December 2003 - cypherpunks-legacy

CIA Fears Hackers, Anonymity
by jya＠pipeline.com 17 Dec '03

17 Dec '03

CIA Director Deutch's comments in the Defense Daily article below about hacker surveillance and the national security threat of anonymity: "Tools are readily available on the Internet, and hackers [computer experts] are a source for any foreign nation or terrorist organization," he said. The personal anonymity provided by cyberspace also aids foreign agents, Deutch said, adding that "hackers, with or without their full knowledge, may be supplying advice and expertise to rogue states such as Iran and Libya." The CIA and other agencies are working to collect information about hackers and their activities from both informants and from other advanced means, including signals intelligence, Deutch said. The CIA is working closely with the Federal Bureau of Investigations (FBI) and the Department of Justice to collect and analyze information about hackers and their relationships with organized crime and foreign agents, he said. ------ Defense Daily, 26 June 1996 Deutch Orders Information Warfare Estimate The nation's top intelligence official said Tuesday that he has ordered a major review of foreign threats to the U.S. information, banking, and telecommunications networks. "The treat of information warfare and the damage it could cause to the U.S. is so significant that it warrants an National Intelligence Estimate (NIE)," John Deutch, Director of the Central Intelligence Agency (CIA), told the Senate Government Affairs committee yesterday. He added that disruption of the information infrastructure could give terrorists or foreign governments the ability to weaken U.S. national security. "Information attacks could not only disrupt our daily lives, but also seriously jeopardize our national or economic security," he added. Deutch said he ordered the NIE to focus attention on how vulnerable the nation's computer-based telecommunications and information networks are to foreign governments and terrorist groups, which are both, despite their relative differences in personnel and funding, potential threats to U.S. information networks. Information warfare is neither manpower intensive nor an expensive form of terrorism, Deutch said, adding that even the smallest radical group can exploit the unregulated and undefended expanse of cyberspace. For example, the Islamic militant group Hezboullah has been using the Internet and other modern means of communications for their daily operations, Deutch said. Such technology could also be used to launch a terrorist act on the U.S., he added. This NIE will determine the damage terrorists or foreign governments could inflict were they to combine information warfare techniques with conventional military tactics to attack the U.S. An NIE, which details potential security threats to the U.S., is usually crafted by the National Intelligence Council (NIC), a senior panel of career intelligence officers and academics. This NIE, however, will also include comments from the U.S. law enforcement community, the Defense Information Security Agency, the armed services, and representatives from the major telecommunications providers, Deutch said. The threat estimate is expected to be complete by December 1, 1996, he added. Preliminary evaluations conducted by the U.S. intelligence community suggest that such a coordinated information attack could seriously disrupt electric power grids, air traffic control centers, banks and the stock market, or even the operational effectiveness of deployed U.S. military forces. Deutch is concerned about the ease with which enemy agents can obtain the hardware and software required to attack the information infrastructure. "Tools are readily available on the Internet, and hackers [computer experts] are a source for any foreign nation or terrorist organization," he said. The personal anonymity provided by cyberspace also aids foreign agents, Deutch said, adding that "hackers, with or without their full knowledge, may be supplying advice and expertise to rogue states such as Iran and Libya." In addition to the high technology, computer-based threat to the U.S. information infrastructure, foreign agents could use conventional explosives to destroy key information facilities and data processing centers. Previous studies conducted by the U.S. intelligence community suggests that numerous foreign nations are creating "cyber-warfare" techniques for application on the modern battlefield, Deutch said. Those programs are geared towards crippling an enemy's command and control centers or disabling air defense networks, he added. Based upon the progress made by these military programs, disrupting U.S. civilian and commercial information networks would be easy, Deutch said. The U.S. intelligence community has begun several activities in response to the emerging cyber-threat, he said. The CIA and other agencies are working to collect information about hackers and their activities from both informants and from other advanced means, including signals intelligence, Deutch said. The CIA is working closely with the Federal Bureau of Investigations (FBI) and the Department of Justice to collect and analyze information about hackers and their relationships with organized crime and foreign agents, he said. Both the intelligence and law enforcement communities are trying to work with private industry and academia in this cyber-warfare campaign, he said. The Pentagon and the CIA may reorganize existing personnel and efforts to create a new information warfare center at the National Security Agency, he added. -----

1 0

UK Crypto regs?
by Simon Spero 17 Dec '03

17 Dec '03

Anybody got a trip report for the IEE meeting yesterday? I phoned the IEE press office, but no-one there seemed to have any briefings, and there didn't seem to be any coverage Simon --- Cause maybe (maybe) | In my mind I'm going to Carolina you're gonna be the one that saves me | - back in Chapel Hill May 16th. And after all | Email address remains unchanged You're my firewall - | ........First in Usenet.........

3 2

Re: Crack for DOS
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:17 PM 6/27/96 -0700, you wrote: >2. If you were looking to compare single key block ciphers like Blowfish, >DES, 3xDES etc. Which one would be considered the best for implementation in >a software security package, assuming maximal key lengths irreverant of the >governmental restrictions. "Best" really depends on your criteria for goodness.... DES has been thoroughly explored, and people have a good idea of how strong it is and how easy it is to implement well in software. It's not strong enough (you can do a bit better than 2**55 brute force tries, and 2**55 isn't enough given modern computers), but you can take care of that by using Triple DES, preferably the 3-key form, which is strong enough for the forseeable future. It's also annoyingly slow in software form, having been designed for bit-twiddling hardware, but there are well-optimized versions on the usual archive servers. Blowfish is new, so perhaps there are flaws that 10-20 years of analysis will find. But it's pretty good - it's small, fast in software, and has an annoyingly slow key-schedule which makes it difficult to use brute-force crackers on. It's got variable key lengths. RC4 and RC5 are also new, fast, have variable key lengths, and appear to be quite strong if used with adequate choices of parameters. RC5 is patented; RC4 was a trade secret, since leaked, and you may get flak for using the _name_ RC4 in a commercial product. 40-bit keys make it exportable but easily brute-forced; 128-bit keys are quite strong. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0

Re: MS-Mail Security
by Bill Stewart 17 Dec '03

17 Dec '03

Leo WONG Wing-yan <wywong2(a)cs.cuhk.hk> > In> I would like to gather informations of whether the MS-Mail server > In> is secure or not, is anyone heard of somebody, say, disguise > In> as other user or read other user e-mail? You have to look at the whole environment. MSMail typically runs on MS-DOS / Windows PCs, on a network using Microsoft file server protocols over TCP/IP, so it has all the vulnerabilities of that environment. (It can run over Novell Netware instead, which has a somewhat more secure file server, but the system is still vulnerable.) The easy attack is to use a sniffer or other ethernet eavesdropping software to listen for MSMail messages on the LAN - they're not sent encrypted. It also runs over dialup, and the dialup and LAN versions rely on a user-typed login name and password for security, but don't require that the password meet any minimum standards for length (empty passwords work just fine.) MSMail is typically used for two different kinds of business applications - a purely internal mail system that doesn't connect to the outside world, or gatewayed to SMTP or UUCP to connect to other locations. I don't know how secure the gateways are, but the places I've seen them used they certainly haven't been reliable, and generally have been heavily hacked on by the users to make them do what the users want, which probably doesn't add to either the reliability or the security. The mail client has its own set of problems, such as choking on messages with more than 30KB of message body. My purely personal non-official opinion is that it's the third worst mail system I've ever used. (IBM PROFS is the worst, and I watched someone use the original Prodigy 1200-baud 24x40 lines with advertising on every page nonsense as well.) harka(a)nycmetro.com >I'd also like to know how secure the MS-Mail files are (*.mmf). >They are password protected and should be encrypted but >does anybody know how secure? For those of you who aren't familiar with MSMail, the .mmf file is the big hulking file that MSMail keeps all your mail in, including new mail and mail filed in folders (you _can_ split it so your Inbox resides in one .mmf on a mail server and all your other mail folders are in one file on your PC.) The main effects are - if the file gets corrupted (perhaps by a bad disk block, or because the "operating system" crashed while you were using MSMail), you can't read the undamaged pieces, - if you received a message that the MSMail client can't handle, like a large text message, you can't read it directly from the mail file using a text editor like Emacs. I haven't tried to crack it, but the experience of people who've cracked other Microsoft Office encryption (e.g. Word, Excel) has been that it's been pretty wimpy. It does prevent casual users of your PC or server from reading your email by looking at the file with an editor or by using the MSMail client without the password, but I'd be very surprised if it kept out a professional who wanted to take the time to attack it carefully. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0

