December 2003 - cypherpunks-legacy

cfs users group dead?
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- hi, is the cfs-users(a)big.att.com list dead? i haven't seen anything for some time and mail i sent just bounced with a bad error. actually, i just got another one. two-for-one bounces if you mail through the cfs-users list! thanks for any info, - -patrick finerty - -- "Those that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin (1773) finger for PGP key zifi runs LINUX 2.0.20 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMkDLdE3Qo/lG0AH5AQEOxAP+ONckRPOAstOQDroZQcSg+p4nP/OoctNw fRV+0FvUcUmjaJLe8ziGGSFJK36gnrWTCrfHsoF1BhRoMIoLEuHoRKNiPgrO88HN FWlWUUJ5Chj84jkLPstHIVAeOPS8RF71okvaWtarqXS6BCFgOByu7PD52VAMD/P4 aE9V2CAjNq8= =DG+6 -----END PGP SIGNATURE-----

2 1

Re: Fear of Flying -- from HotWired
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:51 PM 9/18/96 -0400, Black Unicorn wrote: >On Wed, 18 Sep 1996, Bill Frantz wrote: > >> At 1:21 AM 9/18/96 -0400, Black Unicorn wrote: >> >> On Thu, 12 Sep 1996 12:03:18 -0700, Bill Frantz wrote: >> >> >Gee, biotech has come a long way. Now I can download the Anthrax DNA >> >> >sequence from the net and insert it in some carrier bacteria and start >> >> >making Anthrax bacteria. Neat! >> > >> >Culturing and growing anthrax is painfully simple. No DNA required. >> >> Sorry Unicorn, you missed my point. (1) You need DNA to grow bacteria. >> You can get the DNA two ways. (A) You get a sample of the beast, or (B) >> You get a DNA sequence and then regenerate the DNA. (I don't think B is >> technically feasable yet.) (2) You can't send samples of the beast thru >> the net. > >I think your point was that the net was not responsible for the >proliferation of Anthrax development data. (Am I wrong?) My point was that you need more than just information (but see below). You also need some materials that may be hard to get. Being totally ignorant in the anthrax growing area, I have no idea where I would get my starter bacteria. (Presumably any net-info would tell me. I haven't looked.) At 12:34 PM 9/18/96 -0800, Jim McCoy wrote: >Yes, B is possible. At the moment the devices only work for relatively >small sequences but this is improving and the current generation should be >able to handle a constructing a bacteria sequence pretty well... Ergo >you _can_ send samples of the beast through the net (or at least genetic >clones.) Oh well, if not this year, then next people will be able to down load any virus/bacteria they want. Come the millennium, it will be plants, with mice and rats to follow. Black Unicorn wrote: >My point was that in the eyes of the "leaders" all that is required to >make the net responsible for the proliferation is for the process to be >describeable in a simple one or two page set of instructions (such as >Anthrax is). I have no problem with your point. Mine was intended as sarcasm. ------------------------------------------------------------------------- Bill Frantz | "Cave softly, cave safely, | Periwinkle -- Consulting (408)356-8506 | and cave with duct tape." | 16345 Englewood Ave. frantz(a)netcom.com | - Marianne Russo | Los Gatos, CA 95032, USA

2 2

Banking over the net
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

For some time several Australian Banks have been interested in setting up online banking via the web. Currently the Commonwealth Bank does have online banking, but on non-internetworked servers. This requires an encrypted password. Currently this involves logging into the bank server directly transfering the password, at which case the user has access to their accounts. The unfortunate details are that the instructions for the account are not sent encrypted. Apart from the initial password, all data is sent plain text. There is likely to be implemented an inital web trial of this service in December this year. Hopefully the security will be upgraded a little. Where this is not likely is that the likely canditate for encryption over the net is going to be 40bit netscape (as what bank wants to go against the wishes of the US gov). The banks feel secure in that they are providing a 128bit secured password to the customer via mail. This seems to be the end of the security. While the average member of the public blindly trusts the banks to keep them safe, and untill there is a user friendly means of encrypting data (that the US government supports), I can see alot of room for fraud. ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

1 0

No Subject
by attila 17 Dec '03

17 Dec '03

Mike Farrell, actor and longtime opponent of the death penalty: "We don't rape rapists, we don't burn arsonists, why should we kill killers?" well, come to thing of it, why don't we let a bull rape a rapist? or burn an arsonist at the stake? seems fair to me. maybe even sell tickets to pay for the cost. -- one of the few things we all share: the utter, corrosive contempt for our elected officials. -- Politicians are like diapers. They both need changing regularly, and for the same reason.

