperation. Over-paying them is just one way to do it. One thing that never ceases to amaze me is how the government can continue to ignore the likelihood (hell, certainty!) that since "key escrow" will only be attractive to the extent it actually benefits the user, such users will be served by escrow agents who store only encrypted or anonymously-held keys. These are inherently protected against any kind of disclosure, yet provide all the claimed benefits of key escrow. Jim Bell jimbell(a)pacifier.com

1 0

Re: hard drive encryption
by jim bell 17 Dec '03

17 Dec '03

At 07:53 AM 7/2/96 -0700, Cerridwyn Llewyellyn wrote: > >What is the best utility freely available for encrypting an entire drive >that won't be used for a length of time? ie: I'm going away for a period >of time and wish to encrypt the drive while I'm gone, but have no interest >in actually using it while it's encrypted. I also have no real preference >in what algorithm is used, as long as it's relatively secure. Speed is >also not a big consideration, as it will be used once when I leave to encrypt, >and once when i return to decrypt. >Thanks in advance for the help... You could just de-install and hide the drive. Replace it with some old cast-off drive. (The easiest way to get somebody to stop looking for something is to let him find it.) Jim Bell jimbell(a)pacifier.com

1 0

Re: But what about the poor?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:37 AM 7/2/96 -0400, Duncan Frissell wrote: >"Gee Ossifer I'd love to let you read my files but I just couldn't afford >expensive socialistic key escrow so I bought cheap efficient private key >escrow instead." "Gee Orificer, I'd love to let you read my files, but I just couldn't afford any key escrow, so I went naked and didn't use it." :-) ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: SAFE Forum--some comments
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:40 PM 7/2/96 -0700, Timothy C. May wrote: >... Phil Zimmermann, who told a humorous story of going >to Congressman Dana Rohrabacher's office, seeing the picture of Ollie North >on the wall (much laughter), but finding Rohrabacher's staffers aghast at >the crypto laws and ITARs. Someone pointed out that Phil and Ollie have something in common. They have both been accused of illegally exporting crypto. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

SAFE Archive
by Eric Davis 17 Dec '03

17 Dec '03

FYI: The complete SAFE Forum audio archive is online at: http://www.mediacast.com ----------------------------------------------------- Eric Davis ericd(a)internet.net Director of Information Systems 415-842-7400 (V) Internet Shopping Network 415-842-7415 (F) Visit our site at: http://www.isn.com/ Co-Founder MediaCast http://www.mediacast.com/ Personal contact: ericd(a)cyberfarm.com KD6HTO (R) ----------------------------------------------------- There are no law enforcers if law itself they ignore. -- Inka Inka -- Step Back -- Myth of the Machine --

1 0

RE: SAFE Forum (We sell decryption hardware)
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

Bill Frantz wrote >We sell RC4, 40 bit decryption hardware (based on AMD29000) for $16K. FPGA >devices for breaking DES in 7 days for $1M. [Eric Thompson, Access Data] What? Do you have some information about this ad (e. g. eMail)? I know some bank that would be very interested about this possibility (not for use it, but as an impulse to change their systems). Best regards, Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

1 0

Re: SAFE Forum--some comments
by John Pettitt 17 Dec '03

17 Dec '03

At 06:40 PM 7/2/96 -0700, Timothy C. May wrote: > >I was at the "SAFE" forum yesterday. Too many things to report on, so I'll >just add comments here and there. > I thought it was interesting to not that a Republican Senator came to california to talk about this stuff and *neither* of the California Senators has got a clue yet. One questioner from the audience made an interesting point that given that most of american can't seta vcr clock crypto will be totally beyond them unless it becomes pervasive ("you can buy it at radio shack"). It was pretty clear from all the speaker that this is a libertarian/authoritarian issue and not a liberal/conservative one. John John Pettitt, jpp(a)software.net EVP, CyberSource Corporation, 415 473 3065 PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0

