December 2003 - cypherpunks-legacy

Re: [Off-Topic] "Curfews"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:59 AM 6/2/96, Duncan Frissell wrote: >Of course curfew laws only control the inarticulate and scruffy. Well >dressed children (coat and tie for the boys dress or suit for the girls) who >can claim that they are out doing tons of protected things like work and >school and worship and political campaigning and "trying to save street >children for Jesus" will not be picked up. They can also say things like This, by the way, is the main thing that concerns certain civil rights groups (including the Santa Cruz chapter of the ACLU). They say they'll be monitoring enforcement patterns to see if more "children of color" are picked up than their percentage in the population represents. >"Ossifer, I'm peaceably assembling to petition the government for redress of >grievances. It's in the First Amendment. You could read about it and >everything." Personally, I liked my "religious exemption" example. The Baal worshippers can claim that they are engaging in their religion by grokking the darkness. If picked up and held, they can claim they are "being held without Baal." >to be accused of "owning slaves just like Thomas Jefferson." Parents can >also give their kids blanket notes of permission to be out on the streets. > Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. (It's this taking control from both the kids and their parents and putting it in the hands of cops that really bugs me.) By the way, if being out after curfew is breaking the law, can I make a "citizen's arrest" of some of those nice young chicas in Watsonville? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RISKS: Pachinko card counterfeit background
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------ ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

RE: [Off-Topic] "Curfews"
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. ................................................................................... (sigh) Once again, the individual is backed up against the wall and made to answer to the State ("specifically") for their behavior in the world of human action. ("so who are you that I must explain myself to you?") I was considering the inclination of the list membership to focus upon technological, rather than political, solutions to certain social problems. Would a focus upon the idea of individual self-ownership & authority have any effect upon the State? (who *are* those people, anyway) The State resorts to the use of forcible methods in order to keep their non-valuable citizens in line. The citizens who feel themselves unfairly included resort to the use of technology to deal with impositions of the State upon them when their own ideas on morality are not accepted as legitimate. A lot of people talk about morality and justice, but really who gives a flip. The place of these ideas in the everyday life of each person reduces to irrelevance in the face of all the ignorance and cynicism, and in consideration of the alternative technologies which can be used in place of reasoning, when reasoning makes no difference (when you can't force people to think, as often happens). "I think it's time we re-evaluate the nature of our relationship". .. Blanc

1 0

RISKS: Pachinko card counterfeiting update
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

No Subject
by ezekiel＠alpha.c2.org 17 Dec '03

17 Dec '03

winn(a)Infowar.Com wrote: > > The article discussed the advanced information warfare techniques used by the > perpetrators. "According to the American National Security Agency (NSA), they > have penetrated computer systems using 'logic bombs' (coded devices that can be > remotely detonated), electromagnetic pulses and 'high emission radio frequency > guns' which blow a devastating electronic 'wind' through the computer systems." > [For a complete description of HERF Guns (coined by Schwartau in 1990), see > "Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth > Press, 1994] > Thanks for the info (and for the excellent book, by the way). Can you explain in little detail what are these logic bombs? Also, why these institutions do not install protection from HERF radiation and TEMPEST-type protection from information leaks? Do they think that paying ransom is cheaper than all investment in IW-protection? thanx

1 0

Riding online elevators (Was CNN: Anonymous Stock Tips)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

In my mail this morning was this bit of spam, I never heard of this guy before, Likely scooped my mailing address from misc.invest.stocks. -Newman --Fwd-- >http://chancellor.stockpick.com > >I just got wind that Chancellor Group is reporting big quarterly earnings. >SGA Goldstar is just sending out a "buy" recommendation. I understand other >investment advisors are looking to recommend CHAG. The company has a >strong book value. The short sellers need to cover. This looks like a >good situation to me. What do you think? They are located at: > >http://chancellor.stockpick.com > >Bruce Keller, 203-869-8137 > >To terminate from my Internet Investment Opportunities, Reply to >term(a)portlandweb.com with "remove" in the subject field.

