December 2003 - cypherpunks-legacy

Re: No matter where you go, there they are.
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>From: perry @ piermont.com ("Perry E. Metzger") >Aren't things even worse? Since the satelite signals are not >authenticated with anything like public key methods, couldn't I just >synthesize a signal appropriate to any spot on the planet, knowing the >positions of the satelites relative to that spot? In the case of the C/A (civilian) code, absolutely. In the case of the P code (military) only if you have the key, but in that case, yes. As Jim Bell pointed out, there are boxes you can buy for suitable amounts of money that are "GPS simulators" -- they construct out of whole cloth the signals you would receive if you were at location X with satellites {Y1, Y2, ...} overhead. However, if all you set out to do is fool a location authenticator, deriving shifted location data from the actual satellites is far easier and bound to be much cheaper. There is one limitation this has that the simulator approach doesn't -- delaying real signals requires having access to the same satellites (or a large enough subset, i.e., 3-4 of them) that the checking station has overhead. paul

1 0

Re: Protocols at the Point of a Gun
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 PM 4/10/96 -0700, Jeff Weinstein wrote: > Given that the IETF has no "official" (whatever that means) sanction, >what would prevent any other organization from coming in and trying to >take over their turf? ... It seems to me that this question represents a classic case of the costs of market entry. IETF has a pretty good reputation as a standards body. If another body were to take over its function, they would have to have superior reputation in the relevant market (i.e. IP protocol suite implementors and their customers). Superior reputation could come from: (1) Better response to proposals. (Hard to imagine in the current climate.) (2) Government coercion. (We will throw you in jail if you don't ...) (3) Government coercion. (We won't buy equipment that doesn't meet x standard.) (4) Large User coercion. (We won't buy equipment that doesn't meet x standard. Probably no user is currently big enough to force standards in this way, not even Microsoft.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

RE: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 11:36 AM 4/11/96 -0400, Blake Coverett wrote: >> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >> >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. >> >> I notice you gave no examples. Why is that? >> >> Jim Bell >> jimbell(a)pacifier.com > >In a past life I worked on a Honeywell DPS8 box that had >36 bit words and 9 bit bytes. I'm seeing a few notes of this sort which make such claims, but there is not enough information included to establish that anybody _originally_ called those 9-bit data items "bytes" or not. It appears to me that after the fact, 20+ years later, there is a tendency to call ANYTHING other than a single bit a byte, at least during that time frame. What I'm looking for, however, is an indication that this was actually the term used, THEN, for that data structure.

1 0

washington post notices archives
by Andrew K. Bressen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi-- we here at HKS.net have today received a cease and desist letter from the washington post regarding editorial copy of theirs that was evidently posted to c'punks and then abosrbed into our c'punk archives. Once the archives are restored (RSN) we'll probably manually edit out the messages from the archive. We're trying to get the post to give us URLs for their copies of the content in question so that we can point to their archives, but their legal dept wasn't sure whether or not their archives were on the web. The posts in question date back some time (archive volume 1); I'm not too concerned about a recurrance (though it would make an interesting attack), but thought it was interesting enough to warrent mention, since it seems likely that the washington post was grepping the net looking for themselves. I wonder if robot exclusion on our site would have prevented this? Although the legal staffer who sent the letter did come up with a URL for the offending messages, she seemed unaware of the concepts of "mailing list" and (semi-automated) archives according to the person here who spoke to her. - --andrew k bressen bressen(a)hks.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMW17+1u2h42ZEVfZAQFslQP/avVguGOK/hRz/1SmZtZpld79edoDyJnf yeBkX7WdrfVt1/xSkOdD4xtVHf1FENfeFr50xnt2PPVb8g0E0DQqMv6Cz4ZNy5Su bXzsmvK/zCvLKPn7gueeRjk3jQKohGRf7R9Y6rr6N6jNbCS4zZQQ/nwN7sWdhZA2 epRRPjbH52A= =8d5T -----END PGP SIGNATURE-----

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 09:50 AM 4/11/96 -0400, Richard Martin wrote: > >-----BEGIN PGP SIGNED MESSAGE----- > >On Apr 10, 6:57pm, jim bell wrote: >> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >> >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. >> I notice you gave no examples. Why is that? >Perhaps he thought that most people who were interested could go look >it up themselves. > >- From a really quick web search, we find that the SGI Impact jams 9-bit >bytes [that's what it says] across the Rambus internally. I'm not sure >if the memory itself is 9-bit. Are you sure they're not referring to 8 bits of data and a parity bit? In any case, please give the address to the list so that it can be checked out.

