December 2003 - cypherpunks-legacy

sprint pulled plug on cyberpromo..
by Robert Hettinga 17 Dec '03

17 Dec '03

Ah. I feel *much* better now... For the time being, anyway. Cheers, Bob --- begin forwarded text Date: Sun, 20 Oct 1996 13:53:01 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Bill Sommerfeld <sommerfeld(a)ORCHARD.MEDFORD.MA.US> Subject: sprint pulled plug on cyberpromo.. To: CYBERIA-L(a)LISTSERV.AOL.COM Since this issue was brought up here a little while ago, it seems appropriate to forward this.. (NANOG is the "North American Network Operators Group"). Subject: Re: Cyberpromo.com spam snuffed? Date: Fri, 18 Oct 1996 20:02:17 -0400 (EDT) From: "Todd R. Stroup" <tstroup(a)tstroup.inhouse.compuserve.com> Reply-To: "Todd R. Stroup" <tstroup(a)tstroup.inhouse.compuserve.com> To: pferguso(a)cisco.com cc: nanog(a)merit.edu On Fri, 18 Oct 1996, Paul Ferguson wrote: > It appears that the infamous cyberpromo site has been disconnected. > > - paul > > [snip] > [snip] Cyberpromo is a suspect in sending mail from a host with the name and local domain of compuserve.com (the exact name of one of our mail gateways) They were creating fakeing mail headers by actually haveing a machine on their network with the same name and domain. I could have thought of more creative ways to do this but this is what we saw... Since were getting an influx of mail from upset individuals asking why CompuServe was the host of all this spam. After we found out what Cyberpromo was up to, we asked for cooperation from Sprint to pull the plug. At this time (and to my knowledge), CompuServe has not yet made an effort to engage in any legal action. I am unable to comment on anything else at this time. Todd R. Stroup Network Engineer - CompuServe --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: unsibscribe?
by nobody＠replay.com 17 Dec '03

17 Dec '03

Anonymous wrote: > "Alexander.Kvache" <alexk(a)hcl.com> sent the new word: > > > >unsibscribe > > to the list. I am pretty sure we have seen them all, now. > > OBcrypto - are these spellings randomly generated? Naw, it's a new stego method... ;-)

1 0

Re: Usenet and Re: extortion via digital cash
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 12:34 AM -0400 on 10/20/96, Scott McGuire wrote: > >> I've been thinking about the use of Usenet as a message pool and this >>seems to be a good place to bring up my thoughts. As an already existing, widely disseminated and easily used message pool, Usenet is very valuable to us. I'm concerned that it may not last though. Many people now complain about how low the signal to noise ratio is (even more than they complain about this list). I've heard people say that they have given up on newsgroups in favor of mailing list, web-zines, etc. So, if it gets too bad, might it just fade away? Or, if it remains but becomes unpopular, will it be easy to restrict if we use it for anonymous messages? > >IMHO, it will end up similar to the late night infomerical spots on TV. >Not puch of value there, but bored people will still look. > >Any effort to regulate it will come from a tangent; IDs of some sort >to post in public, or have access to the net, or screening it out of >the hypothetical InfoBahn II networks, or similar. In the U.S., at least, attempts to enforce identification of Internet users or anonymous posters to newgroups and such are likely to meet with stiff legal resistance. The Supreme Court has ruled that anonymous use of protected speech (e.g., political handbills) must be permitted. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

3 2

IETF meets in San Jose, Dec 9-13; want to come?
by John Gilmore 17 Dec '03

17 Dec '03

The Internet Engineering Task Force will hold one of its thrice-yearly meetings in San Jose in December, making it accessible to many cypherpunks. (The following two meetings will be April in Memphis, and August in Munich.) IETF sponsors working groups which propose new protocols and procedures to evolve the Internet technology and infrastructure. Many of these working groups are of interest to cypherpunks. Working groups are open to all interested parties and transact almost all of their business by email. An IETF meeting is a place where working groups can meet and resolve issues that are hard to handle by email. It's also a place for newcomers to the working groups to be introduced to the issues and existing players. An IETF meeting is not a standards committee meeting, nor is it a technical conference. It's a unique animal. The working groups meet in parallel sessions, usually several times per meeting. Participants are encouraged to submit any large publications by email before the meeting, so that they can be intelligently discussed, rather than merely read, at the meeting. There is little or no voting, and few or no "papers". The working groups run by "rough consensus and running code" -- a method near and dear to the cypherpunk credo. There's a whole Security Area with these working groups: aft Authenticated Firewall Traversal cat Common Authentication Technology dnssec Domain Name System Security ipsec IP Security Protocol otp One Time Password Authentication pkix Public-Key Infrastructure (X.509) tls Transport Layer Security wts Web Transaction Security I'm actively working with the DNSSEC and IPSEC groups, on my S/WAN project. In addition there are lots of other interesting working groups for Mobile IP, Web evolution, MIME and email security, IPv6, Dynamic DNS update, etc. All of these have security implications. For more information about any of this, see www.ietf.org. You'll find full info about the upcoming meeting, as well as minutes from past meetings, working group charters and web pages, archives of working group email lists, more info than you'll be able to read. Many working group sessions are multicast on the MBone for those who can't travel to participate, and there is excellent Internet access available on-site, with acres of terminals, printers, and laptop-plugins. Attending the meeting will cost $250 if postmarked before Nov 8. Non-local c'punks who wish to attend, but who can't afford to stay in a hotel, can probably find other c'punks in the area to stay with. (I'm in San Francisco, 50 miles from the meeting, so I'm not a good candidate.) John