2 1

Stinger Specs
by Black Unicorn 17 Dec '03

17 Dec '03

Stinger (AIM-92) (Jane's #: 6604.331) 152 x 7-14 cm (l x d - span) Weight: 18 kg Warhead: HE Propulsion: Solid Range: 2-4 km Guidance: IR Exact effective range / altitude is not listed in the quick guide I have on my desk. I will pull it out of a larger volume when I have time. -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

1 0

Cypherpunk Enquirer [NOISE]
by Mixmaster 17 Dec '03

17 Dec '03

THE CYPHERPUNK ENQUIRER "Encyphering minds want to know." The EFF announced an agreement with the Clinton administration that will "guarantee Americans rights to privacy and anonymity on the Internet for the forseeable future". The agreement, which includes unspecified concessions by the President on matters of encryption, privacy, and the export of encryption programs, is to be signed today in the White House Rose Garden. An EFF official, who wished to remain anonymous, chortled, "We got basically what we wanted, and all we had to do was give up Czechoslovakia." Cellular One today announced the signing of noted Cypherpunk Tim May as their official Internet spokesperson. Mr. May will be filming a series of commercials featuring himself in a hot tub calling a variety of 1-900 numbers on a cellular phone, while a voice-over by Cellular One executives extoles their recently announced 'Geek Plan', featuring free calls during computer hacker's normal waking hours of 7pm to 7am, with all calls to pizza parlors for delivery half-price for the first year. The commercials, the first to be filmed entirely in the 'quick-time' format, should be appearing on commercial web pages within the month. The Cypherpunk Academy of Codes and Cyphers has announced the first official offshoot of the Cypherpunks list. The Junior Auxillary, anchored by the new mailing list cyphertots(a)juno.com, will give budding hackers the chance to get out of the house and hear famous Cypherpunks like Bill Stewart and Robert Hettinga lecture on topics such as "The Port 25 Hack - Fact or Fiction", "Hacking the Transmitter on Your Ankle Bracelet", and "SPAM - Cypherbabes are Impressed by a REALLY BIG One." To join, send a message with the body "subscribe cyphertots" to majordomo(a)cybercrime.fbi.gov. (note to juno.com - we don't do personals) In related news, John Young will be tutoring Dr. Dimitri Vulis in English as a Second Language. Scientists flocked to toad.com recently in response to the first authenticated sighting of a Perrygram in months. The Perrygram, only recently thought extinct, was spotted on the cypherpunks mailing list after an absence of several months. Specialists speculate that it may have detected the recent list increase in its favorite food - pure, unadulterated bullshit. The Reputation Capital markets remained in a deep slump after the recent closings of alpha.c2.org and anon.penet. Analysists estimate the loss in over 1 billion in reputation capital, with the effect spilling over to the rest of the market. Since the loss of anon.penet, Black Unicorn is down 12 5/8, Atilla down 4 3/4 to 8 1/2, Jim Ray is down 10, and Tim May, as usual, is being investigated by the Blacknet Securities and Exchange Commission for his timely shorting of Lucky Green. Novell President Joe Marengi announced today that Novell would begin bundling Microsoft's Internet Explorer with Novell Netware in the third quarter. In return, Microsoft announced plans to release his 8 year old daughter Suzanne unharmed. Next in the Enquirer: HIDE THE KIDS! FIRE UP SURFWATCH! Sandy Sandfort's latest party - WE HAVE MPEGS!

3 2

unsubscribe
by flatline＠direct.ca 17 Dec '03

17 Dec '03

unsubscribe

1 0

The periodic caveat about Timmy May
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

Timmy May habitually digs into his cesspool of a mind for his mailing list fertilizer.