2 1

Hack MSN anyone?
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The names have been changed to protect the innocent... I need say no more I'm sure. - ---------- From: MSN Support JosephB Sent: Sunday, April 07, 1996 4:05 PM To: xxxxxxxxxx Subject: RE: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Yes, windows95 dialup networking uses compression to send the password when connecting. Thanks for using the Microsoft Network Joseph Beasley msn Member Support - ---------- From: xxxxxxxxxx Sent: Friday, April 05, 1996 5:57 PM To: MSN Member Communications Subject: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Ye[Ask Member Support] MemberID=xxxxxxxxxx Problem Description= Microsoft being security conscious and all, I would hope that when I connect to MSN over the Internet, that my MSN client has the decency to ENCRYPT my password when it sends it over the net, yes? This is the first time I couldn't get through to a dial-up connection and had to access MSN using my ISP. Having done so, I find it extrememly convenient, and would like to continue to do so. Thanks. xxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMW18MRhOHC4UmUYJAQHxvAf+NXAoqm8RUIskjtODUE9MYA+0JRs6x8f9 SMD70zWDRpF7mSPB6QaJcWfnufK5VqynrQ6iHfoNO9rC2yRlmkV04Ce3QW2m1z6P NVgAayVofN0Cjd1vITgdrB1XB9u3PnjXUggyTBLnAprTy79dCQsiTgen/2YujsaV Tzx6Xt87CFS8GwQcKWj5VonTkFQVjOuQIa6GbcVwEFiqVaXp2tLf3RUHXBtJ8B0H nC4wecTyra6CW2AAqFVXXmwVGeDh87caSy4Y3oFEQ8mxgZHFxOZLUeLo3MdaE+nx 33Yl2VdsjxTIlkog1R8d+6A1VDqpVqAJzcdjKnPLm8Sivm9wdGgsag== =TSTX -----END PGP SIGNATURE-----

1 0

Re: On computer face recognition:
by David Loysen 17 Dec '03

17 Dec '03

At 10:02 PM 4/10/96 -0700, you wrote: > >On computer face recognition: > > >>> Shaving probably will not be a problem, but holding your head at a >>> slightly different angle... will screw up the system totally, >>> unless the system has radically improved since the last time I read >>> up on it. > >At 11:45 AM 4/9/96 -0500, K00l Secrets wrote: >> Well, the systems I have seen are quite good at finding people's eyes. >> Scaling (for distance), and rotation (for the angle of your head) >> therefore don't really confuse the system once it has your eyes. > >Finding the eyes can only control for rotations in the plane of >the image, when you tilt your head to one side. They cannot >handle the much more common case of 3D rotations, where you >look slightly to the right or slightly to the left of camera. >Facial expressions also throw them badly. > Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of Lawences papers is on using Neural networks to recognize faces. Methinks that the state of the art is advancing rapidly and such problems as not looking at the camera or changing your expression are rapidly being overcome. ===================================== dwl(a)hnc.com Zippity do da, zippity ah, my oh my what a wonderful day. Ya right, and hear I am without time to finish a cup of coffee.

1 0

Re: (political) Privacy, Regulatory Arbitrage, Free Speech
by Michael Froomkin 17 Dec '03