GA law, spam, su etc.
by Deranged Mutant 17 Dec '03

17 Dec '03

So wait... if I'm on a Unix box in Georgia and I use the 'su' command, am I breaking the law? It would seem a 'better' law would outlaw the use of false identitity when comitting a crime, as is (supposeldy) the case in certain discrete carribbean islands... which begs the question, since a crime is a crime, and using a false id to commit a crime is just icing on the cake (and doesn't need to be outlawed anyway). Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

`` Cyber - Times ``
by `` Cyber - Times `` 17 Dec '03

17 Dec '03

========> Maximize your window for best viewing <============== ======> WELCOME TO CYBER - TIMES WEEKLY E-ZINE <========= =============> The BEST web site of the week! <================ ===============> CNN on the WWW! <====================== =========> Check Out Our Complete Marketing Package! <========= * Please do not be offended by this E-ZINE if you choose not to be informed of valuable information, simply reply and put UNSUBSCRIBE in the SUBJECT and you will receive no further issues. We are the PREMIERE Mailing Service on the Internet today, and we currently have a subscription list of over 2,000,000 people now! Remember, we're a FREE E-ZINE, so enjoy your issue. And if you wish to stay SUBSCRIBED to CYBER-TIMES E-ZINE simply do nothing and your FREE WEEKLY issue will keep coming! If you have any friends that would enjoy receiving a copy feel free to have them send a message to: subscribe(a)cyber-times.com then they will be added on our list. ----- Thanks you for your support ---- --- CYBER - TIMES --- * To place your ad in the Internet's Best E-Zine, go to the end of this E-ZINE. We are having a TREMENDOUS Weekly SPECIAL!! =====> GRAND OPENING: CYBER-TIMES MALL ON JUNE 28th <====== * To REPLY to an ad simply E-mail the address listed in the ad or visit there Web Site. /////////////////////////////////////////////////////////////////////////// ************** Government: Home-Business ************************ ============== NO MLM or SELLING ===================== Earn $500 to $1,000 weekly. This is a GUARANTEED Home-Business that was setup and created by the U.S. Government. We will even give you the phone number to call and verify the program. For FREE complete information visit us on the WWW at: http://members.gnn.com/HUDTRACER/fha.htm or E-Mail our auto-responder at:====> hud(a)cyber-times.com and you'll get complete information in 20 seconds!! //////////////////////////////////////////////////////////////////////////// Hiring Now! This truly is THE PERFECT JOB - working on your home PC. You can now telecommute from home with our International Software Company Co. We are seeking full-time & part-time personnel. We offer flexible hours. Must have a computer to process customers orders. Earn $25+ per hour. Must be a PRO and have a clear phone voice. E-mail experience helpful. If you are enthusiastic and have a positive personality call Mrs. Roberts at InterNetWorks at: (619) 781-4104. Call NOW ...24 hours a day! Working at home is the "Wave of the Future". Come Surf the Net with us and earn your financial reward. or e-mail my autoresponder at: internetworks(a)cyber-times.com ////////////////////////////////////////////////////////////////////////// Save 50% ON YOUR PHONE BILL with rates as low as 9.9 cents per minute flat rate day or night from Sprint, MCI, and WilTel. Home or business, billed in 6 increments. Not MLM. No fees, minimums, or commitments for most plans. Also available: 800/888#'s, calling cards, International callback, T-1's, and more. For complete rates, visit our web site at: http://www.catalog.com/impulse/tel.htm or Email: ad18(a)cyber-times.com //////////////////////////////////////////////////////////////////////////// HEALTHRIDER Blowout Sale- $399.99! For a limited time, the premier total body fitness machine that gently stretches and tones every major-muscle group in your body at the same time is offering a "blowout special" on all remaining demo-models for just $399.99. That's a $100.00 savings off the original price, so don't delay. This rare HealthRider opportunity is for a limited time and is good only while supplies last. Call us toll-free at (800) 529-2919 to get all the details! Now's your chance to start looking and feeling your very best! The number to call is (800) 529-2919. (Restrictions may apply) /////////////////////////////////////////////////////////////////////////// The Youngest MLM Co. ever Featured on the Cover of Success Mag. Awarded 1995 Best Company in MLM, by MLM Insider Magazine *Rated #1 by Market Wave/Profit Now, Jan. 1996 *World's most popular nutritionist, Dr. Earl Mindell *World's most technologically advanced products *PROVEN DOWLINE & SUPPORT SYSTEMS Voice box 800-566-5319/800-663-0631 ref. #32025-9 /////////////////////////////////////////////////////////////////////////// MONEY MAKING OPPORTUNITIES FOR WOMEN Want extra money? Want to be your own boss? Over **200** EXCITING and ENJOYABLE ways to make fast and easy money. Most require no training or investment. Work Full Time! Work Part Time! All Legitimate. Check out my 20 Page BOOKLET for ONLY $5.00. Send cash, check or money order to A. Tucker Box 371264 El Paso, Texas 79937. ////////////////////////////////////////////////////////////////////////// WORK FROM HOME! NO INVESTMENT REQUIRED. Experienced self- motivated telemarketers wanted! Excellent income possibilities selling our 12.9 c/min. FLAT RATE long distance service & 17.9c/min travel card (NO SURCHARGES), with 6 second billing. In test runs, telemarketers easily signed 10 new customers a day. One working full timer got 120 in 5 days. Pay STARTS at $5/customer. Earned raises and long-term residual income in compensation plan. 208-263-5681 9am-8pm PDT. /////////////////////////////////////////////////////////////////////////// SPORTS/ENTERTAINMENT Sports News, Point Spreads and MUCH MUCH MORE!! *ALSO Soap Opera Updates CALL NOW !!! 1-900-476-6368 EXT. 6761 $2.99 per minute Must be 18 years to Call Serv-U (619) 645-8434 /////////////////////////////////////////////////////////////////////////// THE PERFECT JOB FOR YOU! Are you looking for legitimate work to do at home and make above average income? WebWorks is seeking 100 agents to answer phones, return e-mail, process orders and offer technical support for our Online Service. For information email at: ad19(a)cyber-times.com or call Ms. Doughery for an interview at (409) 756-5669 9-6 p.m. Central Time. /////////////////////////////////////////////////////////////////////////// Do YOU need a BIG, permanent monthly income?? (up to $65,000/month?) Would YOU like to be able to help more people- family, charities? Have you been disappointed in networking/mlm programs? 