3 2

GAK, GAP, GAY
by tcmay＠got.net 17 Dec '03

17 Dec '03

GAK -- Government Access to Keys GAP -- Government Access to Patients GAY -- Government Access to You At 3:03 PM 9/18/96, Lucky Green wrote: >On Wed, 18 Sep 1996, Jim Ray wrote: >> I agree, and hope so. "Key Recovery," while not as Orwellian-sounding as >> "GAK," is a step on the path to honesty WRT the English language, though >> it's important to continually point out, as Tim did in his post, that >> *access* -- rather than just recovery -- is obviously what Mr. Freeh wants. >> >> I'd count this likely change in terminology as a "cypherpunk victory," >> albeit a very small and certainly a very hard-fought one. > >Nope. It is a Cypherpunk loss. The use of the term "key recovery" for GAK >now fully obfuscates the distinction between accessing a >backup copy by the legitimate owner (or his estate, employer, etc.) and >GAK. Many PKIs will support the former type of key recovery. And for good >reasons. Thanks to the brainwashers using the same term for GAK, it will >now become impossible to tell from a basic description of a PKI if it >supports GAK or not. Furthermore, those who oppose the latter type of key Further, merely _asking_ your Designated Key Recovery Authority what its release policies are will of course place your name on the SPL (Suspicious Persons List). The FAA is an agency which will have nearly unlimited access to communications, under the Safe Skies and Anti-Child-Hurting Act. (Think about it--Clinton already signed a couple of Presidential Decision Directives and Congress passed various anti-terrorism acts which already give the Feds authority to wiretap and surveil more widely than before, at least legally. The Foreign Intelligence Surveillance Act (or court) allows widespread surveillance of suspected foreign agents, without any notification of local courts or of the surveillance target. Won't these many provisions allowing wide surveillance already be used almost instantaneously to force PKIs to disclose keys of all those on the SPL? "If it saves just one child.") On a related note, I read an article yesterday about the proposed new Health Data Base, with all encounters with any medical institution or any health care provider of any sort being cross-linked and cross-referenced. The privacy concerns are supposedly handled by having "security tickets" for various hospital officials, researchers (!!), insurance companies, and law enforcement. (I put the "!!" next to the "researchers" because I don't recall releasing my medical and dietary history to any so-called "researchers." While I have no doubt that many "data miners" would like access to such national data bases, and that some potentially valuable information could be gleaned, I didn't release this information for Joe Gradstudent, Ph.D. candidate to sift through.) [Here are some more details: "Mission: one-stop medical records," Robert S. Boyd, San Jose Mercury News, 1996-09-17, p. 1. "Virtually unnoticed by the public, health-care experts are preparing to create an electronic "Master Patient Index," covering every American's medical records from cradle to grave...."We can't eliminate privacy concerns, but we can minimize them," said Richard Rubin, president of the Foundation for Health Care Quality in Seattle at a planning conference here last week....David Kilman, a computer expert at New Mexico's Los Alamos National Laboratory, where the idea for the master index was born....Only people with a 'security ticket'--such as doctors, insurers, scientific researchers or police with a proper warrant--are supposed to be able to see the clinical details....Kathy Ganz, director of the New Mexico Health Policy Commission, said, "Rights to privacy are genuine concerns, but they will need to be balanced against notions of common good.""] Pretty chilling, eh? As we all know, once such medical, dietary, and genetic data bases are established, the likelihood of privacy-invading use is near unity. If the NLETS data base can be routinely accessed (it's how I got Thomas Pynchon's home address, but that's another story), imagine who will hack this data base! The tabloids will love it, as they gain access to "medical records of the stars." Hackers will suck down as much as they can and then sell the records. And such data bases will be tied to True Names, of course, thus allowing the "freezing out" of anyone who is not a True Name, who has fallen behind in child support payments, who is late on his income taxes, and so on. It doesn't matter if cash is still allowed if one cannot interact with any health care person without a proper citizen-unit data base entry. They've got you tracked even if you pay in gold dust. (Putting on my Duncan cap--not to be confused with dunce cap--I wonder what will happen the first time someone dies because a hospital wouldn't treat someone without a proper citizen-unit health care card?) P.S. I fully understand that some doctors will treat patients for cash, without reporting to The Authorities, just as some doctors will treat gunshot wounds without the mandatory reporting of same to the police. This does not mean such doctors will be easy to find. The System, if allowed to win, will win. P.P.S. Many of the things we talk about on the list are being made possible--the good and the bad--by computerization. Obviously. Burnham's "Age of Privacy" (or maybe it was "The Age of Surveillance"--my copy is not handy) made this point many years ago. We are taking the mechanization and systematization procedures the Germans used so efficiently in the 1930s and modernizing them, with every movement and every transactions tracked and recorded in data bases. Now more than ever we need "credentials without identity" and digital cash. Chaum's article about "Transaction Systems to Make Big Brother Obsolete" is now more urgent than ever. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 6