SAFE Forum--some comments
by tcmay＠got.net 17 Dec '03

17 Dec '03

I was at the "SAFE" forum yesterday. Too many things to report on, so I'll just add comments here and there. And here I'll comment on Ken Bass's excellent comments (there were many excellent points). Bass is a D.C.-area lawyer with the prestigious Venable law firm (the venerable Venable firm?), and a former Reagan Administration official. He pointed out that the driving force for crypto policy is probably the _law enforcement_ camp, not the _intelligence agency_ camp. And that the NSA is regretting the ITAR stuff, as it has sparked an "arms race" to develop stronger crypto. Bass noted that people now equate permission to export with weakness, and that had the U.S. not restricted exports, users probably would've been "fat, dumb, and happy" to keep using breakable crypto. (Many interesting points to make. Bass is no supporter of Clipper and Escrow, and made many points about why the policy won't work. His later dialog with Michael Froomkin and Jerry Berman, about the constitutionality of crypto laws was a highpoint for me.) His comments fit in with the points made by Diffie that the 40 bit restriction is unlikely to satisfy either the user community or the surveillance community. 40 bits is too weak for a targetted attack, but too strong for "vacuum cleaner" intercepts such as NSA SIGINT uses. (Diffie also gave an excellent summary of cryptographic work factors, using 30 bits, 60 bits, 90 bits, and 120 bits as examples. For example, 30 bits needs about a billion operations to brute force, which any modern PC can do in several seconds. 60 bits is a billion times harder, which NSA machines can handle, and 90 bits is beyond current capabilities...) I said I wouldn't do a summary, but I'll make a few comments: -- Both Congresswimmin, Eshoo and Lofgren, seemed genuinely interested in the issues -- Senator Leahy, on t.v. from Vermont, emphasized _privacy_ and made the Cypherpunk/libertarian/ACLU point that he and his neighbors are not criminals and don't think the government has any right to demand that communications, computer files, diaries, and the like be "escrowed." -- Senator Conrad "I ain't no Democrat" Burns was there in person and was entertaining and strongly blasted key escrow and the ITAR restrictions. I found his comments refreshing. -- The whole affair was "preaching to the choir," as many speakers noted. That is, there was little controversy and little disagreement. This was a point made nicely by Phil Zimmermann, who told a humorous story of going to Congressman Dana Rohrabacher's office, seeing the picture of Ollie North on the wall (much laughter), but finding Rohrabacher's staffers aghast at the crypto laws and ITARs. Then, Phil took a hotel shuttle and ended up talking to the driver, who was also aghast. "Where else can you find this kind of consensus?" (A point many of us have made as well, that nearly everyone who has the issues explained to them comes down on the side that the government has no right to tell us we can't use codes and ciphers, that it's all similar to Big Brother demanding video cameras in our homes....) -- Craig Mundie, currently of Microsoft, made excellent points about the costs of a key escrow infrastructure. (By the way, those who read "The Soul of a New Machine" should be interested that Mundie was the leader of the North Carolina research facility of Data General that lost the "shootout at HoJos." If this means nothing to you, read the Kidder book--soon!) -- Michael Froomkin, a law professor (and member of our list of course), pointed out despite the various constitutional issues, the crypto laws are mostly having their desired effect, namely, slowing the deployment of crypto and creating confusion. (That Windows 95 has no crypto modules, and that most browsers and mail programs have nothing built in tells us that the FUD worked.) In summary, for me the SAFE forum was a success. Though it was periods of boring platitudes we all agreed with interspersed with good insights from the speakers and audience. Not much that was new to a Cypherpunk, of course. (In fact, the forum was almost a kind of Cypherpunks physical meeting, in terms of the topics, and in terms of who attended....it was even where we've been having recent physical meetings.) A day well spent. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 5

Re: PGP secret keys
by Deranged Mutant 17 Dec '03

17 Dec '03

On 2 Jul 96 at 6:39, anonymous-remailer(a)shell.port wrote: > Could someone post a pointer to a FAQ that tells what to do if you loose > your secret key file? How can you regenerate your private key so that the > userid number still matches the public key that has been distributed?? You can't do anything. Yer screwed.