16,000+ joined in OUR downline in April!! Some are already making $65,000/mo! Contact me BEFORE you join for benefits available only to our downline. Call NOW: 512-505-6838 (3-minute recorded message) Get fax on demand: 703-736-1600, doc 839 (call from fax-phone) E-mail: ad5(a)cyber-times.com Fax: 360-423-2238 Do it Now! //////////////////////////////////////////////////////////////////////////// INCREASE YOUR INCOME! Get that promotion you deserve or find that dream job you've been looking for. Learn the secrets of creating the ultimate resume that hiring managers choose most often. These techniques have been tested and perfected over the last 10 years. For complete, easy, do-it-yourslef guide, including the "How to Write the Perfect Bullet" section, send $14.95 to: M. Rogers, P.O. Box 583, Hayward CA 94543-0583 //////////////////////////////////////////////////////////////////////////// THE PERFECT JOB FOR YOU ! The perfect job for those who wish to work at home on their own computers!! S. S. Publishing is seeking Customer Service Representatives to answer E-MAIL and process INBOUND PHONE CALLS on your own telephone and computer. Must be positive, professional and have a pleasant phone voice and be familiar with e-mail. Experience preferred, but will train motivated, enthusiastic individuals. Full-time or Part-time positions available, you set the times that work best for you. Above average earnings!! For more information call S.S. publishing at 307-856-7090 or E-mail your daytime phone number to: ad20(a)cyber-times.com /////////////////////////////////////////////////////////////////////////// Love Making 2000 (M/F) A guide on creating intense emotions for increased and intense sexual pleasure. Discover feelings in your body that you never knew existed before. Highs you never thought were possible. Send $14.95 to Simmons Enterprises 1186-1124 Londsdale Ave. North Vancouver, B.C. V7M 2H1. Canada *As a BONUS a chapter called Designing the Lovers Playroom. *Receive $150.00 for your fantasy details in the book. ////////////////////////////////////////////////////////////////////////// "FAX MACHINES WORK!!! Use your Fax machine responsibly. Use it to make money (even while you are sleeping). I'll show you how. I'll give you living proof. Call me TOLL FREE with your name, FAX, and phone numbers at: 1-800-995-0796 ext. 2583 ////////////////////////////////////////////////////////////////////////// ============ THE PERFECT BUSINESS!!! ========== NO Sales! NO Monthly Purchases! NO Inventory! NO Recruiting! NO Phone Calls! NO Meetings! NO Overhead! One-time $120 to $750 outgo generates $HUNDREDS to $THOUSANDS per month income! ===========NOTHING ELSE REQUIRED!!========== We will build YOUR business. You get paid for OUR work!! The best investment you will ever make is owning your own business. For More Info ( 800 ) 955-3974 or e-mail: ad10(a)cyber-times.com ////////////////////////////////////////////////////////////////////////// WARNING!!! WHAT NO LONG DISTANCE CARRIER WANTS YOU TO KNOW!!! LONG DISTANCE SERVICE FOR AS LITTLE AS 9.9 OR 10.9 CENTS PER MIN. 9.9 or 10.9 cents interstate ANYTIME, ANYWHERE in the continental USA. 13.9 800#'s 17.9 cpm calling card, 16.9 rechargeable Debit Cards, No sign on fee, No monthly minimums, No volume requirements. One of the BIG THREE IS UNDERLYING CARRIER. Cut your cost to minimum or participate in referral commissions. Lifetime residual, churches, charities, non profit groups, businesses or individuals. Don't pass this up--it costs nothing to check us out. E-mail for details and more information: ad13(a)cyber-times.com /////////////////////////////////////////////////////////////////////////// Why Wait for ROMANCE...ADVENTURE? Let our #1 Singles Dateline find Attractive, Available singles in your area for you. Post/Listen to 100's of Personals. Call now and Connect! 1-900-369-0419 ONLY $1.99/min 18+ Futurefone //////////////////////////////////////////////////////////////////////////// PET PEOPLE Do you own an exotic bird or know someone who does? (GREAT GIFT) Lake Tahoes 1995 Entertainer of the year, Max Clever offers you this Tolly award winning Video. "Max Clevers" "BIRD TRAINING SECRETS" In the 90 minutes you will learn everything you need to know about training your bird I include TRICK TRAINING, potty training, taming, nutrition etc.. It's only $34.95 + $4.95 S+H to: Bird Traing Secrets 230 Bridge St. Collegeville, PA 19426 or 1-800-689-8707 all cards. Visit Website at: http://www.acy.digex.net/~questflm/ ////////////////////////////////////////////////////////////////////////////// MINIATURE BASEBALL *Sweeping the Country* *Finally a Realistic 4 Player Per Team Baseball Game* *Complete Rules* *Featuring the Auto-Ump, Utility Infielder, and Knockdown Rule* *Complete Blueprints and Stadium Designs* *Add on Products Available* 1-800-240-1263 ////////////////////////////////////////////////////////////////////////////// TRACE YOUR ROOTS Some of the history goes back to the 1400's in Ireland. Some of the USA discs cover as far back as 1725. Coming soon, the history of African-American's in the USA. Prices vary. Available is the search of a single family history for $39.95. **Not every single person that was born or died in an area is on the discs. ** E-mail: ad21(a)cyber-times.com Leave postal address for a complete list. ////////////////////////////////////////////////////////////////////////////// You've seen the rest, now try the best? Sounds familiar? I've been there too, and this is the company I joined! Believe me, if I can do it, so can you. I'll show you and lead every step of the way to a healthier, wealthier lifestyle that's also a lot of fun! Now opening in Europe. For free info without obligation, Simply E-mail: ad22(a)cyber-times.com ////////////////////////////////////////////////////////////////////////////// New Industry is Born! MARKET NETWORKING! Become a Leader in the Industry Build a solid Business via- Sharing - Helping- Teaching Simply, We have the System that Works! Income Potential is very Lucrative All we Need is "U" to spell SUCCESS Please call: Louie at 503-644-7714 or Fax to 503-671-9964 Norma Jean at 503-644-3634 ////////////////////////////////////////////////////////////////////////////// Large Corporation hiring Customer Service Reps to work from home taking orders for memberships to on-line service. All calls inbound. No selling. Earn $25+ per hour. Must have professional phone voice, and home computer for order entry. Email experience