3 2

Re: Multiple Remailers at a site?
by Bill Stewart 17 Dec '03

17 Dec '03

>I don't think multiple remailers at the same site help anything. Assume Alice, Bob, and Carol are on abc.com and Xenu, Yak, and Zut are on xyz.com. Remailing between Alice, Bob, and Carol doesn't make appear to make much difference, but it does reduce the damage if one of the remailer's keys is compromised. On the other hand, mail from Alice -> Xenu -> Bob -> Yak -> Carol -> Zut adds traffic to the system, and makes traffic analysis more difficult, even if the Bad Guys are watching site abc.com and have stolen Alice, Bob, and Carol's keys. The other threat it helps with is that if XYZ.COM gets complaints about that evil user Zut, she can kick her off (Bad Zut!) and still leave Xenu and Yak alone; if the remailer service were provided by the machine owner herself she might be directly liable. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Rescind Authority!

3 7

Come to think of it (was Something that just crossed my mind....
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 May 96 at 22:35, snow wrote: > In some of the discussion on this list there has been some concern > about the governments position on anonymous fund transfers. Well, maybe > concern is incorrect. We _know_ (or should) what it is. They are dead set > against it. Hm. The more I think about it, the more that it seems foolish to be against anonymous payee systems. Mainly because those who want it now (and who will want it in the future) and who have the resources will already have it. As for catching tax-evaders, criminals, etc... for most the five BMWs, indoor heated pool and yacht should be enough attention for those who really want to know. Of course the gov't isn't that interested in doing the legwork... better for them to have everything on a computer for easy data-crunching rather than do real footwork. (Can you say downsizing? Nah.... they'd put twice the savings into useless gadgets like attack helicopters to patrol minority neighborhoods with...) Off the track, slightly: It seems the effect that these laws have are to make it so only the very wealthy and connected (or perhaps incredibly ambitious and smart) have access to privacy and de facto loopholes in the law. The only "criminals" who will be able to get away with anything are those who are already so well off (and possibly buddy-buddy with the Powers That Bee, Bzzt!). [..] > The discussion here seems to assume that business will accept, or > even welcome the ability of it's customers to remain unknown, or nymknown. > It is my position (until proven wrong--please) that larger business DON'T > want anonymity. They _want_ to be able to track purchases and use of their > product for several reasons. Good point. But many consumers want anonymity, or at least to control what information they give customers. Many might even settle for pseudo-anonymity (ie, account number 123456 likes to buy product X, but whoever 123456 *is* is known only to 123456....). [..] > The questions that this raises are: > > 1) Am I full of shit. This is very possible. Everyone is at some time or another, unless you never eat. [..] --Mutant Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Compressed data vulnerable to known-plaintext?
by Deranged Mutant 17 Dec '03

17 Dec '03

On 1 Jun 96 at 19:13, anonymous-remailer(a)shell.port wrote: [..] > But then you still have the problem of identifying the contents. If there > were no headers, one could not tell if the message was compressed using > ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor, > or even if it was left alone. One could also not tell if the decryption > happened successfully. Actually you could, since the actual encoding isn't random. It means something to the compressor. And if you know something about compression algorithms you could probably make some good estimates. (I've seen some arguments that bit-wise a compressed file is easier to make a known plaintext attack against than an uncompressed text file...) Try taking various small (but compressable) text files that are different and run them through compressors. Ignore the usual compressor header information and look at a hex dump of the compressed data... think about it in terms of bits. Look at the algorithm that encoded the data. A good way to avoid known plaintext is to use a feedback mode with a random IV (from a good RNG!). Not perfect, of course... Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: [Off-Topic] "Curfews"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 1 Jun 96 at 21:59, Duncan Frissell wrote: > I'm afraid that some courts have explicitly held that "the child does not > have a right to liberty but only a right to custody." That is old law, > however. Kids have lost many rights recently too including gun rights, etc. ....which dates back to laws that said women and children were mens' possessions. Very archaic. A case from several years ago comes to mind. Apparently a federal(?) court ruled that a 16-yr-old girl's parents were in the legal right to burn her krshna books and ban her from practicing it. [There was a protest in downtown SF sometime in 1989 or '90 about this.] --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