1 0

Re: Wrap Up: Conference on Law Enforcement and Intelligence
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:03 PM 10/20/96 +0000, James Morris wrote: >On Sat, 19 Oct 1996, Black Unicorn wrote: > >> 4. Might be a good idea to review implementations of crypto. >> >> Both James Woolsey and Stewart Baker made sly remarks about the >> reliability of crypto in the public domain. [...] > >There was also an interesting comment made in session three of the >Joint Australian/OECD Conference on Security, Privacy and Intellectual >Property Protection in theGlobal Information Infrastructure, >(Canberra, 7 - 8 February 1996), reportedly by a representative of >the DSD: > >"... PGP may not survive as a viable option for private security." > >For the full quote, see: > http://www.nla.gov.au/gii/sess3.html (1) If I were faced with an opponent who had a crypto system I couldn't break, I would attempt to make him think I could break it so he would stop using it. AKA FUD. (2) If I could break his system, I would want him to continue using it. I would have to be very careful about how I used the material so he didn't catch on to the break. There are some wonderful examples of this logic in "The Code Breakers". (3) The devil is in the details. I still am not convinced that MacPGP has enough sources of entropy for its IDEA key generation. (But I am not convinced that it doesn't either.) I put integrating Jon Callas's entropy manager into MacPGP as a high priority. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