2 1

Re: Message pools _are_ in use today!
by Deranged Mutant 17 Dec '03

17 Dec '03

On 1 Jul 96 at 20:28, David Wagner wrote: [..] > Ian and I talked about this at some length. alt.anonymous.messages > has certain unfortunate shortcomings. > Someone sniffing the Berkeley 'net can tell when I receive an > alt.anonymous.messages message by when I download an article from > the NNTP server; they can tell when I send such an article by when > I upload an article to the NNTP server; they can list all the > ``subversive'' Berkeley folks who have read alt.anonymous.messages > lately. Uploading can be gotten around by using anonymous remailers and mail-to-news gateways... although someone can tell if you send mail to anonymous mailers. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Rambling about "Net and Terrorism" (long, slightly amusing, and
by Deranged Mutant 17 Dec '03

17 Dec '03

On 2 Jul 96 at 1:58, snow wrote/quoted: [It's hard to tell what's a quote and what snow wrote here] > Can anything be done? To stop the likely effects of lots more [..] > In a word, "no." > /* > I disagree. Terrorism, political terrorism is fear. There are ways to > protect military targets that are quite cost effective, unfortunately they > are politically unpopular. (What just happend in Saudi is on my mind. [..] Yep. Terrorism is fear, but *no* target can be 100% protected. Not even military targets, though it can get difficult and expensive for someone to attack a target. In such cases, terrorists would go for easier targets. Terrorism is against a larger, vague target such as a nation or corporation or an industry or an ideology. Instances are against representations of the target.... a military base is attacked because it is a symbol, not because it is strategic. If said terrorists cannot attack a military base, they'll attack some soldiers on leave at a disco. The symbolic importance cannot be understanted (though it doesn't mean that strategic targets are safe either). So to get back to 'net related discussion: differentiate between use of the internet (and phone or mail systems) to plan acts and spread propaganda versus terrorist acts on the internet. The former implies a need for LEAs to snoop, while the latter implies a need for high-security, crypto, etc.... they are not so compatible. So let's say Wild Al's Church of Kookology and Jihad of Banality (WACKJOB) is planning a cyber-terrorist act. They want something symbolic that will demoralize the United Statesers (USers), so that they will pressure the US government to stop it's Promotion of Internation Googoomuck (PIG) in some corner of the world. It's counter-productive for WACKJOB to stop PIG by destroying the Federal Reserve's computers, paritcular because an economic collapse will keep USers from buying widget fluid from one of their sponsor countries. WACKJOB would also be unable use counterfeit (or real) yankee greenbacks to support their enterprise... and likely this would have a negative effect on marks, pounds, etc. Note that any wealthy kooks who couldn't give a damn about WACKJOB or PIG but like to show off their kook-factor among their other wealthy friends by bankrolling WACKJOB would also be adversely affected... and chances are WACKJOB will not bite the hand that helps it. WACKJOB might want to disrupt communications so that they can perform a non-cyber terrorist act against PIG, but this might prove more difficult because the Management's systems of communication (telephones, email, cellular, courier, face-to-face meetings, etc.) is complex and distributed. Also, WACKJOB would want the pigsty networks functioning so that the USers will know about the WACKJOBs sacrificed their lives and disrupted downtown traffic in NYC by leaping off buildings and splattering on the pavement. So other than using the 'net to plan their WACKJOB (so absurd that the NSA gronk who intercepted the traffic had to be taken to the hospital with a hernia from laughing so much), what *symbolic* cyber-terrorist acts could an aspiring WACKJOB plan? Keep in mind people value human life a little more computer records or property (excepting certain 'libertarian' folk). WACKJOBs would attack computer systems that would have an immediate affect on USers lives... but not permanent, and ones that would still allow USers to know it was a WACKJOB. It would have to be something that appeared to affect mainstream USers. Perhaps interfering with transportation or medical communications that allowed for a mass amount of injury or death in a short, tragic and dramatic burst. Seems securing these systems would be a priority. (Question: possibility of two systems of crypto, escrowed for general public and unescrowed for institutional systems which are more controlled, and where LEAs can get some access to because of the institutional nature?) [..] > Civilian targets are harder to protect, but certain steps can be > taken to lessen chances of a sucessful attack. Lesser chances of being hit by a falling WACKJOB are not the same as no chance of it. > Another method, and this would be very unpopular (and > hypocritical of the US) would be simply to announce that we (the Country) > are going to hold the _manufacturing_ nation responcible for the use of > weapons of mass destruction. So if Soviet Nerve Gas is used, we gas a > city in the Soviet Union. MAD carried to a lower level. Feh! Maybe the Russians hate the WACKJOBs as much as the USers, but a corrupt or poor gronk in O-+>| ("The country formaerly known as Russia") sold nerve gas to a WACKJOB... or some WACKJOB stole it. Why hold them responsible?!? And what if it was stolen from a USer? Under that logic, we can go after the company that mined the steel used in the knife that killed Nicole Simpson (probably a few WACKJOBs would agree with that...) > A third option is quite simply to buy as much of it as possible. So WACKJOBs make their own nerve gas from common household ingredients like Olestra and NutriSweet. Then what? >> I expect a city or two to get nuked in the next decade or so. (Haifa or Tel >> Aviv would be my leading candidates.) To