How can you protect a remailer's keys?
by Bill Stewart 17 Dec '03

17 Dec '03

Encryption is critical for protecting against traffic analysis, but it's tough to protect a remailer's keys. Unlike regular email, where you can type the key in as you read it, remailers need to run automatically once you set them up. Some of the choices are: - leave it around in plaintext with only Unix file protections (Ghio2 works this way - does Mixmaster? My ghio2 version has it compiled into the binary, and I try to delete it from source.) - type it in to a long-running remailer process (with human intervention to start) - SSL-based remailers, where the web server handles crypto on a per-machine basis instead of per-remailer - use unauthenticated Diffie-Hellman (either hanging off a TCP port somewhere instead of mail, or 3 pieces of email) - off-line or off-site remailer such as a POP3 winsock remailer that makes it Somebody Else's Problem, and separates the remailer's public interface from the working parts - human intervention on every message (which may not be totally worthless for moderated news postings, if you want to take that approach to spam prevention.) Anybody have any other approaches? These are mostly weak, annoying, or both. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Rescind Authority!

1 0

RE: Riding online elevators (Was CNN: Anonymous Stock Tips)
by blanc 17 Dec '03

17 Dec '03

From: Anonymous In my mail this morning was this bit of spam, I never heard of this guy before, Likely scooped my mailing address from misc.invest.stocks. -Newman ..................................................................... No, I received it as well. Must have taken names@addresses from the list. .. Blanc --Fwd-- >http://chancellor.stockpick.com > >I just got wind that Chancellor Group is reporting big quarterly earnings. >SGA Goldstar is just sending out a "buy" recommendation. I understand other >investment advisors are looking to recommend CHAG. The company has a >strong book value. The short sellers need to cover. This looks like a >good situation to me. What do you think? They are located at: > >http://chancellor.stockpick.com > >Bruce Keller, 203-869-8137 > >To terminate from my Internet Investment Opportunities, Reply to >term(a)portlandweb.com with "remove" in the subject field.

1 0

Re: WSJ on "IRS-bashing"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:01 PM 5/29/96 -0700, Rich Graves wrote: >Fascinating. Could you provide citations to these laws so that people in >this plane of reality might take a look at them? Over here, any such law >would be invalidated by R.A.V. v. St. Paul. The only exceptions are >restrictions on "fighting words" that meet the tests in Chaplinsky v. New >Hampshire and "hostile working environment" discrimination, which I assume >is what you're talking about, in some elliptical way. Pittsburgh Press vs Pittsburgh Human Relations Commission (sex specific help wanted advertizing outlawed). Various Fair Housing Laws ("we don't rent to your kind here" punishable by confiscation of property). Civil Rights Act of 1964 (verbal expressions of discrimination in the course of employment, housing, or service in public accommodations punished in numerous ways). Expressions of ill-will towards the President or members of his family punishable as threats in circumstances where similar comments made about anyone else would not be actionable. Note that work is a big part of most people's lives and there are substantial governmental restrictions imposed on speech in the work place with fellow employees and customers. DCF

1 0

Re: Riding online elevators (Was CNN: Anonymous Stock Tips
by Deranged Mutant 17 Dec '03

17 Dec '03

On 2 Jun 96 at 1:00, Harry Bartholomew wrote: > > In my mail this morning was this bit of spam, I never heard of this guy > > before, Likely scooped my mailing address from misc.invest.stocks. [..] > No. Seems to have gone to all cypherpunks. I've never heard of > misc.invest.stocks. The only time I saw it was in that post... thankfully. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

No Subject
by John D. Ervin 17 Dec '03

17 Dec '03

list John D. Ervin Also known as "Felix1" jervin(a)netpath.net

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by minow＠apple.com 17 Dec '03

17 Dec '03

> >One of the oldest tricks for running a stock up (or down) is >to put rumor teams on elevators in the financial district of >major cities. It would be more efficient to talk about the rumor on a cellular phone. Probably make a nice sting scenario, too. Martin Minow (who expects a cut of the reward money). minow(a)apple.com