17 Dec '03

Thank you for the thoughtful comments. On Tue, 11 Apr 2000, Joseph M. Reagle Jr. wrote: > I just read your paper and had a couple quick comments, I used to think that > the Internet would be an ultimate promoter of liberal democratic values, > however given recent events in asian countries (which you mention) > particularly actions of China (which you didn't) I am not at all sure that > this will be the case -- of course, one can't prove these things, but I tend > to believe that China could actually clamp down on the freedom of speech > with respect to the following: I agree that the next draft should discuss China more. I think China could probably clamp down very effectively. I am not persuaded it could do so without giving up a very large share of the benefits of access. > > "Like it or not, we live now in an age of completely free speech..." I think > it would be very worthwhile to examine what is meant by "free speech." I > don't think free speech means, if I want, I could say what I want and no one alas, this is beyond the scope of this essay. There's a huge literature on this in the law reviews, though. [...] > > So perhaps the Internet shall provide a mechanism for practical free speech > (allowing some to speak their minds, and the others that get trapped will > get crushed) but it shouldn't be considered a subsitute for political free > speech (in which no one gets crushed). In the case of countries like China, I agree. It's not a substitute. Just an enabler in places that don't choose to practice draconian access control. > the hope is that the practical free speech will enable political free > speech, but based on news reports I am seeing this is less likely than I > used to think, and as you mention in the section of "Mobility of Personal > Data" the capability of this technology to abuse the citizens' and > customers' rights are also increasing, but their isn't an open mailing list > on which everyone can examine the conversation between the organizations > which wish to accomplish this. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 07:59 PM 4/12/96 -0400, Black Unicorn wrote: >On Fri, 12 Apr 1996, E. ALLEN SMITH wrote: >> >I might add that the Cayman Islands are full of trust companies with >> >provisions which forbid the disclosure of data to a client who is >> >coerced. A law on the books refuses to recognize "consent" orders made >> >under judicial compulsion. This would give the appearance of total >> >unavailability of evidence and suggest the futility of contempt >> >charges. Yet courts have still, and with no small measure of success, >> >imposed sanctions on witnesses so protected. >> >> What measure of success? Getting the data, or locking up the witness? >> -Allen > >Getting the data. If the IRS or a private plaintiff wants it bad enough, >they can usually get their hands on it, or at least find out where it is. > >The government of the United States doesn't play "fair" when they want >something. But if the government of the United States does play "fair," then why can we not play "fair" and kill their agents who violate what we feel is our rights? After all, the government is merely the representative of the people (at least in theory!) and it 'must' follow the rules (laws, Constitution, etc). To whatever extent it exceeds those limits, and to whatever extent the public can't get justice to prevent those violations, why would the public be obligated to accept them? To believe otherwise is to believe that the government has some sort of special dispensation to violate the law. I don't believe this; it wouldn't surprise me to hear that you do, however. Which is it? Jim Bell

2 1

Web of Trust Keyring
by Black Unicorn 17 Dec '03

17 Dec '03

Does anyone have a pointer to the Web of Trust Keyring? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

2 1

Re: Bank transactions on Internet
by stevenw＠best.com 17 Dec '03

17 Dec '03

On FPGAs: > And it is rather unlikely that one could make a high clock speed >high performance hardware based key cracker work without traditional >high speed logic debugging tools such as a fast logic analyzer (if we >are talking 5-10 ns clock especially) and a 1 ghz or so digital scope. >These kinds of gear, though sometimes available after hours to engineers >working for more liberal companies or schools, cost many thousands >of dollars and are not garden variety items available to any hacker. Probably not necessary. Simulators do just fine. And the FPGAs themselves top out at 50 to 80 MHz. > And finally, depending on the technology of the part being >used, there may be a significant cost in the order of at least hundreds >if not thousands of dollars for a specialized programmer capable of >programming ("burning") the FPGA with the interconnect patterns generated >by the software. These tend to either be specialized to one kind of >part and maybe modestly cheap (hundreds of dollars) or universal and >several thousands of dollars (such as DataIO gear). Easy to access. They are everywhere. The EPROMs are about $6 each and are serial. You could build a programmer at home. > And at least in my experiance (I may be unusually stupid and >careless and clumsy or may not be) even if the parts are a few times >reprogrammable (as CMOS FPGAs often are these days) one can assume >that one will fry, or break the pins off, or reprogram one time too >many the FPGA or FPGA's before one gets the design working. This >means that it would be realistic to assume several parts would be >consumed by the prototyping effort, they may not be cheap and this >adds up too. While there are OTP FPGAs out there (typocally Altera), many are in-circuit programmable *any* number of times since they use SRAM internally not EPROM cells to program the configuration. The latest twist on FPGAs is to add more RAM internally and have them reprogram themselves on the fly, hundreds of thousands of times a second. This cuts the logic requirements down for desidhns that don't need all of the logic all of the time. > So whilst someone working with these parts as part of their job >or schooling might well have access to all the required resources on an >informal basis and be able to build a key cracker in evenings or >weekends for little more than the cost of the chip and a PC board to >hold it, it should be realistically noted that the actual cost of >equiping a lab from scratch with the required resources is more on the >order of tens to hundreds of thousands of dollars rather than $400. True, but $400 is probably not far low. > I must hasten to add that high density FPGAs have many many >legitimate uses in prototyping logic and producing products in small >volumes too small to justify the tooling costs of doing mask programmed >gate arrays (which tend to be significantly faster and easier to design, >but cost $5-100K NRE to set up custom masks for fabrication). The >current generation of them make it possible to build logic systems in >one small chip that a few years ago would have been large PC boards >full of PALs and other logic. My employer uses FPGAs in all new designs for production. They are *very* common for products that sell into the thousands per year. Mask-programmed gate arrays have the major disadvantage of very long lead times, usually a more pressing requirement than saving $30 per board over several thousand boards. Companies now make boards that contain just FPGAs wired in a grid. They are sold as general-purpose logic engines with software to implement circuits as hardware simulations. I'm sure that these would do just fine, though they are costly. ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 02:51 PM 4/12/96 -0700, Alan Olsen wrote: >At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: >> >>On Apr 12 at 8:07 >>jim bell wrote: >>> >>>Are you sure they're not referring to 8 bits of data and a parity bit? In >>>any case, please give the address to the list so that it can be checked out. >> >>Come on, give it up already and admit you were wrong. At least 8 different >>people have cited examples of machines that supported non 8bit bytes. Your >>pride is getting the best of you. > >Jim is unwilling to admit his errors, even in things he has little or no >training in. (I remember him claiming at one point that he was not a >programmer or did any coding for that matter. Why he continues to persist >in such things I will not speculate on...) What I meant was the most honest answer I could give: I am not a professional programmer. I have programmed, in APL, Fortran, Algol, PL/1, Pascal, and I can read BASIC's well enough, but not recently.