Australian "ITAR" regulations
by Sherry Mayo 17 Dec '03

17 Dec '03

Hi all Some time ago I had various email exchanges regarding Australian crypto export regulations. More recently I've been put in the picture by David Cox and others that there are in fact ITAR-like laws in force in Australia. The last time I looked into this, Matt Crean(?) had very little luck finding any info from the various relevant departments, have of whom didn't seem to have a clue. In short, Crypto export from Australia is illegal without a licence - this is making it difficult for David's software firm to compete with their unhampered German competition. Using the following search URL you can find the relevant text (shortened version appended)) http://www.austlii.edu.au/cgi-bin/sinodisp.pl/au/legis/cth/consol_reg/cer43… However, if anything is done about ITAR in the US, I wouldn't be at all surprised if Australia follows suit. Sherry ps There is an awful lot of crap on c'punks these days - reading it is a bit of a needle in a haystack exercise ;-( ========================= CUSTOMS (PROHIBITED EXPORTS) REGULATIONS - SCHEDULE 13 MILITARY AND NON-MILITARY GOODS (EXPORTATION PROHIBITED EXCEPT ON PRODUCTION OF A LICENCE OR PERMISSION UNDER REGULATION 13B) >>>[snip]<<< 43. Other goods as follows: (a) complete or partially complete cryptographic equipment designed to ensure the secrecy of communications (including data communications and communications through the medium of telegraphy, video, telephony and facsimile) or stored information; (b) software controlling, or computers performing the function of, cryptographic equipment referred to in paragraph (a); (c) parts designed for goods referred to in paragraphs (a) or (b); (d) applications software for cryptographic or cryptanalytic purposes including software used for the design and analysis of cryptologics; (e) radio transmitters and receivers for spread spectrum or frequency agile communications systems having a total transmitted bandwidth that is: (i) 100 or more times greater than the bandwidth of any one information channel in the system; (ii) in excess of 50 kilohertz; or (iii) designed or modified to use cryptographic techniques to generate the spreading code for spread spectrum or the hopping code for frequency agile systems; (f) parts designed or adapted for goods referred to in paragraph (e); (g) software and equipment designed or adapted for controlling the functions of goods referred to in paragraph (e) ; (h) information security systems, equipment, software, application specific assemblies, modules or integrated circuits, designed or modified to provide certified or certifiable multi-level security of user-isolation at a level exceeding Class E4 of the Information Technology Security Evaluation Criteria (ITSEC) or equivalent in force at the commencement of these Regulations; (i) software designed or adapted for the purpose of demonstrating that the information security features referred to in paragraph (h) provide a multi-level security or user-isolation function.

2 1

No Subject
by attila 17 Dec '03

17 Dec '03

Dimitri; your taste is limitless, your tongue in every sewer. must we suffer the depths of your insane depravity? should we drop a dime on you? you're a disgace to humanity. must we scan even body text to get rid of you? I doubt Tim cares about the lunatic ravings of someone as mad as the mad N's "ice weasals," but your childish profaning of humanity seems to have no bounds. I am flat against censorship, but I think this warrants excluding Dimitri from the list. block his posts and block his subscription. these personal attacks have nothing to do with your general rights; collectively, we are permitted to screen against a banal display of ignorance. On Wed, 18 Sep 1996, Dr.Dimitri Vulis KOTM wrote: > > Shamster: SHA-enabled biocomputing hamster. > > I'm sure Timmy would like to wrap one up in duct tape and shove it > up his ass... >

1 0

No Subject
by barina man 17 Dec '03

17 Dec '03

unscribe

1 0

Re: WinSock Remailer Version ALPHA 1.3 Now Available
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Thu Sep 19 09:07:16 1996 Has it already been exported by some sinister anonymous? If so, where? - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMkDxJRFhy5sz+bTpAQGnGAf9GgDkjFpjbHewBBAQlGBiZvVeRM+Co8zx sP8eQN3FJbvwVQdIblxy3Tc4k0/q4+8KA/GCYpEsN4h9+71CgPWHeMGla0egKf4L eGcYGlBKNPA+EmJnX7YETqMAFOblejgxgxWwnPOZLMiOqiBhTGpqIq1xEJugXm6v m85qDTSomlhygKnexWVv9jVM6ntyx2x0WBCwR/L+B9NrFcoBv5GTCpiXOoEzOXq2 PhPmxxdD1Q2NF9/FSLGTOJPy9BgIyO7L3MzmKeC5ps3jlmN2Q4U+Icdchd4nnB/a IAzyBWqNCnxmglbdhhq2JoU1HLi+6DsuhaOoE3T5VDar+gPcVD/Apg== =0Iof -----END PGP SIGNATURE-----