1 0

Re: Java Crypto API questions
by minow＠apple.com 17 Dec '03

17 Dec '03

>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >the eagerly awaited (at least by this user) Java Crypto API. Here are my notes (and between-the-lines observations) from the Java crypto sesions (which were very well received). Watch the Java web sites for transcripts from JavaOne sessions. (but I don't know if the BOF will be available). -- Security is *important* -- zero tolerance for security bugs. Gosling said in his keynote that it changes things when people send their bug reports to USA Today. -- They're working with standards folk: W3C, IETF. -- Clean, simple design, paying attention toll aspects of security design: language, virtual machine, components (libraries). -- Adding digital signatures to code enables greater trust -- the user can allow an applet to "escape from the sandbox." -- Policies = Assertions + Capabilities. That's what my notes say -- I think it means that the user can use a signature to authenticate the applet's author/publisher and allow it greater capabilities. For example, a stock trading applet might be granted the capability to access a stock price service (Dow Jones) *and* a stock trading service. The current applet model only allows remote connection to the site that distributed the applet. -- Java will allow signing archives (a set of classes and resources). -- Network-centered security: digital signatues, encryption, key exchange, hash, bignum, random number generators. -- Packages (third-party applets) communicate with security packages through an abstract layer. There may be multiple packages. -- They will provide a secure key storage (like Apple's PowerTalk today, I presume) where "all" of your keys are held under a a single password. Rogue applications (applets?) can't leak keys. -- Feedback to security-api(a)java.sun.com. -- There's a white paper on the verifyier on the sun web site. -- They're writing a security policy for applications (applications function like "ordinary" Unix/Mac/whatever applications. -- User preference to designate capabilities for signed/unsigned applets. ---- ---- ---- Notes from the security birds of a feather session ---- ---- ---- -- Need multiple security managers: if any say no, reject the request. -- Servet, applet need different security managers. -- Problem with firewalls: client accesses server via firewall via proxy servers. May not be able to open a URL directly. -- Java Commerce API coming for payment functions. -- Problem with foreign applet vendors: how can a non-US security class vendor certify a class to be used (outside the US). Currently, it must be imported and signed by Sun. But, then it can't be exported without a Commerce Department license. No (current) plans to establish a signing authority outside of the U.S. Martin Minow minow(a)apple.com

1 0

premail manual info
by test921148＠alpha.c2.org 17 Dec '03

17 Dec '03

Whopee! Just installed premail. But I have a Question on how to use it. I need some Manual explaining how to use Premail and what can I put into its Configuration-file. I use Version 0.43 of Premail. The perl Script is somewhat readable but it is better if some User-manual was available. Send Answers to test921148(a)alpha.c2.org