3 2

Q.E.D. reply to Perry Metzger
by cypher＠cyberstation.net 17 Dec '03

17 Dec '03

> > IPG Sales writes: > > Some of you have sardonically written to say "Nihil Est > > Demonstrandum," N.E.D. because an OTP must be derived from a > > hardware source, that is, it must be a pure random sequence > > of limitless entropy. Accordingly, they unbashfully assert > > that an OTP generated by a computer program is not possible. > > > > How do they know that? Does the Bible tell them so, or the > > Koran, or do they get it from the Torah? Why not cite the > > source of their certainty instead of advancing an unsupported > > proposition. > > See Claude Shannon's papers on information theory. [Available as: C.E. > Shannon, Collected Papers: Claude Elmwood Shannon, N.J.A. Sloane and > A.D. Wyner, eds., New York: IEEE Press, 1993.] > > Shannon invented information theory in 1948 and 1949. Part of his > papers discuss the information theory of cryptosystems. He > mathematically proved that only a O.T.P.. using non-reused physically > random numbers could provide what he termed "perfect secrecy". I > accept mathematical proofs above the Koran or the Bible. (The Torah is > a subset of the Bible.) As in so many other cases, you are so F.O.S. that it is unbelievable. Your eminence pontificating about it does make it true. Furthermore, Shannon certainly did not prove that physically random numbers are required to provide what he termed "perfect security." I believe that closer reading and interpretation will reveal that what he was saying was that any mathematical series other than truly random numbers can theoretically be reconstructed by some means, including brute force, should that be required. Obviously that is true. I do not disagree with the fact that brute force can be used to attack the algorithm that I have advanced. It you try all of the possible OTPs, PRNG encryptor streams, against the ciphertext, then only a limited few and maybe only one meaningful plain text can be obtained. There is absolutely no dispute about that. Accordingly, Shannon is quite correct in saying that it is not "perfect." It is not perfect in a mathematical sense, and in that limited sense only, you are correct. However to try all possibilities, is mathematically impossible - thus the algorithm must be attacked analytically - as EVEN you, or anyone else, will be able to clearly see, if you examine the algorithm, it cannot be attacked analytically. My algorithm most certainly does NOT produce a theoretical pure Random Number Stream, accordingly it is a PRNG, but it most certainly does produce an OTP that meets each and every requirement of such, other than some theoretical definition that you seek to impose on it by your dogmatic words. You do not have to take my word for it, the FULL ALGORITHM, which has never before been published, is set out on our web site. There is no mathematical proof that my PRNG streams are not an OTP - because they are OTPs. There are 156.8816 megabytes of raw encryptor stream data at our site. They constitute 10 OTPs, all using the same key, only the message numbers vary.but with different message numbers only. > > I do not mean to be rude, > > You are anyway. > You are so vane, so crass, so dogmatic, so blinded by your opinions, that you obviously look at yourself in the mirror wheneever given the opportunity. You do niot know what the hell you are constantly pontificating about. talking aboutand including the one under discussion herein. Why not show everyone your prowess by telling us what the key and the As, Bs, and Cs, are they were used to generate the 156.8816 megabytes referred to above. Of course, you cannot, so you bray like an ass to cover up your crypto impotence. > > but excuse me, what > > scientific proof can they offer for that immovable avowal? > > See above. See above > > > There is no scientific proof whatsoever, none at all, > > See above. See above > > > except > > for the words and their steadfast, and maybe self serving, > > postulate. > > See avove. See above and below > > > Accordingly, obviously it is they, not us, who are > > the ones that have "Nihil Est Demonstrandum," in this matter. > > See above. See above > > > There is not one scintilla of sustainable evidence to support > > such a doctrine. > > See above. See above and below. > > > While the vast majority of people knowledgeable about > > cryptography have not heretofore believed that it is possible > > for software to produce an OTP, > > It is not possible. It is absolutely possible, Q.E.D. > > The information content, or entropy, of the key stream is necessarily > no larger than its keyspace. That is, if you have a software > pseudo-random number generator using an N bit seed, the entropy of the > keyspace is necessarily never greater than N. This is mathematically > certain -- no amount of prayer on your part can change that. > > > that does not make it a > > scientific fact, More of your meaningless B.S. - Obviously you wrote your reply before you read my entire message. > > Sorry, its even better -- a MATHEMATICAL fact. > You saying it, like a lot of other supercilious crap that oozes out of you brain as "write bites," does not make it so. All kinds of crap is running loose up there, you need to get it under control someway. It is absolutely not perfect in the Shannon sense, but it does not have to be theoretically perfect to fulfill the requirement of being an OTP. You definition of an OTP, or a OTP as you mistakenly refer to it, is an extraneous mathematical definition that people have mistakenly extrapolated from Shannon. > > In support of their position, some have pointed out that John > > von Neumann, to paraphrase, stated that ARITHMETIC cannot > > produce random numbers, > > von Neumann meant any deterministic algorithm, actually. > There you go again, pulling things out of you crazy hat, head, running off at the brain again, stating a falsehood and hoping that people will overlook it. I assume that you held a seance with von Neumann and he told you that from the great beyond, since that is clearly not what he said. A careful reading of von Neumann does not reveal that he said one thing and meant another. He used the word ARITHMETIC, if he meant something else he world have said so. Furthermore, he was referring random numbers, and to repeat emphatically, my algorithm is a PRNG, but it also happens to be an OTP, as we can prove. Q.E.D. > > We stipulate the obvious fact that the encryptor stream > > generated by EUREKA is a PRNG stream, though we do consider > > it gross denigration to castigate it as ONLY a PRNG stream. > > If it is a PRNG, you do not have a One Time Pad, period. What you have > is a stream cipher. > It is a stream cipher, but it is also an OTP, just as a hardware sourced RNG is a stream cipher that is also an OTP. > > Furthermore, past examination has shown you have a POOR stream cipher. > Did you see the movie, Dumb and Dumber - you are obviously getting dumber and dumber and dumber - would I have come back to you 5 months later with the same thing - you are obviously brain dead - as I have stated on numerous occasions, the previous proffer was only a