helpful. Only persons with those qualifications should CALL Mr. Bellet 1-804-643-3229 24 hours a day or EMAIL gatesnet(a)cyber-times.com ////////////////////////////////////////////////////////////////////////////// STAR LINK- GREAT SOFTWARE PRICES for PC's & MACS. We carry 1000's of software titles at low, low prices. Special discounts available for Students, Faculties, and Schools. PO's are welcome from Government Agencies, Educational Institutions, & Corporate 1000. Phone, Fax or Email for current prices, or to request a price list. Ph: (215) 953-8239 Fax: (215)953-8249 Email: ad23(a)cyber-times.com ////////////////////////////////////////////////////////////////////////////// ==========> TOP WEB SITE OF THE WEEK <================ =========> This is a MUST visit Web Site: <=================== ===============> http://www.cnn.com <===================== CNN Online is the best place to get up to the minute information around the clock. Business, Sports, Technology Reports, Health etc. ====================================================== Here's The Unbelievable Prices To Advertise Here. 1) 7 line classified ad to 500,000 people==> $49 =>Extra Lines => $2.00 2) 7 line classified ad to 1,000,000 people=>$99 =>Extra Lines => $4.00 3) 7 line classified ad to 1,500,000 people=>$149=>Extra Lines => $6.00 4) 7 line classified ad to 2,000,000 people=>$185 =>Extra Lines => $8.00 **** PLACE YOUR ORDER TODAY! THESE PRICES WON'T LAST LONG **** ****For anyone who advertises with CYBER-TIMES will receive 900 Places to Advertise for FREE on the World Wide Web and a FREE AD in CYBER-TIMES Electronic Mall for 1 year! We are here to see you achieve. ****Also, as you noticed in the ads above your mail is forwarded to you through our server!! So your E-mail address is not given out. =========================================================== ********** Complete Marketing Package ********** We have put together the most complete marketing package and are glad to make it available to you. Here's what we put together: =====> 2 Million E-mail Addresses =====>FREE copy of Pegasus Mail =====>900 Places to advertise FREE =====>Complete Internet Business Guide =====>FREE Auto-Responer for 1 FULL YEAR.=====>FREE 1 YEAR ad in our New Cyber Mall *If this is any interest to you please send a E-mail message to our Auto-Responder at: marketing(a)cyber-times.com And you will receive FREE complete information. ============================================================ ** We also build TARGETED E-MAIL LISTS for your special needs call 216-226-8799 For our SPECIAL PRICES!! So if you're selling something SPECIAL and you need a BRAND NEW FRESH TARGETED LIST, you're at the right place. And we'll even do the mailing of the list FOR YOU!! ============================================================ Here's a few of many testimonials we like to share with you. -------------------------------------------------------------------- " Your company is doing a terrific job for me! Thank you, Thank you! I am very impressed with your computer and marketing expertise. I will continue to send business your way. You deserve to get wealthy from this because you're doing a good job for people. You really give them their money's worth and do not cheat them like so many of these other e-mailing companies do. I have run ads with 3 others companies and NEVER got orders, like I do with you". Thanks. - Becky - ( California ) "I have placed ads with various companies such as "Cyber-Promotions", "South West" and "Pin-Point" you guys are by far the BEST. I have never gotten a better response and made more sales. I look forward to placing my ad again and again... Thank you. -Dennis- ( Illinois ) ========================================================= ============ " FLOODGATE " The Bulk E-Mail Loader. =========== If you ever heard of it now is your chance to get it. Learn step by step on how to extract E-mail addresses and send your sales letter out to over 500,000 people per day! You may have heard of similar programs like FREEDOM or HARVEST but don't be fooled by them this is the REAL THING! For FREE complete information simply send an E-mail message to our Auto-Responder at: flood(a)cyber-times.com Also, 2 MILLION E-mail addresses are included with your copy. ========================================================= -----------------------------ORDER-FORM---------------------------------- Yes, I want to place an advertisement in your Electronic-Magazine to the following amount of people. Check one Below: $39 - 500,000:_____ $59 - 1,000,000:_____ $79 - 1,500,000:____ $99 - 2,000,000:____ These prices above are 50% off the regular costs. This special won't last to long, get your spot now!! Ads are placed in order as they're received. There are never more than 26 advertisements in each E-ZINE! All advertisements can only be 70 characters per line and font size of 12. When sending payment include a copy of your ad, EXACTLY how you want it sent, and it will be sent that way. Including Extra Lines Total:_________________ ------------------------------------------------------------------------------- First & Last Name:__________________________________ Mailing Address:____________________________________ City:_____________________________ State:____________________________ Zipcode:_________________ E-Mail Address:____________________________________ Phone Number:_____________________________________ Make check or money order payable to: Creative Financial Alternatives Send Payment to: Creative Financial Alternatives CYBER-TIMES 14837 Detroit Ave. Suite 135 Lakewood, OH 44107 * If you have any questions or want to place an ad call: 216-226-8799 Thank you. * We also accept checks by Phone or Fax. You can place you order by phone, or tape your check to a piece of paper with all your ordering information and a copy of the ad exactly as you would like to place it and fax it to 216-226-3225. Phone: 216-226-8799 Fax: 216-226-3225 << Copyright 1996 - All Rights Reserved >> Cyber-Times, or any subsidiary thereof, accept no responsibility whatsoever for the content or legality of any advertisement that appears in any mailing. It is the advertisers responsibility to check with Local, State, and Federal laws pertaining to the product or service they advertise. Cyber-Times 14837 Detroit Ave. Suite 135 `\|||/ Lakewood, Ohio 44107 (o o) Phone: 216-226-8799 Fax: 216-226-3225 ooO_(_)_Ooo________________________________________________ _____|_____|_____|_____|_____|_____|_____|_____|_____|_____| _____|__ __|_____|_____|_____|_____|_____|_____|_____|_____| _____|_____|_____|_____|_____|_____|_____|_____|_____|_____|