1 0

INFO: Sen. Burns urges White House to follow NRC recommendations (6/2/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| SEN. CONRAD BURNS URGES CLINTON TO REASSES ENCRYPTION POLICY AND ANNOUNCES HEARINGS ON THE ISSUE for 6/12/96 REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST SEN. CONRAD BURNS (R-MT) SCHEDULED FOR HOTWIRED CHAT 6/11/96 10-11PM EST Date: June 2, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News Text of Sen. Burns' letter to President Clinton How to receive crypto-news ----------------------------------------------------------------------------- NEWS Sen. Conrad Burns (R-MT), principal co-sponsor of legislation to ease restrictions on encryption, yesterday sent President Clinton a letter urging the Administration to reassess its encryption policy in light of a recent report by the National Research Council. The findings contained in the NRC study, released at a briefing in Washington DC on Thursday, raise serious questions about the rational for the Administration's current approach to cryptography policy. The study states explicitly, "Current national cryptography policy is not adequate to support the information security requirements of an information society." In his letter to the President, Senator Burns said that the NRC study presents overwhelming evidence that the current approach to encryption policy has failed. Burns also pledged to hold hearings in the Senate Commerce Committee on June 12 and 26. The night before the hearings (June 11 at 10 pm ET), Senator Burns will be live online at HotWired (http://www.hotwired.com/wiredside) Be sure to save the date and stop by to talk with the Senator about his efforts to encourage the widespread availability of strong encryption and get a preview of the hearings on the Pro_CODE bill. Information on Senator Burns' legislation, as well as information on the NRC report, is available at http://www.crypto.com DON'T FORGET! Representative Rick White (R-WA) will be on HotWired Wednesday June 5th at 9pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Representative through a moderator and get real, immediate responses. ----------------------------------------------------------------------------- TEXT OF SEN. BURNS' LETTER TO PRESIDENT CLINTON May 30, 1996 The President The White House Washington, D.C. 20500 Dear Mr. President, I urge you to reassess the administration's position on cryptography policy in light of the report released today by the National Research Council, "Cryptography's Role in Securing the Information Society." The report was put together by the NRC Committee to Study National Cryptography, which included members from across the spectrum of the business, academic, defense and intelligence communities. The fact that such a diverse roster of our brightest minds could achieve consensus after taking two years to pore over the details of encryption policy is remarkable, and their recommendations should be taken most seriously. The acronym of the report's title-CRISIS-is especially apt given the massive economic and national security costs of the current policy, which severely restricts the export of software containing strong encryption. As the report states, "Current national cryptography policy is not adequate to support the information security requirements of an information society. Indeed, current policy discourages the use of cryptography, whether intentional or not, and in so doing impedes the ability of the nation to use cryptographic tools that would help to remediate certain important vulnerabilities." As the Chairman of the NRC Committee to Study National Cryptography, Kenneth Dam, states in the report "the crisis is a policy crisis, rather than a technology crisis, an industry crisis, a law enforcement crisis, or an intelligence-gathering crisis..." The most recent version of the administration's policy, as reflected in the draft white paper of the interagency working group on encryption, unfortunately reveals a continuing commitment to government-imposed mandates rather than private-sector solutions. The proposal, which was quickly dubbed "Clipper III" because of its close alignment with the earlier rejected Clipper schemes, has the support of neither the software industry nor the Net community. Indeed, as the Committee noted, an essential flaw behind the administration's policy is the continuing reliance on the national security and law enforcement communities to drive the policy through administrative diktat rather than open legislative action. As the report states, rather than vainly attempting to reign in the inevitable widespread use of strong encryption, the administration should be actively promoting it. The use of strong encryption has become vital to both ensuring the privacy of individuals and fostering the growth of the Global Information Infrastructure into the 21st century. As for the national security aspects of encryption policy, the report states that cryptography can protect proprietary information and reduce economic espionage. In addition, strong encryption can protect nationally sensitive information systems and networks against unauthorized penetration. Therefore, the use of strong encryption serves to protect national security rather than hinder it. Simply put, "on balance, the advantages of more widespread use of cryptography outweigh the disadvantages." I further call your attention to specific recommendations by the Committee: *National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. *No law should bar the manufacture, sale, or use of any form of encryption within the United States. *Export Controls on cryptography should be progressively relaxed. *The U.S. government should promote the security of the telecommunications networks more actively. *The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. *Aggressive government promotion of escrowed encryption is not appropriate... *The debate over national cryptography policy can be carried out in a reasonable manner on an unclassified basis. *National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. A core recommendation of the Committee is that the administration foster an open public debate so that a national consensus on cryptography can be developed. I agree wholeheartedly and hope that the public hearings beginning on June 12 in the Commerce Committee's Subcommittee on Science, Space and Technology, which I chair, will help foster this process. Many of the NRC's recommendations are reflected in the "Burns Pro-CODE bill," S. 1726, which will be debated on that date, with an additional hearing to be held on June 26. Now that some of the best scientific and technical minds in the country have essentially endorsed the position that business and policy advocates have been taking for years, it's time for the administration to come around as well. In conclusion, I can only agree with the Chairman Dam's statement: We believe that our report makes some reasonable proposals for national cryptography policy. But a proposal for action. What is needed now is a public debate, using and not sidestepping the full processes of government, leading to a judicious resolution of pressing cryptography policy issues and including, on some important points, legislative action. Only in this manner will the policy crisis come to a satisfactory and stable resolution. Sincerely, /s/ Conrad Burns U.S. Senator ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