me, this is unsurprising. > My bets in the following order: [..] So the WACKJOBs decide that the center of PIGginess conspiracy happens to be in some rural BFE, hiding under the guise of the Fritters County Malitia and Bible Emporium or maybe in the local Federal Bureau of Ice Cream and Prophylactics Building and nuke the small town you just happen to live in. (Who would have suspected Oklahamo City?) Many terrorist strieks against Brittain or Israel/Palestine did not occur in major cities. Many did not occur in those countries, but on airlines or cruise ships, or in other countries where the targets are. If you are a USer, you are a target for a WACKJOB. Doesn't matter if you're in NYC or London or the middle of nowhere or taking an airplane from a WACKJOB-sympathizing country. Doesn't even matter if you're a WACKJOB sympathizer. > I don't think that terrorists in the middle east will pop a nuke as > they would get as many of their own as the "enemy". One of the things a > terrorist needs more than money is a place to hide, and if you are > killing your own people, they won't shield you. [..] Why only mideast groups? Why should *they* be the only terrorists? With the 'net, any group with a bone to pick can, in theory, go after bigger cyber-targets (in theory, anyway). And why nuking? One can understand up-and-coming-regional powers such as Iran or Iraq, Pakistan, trying to get stolen nukes, but not likely for terrorism. Not saying that no terrorist group would use nukes... but even a lot of stupid WACKJOBs know that nuking a major (or minor) US city would provoke a fierce response from the US, and probably a lot of other countries that felt equally under threat or wanted to disociate themselves from WACKJOBs. If a WACKJOB's friends or family felt nuking was too extreme, a WACKJOB becomes a pariah. Perhaps even the official WACKJOBs disociate themselves from the WACKJOBs who nuked some city... Terrorists want to demoralize their enemies, not anger them further. [..] > One objective of terrorism is/could be to lessen a populations faith > in "The System". Some possible situations [...] > > Trash a multi-store pharmacy database and people can't get their > prescriptions, or worse get the wrong one. Wrong ones? No. It can be recovered from, though with much inconveniencem for most people. Trashing a computerized pill-making system so the wrong medications were in the wrong pills would have more effect... but would it demoralize faith in the system? > Cause disturbances in certain parts of certain cities, then attack > the 911 system to route officers and firemen to _wealthy_ neigborhoods at > the expense of the poor neighborhoods. Then complain to the papers about > it. The 911 system doesn't work. Officers and firement only go the the wealthy neighborhoods in many cities and plenty of people already complain about it. WACKJOBs want a terrorist act that would be noticed... contributing to the status quo isn't an act of terrorism. > Gain control of the power grid (I don't know how possible this is) > and selectively brown out certain sections of the city during peak demand > periods. Make it obvious, then do the preceeding idea. Many places have backup generators or their own local systems. If you live in a hurricane or earthquake prone area your used to losing your electrcity. Possibly one could get a utility's computer system to dosconnect thousands of subscribers for not paying bills, which would incite anger against it (though chances are their computer system would do this without any human intervention). Differentiate between extortion ("give a million dollars to x account or all subscribers are disconnected"), vandalism/prank/K001 d00Z feat, system malfunction/bad programming, and WACKJOBs. They cannot be lumped together as generic 'terrorism'. It seems the pro-GAK and police-state forces focus on WACKJOBs when they use the term 'terrorists' (though they may label others as such for effect at times). > In all of these people will, or could die, but are much more > effective in undermining the faith people have in the structures that run > the country. If a bomb blast goes off, people get pissed off at the bomb > makers, if the power fails, people get pissed at the electrical company. > If you can create a large enough disturbances they will be better than > bombs. What is one trying to accomplish by creating a disturbance? To lead to a collapse of the nation state? Chances are widespread disturbance will lead to large-scale martial law, which would favor statists. The focus has been on larger, 'sexier' and 'heroic' acts of terrorism which are inappropriate to the 'net. What if the WACKJOBs manage to infect copies of Windoze 6.0 with a copy of a virus that destroys PIG-related files? Or if they vanadalize web pages, ftp- or gopher sites with (what they perceive as) PIG-related materials? Or a WACKJOB cancel-moose roaming Usenet? It also seems as if GAK- proposals would be a hinderance to measure to protect against such acts. Another reason the 'net is a "terrorist threat"... it allows "terrorist" groups to have a voice. Didn't a recent government paper cite Zapatista communiques as an example of this? Anti-terrorist measures are as much (if not mroe) thought 'protection' as they are property/life protection. "Terrorism" (as defined by the state) does more to stregthen the state, by creating a nebulous enemy that the state can put an ugly face on while seizing control to 'protect' itself. 'Cyberterrorism' is something the state uses to claim jurisdiction over the cybernetic ether, or by which certain consultants spread FUD for their own benefit. Situationist's comments about the "Protection Racket" come to mind here. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 06.39 AM 7/2/96 -0700, anonymous-remailer(a)shell.portal.com wrote: >Could someone post a pointer to a FAQ that tells what to do if you loose >your secret key file? How can you regenerate your private key so that the >userid number still matches the public key that has been distributed?? You can't. You're dead. Next time make a backup.