2 1

Policy Post 2.26 - Sen. Crypto Hearing; SAFE Forum Cybercast; CDT on C-SPAN; more
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 26 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 26 June 28, 1996 CONTENTS: (1) Senate Encryption Hearing - Sea Change in Policy Debate (2) First Ever "Cybercast" of Congressional Hearing (3) SAFE Forum Live Online -- Join Us July 1st! (4) CDT Deputy Director Janlori Goldman on C-SPAN - 7/1/96 (5) How to Subscribe/Unsubscribe (6) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) SENATE ENCRYPTION HEARING ILLUSTRATES SEA CHANGE IN POLICY DEBATE On Wednesday June 26, 1996 the Senate Commerce Subcommittee on Science, Space, and Technology held a hearing to consider legislation designed to encourage the widespread availability of strong, easy-to-use, privacy and security technologies for the Internet. Wednesday's hearing illustrated that a sea change has occurred in Congressional attitude towards the encryption policy debate. While members of the Subcommittee noted the complex law enforcement issues raised by the encryption policy debate, the Senators also recognized that because of the global nature of the Internet, top down regulations such as export controls and centralized government mandates like the Clipper schemes will not address the needs of individuals, business, and even law enforcement in the Information Age. In addition, several Senators noted that future of electronic commerce, privacy, and the competitiveness of the US computer industry should not be held hostage to law enforcement considerations. This change in Congressional attitude towards encryption policy is significant and extremely encouraging. Wednesday's hearing was also significant because it was the first ever Congressional hearing cybercast live on the Internet. Details on the Cybercast are attached below. The hearing, chaired by Senator Conrad Burns (R-MT), was called to consider the Promotion Of Commerce Online in the Digital Era (Pro-CODE) legislation, which would relax current regulations restricting the export of strong encryption. Witnesses testifying before the panel included: * Phil Zimmermann, Inventor of PGP * Whit Diffie, Sun Microsystems, Father of Public-Key Cryptography * Phil Karn, Qualcomm Inc, Cryptographer * Marc Rotenberg, Director, Electronic Privacy Information Center * Jerry Berman, Executive Director, Center for Democracy and Technology * Matt Blaze, Lucent Technologies Cryptographer, * Barbara Simons, Chair of US Public Policy Committee, ACM * And 135 Netizens (http://www.crypto.com) CDT Executive Director Jerry Berman also testified before the Subcommittee. Noting that the current US encryption policy has left individual Internet users without adequate privacy and businesses without necessary security, Berman urged Congress to instead move forward to reform US policy based on the following principals: * THE INTERNET IS NOT LIKE A TELEPHONE SYSTEM: The traditional approach to wiretapping cannot simply be extended to the Internet. This new medium encompasses a range of social functions far beyond simple two- way voice communication. These broad activities demand a heightened capacity for uses to protect their security and privacy online. * THE INTERNET IS A GLOBAL, DECENTRALIZED MEDIUM: Efforts to impose unilateral national policies -- such as export controls or key escrow proposals -- are unlikely to be accepted widely. Decentralized user choice solutions to privacy problems are preferable to and more effective than centralized, governmental mandates (such as the Clipper proposals). * ON THE INTERNET, THE BILL OF RIGHTS IS A LOCAL ORDINANCE: Constitutional guarantees of privacy and free expression to U.S. Citizens whose communications regularly cross national borders. Policies should be designed to protect Americans outside the shelter of U.S. law. Berman expressed CDT's strong support for Congressional efforts to reform US Encryption policy, and urged Congress to act quickly to liberalize export controls and provide American Internet users with the strong security and privacy they so badly need. Audio transcripts of the Hearing, copies of the prepared statements of the witnesses, and other background information is available at CDT's encryption policy web page: http://www.cdt.org/crypto/ HEARING SHOWS NEW SENSE OF URGENCY AND FOCUS IN CONGRESS The clearest example of the emerging frustration in Congress with the current export restrictions came in an exchange between Senator John Aschroft (R-MO) and Phil Karn, a cryptographer with Qualcomm and a plaintiff in a case challenging the export restrictions: Sen. Aschroft: So for all other countries, the world is the market, but for American companies, America is the only market and the rest of the world is off limits? Karn: You've got it. Sen. Aschroft: Mr. Chairman, I think that's one of the reasons we need to look very carefully at the bill (Pro-CODE) we are looking at here today... Sen. Aschroft: In all our discussions about whether it (cryptography) is good or bad, we ignore the fact that it's THERE, and it can be available to Americans by American companies, it cannot be available to anyone else by American companies, but it can be available around the world by a company in any other country. This exchange, as well as strong statements in support of the Burns Pro-CODE bill from Senators Patrick Leahy (D-VT), Ron Wyden (D-OR), and Representative Bob Goodlatte (R-VA), who made the unusual move of coming to a Senate hearing, show that Congress is finally giving the need to reform US encryption policy serious support. A hearing of the full Senate Commerce Committee, chaired by Senator Larry Pressler (R-SD) is expected in mid July. Representatives from the Administration and Law Enforcement agencies are expected to testify. CDT is working with Senator Burns' and Senator Pressler to bring that hearing live online. Check CDT's "Congress and the Net" Web Page at http://www.cdt.org/net_congress/ ----------------------------------------------------------------------- (2) FIRST EVER CYBERCAST OF CONGRESSIONAL HEARING SHOWS CONGRESS' GROWING DESIRE TO REACH OUT TO THE INTERNET COMMUNITY Wednesday's hearing was the first Congressional hearing to be cybercast live on the Internet. The cybercast, coordinated at the request of Senator Burns by the Center for Democracy and Technology, HotWired, DIGEX, and the Voters Telecommunications Watch, provided Netizens around the world with the opportunity to be a part of the Congressional debate on an important Internet policy issue. By reaching out to the net.community and providing netizens with an opportunity to participate in the hearing (Senator Burns asked several questions posed by the online audience), the cybercast marked an historic moment in the evolution of the net.community as a political force. In addition to a live audio feed from the hearing, approximately 40 netizens participated in a simultaneous discussion of the hearing in a chat area on HotWired. A member of Senator Burns' staff also joined the discussion from inside the hearing room, providing insights into the proceedings, answering questions from the audience, and delivering audience questions to Senator Burns. The goal of the hearing cybercast, as well as other recent CDT sponsored online discussions with members of Congress, is to bring the net.community and Congress together on critical Internet policy issues in order to encourage a constructive dialogue and mutual understanding. CDT is pleased to have been a part of this historic event, and looks forward to bringing the next Senate Encryption hearing tentatively set for mid-July online. Audio transcripts from the hearing are available at: http://www.cdt.org/net_congress/ ---------------------------------------------------------------------- (3) SECURITY AND FREEDOM THROUGH ENCRYPTION FORM -- JULY 1, STANFORD CA The Security and Freedom through Encryption (SAFE) is set for July 1 in Stanford, California. The event will bring together members of Congress, privacy advocates, cryptographers, and industry leaders for a discussion on the need to reform US encryption policy. A complete list of speakers and the program schedule is available at the URL below. HOW TO PARTICIPATE IN THE SAFE FORUM * The Forum is free and open to the public. You can reserve your free ticket by visiting http://www.crypto.com/safe SPACE IS LIMITED AND YOU MUST REGISTER BY 12:00 MIDNIGHT EDT/9:00 pm PDT SUNDAY June 30. * The SAFE Forum will also be CYBERCAST LIVE ON THE NET! For information on how you can join, visit: http://www.crypto.com/safe/cybercast.html ----------------------------------------------------------------------- (4) CDT DEPUTY DIRECTOR TO APPEAR ON C-SPAN'S WASHINGTON JOURNAL MONDAY JULY 1 7:45am EDT / 4:45am PDT CDT Deputy Director Janlori Goldman will appear on C-SPAN's interview program "Washington Journal" on Monday July 1 at 7:45am EDT / 4:45am PDT. She will be discussing privacy issues on the Internet. The program will also highlight CDT's Privacy Demonstration and Online Privacy Clearinghouse. CDT's Privacy Demonstration and Privacy Issues Page can be accessed at: http://www.cdt.org/privacy/ ------------------------------------------------------------------------ (5) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (6) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.26 6/28/96 -----------------------------------------------------------------------