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 12:00 AM 4/10/96 -0700, Bill Stewart wrote: >At 09:33 PM 4/8/96 -0400, Jack Mott wrote: >>This may be a bit of a no brainer, but everything I have read sorta >>skips over this point. a bit is 1 or 0. 8 bits make up a byte (0-255). > >Be careful writing code - sometimes a byte is -128 to 127 instead of 0 to 255. >Also, there are machines (mostly old kinky ones) that use bytes of sizes >other than 8 bits. No, Bill, a "byte" has ALWAYS been 8-bits. One of the main reasons the term "byte" was invented was because the term "word" (as in, "word length") varied for different computers, especially in the 1960's. (In fact, many computers of that era used word lengths other than 8, 16, 32, 64 bits, as surprising as this may sound to the current crop of PC and Mac afficionados.) This made it inconvenient to talk about memory capacities unless you were referring to the same machine. The solution was to invent a new term, "byte," which conviently had about the same size as an ASCII character and was always 8 bits.

7 6

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 2:28 PM 4/10/96, Black Unicorn wrote: > This showed up in my mailbox: <snip> > PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate > Eudora and MacPGP are now available in the latest Button Circle release >at: > ><ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch9 >6.sit > .hqx> I'm using it. I actually went out and bought OneClick to do so, mostly because I wanted to mess around with scripts for other things and OneClick looks pretty painless to use. PEP works pretty much as advertised, except that the finger operations take too long for my ISP to execute sometimes, and evidently the finger events in Eudora aren't robust enough to wait for the operations to complete, so a "wait" has to run. The work-around is to manually do the finger instensive "get cypherpunks remailer names" and "get remailer-keys" operations with eudora, copy the results, and then run the scripts. Anyway, I bashed on it, and PGP, a bit, and now there's a palette when I use Eudora which I can click to do chained remails, which I was never really able to do before. It also does signs, which are fine, and encrypts, which are also fine, but the decrypts come up in the PGP window, which is crypto-correct, I suppose, but I like the dump-it-into-it's-own-mail-window result of the original OSA scripts which come with MacPGP. This is useful if you actually want to reply to an encrypted mail message. One of the other things that is nice about the original MacPGP scripts is that they automatically verify signatures on decryption, and, at the same time, they also automagically add any attached keys to your keyring, pending certification, etc. Anyway, if you have OneClick already, then PEP is a way cool thing to have. Here. I'll sign this message with it. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWwYUvgyLN8bw6ZVAQEUKgP/eXQsCS/AaAj07s9PAX07j5WcXCXDGvpF RxDSLqJNA3wOcU3QKrDc/T0HfzQELM/RbjOvDy7XPWUwxEN/SUTfRzAekYtJ6RbM 2w3CDYtNsdXyv4yyrgNF1eIjs+IecYYrCBeXJcvHn6fRwEbVBr+yFgXIprjfeEZ9 of/IGHDE0Qc= =bshY -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: No matter where you go, there they are.
by David Lesher 17 Dec '03