part of the overall algorithm, to solicit help from some of the cypherpunks, which I did get. The so called breaking with "Known Plain Text," was an absolute farce, it would have applied to only one message where it could be applied, if at all - it did not apply to the whole system, each OTP was, and is completely different - but that is beside the point, we did make some changes to negate other possible attacks, but those were modest changes. Any one that looks at the algorithm, which obviously, as a self proclaimed crypto Diety, you have not deign to do, can determine that it is in now way what you have looked at before. > > It is a PRNG issue that also happens to be an extremely well > > behaved OTP sequence, with limited but ample entropy, as well. > > If the entropy is limited, you do not have a One Time Pad, period, end > of discussion, its over. > You say that Shannon, or you, or someone can prove that mathematically, so let's see someone do it. 156.8816 megabytes of raw encryptor stream output should be enough to work with - if you need more, I can provide same. I agree that theoretically it can be broken by brute force but that is patently impossible as you can quickly discern if you examine the algorithm and try it, instead of salivating your mouth off with baseless blabber. Obviously, my algorithm does not produce a pure random stream. I agree with Shannon that it is not "perfect," but it most certainly is perfect enough to meet any and all practical requirements, now and forever. > > It meets each and every criteria rationally established for an > > OTP in all reasonable aspects. > > Set by WHOM? By you? Your criteria bear no resemblance to those > accepted in general. Are you one of those people who sells someone a > loaf of bread and says "this is an automobile, by every criterion I > have set for automobiles"? > There you go again, strutting about and spreading your pretentious turkey droppings, manure, all over the place. As you know, I headed the OTP group at NSA, and while there I conceived and implemented, under the direction of Abraham Sinkov, Dottie Bloome, Leon O'mera and William J. Cherry, LONE STAR, the Library of ONe time pad Encryption Statistical Analysis Routines. I was responsible for the generation and computer analysis of OTPs at NSA. I have worked on thousands of OTPs, both in the generation of, and comprehensive analysis of same, including looking for repetitive usage of the same OTP, including direct as well as nth degree derivatives, over the last 40 years, at NSA and at Mauchly-Wood. I make no claim that I am the world's greatest OTP authority, or even an authority on them like you obviously THINK you are, but I think that I have more than a little knowledge about the subject of OTPs. That brings up something that utterly fascinates me. Which is your frequent oblique writings about VERONA, or is it VENONA, or maybe it is VERONICA, or maybe even VERONIKA - anyway you know what I mean. Would you be so kind as to enlighten me, us, about that subject - I would like to finally find out what really happened from an authoritative source. How were we able to break some of those messages. Please help me, us, out with details instead of blabber. For those who have not seen my resume', it together with dozens and dozens of references, many of whom are well known, and some of whom you may know, is posted on our web site, but obviously that does not prove anything, except to provide a point of reference. The point is that we have disclosed the complete algorithm, for the first time at the web site, so let's see someone provide us with the key or the ABCs. Our server is downloading an enormous number of the algorithms/data/statistical tests, over 1,000 so far, so we assume someone is testing it and evaluating it. And for you to claim that my contention is analogous to comparing bread to an automobile, petty nonsense and mindless hyperbole. > > Think about that simple supposition for a moment. What do we > > mean by an OTP? > > Something different from what everyone else means, so it makes no > difference. Obviously something different from what YOU, and most others, mistakenly think it means. It is not some esoteric, theoretical mathematical meaning that has no relation to our real world. It is a tool to encrypt and decrypt messages with, it is not a mathematical formula. If you say that a random number sequence is not generated, I agree. If however, you go on and add that, "thus by definition it is not an OTP," then that is patently and absolutely a false statement, though subscribed to by most of the cryptography community. You are a mix-master stirring up cryptography and IT, and you simply cannot homogenize them into a fully blended mix. I assert that an OTP is a tool used for encryption which by definition, can never be used again, and which consists of a sequence of bits which can not be derived by any POSSIBLE, not theoretical but POSSIBLE, means. Granted, our stream could theoretically be derived by trying all of the possible 10^34322 keys/table values, but that is theory, it is absolutely clear that there is no way to try all the possibilities, or even the first 800 bits of an encryptor stream. Any relatively informed mathematician can quickly discern that there is no analytical attack that can be made against the stream, it is that simple, as readers/evaluators will find. If the only method of cracking the system is by brute force, and that is impossible, then it is absolutely an OTP for encryption and decryption purposes, which is its purpose - it is not something to define in IT writings. Our algorithm is absolutely not perfect in the theoretical sense but it is PERFECT as far as the ability to determine the underlying plain text is concern. > > > Not only that, but you can prove it to yourself, Q.E.D. We > > maintain that it is discernible to any knowledgeable person > > who probes the algorithm, that the only analytical tack that > > can be mounted against EUREKA is brute force and that is > > patently impossible.. One of your Cpunk colleagues says he > > uses Triple DES, 168 bits, and he does not believe that it > > can be brute forced - I agree, 3-DES, 10^50+ possibilities, > > cannot be brute forced now, or in the foreseeable future - > > then what about the EUREKA's 10^34322 possibilities, > > 10^34271+ greater than 3-DES? No way, not now, not ever. > > Furthermore, EUREKA is an order, or more, magnitude faster > > than triple DES, easier to use, much more secure, etal. > > I believe that we have already established that your cipher is easy to > crack, so your claims that it is hard to crack really don't matter. > > Perry > To repeat, we have made some a changes, and for the first time disclosed, detailed, the FULL ALGORITHM at great length at our web site. The reason that you do not want to argue that is obviously because you are absolutely impotent in that regard and you are unable to dispute facts, so you blindly conjure up some witches brew of words and think that people will never know the difference. To paraphrase John Dean, the truth will always come out and your ass braying will never stop that truth. Don Wood,