1 0

BW: E-commerce
by caal＠hopf.dnai.com 17 Dec '03

17 Dec '03

> (KPMG-PEAT-MARWICK-STUDY) American companies forecast huge growth in > electronic commerce, but study uncovers concern about the impact of > ambiguous state tax laws > > Business Editors > > NOTE: The following news release replaces > BW1109, which was upheld by KPMG Peat Marwick. > This revised version is for immediate release. > > NEW YORK--(BUSINESS WIRE)--June 27, 1996--An overwhelming nine > out of ten financial executives at American companies currently > engaged in buying and selling goods or services over the Internet > caution that government must clarify the associated state and local > tax implications if this new method of doing business is to reach > its full potential, according to a study conducted on behalf of KPMG > Peat Marwick LLP. > > "This study shows that electronic commerce is taking off," said > Kent Johnson, National Partner-in-Charge of KPMG's Sales and > Transactions Tax practice. "But it also reveals the frustrations of > corporate America as it tries to cope with the murky environment > created by applying old tax laws to new ways of doing business." > > Johnson continues: "Taxation of electronic commerce varies from > state to state so determining what's taxable and who is responsible > for paying those taxes becomes very complex." > > Survey respondents appear to agree. Almost seven out of ten > respondents (67%) say that state and local tax laws governing > electronic commerce are ambiguous, while more than half of those > polled (51%) say that this ambiguity is already inhibiting their > involvement in electronic commerce. Furthermore, 50% say they are > "not very" or "not at all" familiar with the sales and transaction > tax implications -- twice as many as those who say that they are > "very" or "extremely" familiar with the tax issues. In fact, 20% > of the financial executives surveyed do not know if their companies > are even subject to sales and transactions taxes for the sale of > products and services over the Internet. > > Johnson says that these statistics are particularly distressing > because several states and municipalities have already begun taxing > certain Internet services. > > "The huge growth potential of the Internet has undoubtedly > caught the attention of state tax administrators who are eagerly > looking for ways to apply existing tax laws and capture some of the > revenue this business generates," said Michael H. Lippman, > National Partner-in-Charge of KPMG's State and Local Tax Technical > Services. "On the other hand, companies are saying that tax law, in > its present form, cannot be applied to the new world of electronic > commerce. They are calling for, at the least, a rewrite of the > statutes and many contend that the states should give electronic > commerce time to develop before imposing taxes." > > Companies' concerns about taxes, however, go beyond those > related to the bottom line. More than half of those surveyed (53 %) > think taxing electronic commerce has the potential to become a > significant threat to privacy. Other specific areas of concern > include: "the crafting of equitable laws from state to state and > across industries" and "fear that state taxing authorities will take > a very aggressive approach in determining whether a company is > taxable in its state." > > Said Johnson of KPMG's Sales and Transaction Tax Practice: "Even > though companies are saying they're concerned about the impact of > state and local taxes on electronic commerce, very few have been > proactive in working with taxing authorities to help ensure > equitable rules." Nearly seven out of 10 companies (68%) say that > they are "not very" or "not at all" involved with efforts to > affect state and local tax policy, compared to only one in 10 > companies that are "very" or "extremely involved." However, > exactly half of respondents (50%) claim they do intend to become > involved in industry group discussions and debates in the future. > > Looking at taxation of electronic commerce from an international > perspective, Jeff Stein, National Partner-in-Charge of KPMG's > International Services, notes that the impact of ambiguous tax laws > on electronic commerce is even more heightened as companies expand > their sales and operations overseas. > > "Electronic commerce has the potential to fuel the engine for > future growth of U.S. exports," notes Stein. "In fact, 83 percent > of study participants believe that electronic commerce will be a > major vehicle for U.S. exports." > > About one-third of companies believe that state and local taxes > imposed on electronic commerce diminish their international > competitiveness. Indeed, some companies even said that that they > would consider moving their Internet activities offshore to escape > state and local taxes in the future. But, KPMG cautions, such a > move might not provide the anticipated tax haven because > jurisdictions around the world are revenue-starved and will be just > as aggressive as individual states in imposing taxes on companies > engaged in electronic commerce. > > "There are a great deal of unknowns when it comes to electronic > versus traditional commerce. We've been advising our clients to > develop a multi-level, flexible approach that positions them for > sudden changes in policies. At the same time we'll continue to work > with regulators to help clarify how current tax laws can be fairly > applied to business in the 21st century," said Lippman. > > Editor's note: The KPMG Study was executed by Clark, Martire & > Bartolomeo, Inc. during June 1996. Results of the study will be > available through KPMG's State and Local Tax Practice World Wide Web > Site at HTTP:\WWW.US.KPMG.COM\SALT\ or by calling Patricia Neil, > KPMG's director of State and Local Tax Marketing & Communications at > 212/872-6570. > > For the purpose of this survey, electronic commerce is defined as > buying or selling products or services over the Internet. The > survey was conducted among 291 companies with gross revenues in > excess of $50 million. They span four industry groups: publishing; > software/business services/ advertising; communications; and > manufacturing/distributing/retail. > > KPMG Peat Marwick LLP is the U.S. member firm of KPMG, The Global > Leader among professional services firms. Worldwide, KPMG has more > than 6,000 partners as well as 76,000 professionals servicing > clients throughout 1,100 offices in 837 cities in 134 countries. In > the U.S., KPMG partners and professionals deliver a wide range of > value-added consulting, assurance and tax services in five markets: > financial services; manufacturing, retailing and distribution; > health care and life sciences; information, communications and > entertainment; and public services. > > --30--bk/ny* > > CONTACT: Pat Neil > KPMG Peat Marwick LLP > 212/872-5506 > E-mail: pneil(a)kpmg.com > or > Jackie Kaldon/Constantine Theodoropulos > Shandwick USA > 212-420-8100, ext. 213, 217 > 800-223-2121 > E-mail: jkaldon(a)shandwick.com > > KEYWORD: NEW YORK > INDUSTRY KEYWORD: TELECOMMUNICATIONS GOVERNMENT COMED > > REPEATS: New York 212-752-9600 or 800-221-2462; Boston 617-236-4266 > or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW > URL: http://www.businesswire.com > > > > Copyright 1996 BusinessWire. All rights reserved.

1 0

Re: MS-Mail Security
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-06-27 21:39:21 EDT, harka(a)nycmetro.com writes: >I'd also like to know how secure the MS-Mail files are (*.mmf). They are >password protected and should be encrypted but does anybody know how secure? > >Harka >___ Blue Wave/386 v2.30 [NR] > > as far as I know.. the encryption used on them is weak. I think ive seen a generic cracker for these on the internet. I dont think MS is going to put the time into a good VERY secure encryption for this.. because then aftermarket things wouldnt be bought!!! hehe

1 0

Another free speech victory
by Anonymous User 17 Dec '03

17 Dec '03

Just read that the Supreme Court "struck down provisions of the 1992 Cable Act that require local cable companies to either ban indecent shows from appearing on leased or access channels or place all programs deemed indecent on a single channel and block it. Those provisions violate free-speech rights, the court said. But the court said Congress lawfully can permit cable operators to choose not to broadcast such programs on leased access channels." [NYT] Looks like the gov't will lose if it decides to appeal the CDA decision. Medea

1 0

secure WWW on UNsecure servers
by Kevin Q. Brown 17 Dec '03

17 Dec '03

I know several people who want to share private information on some web pages but do not trust any publicly-accessible web server not to leak the information on those pages. The normal IP address or password-based web page protection mechanisms thus are not sufficient since they assume that the server is secure from non-web-based mechanisms for retrieving the pages. Also, encryption schemes such as SSL will not solve the problem because they protect only against interception between the server and the client, not at the server itself. Instead, it looks like the web pages must reside on the server in encrypted form. How might one arrange for these encrypted web pages residing on an (unsecure) server to get decrypted only at the client's machine? This should work as transparently as possible for the user; except possibly for a userid/password query it should look like a normal web browsing session. For now, we can assume that the decrypted web pages contain only HTML and images in .gif format. Might this best be done with some combination of special MIME types and helper applications or plug-ins? Has someone already done it? Thanks. Kevin Q. Brown kqb(a)c2.org

5 4

Re: Another free speech victory
by jim bell 17 Dec '03

17 Dec '03

At 11:05 AM 6/28/96 -0700, Anonymous User wrote: >Just read that the Supreme Court "struck down provisions of the 1992 >Cable Act that require local cable companies to either ban indecent >shows from appearing on leased or access channels or place all >programs deemed indecent on a single channel and block it. Those >provisions violate free-speech rights, the court said. But the court >said Congress lawfully can permit cable operators to choose not to >broadcast such programs on leased access channels." [NYT] > >Looks like the gov't will lose if it decides to appeal the CDA >decision. >Medea However, it's worrisome that the decisions were only 6-3 and 5-4. Jim Bell jimbell(a)pacifier.com