17 Dec '03

I asked a friend charged with spending money in this area. Here's his reactions, and those of someone he consulted: ================== ..There is a business case flaw in the proposal. The scheme as laid out only provides a high confidence factor on the users location (+- 10M), NOT on the actual identity of the user. Thus it would have to be coupled with some other form of I&A. The business question then arises, is the confidence delta provided by this scheme consistent with the cost delta? My first take is that the answer is no. =================== Re spoofing the system. If you think about the geometry of the problem, the delay to be induced for each satellite is a time varying function of the satellite's position, the reference site, and the target. It will vary from positive to negative values for many satellite passes. It can be precomputed, but the precomputed adjustment will be in error by some amount due to the orbital perturbations mentioned in the original article. The most common prediction error is the in-track postion, which inconveniently for the predictor has the greatest effect on one's ability to calculate the right delays. Anyone with access to a decent orbital prediction code and access to the statistics on orbital perturbations should be able to calculate the expected delay prediction error as a result of the orbital uncertainties. If the delay prediction errors are detectable, then it seems the system is secure after all, allthough other reservations on operational suitability might still apply. Note that the sensitivity is a function of the distance between the reference site and the target. If you could collect your reference signal across the street from the target, it would make spoofing a lot easier. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: washington post notices archives
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:39 PM 4/11/96, Andrew K. Bressen wrote: >we here at HKS.net have today received a cease and desist >letter from the washington post regarding editorial copy >of theirs that was evidently posted to c'punks and then >abosrbed into our c'punk archives. > >Once the archives are restored (RSN) we'll probably manually edit out >the messages from the archive. We're trying to get the post to give us Several relevant points for lists like ours: 1. Expect more and more of these sorts of copyright "cease and desist" (or, as I like to say, "decease and cyst") orders, as newspapers and magazines use search engines to find their stuff. Expect some "automated searches" to be done routinely, even offered as services by third parties. ("Find infringing copies...make $1000 a week in your spare time.") 2. What does removal of infringing articles mean for follow-ups? If I reference a WSJ or NYT article that someone has quoted or forwarded, is my follow-up expunged also? 3. And what of the "Cypherpunks Archives on CD-ROM"? Too late to simply remove a single article...does the entire production run go into the landfill? (I haven't heard much about the "enthusiasm du jour" of the "Cypherpunks CD-ROM," but this always been a concern, that legal issues would have to be resolved, including the getting of releases from several hundred or more parties.) 4. Suppose the HKS archives were actually offshore, in the Cayman Islands or in some place that doesn't recognize copyright law in the same way most Western or Berne Convention countries do? 5. Suppose access to such archives is done via Web remailers, and the location is not easily determinable? (To be sure, lots of hits means traffic analysis will reveal the location....the same general problem with "reply-blocks," of course.) It sounds like the Washington Post is discovering the brave new world. Expect an article or two on this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PEP Announcement (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This showed up in my mailbox: --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information ---------- Forwarded message ---------- Date: Wed, 10 Apr 1996 00:03:29 -0400 From: Amos Elberg <aelberg(a)wesleyan.edu> To: unicorn(a)schloss.li Subject: PEP Announcement Uni, can you forward this to the c-punks for me? --------- PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate Eudora and MacPGP are now available in the latest Button Circle release at: <ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch96… .hqx> PEP is designed to provide features similar to the UNiX premail program on the Macintosh. It handles encryption, decryption, signing, verifying, anon.penet.fi remailing and cypherpunk remailing. PEP uses OneClick to place a button bar in Eudora, from which the user can select privacy functions. Buttons pop-up menus of encryption targets, signature keys and cypherpunk remailers. Q: What do I do about the rest of MacPGP's interface? A: PEP is not designed to replace MacPGP, just to provide easier access to it from within Eudora. For a full featured MacPGP GUI replacement with added features, try Raif Naffah's MacPGPControl application. Q: Isn't the name 'PEP' pretentious and derivative? A: Yes, I think so too. I couldn't think of a better one. Suggestions are welcome. Q: I have a lot more questions. Where are the answers? A: In the documentation. If you have any more questions, please direct them to <mailto:aelberg@wesleyan.edu> ------------------------------------------------------------------------------ Amos B. Elberg | #include disclaimer.h Amos will code for Wesleyan University | food. E-mail me for a resumé. Please. 341 S. Main St. Apt. 3N |---------------------------------------- Middletown, CT 06459 | Help keep the net safe from the Will Code for Food! | aesthetically challenged. Please, Public keys available from the usual | oppose ASCII art. keyservers, or by request. |---------------------------------------- PGP fingerprint = 08 B8 87 04 6B 21 08 5D B0 62 F7 94 7B 42 0F 10 --- end forwarded text