1 0

The Beauty of "A la Carte" Insurance Plans
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:44 PM 9/18/96, jbugden(a)smtplink.alis.ca wrote: >I don't speak for the left, nor for the right. I don't think that there is a >unified voice on either side of the political spectrum. However I do find it >ironic that market driven health insurance has the potential to be more >intrusive into personal life than many government systems (cf. genetic >screening). > >If all you do is replace Big Brother with Big Business, then all that has >changed is the name. To paraphrase the character in "The Graduate": "One phrase, Benjamin...a la carte insurance." I delight in explaining this point to people, and watching the glimmer of understanding take hold, then watching them realize the implications. I recall explaining this view a couple of years ago here on this list, but probably not since then. So, time has come for me to give it another shot. Is there an alternative to a Giant Corporation (tm) essentially performing the role of Big Brother? I submit that there is. Here's what one does. I'll use a concrete example. Suppose that one is not a homosexual, is not engaging in anal intercourse with partners, is not an IV drug user, and is not a hemophiliac. Further, suppose that one is reasonably monogamous (e.g., fewer than several different sex partners a year, and such partners are themselves not in high-risk groups, as defined in the first part of this paragraph). Such a person is in a very low risk group for AIDS. What one does is to *opt out* of any coverage for AIDS-related coverage. One opts out completely, signs a waiver to this effect, and absolves the insurer of any responsibility for AIDS- or ARC-related illnesses. (This is not perfect, is not "fine-grained" enough, compared to an insurer doing exhaustive tests and lifestyle interrogations and then offering some precise rate to be paid. But it has the advantage that the insurer does not get the exhaustive and intrusive lifestyle information, and the rough cut of "opting out" is almost certainly OK for most low-risk persons. Your mileage may vary, in which case you may submit to a detailed lifestyle analysis. Sadly, many laws exist which don't allow insurance companies to ask the questions and do the tests needed to establish the risk of getting AIDS--sort of like not allowing an insurance company to ask if a person is a low-risk philosopher or a high-risk aircraft test pilot!) Ditto for any other disease which one can either make a reasonable estimate of, or can be _tested for_ (tested privately, independently of any insurance company!). Thus, for the various _genetic_-related diseases, one can check independently to see if one is a reasonably likely carrier of such genes, and, if not, can *opt out* of any coverage for those diseases. This process of *opting out* has the beautiful advantage of taking one's self out of the "subsidizers" pool while not materially affecting one's actual risk of being uncovered for some disease or condition. And all without an intrusive physical exam (though an exam may still be asked for, etc.). The parallel is quite close to people opting out of coverage for things they know they are not at risk for, such as hang-gliding accidents, horseback-riding accidents, aircraft test piloting, etc. (Such exemptions are not "enforced" by the insurance company following one around, or mounting a "position escrow" device on one's body, but by the eminently reasonable approach of simply not paying off if the accident was due to a hang-gliding accident, a horseback riding accident, etc. This is how the "non-smoker" discounts in auto insurance work...finding strong evidence that one is actually a smoker (crud in the lungs, cigarette butts all around the house when living alone, etc.) is positive evidence that one lied about being a non-smoker, and the policy is cancelled without payout.) I wish I could say I thought of this strategem of "opting out," but I believe I read about it some years ago in "Reason" or "Liberty." It understandably outrages liberals, who realize that people will arrange private tests for themselves, and will then opt out of a la carte coverage of diseases they reasonably believe are unlikely to affect them. (Nothing is certain, of course, and there is some chance that if one opts of coverage for Lou Gehrig Disease, or MS, or AIDS, that one may still end up with one of these diseases. TANSTAAFL, and most people will jump at the chance to remove themselves from a pool for something they feel they are very unlikely to get.) To relate this to the other examples, if one opts out of SCUBA-diving coverage, because one is not a SCUBA diver, this does not require the insurance company to intrusively investigate one's life. Diving accidents just don't get covered, period. Some have argued that a la carte insurance should be banned, for precisely this reason, that people will always be able to "game against" the rules. (To make this clear, the flip side of someone opting out of coverage for Disease A is that someone else may already know they are very likely to have Disease A or be at strong risk for Disease A. Forcing an insurance company to accept all applicants means this second category can game against the system, getting more out of the system than they expect to put in.) Supporting the "opting out" or "a la carte" approach to insurance allows personal privacy to be maximally preserved. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re:really undetectable crypto made somewhat practical
by Steve Reid 17 Dec '03