1 0

anonymous mailing lists
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: Cypherpunks ## 06/28/96 04:34 pm ## Subject: anonymous mailing lists ] >Date: Fri, 14 Jun 1996 02:15:03 +0000 (GMT) >From: Ecafe Mixmaster Remailer <mixmaster(a)remail.ecafe.org> >Subject: Hackerpunks and C2 >The proposal for a Hackerpunks nym based mailing list is >interesting, however, there are some concerns regarding the >susceptibility of the list to traffic analysis. I was thinking about attacks that can be carried out on remailers in general, and came up with something that is potentially pretty nasty, especially for anonymous mailing lists and people who post a lot of stuff anonymously using ``nyms.'' Let's imagine an anonymous remailer network as a ``black box'' which functions perfectly. Messages (broken into equal-sized packets and strongly encrypted) are sent into the network by the sender, and at some later time, they come out at the receiver. Let's assume there is no possible way for an attacker to trace a message through this network. Now, we still have to deal with two more issues--mail goes into the network, and comes out of the network. At those two points, there is trafic analysis available. Specifically, we can see how much data goes over the line. (Naturally, if it's encrypted, we can't tell how much of it is real data and how much is padding.) Generally, when we're attacking this system, we're trying to figure out either the sender or the receiver of a message (or a sequence of messages), based on what we can observe coming into and going out of the network of remailers. There are basically five scenarios: 1. The sender wants to know who the receiver of his message is. 2. The receiver wants to know who the sender of his message is. 3. An outsider wants to identify the sender of a message. 4. An outsider wants to identify the receiver of a message. 5. One receiver of a message wants to know who the other receivers of the message are. (This is the case for anonymous lists.) Now, there are a couple of different ways these attacks can be carried out. Usually, I've seen people talk about ``tracing'' attacks, in which a message is traced from one side of the network to another, without any clear idea of who might be on the other side. However, I think a more realistic situation is to imagine the attacker trying to test the hypothesis that some person is on the other end of the anonymous transmission. If relatively few people regularly send or receiver anonymous e-mail, then this is practical for many kinds of test. It's even more practical when we're dealing with relatively small populations of interested people in some technical subject. (This is conceptually similar to the ``dictionary attack'' on passphrases.) Basically, what we're looking at, in that case, is some test which (with some reasonably high probability) determines whether some person is the sender or receiver of a given message or stream of messages. This leads to some interesting insights. 1. In reasonably large text messages, it's probably easy to test hypotheses about senders. There are metrics that can more-or-less identify the writer of a piece of prose. While it's no doubt possible to defeat this kind of analysis for some things (i.e., blackmail notes or rigidly-defined messages in a cryptographic protocol), I suspect that this is very hard to defeat for a mailing list where the objective is to discuss serious technical issues. (This kind of analysis also causes headaches for people trying to do strong steganography in text.) 2. If an attacker (i.e., the NSA) logs the total volume of all traffic in and out of the remailer network, and to whom each message came from or went to, then that attacker can probably mount some very powerful hypothesis-testing attacks. It's these attacks I want to discuss. If Alice sends a message to Bob through the remailer network, two things must happen to prevent it from being trivially traceable. 1. The message has to change size. If the message is already encrypted, then compression isn't much of an option--so what's left is padding it out by a random amount. The amount of padding per message is probably a uniformly distributed random variable. 2. The message has to be delayed somewhat. The delay is probably also a uniformly distributed random variable, or possibly the result of adding N such variables, where N is the number of chained remailers. For a single mailing, this is probably not much of a threat. There will be enough ``noise'' in the delay and padding that most transmissions will be masked. However, consider the situation of a mailing-list. Alice and Bob are both recipients of the list. Alice wants to decide whether Bob is receiving the list. Let D be a delay such that, if Alice received her copy at time T, 90% of the other list members received their copy between T-D and T+D. Now, Alice looks at Bob's anonymous e-mail volume during that time span vs. at all other times. If he's receiving the same stuff she is, then there should be an increase within that span of time, on average. The random distribution of the arrival time will mask individual transmissions, but with many messages, it probably will not. (This is conceptually similar to the situation in Paul Kocher's timing attacks--adding some random pauses doesn't hurt the attack as much as most people expect it to, because those random pauses, summed up over many messages, become a normally distributed random variable.) The average amount of anonymous e-mail Bob gets per day doesn't have much effect, nor do occasional worst-cases. The only ways I can see to prevent this attack are either to ensure that Bob gets a constant rate of information from the anonymous remailer network, or to make the arrival time span so large that other randomness in the sample makes the change in volume undetectable. In general, I don't think this second one will work without accepting incredible delays on messages. This can also be adapted to tracing back anonymous posters to newsgroups and mailing lists, when they use a consistent nym. (They could also be traced by textual analysis.) In this case, the attacker starts by posting some anonymous messages (not using a nym--he doesn't need one), to get some statistics on what the average delay is, and also what the average amount of padding is. He may do this for several different ways of putting things together--he's got almost unlimited time to gather acceptable data. At this point, he observes in/out traffic logs for each hypothesized sender during a wide timespan before the arrival of the post at its destination. He compares activity inside that span with activity outside, over a large number of posts. If there is a correlation, then he's got the e-mail address of the nym. There are ways to get around this second attack, at least to some extent. However, I don't think it's wise to count on even very good remailer networks (i.e., the Mixmaster stuff) to protect your anonymity in this situation. (However, note that I'm thinking in terms of a very well funded, determined adversary. It's probably not too bad to count on it to protect your anonymity from technically unsophisticated attackers--but I wouldn't recommend using it for things that (say) the FBI or NSA might get very interested in.) I think the best defense against this will be something like this: Each user sets a quota of how much trafic he will take in and send out per day. Once per day, he goes through an interaction in which he downloads and uploads that much stuff, whether there's any of it for him or not. (Naturally, this won't be detectable from looking at the transmission, timing the interaction, etc.) This makes any volume variations per day disappear. Unfortunately, it also limits the user's total inflow and outflow, which means he'll have to set it to something larger than the maximum he ever expects to get. (It would be possible to have occasional overflow onto the next day's downloads, but not too often, or the user would fall further behind, on average, each day.) The size of these quotas will still leak some information, though not enough for the kinds of attacks I discussed above. Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdRWR0Hx57Ag8goBAQHCowQA71WBKkx1yonS0dEpy3pe7lgvSJPkpLUk zLjm0KeFoP+HGQBep48iILRYBlbGy5czcxNCU4zhE6+c4PWwvD+BpaGGccWWkyRi 0l/rdo5L5/1KgnpCAQJ/HNyRH0fO2NNOHvGB3m7I0H3lfmfOlNed8oIIjPFDVB23 60wpMZ9S93w= =HC1g -----END PGP SIGNATURE-----

5 5

Re: rsync and md4
by jim bell 17 Dec '03

17 Dec '03

At 01:19 PM 6/29/96 -0400, Mark M. wrote: >> A first guess might be 2^-128 but I know that this sort of thing is >> rarely that simple. Is md4 that good? > >2^-64. >> >> Note that I am not interested in "attacks" on md4 as such as the >> source of the random data is just another file provided by the same >> user, so it won't have been specially designed to defeat md4. >> >> If the probability is within a few orders of magnitude of 2^-128 then >> can I also be sure that if I only use the first b bits of a md4 >> checksum it will be within a few orders of magnitude of 2^-b ? There >> is an option in rsync to use a shorter checksum by truncating >> md4. This saves some bytes on the link at the risk of lowering the >> confidence. > >The probability of failure is 2^-(b/2). I don't think that's correct. That would be the correct formula if I were looking for two strings that happened to have the same hash value, but that's not what he's asking for. Jim Bell jimbell(a)pacifier.com

1 0

John Grubor and you
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Lucifer Remailer Operator wrote: >Just for the record, I am NOT John Grubor and had never even heard of him >before I did an Altavista search on his name earlier today. The concept that >some net.loon like Grubor would get another account with DHP to run an >anonymous remailer for whatever reason is LAUGHABLE. From what I have read, >Grubor spams newsgroups quite often, something I have not done nor plan on >doing. I was expecting people to be posting paranoid rantings about how I >am obviously a SPOOK... Why you were expecting people to be posting paranoid rantings if you did not even know who Dr. John Grubor, undercover police agent, was?