1 0

Re: Edited Edupage, 4 April 1996
by Michael C. Peponis 17 Dec '03

17 Dec '03

On 12 Apr 96 ,E. ALLEN SMITH wrote: > From: IN%"educom(a)elanor.oit.unc.edu" 5-APR-1996 01:25:00.85 > >IBM'S INTELLIGENT MINER DIGS OUT THE GOOD STUFF > >IBM plans to offer companies "data mining" software and services, allowing > >them to make better use of disparate pieces of information stored in their > >computer systems. The Intelligent Miner software will be available on IBM's > >RS/6000 servers by the fall, and on other platforms by year end. The > >company also plans to develop Intelligent Decision Server software for local > >area network-based information analysis. (Investor's Business Daily 3 Apr > >96 A9) > > Anyone have any _specific_ ideas on how their Intelligent Miner system > works? It would appear to be relevant to the identity-spoofing discussions. > -Allen Not really, it's a tool used in Data Warehousing/Decission Support Systems. Here is what it is in a nut shell. A company creates a Data Warehouse, defining it's data universe in terms of business rules and practices. Data Mining is the process by which users try to make sence of all the data. They call it "intelligent" because it supports natural language queries, ie the end user does not need to know SQL or the table layouts to retrieve the information they want. Very sketchy explination, but there are entire volumes written on the subject, and it's new technology so the exact definition varies depending on who you ask. I have been developing systems like this for the past year, and I still can't give people a cut and dry answer as to what the hell it is. Regards, Michael C. Peponis Public Key Avalible Via Key Servers, or Finger

1 0

Re: Contempt charges
by Moltar Ramone 17 Dec '03

17 Dec '03

> Message-Id: <199604100152.DAA25396(a)spoof.bart.nl> > To: cypherpunks(a)toad.com > From: anonymous(a)nowhere.goucher.edu (Senator Exon) > Comments: Please report misuse of this automated remailing service to > <remailer-admin(a)remailer.nl.com> Oooh... forged headers... forged to indicate they're coming from _my_ school. I wonder who _this_ could be... perhaps someone who has expressed anger at me on the list? Perhaps just a random choice? Perhaps me? (Not me, that I'll tell you...) > Borrowing inspiration from May, a page from Scheier and some code from > Gutman... Techniques from Detweiller, and lousy law from Jim Bell (I _wonder_ who might have posted this... :-) ) > Hard disk space being cheap now, Bob creates several distinct disk > partitions and uses Peter Gutman's Secure File System, or equivalent, to > encrypt all of them. [ ... ] >Practically, Bob cannot be forced to reveal the pass phrases to any >alleged remaining secret data, since this might not exist. To further >encourage this belief Bob might associate innocous data with a first pass >phrase, mildly embarrasing data with a second, and so on, and then, after >revealing the first, gradually allow himself to be be coaxed into revealing >the second and disclose a third only after the rubber hoses came out. > >Since all of the partitions have similar content, no statistic should >reveal which is which. Bob might have a bit refresher routine >periodically nibble read and rewrite the whole disk so that no >electronic characteristic exists that reveals record age. Sure, this will effectively hide the data; so will a plain old encrypted partition... >No doubt, a judge might whimsically keep Bob in jail for a while, trying >to assure that he has revealed all of the pass phrases, but the judge >can never be certain, even when Bob has disclosed everything. This >situation creates doubt that Bob is in contempt, even when he is, and >makes a prison term relatively pointless, unless for revenge. But that's what a contempt charge is _for_: "You're not treating me with respect, so I'm going to punish you." It might be described as being for a particular reason (ie supressing evidence), but each of those reasons ultimately boils down to lack of respect. In addition, were I handing down (or prosecuting) the contempt charges, I'd claim that the statement (even if it was made in public) that the individual didn't know all the keys in the first place was a lie, and that, by repeating the lie, they were purjuring themself. I am not a lawyer; however, I suspect that neither was the anonymous poster. In fact, I think I have a pretty good idea of who it was: someone on the list who: (1) Has recently been claiming that contempt charges were worthless, and that people should start ISPs, and pool money for insurance. (2) Has (probably) used this technique (at least once) before to create the appearances of support for one of his/her ideas which really has no support. (3) Might _possibly_ be upset with me (due to the headers...) I can't think of _anyone_ who meets THAT description, now can I? ;-) Jon ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA.