17 Dec '03

I'm on FCPUNX instead of regular Cypherpunks, so please excuse me if I'm a little behind the thread. > New Scheme: First, calculate the MD5 hash of all the words in the various > dictionary files used by the password cracker program and create a > database containing every word and the first 4 bits of its MD5 hash. > Given such a database, it would be possible to write a program that > accepts as input a block of cyphertext (the stego message, encrypted), > chunks it up in to groups of 4 bits and then, for each chunk, displays the > words that have hashes that start with those same four bits. The person > running the program would select words that form meaningful sentences but > also produce hashes that combine into the encrypted stego message. This > scheme would send 4 stego bits per word. As a slight improvement, you could turn this into a complete stealth encryption scheme, using only the one-way hash function operating as a MAC. Instead of hashing just the word in an effort to get stego bits, you could hash a key along with the word. In order to get the intended hash you would need to know the key. Since you're probably hashing a whole block of 512 bits (or whatever's specified in the algorithm) appending a key should not affect the speed of the system. I'm certain that this would increase the security, possibly enough that you wouldn't need to use a regular encryption algorithm (but I wouldn't bet on it). Crude example: Assume that Alice can use the words "Greetings" and "Salutations" interchangably without drawing suspicion. Also assume that "PASSWD" is a secret known only to Alice and Bob, and that the stego software looks at the low bit of an MD5 hash. MD5 ("GreetingsPASSWD") = c7bf6e051731a0dcf52baa330c9d2e7d <- low bit=1 MD5 ("SalutationsPASSWD") = 2dd2ba080b5feb060ffbc6d196fd1b34 <- low bit=0 If you say "Greetings" you're sending a 1, if you say "Salutations" you're sending a 0. Eve doesn't know about "PASSWD" so she can't do the hash and figure the bit. Of course, if you're using this to send more bits, you'll need something harder to guess than "PASSWD". The trick is in figuring out which words have stego bits and which don't. It might be better to stego bits into a whole line instead of a word, as that would probably offer more flexibility. ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)

2 1

RE: Bernstein hearing reminder: THIS Friday 11:45AM, SF Federal Building
by Batman 17 Dec '03

17 Dec '03

For the 200th time, unsubscrive me of your fucked mail lists.

3 3

Counter "noise" with "signal" (please?)
by Douglas B. Renner 17 Dec '03

17 Dec '03

If a S/N ratio becomes irritating, by all means, don't increase the denominator! In other words, do your part to let undeserving threads die. Certain things can only be dignified with a response, but I imagine that goes without saying. -Doug Renner

1 0

Morality, Responsibility, Technology.
by Douglas B. Renner 17 Dec '03

17 Dec '03

Some previous thread mentioned the potential usefulness of a large database containing private medical information, and possibly genetic detail as well. While I agree on the tremendous constructive potential of such a hypothetical data-mine, I seriously doubt that Mankind has the moral integrity to use this type of knowledge responsibly. Supposing for example, a particular genetic "defect" were found with such a database to have a 90% correlation with the presence of epilepsy. Immediately, doctors & scientists would strive to find a way to gain some leverage against this "defect." We might for example see a testing procedure for human fetuses to determine whether a particular pregnancy "should be" terminated. People would become famous, and much money would change hands due to this "discovery." Generally people will conclude that Science has given them more control over their lives than they previously had. The problem is, nobody really understands just what this "defect" really means. Nobody understands why it is there, or what kind of a choice we are really making my attempting to remove it from our gene pool. Remember that Sickle Cell Anemia is caused by a genetic "defect". We are lucky enough to know that the carriers of this "defect" are uniquely able to survive certain plagues. This so-called "defect", as troublesome as it may be to some individuals, is really a latent strength, which is how natural selection reinforced it in the first place, and we may need it again. The term "defect" is therefore entirely out of line. We have no business placing judgements from our own limited material value sets onto something which has the definite potential of affecting all future generations of Humanity. It's none of our business. Further, when such a database is eventually created, I ask not "who" but "what" will have access to it? What kind of non-sentient group mentality will have sufficient authority and be presumptuous enough to declare itself morally objective? What kind of a larger process might such an entity be unwittingly serving? We already have many times more material knowledge than we are morally capable of handling as a species. Here's one tiny example. The most widespread use of the knowledge of psychology is guess what? Advertising and Marketing. Our average American sits entranced watching hours of television daily, unwittingly absorbing countless impressions by advertisers with more money than morality. Can he identify the "glittering generalities" or the "bandwagon appeals" or any of the other effective forms of propaganda? Does he know the truth from a lie when sexual titillation is part of the presentation? May he readily accept what is presented, and most of all: Does he see himself sitting there, absorbing these impressions? We don't see our selves in action. We can't know what we're doing. None of us have developed sufficient "presence" to know what we are really doing most of the time. We can't possibly be objective, except in extremely rare, life-changing moments, and even then only if we're lucky. Just thinking about yourself thinking isn't enough, because where are your emotions? Do you really understand why your thoughts are what they are? Did *YOU* put those thoughts in your head intentionally, or did they sort of happen on their own... one thought following another through some combination of association and external stimuli? And while you've been busy reading this, with your attention directed outward, why haven't you been aware of the sensation in your feet, or the tension in your face, or your posture, or your breath? As westerners we have directed so much of our attention "outward" that we develop little or no objective knowledge of what goes on within us. Can we break this cycle? If there really are esoteric schools, with disciplines and methodologies of obtaining self-knowledge, then this knowledge must be such that by its very nature, it cannot possibly be communicated successfully in any large, public manner. But I digress. As a reader of this list, have you ever asked yourself Why, why is it that you personally want strong encryption to be widely available? It's a very powerful emerging technology, and it's in the palm of your hands. Douglas B. Renner dougr(a)usa.globelle.com