2 1

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

declan(a)well.com (Declan McCullagh) spake thus and so: >WASHINGTON, DC -- With no fanfare and no hype, the Justice Department >yesterday faxed a 39-word statement to Senator Exon saying they will >appeal their loss in the Philadelphia case. > >The consolidated lawsuits of ACLU v. Reno and ALA v. DoJ resulted in a >victory for the plaintiffs earlier this month after a three-judge panel >granted a preliminary injunction preventing the DoJ from enforcing the >Communications Decency Act. Sounds like a case of "political testicles in a vise." This smells like an election-year maneuver so the Clinton administration can maintain its faade. (After all, who wants to be called "soft on the protection of children"?) By the time it's finally settled, the Congresscritters will have been re-elected and can go merrily back to perverting the Constitution. So how'd we wind up having to choose between *these* two yahoos for President? :-)

1 0

PC-ness of nym.alias.net
by Rich 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 28 Jun 1996, Anonymous wrote: > I would appreciate any information members may have regarding the > security/safety of the new nym server nym.alias.net (in "alpha" state) who > posted here about 3 weeks ago. Nym.alias.net reportedly is the same > machine as anon.lcs.mit.edu. > > Specifically, is the individual running the nym _known_ to cypherpunks, or > is this an unknown about whom I should have serious doubts. I could tell you who it is, but then I'd have to kill you. So let's just stick to publicly available information. According to the root DNS servers, which as we know are controlled by a ZOG defense contractor, alias.net is an alias for alpha.jpunix.com, and anon.lcs.mit.edu is indeed the same as nym.alias.net. alias2-dom is said to get name service from Sameer and company, but that could be a trap. Obviously, they've infiltrated pretty deep, but thanks to you, we know to be careful. Then again, this could just be FUD from another Fucking Statist. Who knows? Somewhat more seriously, wouldn't it be nice if the various remailers signed each other's keys? - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMdScnJNcNyVVy0jxAQEwFQH/ZXv+9Nj5ZDjk5FpA33T+kw68H39p/SuW Ab/hRfGGkZX97PIa50C7UVu4YROYE9RYcn7kalsZgFKOsJKAq3JKIw== =1CQg -----END PGP SIGNATURE-----

2 1

rsync and md4
by Andrew Tridgell 17 Dec '03

17 Dec '03

I've recently released a package called rsync that uses a checksum search to provide very efficient file update over a slow link. (see ftp://samba.anu.edu.au/pub/rsync if you are interested) Now I'd like to calculate some probabilities of failure of the algorithm. The fundamental thing I need to know to do the calculation is the probability of a random piece of data of length n having the same md4 checksum as another given piece of data of the same length. A first guess might be 2^-128 but I know that this sort of thing is rarely that simple. Is md4 that good? Note that I am not interested in "attacks" on md4 as such as the source of the random data is just another file provided by the same user, so it won't have been specially designed to defeat md4. If the probability is within a few orders of magnitude of 2^-128 then can I also be sure that if I only use the first b bits of a md4 checksum it will be within a few orders of magnitude of 2^-b ? There is an option in rsync to use a shorter checksum by truncating md4. This saves some bytes on the link at the risk of lowering the confidence. Why md4? I chose md4 because it seemed to be the fastest of the reputedly strong, publicly available checksum algorithms. Suggestions for alternative algorithms are welcome. Cheers, Andrew

2 1

Re: News: NEC has encrypted networks ...
by jim bell 17 Dec '03

17 Dec '03

At 10:52 PM 6/28/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 28-Jun-96 News: NEC has encrypted >net.. by Ernest Hua(a)XENON.chromat >> Japanese companies catching up and passing American companies >> should scare those Congressional critters into action: > >Realistically, there's not a chance in hell Pro-CODE will pass this >session. >-Declan Which reminds me... About that NTT chip: While I haven't been looking particularly carefully for it, I haven't noticed an announcement in any of the electronics magazines I normally read. Has anyone seen a reference to it? I think we ought to learn more about it: Does it implement an open standard, so that other manufacturers can build compatible phones? Jim Bell jimbell(a)pacifier.com

1 0

www hacking?
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

I havent seen much in lines of this being a problem yet..although I was reading through practical unix security (newest edition) and it made mention of the danger of hacking WWW. Forgive my ignorance on this.. but what dangers are there? I could see someone attacking the main server and do damage in that sense..but Im a little outdated in this as far as what is attacked. The only thing Ive ever had to worry about was unix, now theres oh-so much more. If someone could tell me the dangers of someone attacking someones site..etc..on the WWW, I would much appreciate it! Thanks Adam

2 1

unsuscribe
by ryans＠worldchat.com 17 Dec '03

17 Dec '03

unsuscribe

2 1

mocking paranoia
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Earlier, someone mocked someone else for being paranoid. Sorry, but this is a mistake. By definition, you have a non-empty threat model when you set out to encrypt; therefore you must be paranoid to use encryption. Or else they really *could* be out to get you, but sometimes it's not possible to tell, and you have to assume that they are. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Open letter to the NSA
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

You screwed up, guys. If, instead of restricting the export of strong crypto systems, you had instead encouraged it, you would have prevented the development of foreign crypto expertise. Look at South Africa: we banned them armaments, so they created their own arms industry. Now they're a serious arms exporter. You won in the short-term and lost in the long-term. Where is the wisdom needed to admit your mistake? Missing, I'd say. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Re: rsync and md4
by jim bell 17 Dec '03

17 Dec '03

At 01:50 PM 6/29/96 +1000, Andrew Tridgell wrote: >Why md4? I chose md4 because it seemed to be the fastest of the >reputedly strong, publicly available checksum algorithms. Whatever you do, PLEASE stop using the term "checksum" when what you really mean is CRC, hash or something else. A "checksum" is a bad error checker, only somewhat better than none at all. If you use the term "checksum" some neophyte might actually misinterpret what you're doing and implement a real, honest-to-goodness checksum in his next program. Jim Bell jimbell(a)pacifier.com

1 0

Re: RFD: Developing Nations and crypto (based on excertp from Edupag
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:48 AM 6/26/96 -0700, Timothy C. May wrote: > Sadly, most developing countries (Third World, LDCs, whatever) have > repressive governments of various stripes...few are libertarian. Several > have embraced computer technology, but primarily as an instrument of social > control. This is true, but basically back to front. Certain common forms of repressive economic policy cause poverty. From time to time political convulsions change this policy for a long period. If the period is several decades, development follows. In the past, popular support for these repressive policies was vast and overwhelming, and once in place they could only be changed by fairly murderous dictatorships, for example South Korea and Chile. Popular support for these policies is still substantial, but has steadily diminished. In my opinion this diminishing support is largely the result of improved international communications. When people in poor countries discover that their social order is radically different from that in similar rich countries, they are apt to vote for institutions similar to those in the rich country -- the JR Ewing affect. In short, the third world it has become considerably easier to create liberty without the need to massacre real, suspected, and imaginary communists. >Singapore is an example of a country that jumped from former colonial >status, surrounded by relatively poor (GNP) countries, to the "Information >Age." And what is the result? What our own Sandy Sandfort dubbed >"Disneyland with a Death Penalty." No spitting, no cursing, no long hair, >no "Wall Street Journal," no pornography, no Internet free access, no >dissension. And smartcards track the movements of all Citizen-Units. Not an >encouraging example. > >As for the comment that "they aren't bogged down in older ways of doing >business, communicating, etc." Well, some of these "older ways" include: > >- concepts about the ownership of property and transfers of title > >- contracts, and the ability to make and enforce them > >- understanding of the Uniform Commercial Code (the descendent of the "Law >Merchant" which Western societies have embraced for centuries) > >- a stable middle class, solid educational facilities, and a tradition of >business and technical achievement > >(These are all things which are missing in many Third World countries, for >whatever reasons. Even in many Second World countries, such as the former >U.S.S.R., and these lacks are making the development of modern economic >systems problematic.) > >Certainly some small nations--perhaps island nations--can essentially jump >directly to an "information based economy." The Cayman Islands and several >other examples come to mind. > >I find it harder to believe that a _large_ nation is likely to make such a >transition. > >--Tim May > >Boycott "Big Brother Inside" software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Licensed Ontologist | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0