Re: [Off-Topic] "Curfews"
by jim bell 17 Dec '03

17 Dec '03

At 07:45 PM 6/1/96 -0700, Timothy C. May wrote: >At 1:59 AM 6/2/96, Duncan Frissell wrote: > >>Of course curfew laws only control the inarticulate and scruffy. Well >>dressed children (coat and tie for the boys dress or suit for the girls) who >>can claim that they are out doing tons of protected things like work and >>school and worship and political campaigning and "trying to save street >>children for Jesus" will not be picked up. They can also say things like > >This, by the way, is the main thing that concerns certain civil rights >groups (including the Santa Cruz chapter of the ACLU). They say they'll be >monitoring enforcement patterns to see if more "children of color" are >picked up than their percentage in the population represents. This, the curfew situation, is yet another of the reasons I'd favor "playing hardball" with the government. I'm very much against discriminatory enforcement, but on the other hand I don't think my liberty should be dependent on getting an organization like the ACLU to look out for and complain against discrimination against me. I feel if a group of left-handed albinos think the police are being too hard on left-handed albinos, they shouldn't have to convince the ACLU of this, and should be entitled and able to fight back effectively and prevent what they view as abuse. True, such a situation may occasionally lead to abuses, but I strongly expect that those abuses will be far fewer than the current system. Jim Bell jimbell(a)pacifier.com

2 1

(no subject)
by ira 17 Dec '03

17 Dec '03

1 0

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 6/2/96 -0700, Martin Minow wrote: >>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >>the eagerly awaited (at least by this user) Java Crypto API. >---- ---- ---- >Notes from the security birds of a feather session >---- ---- ---- > >-- Need multiple security managers: if any say no, reject the request. >-- Servet, applet need different security managers. >-- Problem with firewalls: client accesses server via firewall via > proxy servers. May not be able to open a URL directly. >-- Java Commerce API coming for payment functions. >-- Problem with foreign applet vendors: how can a non-US security > class vendor certify a class to be used (outside the US). > Currently, it must be imported and signed by Sun. But, then > it can't be exported without a Commerce Department license. > No (current) plans to establish a signing authority outside > of the U.S. We've heard this assertion before. Why not import the software, generate a detachable signature, and then export the signature for re-attachment overseas? Surely export of signatures isn't controlled (even arguably) by ITAR. Jim Bell jimbell(a)pacifier.com

1 0

Insider Trading and Inside Information
by mpd＠netcom.com 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: > And, how can someone who acts on overheard information--as > in the elevator example Sandy cited--be charged with any > crime? Unless they are "insiders," covered by SEC rules > about trading, they are free to act on essentially anything > they hear. "He who hesitates to act on inside information is > lost." > (To elaborate on this: I was never classified as an > "insider" during my time at Intel, and I certainly bought > and sold the stock based on what products and news I knew > was coming out or what rumors I'd heard. Only a select group > of executives and staff in the specific departments > generating earnings announcements, auditing, etc., were > covered. And senior executives are covered by various rules > about trading stocks. And family members and friends may be > covered, if they learn of "inside" (in the SEC sense) > information. The SEC, in cooperation with the courts, has been gradually shifting the definitions of "insider" and "inside information" to more all-encompassing ones. It used to be that an insider was an officer of the company, or someone with a fiduciary relationship to the firm, such as a auditor or investment banker with which the firm did business. Inside information was also similarly limited to a narrow collection of material subject to regulatory restrictions on its disclosure. Nowdays "inside information" has been expanded to include anything that the general public is not privy to, and "insiders" can be almost anyone as well. Indeed, the current definitions can subject to criminal sanctions low level employees trading their company's stock on the basis of rumors, or newspaper columnists trading in anticipation of reaction to their published speculations. It's not even safe to trade on what formerly would have been known as "hot tips" any more, unless the average person in the street had a mechanism to access the information. The legal theory behind all this is that anyone, no matter who they are, trading on any publicly unavailable information, no matter what it is, might be perceived as profiting at the expense of the zillions of ordinary investors, whose continued playing of the Stock Lottery^H^H^H^H^H^H^H Market the govermment and big business definitely want to encourage. Not to mention the huge public support for the prosecution of anyone who the public thinks has "gotten away with something" that Joe Six-Pack didn't have the opportunity to do, and made a few bucks in the process. If this trend continues, I won't even be able to take an Intel janitor to lunch, and trade the stock based on his impression that Andy Grove looked particularly happy while having his office cleaned, without risking an "insider trading violation" should the stock go up. A new and interesting manifestation of the "Surveilance State." -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Ok, what about PGP (was: MD5 collisions)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 May 96 at 1:26, Chris Adams wrote: > How about a NSA-stomper option that would use all-of-the-above? For the truly paranoid (or > owners of Pentium-Pro 200Mhz multi-processor machines Chances are that if the algorithms alone aren't "NSA-stompers", an all-of-the-above option won't be. > Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? > (with the obvious speed decrease...) That would actually be less secure. RSA may be PGP's weakest link. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