2 2

Re: 56 kbps modems
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:41 AM 9/17/96 -0700, Eric Murray <ericm(a)lne.com> wrote: >Crypto/security related: how hard is it to hack a Frame Relay >connection? My impression is that it requires access to >one of the telco's routing computers, which would make it >about equivalent in difficulty to hacking POTS. Frame Relay doesn't get handled by the telco's POTS routing (unlike ISDN) - it's handled by whatever frame relay switch the telco uses. I don't know what Pac Bell uses; AT&T uses Stratacom switches, I think MCI uses Cascade, USWest uses a mixture. Frame switches mostly use Permanent Virtual Circuits, though Switched Virtual Circuits will be coming out in the next year or so. PVCs are pretty tough to hack, because they mostly get provisioned from an administrative interface on the switch rather than in-band. SVCs will offer a bit more risk, since switching is switching. But it's probably pretty tough. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Cryptologie: Conference internationale - 25 SEPT - Paris
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable To: cypherpunks(a)toad.com Date: Thu Sep 19 11:31:08 1996 > September 25, 1996 > > Centre de Conf=E9rence Internationale > 19 Avenue Kleber, Paris 16, France > > Program, registration and further information (English): > http://www.epic.org/events/crypto_paris > I'll be there, how about any of you out there (yes, I know some of you wi= ll be there as a feature)? - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMkES3RFhy5sz+bTpAQEzmAf/d1XqnIlGj3jgX/hgGLwom15WLsNvPjfZ YcQqOjP3e5pEeHjWWAUUjQ2dopTOI7+Kytb4ZCIgoI6TIFmkWj/jAMfpx/IYx89C Db3f7+jvEN19Q/NQUYdUXktqaMC7zFMjgX8U2LBfiuR7qloMMJV+O3pDTvdJCjln BumjKnk9NwebtBrcmMIw3Y1LZ1jjFfwbanUEYlKMUgp32XXxxe+q0HOWI4x9gb32 NvPlXSftPSkpHt2M8V52wZljbtnd9WfDTsqscEjaZ3e++IousAc2itkFSV3jvS72 XT2ZZrU3lJc0n8qOjKyYR19hMIfzQgzwmrbukK0/W8R923SSA01nGA== =ERW9 -----END PGP SIGNATURE-----

1 0

Re: DL in exchange for fingerprint
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:13 PM 9/19/96, Gary Howland wrote: >Timothy C. May wrote: >> >> (Yes, I disliked being thumb-printed, but I could see no viable >> alternative. I'm sure Duncan has some scheme to declare himself a Botswanan >> exchange student, but I decided being thumb-printed was the lesser hassle.) > >Sure, it's always less hassle doing what they want. Privacy doesn't >come for free. It's easier to let the police search you in the street >than it is to make them arrest you so that you can make a formal >complaint. So, just what it is _your_ method of dealing with this? While it is noble to talk about fighting the system, just how do you go about doing it yourself? Do you simply drive without a valid driver's license? I know some folks who do, of course, but it's not something that's "worth it" to me. (This space reserved for your lecture about how I need to be prepared to go to jail to defend my right not to be thumbprinted, etc. On second thought, why don't you be the one to go to jail, and then you can let us know your experiences.) >> Paraphrasing that famous quote, just which part of "not for identification" >> don't they understand? > >Hmm - who are you paraphrasing here? (Just curious). "What part of "No" don't you understand?" and "What part of "Congress shall make no law" don't you understand?" --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 5