1 0

Blue Box Plans & hacker bbs's
by h2＠juno.com 17 Dec '03

17 Dec '03

I know this is my second question in a short period of time...but anyone got or know where to get any good blue box plans?? I cant find shit on the web, and I need some good hacker telnet bbs's. Someone please give me either. THanks HeLiUM

2 1

Re: Stego via TCP/IP (was Re: crypto wish list)
by Bill Stewart 17 Dec '03

17 Dec '03

>>>Where is highly sophisticated stego? >>What are our options? >>- Stego in english text. >>- Stego in audio and graphic file formats >>- Stego in Internet Phone protocols. >>- Stego in Internet video conference formats My experience with CU-SeeMe has been that it loses huge quantities of data, though that's partly because I've only used it over 14.4 modem, which isn't really fast enough. If the data formats are documented, it wouldn't be hard to add a few frames of "pictures" every second or ten that are designed to get sidetracked. CU-SeeMe can talk one-to-one, but is generally used through "reflectors", which are conference bridges. One technique is to stego-equip both the client and reflector; a more generally useful but harder method would be to see what you could get to pass through a reflector between two stego clients. Motion pictures in general give you a lot of slack; not only do they have high data rates from uncheckable sources, but you can hide data in ways you correct later, e.g. for Frame1 ... Frame2 ... Frame3, where the values for a given pixel change between Frame1 and Frame3, you can encode some bits by picking whether the change happened between Frame1 and Frame2 or Frame2 and Frame3, and your output is perfectly valid video, readable by anybody, only a bit fuzzier than it might have been from that cheap $89 camera you're using in bad lighting with the ceiling fan going in the background. Stego in innocuous-looking data is another approach. Send those spreadsheets of traffic data or SNMP stats or daily sales of products from your supermarket or whatever! I've been wondering about _un_sophisticated stego, for cases where you're trying to slip below the radar of simple bots or dumber eavesdropping thugs. For instance, you could send that DOS executable .exe or animated GIF which really _does_ expand into the cover-traffic file or generate the annoying flaming background for your web page, but which also drags along a bunch of stegobits that the executable thinks are just data it's ignoring or the GIF thinks is past the last frame. Then there are pictures which have inherently high entropy, so you can get away with a lot more stego - like the animated cloud picture movie you interpolated from the weather satellite photos, or the photo of the wheelbarrow of sawdust. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

3 2

Re: extortion via digital cash
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:46 PM 10/15/96 -0500, Andrew Loewenstern <andrew_loewenstern(a)il.us.swissbank.com> wrote: >scottb(a)aca.ca writes: >> I was wondering, what if you demanded payment via Ecash, >> through nym servers, aliases, etc. From what I understand, >> it is just like cash, ie: no record of transaction, but you >> get the added bonus of not having to meet the other party-like >> a fund transfer. > >This has been discussed quite a bit on the list before and there is even a >bit about it in Applied Cryptography. Basically the extortionist must be >careful in how he arranges payment. As Andrew says, yeah, you can do it. Chaum's Digicash is currently implemented as payer-anonymous but not payee-anonymous, primarily because Chaum's worried about this kind of problem. But Chaum's original mathematics give payee-anonymity as well, and there are ways to adapt the payee-non-anonymous implementations to get that back (though you'll have to write your own application code to do some of it.) In some implementations it's sometimes easier to be payee-anonymous if you're willing to take the risk of double-spending (i.e. trust the payer not to double-spend the money before you can take it to the cambio to trade it for unmarked money.) And, yes, there are all kinds of scary applications for it, such as Blackmail, extortion, ransom for kidnappers (which breaks the main connection that police have with those kidnappers who really _do_ want to collect the money and return the victim alive), and paying assassins (who have less risky payoff problems.) It also has many non-scary but politically incorrect applications, such as making change and trading foreign currency (aka money-laundering), paying for politically incorrect recreational substances, bribing politicians to do things they shouldn't, bribing government employees to do things they should but aren't, getting paid for work without the inconvenience of taxation, etc. Tim May's Cyphernomicon and the various Blacknet authors talk about this in some detail. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Car Rental: Refusal to take Check Cards
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

On Sun, 20 Oct 1996, Black Unicorn wrote: >Go try it out. Renting cars with cash, while possible, is extremely >difficult. Piffle. Just look for the sleazy little car rental outfits. I quote from the Tucson, AZ yellow pages: "Cash Deposit Accepted. Rental Into Mexico." "Cash Deposits Accepted. No Credit Required." "Yes, We Can! Mexico! Cash Deposits!" "No Credit Card Needed. Se habla espa~nol." "Save A Buck. Used Car Rentals. Low Low Rates. Clean-Inexpensive-Dependable. Se Habla Espanol." Seems easy to me (and ideal for Sub-Commando Marcos or Cody or whomever). Dave

1 0

amnesia@chardos.connix.com DOWN
by Scott Kenney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Effective immediately <amnesia(a)chardos.connix.com> is DOWN. I was requested to terminate remailer service by my ISP, which has received numerous complaints recently (from people who obviously don't have the ability to read the headers correctly), and finally had enough. The acquisition of my own domain name should alleviate any future objections, but this will have to wait till after the 1st of the year :( For the next 10-15 days I will manually process any mail destined for nymservers or just passing through to other remailers. Scott Kenney <saken(a)chardos.connix.com> <amnesia+admin(a)chardos.connix.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmrP75QgY7wl3Gh1AQFqcAQA3W86FvrThZ7kYiKxJxf2GMZlDm+OIczo fe27kSLtW6xpWegl95FGBYhLnf/PUWIpziUblGaY7lfvn7WfXQ2pOMapOWO5Uq/j 5iIiHf3cQogMeFeUp3clD10zfvkV698mdl22dj12BXQbxOcxJBvv9Tu++bzAuJZm c6QErMfwghI= =y24d -----END PGP SIGNATURE-----