1 0

Re: SAFE Forum
by John Pettitt 17 Dec '03

17 Dec '03

At 10:57 AM 7/2/96 -0700, Rich Graves wrote: >On Mon, 1 Jul 1996, Bill Frantz wrote: > >> "Crime prevention ought to be part of the FBI's mission. [Herbert Lin, >> National Research Council] > >In case it's not clear, this was said with much sarcasm... i.e., today's FBI >is too often engaged in other pursuits. This in the context of explaining >that ubiquitous strong crypto is the best defense against computer crime. > >-rich > > Crime prevention is *never* part of their mission after all if crime is prevented it's hard to use the crime stats to justify the budget ... John Pettitt, jpp(a)software.net EVP, CyberSource Corporation, 415 473 3065 PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0

Re: SAFE Forum--some comments
by Lile Elam 17 Dec '03

17 Dec '03

Well, I went to SAFE and found that it was very helpful for me. I have been struggling with trying to figure out what I personally can do to help change the current state of cryptography in the US of A and found that alot of good suggestions were made at this conference. It was almost like a brainstorming event on how to get things (US politics and laws) going in the right direction in this field. Hearing leaders in the cryptography field speak was awesome. They were direct and to the point. And you could tell that they were being completely strait with everyone about the current situation and what the technology could/could-not do for us. The comment I kept hearing over and over was that we have to educate the public about what cryptography is and why it's important to everyone using computers to communicate. This public includes people who are not on the net and those who don't even know what the Internet is. So, now I have some ideas on what I, as an individual can do to help. Educating poeple about crypto. I work with alot of artists on the net (~300+) and will introduce crytography to them. We'll think of some cool ways to implement it in our work and in the process will learn how to use it. :) The SAFE t-shirts were great too... -lile (a webmaster(a)art.net) www.art.net