CIA hacked
by Mike van der Merwe 17 Dec '03

17 Dec '03

Hi everybody Heh! This one's good for a laugh :-)) http://www.odci.gov/cia Seems the DOJ hack was a good inspiration. Heh! Life's good when you're willing to work at it. Later Mike ____________________________________________________________________ I'm sure we will find out in a few years that Microsoft invented the Net. Or brought it to the masses. Or saved it from a certain and early demise. Or all of the above. JAMES SEYMOUR

3 4

Re: GAK, GAP, GAY
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:52 AM 9/18/96 -0700, Tim wrote: >It doesn't matter if cash is still allowed if one cannot interact with any >health care person without a proper citizen-unit data base entry. They've >got you tracked even if you pay in gold dust. > >(Putting on my Duncan cap--not to be confused with dunce cap--I wonder what >will happen the first time someone dies because a hospital wouldn't treat >someone without a proper citizen-unit health care card?) By definition, without a citizen-unit health card number, a Health Status Transition Event can't be recorded, therefore nothing will happen. It's possible that some auditor may notice a short-term increase in the amount of hazardous medical waste disposal at the facility that can't be properly allocated to health-services-consumption-units for cost recovery purposes, but there are overhead accounts for such things, which are simpler than creating fictitious accounts for "un-persons" or some such. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

DL in exchange for fingerprint
by Jeff Barber 17 Dec '03

17 Dec '03

Oh joy. You no longer need to be arrested to get fingerprinted in Georgia. On the front page of Wednesday's Atlanta Journal, under the headline "Now you can get driver's license in minutes": The average 45-day wait to get a new driver's license in Georgia will be a thing of the past under a new system that will churn them out while customers wait. "From start to finish it takes about 10 minutes," said chief examiner ... in charge of the Georgia State Patrol's driver's license office in Milledgeville where the system went into effect on Tuesday. Previously, drivers received a temporary paper license that was good for 45 days. ... ... Officials at the Department of Public Safety plan to have the new computer system in 82 locations across the state by Oct. 1. Georgia is the 32nd state with the system. After an eye exam, the applicant presses a finger down on a pad that registers the fingerprint in a state-wide memory bank. Then, the examiner confirms the name, address, and identifying information. ... The licenses have a hologram of the word "Georgia" behind the driver's name, age and address, and a bar code on the back that contains a laser recording of the driver's index fingerprints. "We keep a memory bank that matches your fingerprints with your license," [DoPS spokesman] said. "In other words, if you went to get a new license with a false birth certificate and your fingerprint didn't match the name, you wouldn't get a license. And you could also face possible investigation for fraud from the Public Safety's investigative division." ... "I think it's wonderful," said Katherine Kidd, the first Milledgeville driver to get the instant license. "It's a great idea. Now we don't have to wait forever." [ End quote ] Just what I would have called it: a great idea. Is it true that 31 other states take your fingerprint as part of the license application? I feel sick. -- Jeff

2 1

SAB_tag
by jya＠pipeline.com 17 Dec '03

17 Dec '03

9-19-96. NYP: "New Method of Internet Sabotage Is Spreading." Markoff. Sabotage reported by Panix is spreading and has now occurred at least a dozen other World Wide Web sites around the nation. Officials concede that there is no easy defense against the attack. One said. "I think this is sick, but I guess that is what these guys do." "Regulators Turn Spotlight on Cybermoney." As concerns grow about electronic money laundering, cybercounterfeiting and bank runs on the Internet, regulators around the world are scurrying to catch up with the rapid development of electronic money. The US plans to announce today two initiatives intended to grapple with the new technology, and in another move, G-7 will examine the international cooperation needed as money moves through the borderless world of the Internet. ----- http://jya.com/sabtag.txt (14 kb for 2) SAB_tag ---------- Pipeline is sluggish due to transition to Mindspring operation. Responses may be slow or never. Try again after 2000, or forget about it, go Luddite.

1 0