1 0

Paper on Network Security
by John Young 17 Dec '03

17 Dec '03

We posted news* a few days ago of a white paper by the OURS organization on network security. We have put it at: http://jya.com/recsec.htm (63 kb) OURS is an our-gang of gorilla industries such as Bellcore, Chase, LDS(!), Compaq, DEC, EDS, EXXON, IBM, Intel, MIT, Microsoft, Motorola, Novell, Oracle, Princeton, Security Dynamics (!), Societe Generale, Texaco and Ziff-Davis. Mother of all GAK-enfeebled alliances. The report was prepared by an Information Protection Task Force of OURS members assisted by Amex, ICL, Mergent and TIS. It's a fair overview of what mega-corporations fear of network vipers and what they pray will exorcize the Edenic mayhemics. Sorry, it's a bit too long for E-mail. * That original news report is at: http://jya.com/oursay.txt

2 1

Re: Blue Box Plans & hacker bbs's
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:09 PM 10/20/96 EDT, you wrote: >I know this is my second question in a short period of time...but anyone >got or know where to get any good blue box plans?? I cant find shit on >the web, and I need some good hacker telnet bbs's. Someone please give >me either. goto alt.2600. Around here we generally can afford to pay our phone bills :-) Also, the network's signalling has changed, and the basic Captain Crunch Whistle doesn't work many places any more - most of the signalling is digital out-of-band rather than inband audio. Phreaking isn't impossible (or there wouldn't be as many people chasing the Dread Pirate Mitnick), but at this point you actually need to know what you're doing to succeed at it, and merely having plans for a device you don't know well enough to emulate in code on your PC isn't going to buy you much. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

6 8

AOL/remailer testing
by Raph Levien 17 Dec '03

17 Dec '03

Hi cypherpunks, It has come to my attention that there may be problems sending mail from the anonymous remailers to AOL accounts. I'd like a volunteer with an AOL address to recieve a test messages sent by me, and report back to me which mails got through and which didn't. Thanks very much in advance. Raph Levien