2 1

Re: Self-signed certificates
by Carl Ellison 17 Dec '03

17 Dec '03

Here's some trouble-making I'm doing on another list (one that believes in X.509 certs and CAs).... :) - Carl >Date: Tue, 02 Jul 1996 17:34:46 -0400 >To: Greg.McPhee(a)Software.com (Greg McPhee) >From: Carl Ellison <cme(a)cybercash.com> >Subject: Re: Self-signed certificates >Cc: ssl-talk(a)netscape.com > >At 01:51 PM 7/2/96 -0700, Greg McPhee wrote: >>> >>>If you have encountered an old friend of yours on the net and want to make >>>sure that you can exchange keys with her without some active eavesdropper >>>getting in the path and substituting keys, then a CA's cert is probably >>>worthless to you. [I have a paper at this month's USENIX Security Symposium >>>on this subject.] >> >>I want to understand why the "CA's cert" above is worthless. Assuming the >>"CA's cert" is a self signed certificate identifying a CA, then is it >>worthless because it is an untrusted CA, or because my old friend and I >>don't have personal certificates signed by this CA? >> >>Couldn't wait for the paper :-) > >OK -- at the risk of boring the list... :) > >There are many definitions for "identity". In this one case, I'm using the >example of an old friend. We meet again on the net and want to trade keys, >for private communications. Much of the loose talk over the years about >certificates says that if she and I have certificates from a good CA, then >we can be assured we aren't being spoofed. That statement isn't true. > >To state it more formally, a CA's certificate in this case is neither >necessary nor sufficient. > >The CA binds a key to *its name for a person* -- trying to make that name >globally unique and meaningful -- but all it can promise is to make the name >unique. It can't promise to make it meaningful *to me*. The CA is not >aware of my existence, much less of what I know about each person in the >world. There might be 100 certificates for "Sue Robinson" -- with various >other information to distinguish them from one another -- but when I knew >her she was going under the name of Laura and I have no clue what her other >distinguishing information is. I had lost touch with her. > >I could ask her, over the net, and she would tell me all those new bits of >information. > >Trouble is, I need an authenticated channel to her in order to be sure I'm >not being spoofed while she tells me her SNail address (or whatever makes >her cert unique). I can't get an authenticated channel without the cert. >Impasse. > >Thus the cert from the CA is not sufficient. > >It is also not necessary. The paper I'm presenting gives a protocol with >which Sue and I can use our shared memories (what makes us old friends in >the first place and, in a real sense, the *true* definition of "identity") >to prove to each other that there is no eavesdropper over a confidential >channel we create. Once we've done that, we then we can tell each other our >keys and each issue a cert for the other's key. At that point, we have >certified keys for each other without involving a CA. What's better, I have >her certified key from a "CA" I can trust above all others -- myself. > >[QED] > > - Carl

1 0

Re: Message pools _are_ in use today!
by um＠c2.org 17 Dec '03

17 Dec '03

>alt.anonymous.messages is not an ideal message pool-- it is a hack. >(Granted, it *is* a really cool, clever, and practically useful hack.) I agree that alt.anonymous.messages is not perfect. But if you download all articles and don't post to alt.anonymous.messages without using a remailer, the only real threat are denial of service attacks with cancel messages etc. >If folks have better ideas for how to achieve really good recipient >anonymity, I hope they'll speak up! I think a DC+ net would achieve the same degree of anonymity more efficiently. (It's not trivial to estimate the traffic caused by a remailer net as proposed by Ian, so I may be wrong there.)

2 1

Re: Info on alleged new German digital wiretapping law?
by um＠c2.org 17 Dec '03

17 Dec '03

Rich Graves <llurch(a)networking.stanford.edu> writes: >None of the Europeans I ran into at today's SAFE conference had even heard >of the legislation decried at > > http://fight-censorship.dementia.org/fight-censorship/dl?num=3027 > >and in alt.fan.ernst-zundel. What's up? The report is correct. The mainstream press has completely ingnored the wiretap legislation, probably because it is part of the long-awaited new telecommunications law to end the Telekom monopoly.

3 4

LE Risks with No Crypto
by Duncan Frissell 17 Dec '03

17 Dec '03

Did anyone notice the fun little bit in the story of the bust of the Viper Militia in Arizona? The state employee that BATF sent to infiltrate the group almost "assumed room temperature" because an ally of the Militia working for AT&T pulled his long distance phone records. The infiltrator was questioned rather closely about some of his phone calls to official numbers. He managed to persuade them that he wasn't a Fed. Too bad AT&T doesn't use an encrypted open books system to store is records so that "bad guys" can't abuse those records and put our heroic law enforcement personnel at risk. This is a perfect illustration of the fact that technology puts the government most at risk because it will always be the juiciest target. "Worth the powder to blow it up with." DCF

3 2