1 0

Re: So, what crypto legislation (if any) is necessary?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:27 PM 4/9/96 -0800, jim bell wrote: >At 07:08 PM 4/9/96 -0700, Bill Frantz wrote: >>At 3:21 PM 4/9/96 -0800, jim bell wrote: >>>And the rest of us are tired of seeing those non-responses! >> >>I wish to state that Jim Bell does not speak for me. > >Tell me, what is the most exciting, interesting, and imaginative usage of >"Yadda Yadda Yadda" that _you_ remember, Bill? This will be my last post on this subject. Since Jim Bell ALWAYS has to have the last word on any given subject, he will continue to try to read something into my statement that is not there. I can not get much clearer than: I have not authorized Jim Bell to speak for me. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: No matter where you go, there they are.
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 8:53 AM 4/10/96, Hal is rumored to have typed: > Peter - didn't they say that the checking station is also listening > to the satellites? That way they can tell that you are playing back > signals that you taped earlier because they won't match what the > satellites are broadcasting right now. There is going to be processing and network delay involved here (unless Denning et al have figured out some way to communicate faster than the speed of light), so drift between the what you report and what the checking station and repeaters are hearing _at that time_ is inevitable. This is the loophole which allows Peter's attack, a loophole which cannot be closed (because the spoofer can always claim to be on a slower link than she really is and there is nothing the verifiyer can do to prove otherwise.) If I want to pretend to be closer to the receiver than my true location I simulate a slow link which gives me enough time to record what the signals would be at the near location and then quickly resend them to give the appearance of the spoofed location. In fact, I think that this really all boils down to trying to use GPS as a non-interactive proof of location, and the information posted about the system does not address the obvious attacks on such systems which are known from research into ZNPs. > If their authenticated repeaters are used then you have to assume the > checking station has all the satellite signals and again the best you can > do is pretend to be a Mole Man. The authenticated repeaters may collect all signals, _but the receiving station does not get them all at once_ because it will take time for the signals to propogate from the repeater back to the station attempting to determine location. Having all of the signals does not help the checking station other than allowing it to share a set of sats with the person attempting to authenticate. It still does not And perhaps more importantly, do you really want anyone you connect to on the net to know your location to the nearest 10 meters? What is Dennings fascination with building Big Brother? jim

4 7

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 13 May 96 6:45:35 PDT remailer email address history latency uptime ----------------------------------------------------------------------- mix mixmaster(a)remail.obscura.com ++++++++++++ 4:10:52 100.00% alpha alias(a)alpha.c2.org +.+++++++++* 49:42 99.99% haystack haystack(a)holy.cow.net -*#*##+--++* 18:17 99.98% exon remailer(a)remailer.nl.com *******+***# 2:48 99.98% lead mix(a)zifi.genetics.utah.edu ++++++++++++ 37:55 99.97% amnesia amnesia(a)chardos.connix.com _. --+----++ 12:19:41 99.83% flame remailer(a)flame.alias.net ---+---+-+++ 2:44:17 99.81% c2 remail(a)c2.org +++++++++++* 46:01 99.75% alumni hal(a)alumni.caltech.edu #-### #*#### 7:16 99.69% vegas remailer(a)vegas.gateway.com ###**-***##* 1:07:26 99.64% ecafe cpunk(a)remail.ecafe.org ###*###+## # 7:38 99.60% portal hfinney(a)shell.portal.com #-## -# #### 5:07 99.57% shinobi remailer(a)shinobi.alias.net ***+**+* +** 37:06 99.26% penet anon(a)anon.penet.fi _ .____. 66:02:55 99.01% replay remailer(a)replay.com +********+* 5:20 98.53% treehole remailer(a)mockingbird.alias.net ---+++-+-- 2:07:49 86.55% extropia remail(a)miron.vip.best.com --.---- 8:00:07 48.50% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Free demo disk of "distorted number" crypto
by Mark O. Aldrich 17 Dec '03