1 0

Apologies and Clarifications -
by cypher＠cyberstation.net 17 Dec '03

17 Dec '03

First of all, I would like to sincerely apologize for my personal attacks on Perry. It is the first time that I have ever done that and I apologize for wasting you time and mine in that regard. He is obviously going to try to pontificate and rehash the old forever. Accordingly, to paraphrase Chief Joseph, "from where the sun now sits, I will fight Perry Metzger no more, forever." I further apologize for any offense that you feel that I may have caused. As to other matters: Instead of replying to the attacks being fabricated by Perry and other I have opted to recapitulate the matter at hand as perspicaciously as my limited abilities permit. As we know, Shannon was not a prolific writer. We also know that IT has not advanced very far during the 50 years since Shannon's nascent ground breaking work. Why? Because of the very issues that are at the heart of this matter. The differences between black, white and all the multitude hues of grey in between. I am extremely skeptical, and believe many readers may be too, of people that go around flaunting their understanding of Shannon, entropy and its application in absolute unequivocal mathematical terms. I hold that such a position, except in terms of delimiters, does not reflect an understanding of Shannon's impartations but au contraire, it is evidential proof that they do not have any real appreciation of Shannon at all. That is in no way intended to denigrate Shannon's very important contribution to our endeavors. I embrace the predicate that Shannon in terms of mathematical certainty has only defined the boundary conditions of the playing field within which we must play our games. If we stray outside that field, we are errant in the absolute sense. If we however play within those mathematical certain boundaries, we may be in error for other reasons, but Shannon cannot be cited as the casual agent. The recondite "parti pris" hijacking of the definition of the term OTP on the basis of conflict with Shannon is ludicrous, when such usage is apodictically within Shannon's delimiters. I have witnessed several definitions of an OTP which I maintain are entirely consistent with Shannon. Among such are: An encryption where any ciphertext may in fact be an an encrypted expression of any plaintext of the same or lesser length; or an encryption where the only information obtainable from the ciphertext is the maximum plaintext length; and so forth. All of these definitions have the essential quality that at the bit level, they can be reduced down to the equation: Pb xor Ub = Cb where Pb is a Plaintext bit, Ub is an Unknown bit and Cb is the resultant Ciphertext bit. Of course the combining form is normally XOR, but could be table lookup, modulo additive, or other. The important thing is that so long as only Cb is known, it is impossible to determine either Pb or Ub. If somehow the Ubs can be subtracted or cancelled out, as for instance by any discoverable reusage of Ub, even in a derivative form, then you may be able to recover some or all of the Pbs. The assertion that an Ub must be an Rb, a truly Random bit, is irrelevant ideology unless there exists the means to convert the Unknown bit, Ub, into a Known bit, Kb. That is the sublime basis of the IPG algorithm, which is to generate a stream of "unknown bits" which cannot be analytically reconstituted in the absence of the OTP generator key, and possibly other related key like parameters. The additional caveat of course is that the key cannot be guessed, nor can it be derived from brute force methodologies, both of which are patently impossible with the IPG algorithm. You do not have to be a Stephen Hawking to comprehend why that is a fact; each of you, with possible minor exceptions, will be able to discern that because it quickly becomes self evident as you ply the algorithm. There are those who will advance the contention that the ciphertext cannot in fact represent any possible plain text. That is incontestably true. In fact with reasonably long ciphertexts, say for example an encrypted FAX, unlike a hardware sourced OTP, there will only be one meaningful plain text that can be derived from the resultant ciphertext. Does that mean that a given ciphertext might not represent any plain text of that same, or lesser, length? One would think so, since it obviously cannot. The problem being though, is exactly how do you go about proving that any given plain text cannot be represented by a known ciphertext. There are two prongs to such a proof, both of which must be substantiated in any specific case at hand:. 1. Inclusionary Proof - the one most frequently advanced alone, which simply stated says that since each encryptor stream may represent any possible encryptor stream of that same length, then the ciphertext may be the XOR product of any plaintext of same said length. Obviously, a hardware sourced OTP DOES meet that proof. Also. it is patently evident that the IPG software OTP DOES NOT meet the inclusionary proof test. 2. Exclusionary Proof - which is equally valid, and simply stated consists of two propositions: A. Can any plaintext be encrypted with the OTP? Obviously the answer is YES for BOTH both hardware sourced OTPs and the IPG software sourced OTPs. B. If 2.A is true, is it possible to exclude any plaintext possibility? Obviously in the case of hardware sourced OTPs, no plain text can possibly be excluded. What about the IPG software OTPs? . One method that you could theoretically be used to exclude a possible plaintext for the software OTP, would be to by brute force try all possible keys, until the correct one is obtained. That however, would be difficult to say the least, as a matter of fact it is impossible: If every subatomic particle in our known universe was a Googol, 1 with 100 zeroes after it, of Cray T3E computers - and each of them had been brute forcing a partition of the possibilities at the rate of 1 Googol of them per picosecond which could not be done - but assume that it could - and they had been doing so since the Big Bang say 20 billion years ago - and they were to continue to do so for the next 20 billion years, that is beyond the life expectancy of our solar system/galaxy, and perhaps the universe, then approximately 10^322 of the possible OTPs would have been tried. Thus it would still take 10^34000 times as long as that to try all of the possibilities - that is they would have tried only one part in 1 with 34000 zeroes after it - not theoretical infinity by any means, but a very, very large extra-astronomical number. Brute force is patently impossible. . Another possibility might be to guess it - anyone recognizes that would not be practical, and how would you know that you were right. All of the IPG OTP generator, aka Encryption, keys are themselves OTPs. . Another possibility would to be to analytically exclude the invalid possibilities. As stated previously, and as you can discover for yourself, this reduces itself back down to to the exact equivalent of the brute force method set out above. With the algorithm, there is no difference between analytically exclusion and brute forcing - they are one and the same. So in fact, any known ciphertext may indeed be an encryption of any plaintext of that same, or lesser, length, because you cannot prove that it is not a specific plaintext. Some will contentiously assert that the key and other parameters might be hacked. While we include within the system facilitators that reduce that risk to a minimum, and to near zero if you use simple precautions, it is true that the hacking possibility exists. However, that possibility exists for RSA, PGP, hardware sourced OTPs, or any other form of security or encryption. We are better positioned in that regard than others but in terms of the human element, as we all know, there is no such thing as perfection. With warmest regards, Don Wood

1 0

Alice in Cypherspace
by David Lesher 17 Dec '03

17 Dec '03

I found my copy, if the person asking last week still needs it.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Dimitri
by David Lesher 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM sez: > Sounds like a crontab job, or Timmy May, or both. THIS sounds like our friend SternFUD. {Who, BTW, is back attacking folks in the pgp groups..} -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Wrap Up: Conference on Law Enforcement and Intelligence
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:13 PM 10/20/96 -0600, C Kuethe wrote: >On Sun, 20 Oct 1996, Bill Frantz wrote: >> (3) The devil is in the details. I still am not convinced that MacPGP has >> enough sources of entropy for its IDEA key generation. (But I am not >> convinced that it doesn't either.) I put integrating Jon Callas's entropy >> manager into MacPGP as a high priority. > >Tell me more... I use macpgp. I just built some new keys tonight, a 2048 >bit monster. PGP wanted 1496 bits of rand info... where is it's entropy >"Hole" > >And what is the "Entropy Manager"? When you build RSA keys in PGP it uses keyboard timings to acquire "true randomness" or entropy. This kind of randomness is related to quantum mechanical uncertainty. It probably has enough entropy to safely generate RSA keys by the keyboard technique it uses. In addition to RSA keys, it generates symmetric IDEA keys whenever you send a message. It uses keystrokes accumulated during normal operation and saved in a file called randpool (or something like that) to generate these keys. Since you almost never enter keystrokes during the normal operation of MacPGP, I am concerned that randpool does not have enough entropy. Entropy Manager is a program Jon Callas of Apple is working on. It uses well-known sources of entropy in the computer to build up a pool of entropy for use by programs that need it. The last I heard, it was nearly ready. I would trust it more than the ported PGP since Jon has examined sources available in the Macintosh specifically. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Re: Usenet and Re: extortion via digital cash
by Bill Stewart 17 Dec '03