penet to be compromised again? More Scientology lawsuit crap
by Deana Holmes 17 Dec '03

17 Dec '03

I just received some information on IRC channel #scientology that Julf Helsinghuis is being sued by $cientology *yet again* for a name. Apparently this has to do with the deposition request to Homer Wilson Smith (lightlink.com) Scamizdat #3 was posted through lightlink.com and the $cientologists have wanted for a long time to figure out who did it. (Which is why they sued Grady Ward.) Homer, in response to the deposition request, consulted his logs, and said that the original post came from penet.fi. So $cientology has apparently gone to the Finns again to ask that Julf be forced to give up the name. I'm appending a copy of the IRC log, as I'm too lazy to edit it down to particulars. It includes the name of the police officer involved (Kaj Malmberg) as well as a Finnish newsgroup and article id for the whole story. If someone knows Finnish and can give a rough translation, it would be terribly appreciated by a lot of people. <enclosed IRC transcript> <Ignatius> hi guys... do you have the latest news on Julf Helsingius' case? > Ig: what do you mean, latest news? <Sherilyn> The julf case? * Sherilyn didn;t know there _was_ a julf case... <Ignatius> ok... copyright offences are crimes under Finnish law, not torts. <Ignatius> Kaj Malmberg, the Finnish police officer who handles the investigation of the copyrighted material through penet.fi, posted an article to a domestic newsgroup today. <Sherilyn> Do you have the message-id and group name? <Ignatius> the scienos have filed a motion at a local court in Helsinki to force Julf Helsingius to give out the name of the poster. <Ignatius> sherilyn, are you good at Finnish? <Sherilyn> ig: lol! <skaplin> Who posted what through penet?? <Ignatius> the hearing is scheduled for the beginning of next week... perhaps already tomorrow. <Sherilyn> So was penet the server before lightlink in the scamizdat case? <Sherilyn> Homer gave them the name of the prior server, or was going to *** skaplin changes topic to "Penet under attack...Again!" <Sherilyn> Well this needs to be put out loud on groups where people use penet <skaplin> Ignatus: How good are you at translating? <Sherilyn> Last attack on penet got the scientologists a very bad rep > Ig: We need that post. > IN ENGLISH > ASAP! > even if it's a lousy translation. <Sherilyn> This cop guy speaks English <Sherilyn> Didn't he post in English to a.r.s.? > Sheri: he may not want to post it on a.r.s <Sherilyn> It's true, skap <Ignatius> i don't know more than what I already mentioned. The police officer didn't even mention Scientology; he just mentioned that he was investigating a copyright offence. <Sherilyn> She would make a lovely domina > sheri: you should see what I'm reading now :) <skaplin> We're sure penet is under attack for a name though... <Sherilyn> Bloody hell fire! <Sherilyn> I have 6440 posts downloading! <Ignatius> i'm writing an article to post to the ng:s, but it's obvious we don't have all the bits of the puzzle yet. <skaplin> Want some kippers with your spam sheri?? :) <skaplin> Ignatus: What newsgroup was it in? > ig: please post it asap. > also, send it to rnewman(a)cybercom.net. <Ignatius> skap, sfnet.keskustelu.laki; <4os5bu$flp(a)idefix.eunet.fi> <Ignatius> the police officer, Kaj Malmberg, is at kaj.malmberg(a)helsinki.poliisi.fi <end of transcript> Deana Holmes mirele(a)xmission.com

1 0