17 Dec '03

On Fri, 10 May 1996, William Ono wrote: > On Fri, 10 May 1996, Mark O. Aldrich wrote: > > > technical. They are also offering a technical write-up via fax-back at > > 301.588.2162. > > I just called that number, but got no answer after ten rings. Could you > please verify it? I just checked it. It's working. It answered with the "menu" after two rings. Anyone else try using this thing? ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Report on Smart cards
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Financial Times, 13 May 1996 Smart cards poised to mark revolution in data protection The poor image of the technology as "Big Brother's little helper" may be altogether undeserved, says Alan Cane The smart card -- a piece of plastic the size of a credit card with a computer embedded in it -- offers numerous benefits, but will force a re-evaluation of attitudes to privacy and data protection, says Demos, the independent think-tank. Its report, one of the first to analyse policy issues raised by the rapid proliferation of smart cards in areas such as finance, health and public administration, warns that the benefits will only accrue when people are confident the technology will not become "Big Brother s little helper", as the authors put it. Helpfully, Demos suggests policies to sidestep what it sees as a "sterile confrontation" between civil libertarians and authoritarian government and business interests in promoting the benefits of smart cards. "We have argued that people will trust in these technologies when they can choose anonymity where they want it and have greater control over the use of personal information held about them," say the authors. What distinguishes the smart card from other information technologies and gives it its power is the capacity to concentrate and manipulate a huge amount of information in a tiny space. A reading device is necessary to view the information, but smart cards compute as well as store data. Software can be incorporated to encode the data, rendering it unreadable to anyone without the right key. What can smart cards be used for? Their main use now is as telephone cards for public pay-phones, but they have the potential to identify individuals, to act as an electronic wallet for cashless shopping, and to provide a secure and portable information store. Medical histories could be stored on a smart card, for example, ready for recall by a doctor. Visionaries talk of virtually unlimited amounts of information distributed through society in a variety of forms -- the credit card model has been adopted for convenience rather than because of limitations inherent in microcomputers. Badges, pins and jewelry could all become "smart" accessories in the future. However, this sort of crystalgazing raises questions. For example, what information should be stored on a smart device? Who should be able to read it? The Demos researchers are critical of suggestions by Michael Howard, Britain's home secretary, that a smart card could be used as a national identity card: a government-issued, multi-functional card, with the populace having little or no choice about which applications were available on the card -- and perhaps no say about the privacy system employed. Regulation of the privacy system -- encryption -- is important. It is comparatively easy to devise encryption methods which are almost impossible to break within a reasonable period. That worries governments fearful of being unable to unpick communications from terrorists and the like. The US has attempted to forbid the export of the more powerful US cryptography systems. The Demos researchers argue that such tactics are counter-productive. They favour a private "key escrow", a system where cryptography users deposit the key to their system with a trusted private registry, approved and regulated by governments. "Government law enforcement agencies would have to obtain a court order on the basis that they had strong reason to believe that an individual or company that had escrowed their keys ... was guilty of some crime". The report proposes a radical reform of data protection legislation through some 10 supplementary conditions. Data users, for example, would have to get express consent from individuals for the use to which they would want to put the data. Rules on disclosure to third parties would be tightened, so that data users would have to receive specific permission from a data protection registrar in order to gain access to specific information. It argues that individuals should be able to choose the card they want, and decide what information and applications will be loaded. "Where [Michael Howard's] card is an essentially authoritarian instrument, our proposal is for a more market-based instrument in which the role of government is to align the incentives within the market to ensure privacy, trust and individual access and control," says the report. - On the Cards, by Perri 6 and Ivan Briscoe. Demos, 9 Bridewell Place, London EC4V 6AP. UK9.95. -----

1 0

Re: Mandatory Voluntary Self-Ratings
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 03:45 AM 5/13/96 EDT, E. ALLEN SMITH wrote: > the conservatives won't let people just rate > "objectionable" material in order to keep it from them. They want it off the > net/world whether or not it's rated. In the course of channel surfing, I have once or twice come across the Christians ranting about pornography. They have both legitimate and illegimate complaints, but mainly they emphasize the legitimate complaint. PICS addresses this legitimate complaint. Should cut the volume down considerably, or else force them to drop the hypocrisy, if indeed they are hypocrites. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0