17 Dec '03

> As an already existing, widely >disseminated and easily used message pool, Usenet is very valuable to us. >I'm concerned that it may not last though. Many people now complain about >how low the signal to noise ratio is [...] So, if it gets too bad, might it >just fade away? Or, if it remains but becomes unpopular, will it be easy to >restrict if we use it for anonymous messages? I haven't read all of Usenet in 10+ years :-) But it keeps growing, and if you're trying to piggyback anonymous messages on it, then it's great to have VOLUME, VOLUME, VOLUME, as the talk.bizarre folks put it. On the other hand, there are technical difficulties with using the current modes of Usenet for real applications, and volume may make it worse. Usenet used to work by flooding - every message goes to every machine, so it's not suspicious your machine receives an Anonymous Message. Most machines had multiple users (Unix, after all), and didn't log who accessed what files in the news spool (which you could do directly as well as through your newsreader.) Now, however, most users use NNTP to fetch news articles from their ISP, and the number of machines receiving the whole Nx100MB/day flood is probably smaller, though perhaps businesses and universities are putting up with it, and perhaps the usage patterns are different outside North America. Fetching material by NNTP is probably logged by many ISPs, and can also be detected by sniffers in the places where security is weak enough for them, which probably includes many major ISPs. So it's easier to detect who's reading alt.anonymous.messages, especially if some government agency subpoenas logfiles. azur(a)netcom.com (Steve Schear) wrote: >In the U.S., at least, attempts to enforce identification of Internet users >or anonymous posters to newgroups and such are likely to meet with stiff >legal resistance. The Supreme Court has ruled that anonymous use of >protected speech (e.g., political handbills) must be permitted. No legal resistance at all, if it's done by ISPs or businesses or individuals - only if the government tries it does it get into "protected speech" territory. There may be market resistance, and the Internet and Usenet are fundamentally worldwide cooperative efforts, so if the protocols support anonymity, then participants in the nets can choose to have their systems cooperate with or refuse to cooperate with anonymous messages, and you'll find some people doing each one. This may mean that small-ISP.net and xs4all.nl will permit anonymous users and aol.com, compuserve.com, and proxy.gov.sg will demand Internet Driver's Licenses to let your postings through, while nihilism.net won't allow any non-anomymous messages. Spontaneous order is like that. And the US government could probably get away with sponsoring Internet access for Real American Citizens and Green-Card Holders that requires positive identification because you can file your tax forms over it, as long as they don't prevent anonymous messages on _some_ part of the net. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: [crypto-philo]OTP or DES?
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:45 AM 10/20/95 -0500, walrus <walrus(a)tcgcs.com> wrote: >I would argue that the security of an OTP is >derived not from the fact that it really is secure, but from the fact that >it is claimed to be an OTP. The meaning of "Security" depends on your threat model. Are you worried about - having your message noticed? - having your message decoded? - being able to deny a possible decoding of your message? Whether your message noticed or not depends a lot on the environment; in some places "pure noise" is not noticeable, while in others it really stands out (posting it to a text newsgroup, for instance.) If you simply remove the "----- BEGIN PGP" etc. headers/trailers from a PGP message, it's still got a well-defined format, including magic numbers indicating what kind of data is in each block, block length indicators, etc. They're both noticeable to someone who's trying to find them and strong evidence that something is a PGP message. That's why there's a Stealth-PGP, though even it's not perfect. As far as "Secure" meaning "They can't decode the message", if you use a One-Time-Pad more than once, you can lose (viz. VENONA.) If you use a pad that's not true random numbers, but is some simple LFSR or LCM PRNG, or some random English-language book, it's pretty easy for skilled cryptanalysts to decode it. If you use something that has a well-defined structure as a pad, and the Bad Guys notice your message and decode it, it's not credible to say "oh, no, it's just a one-time pad, the fact that there's one chance in 2**168 of that particular series of random numbers matching the output of triple-DES shouldn't influence you any, Judge".... You're gonna go to jail. What gives you deniability with OTPs is that they _can't_ produce a meaningful message that's any more probable than any other meaningful message of the same length, so you can argue that it really says "BUY MORE" instead of "RUN AWAY" or "ATTACK!!" and even if they guess you're lying, they can't tell what the true message was. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

lambda 2.11 - Short-circuits in Burma
by -Jerome Thorel- 17 Dec '03

17 Dec '03

netizen's --> Lambda Bulletin 2.11 <-- contents + Short-circuits in Burma + Medical privacy and PGP + New York's CDA on tracks * * * * * SHORT-CIRCUITS IN BURMA The military regime in Burma decided last month to ban information technology use and possession, in order to sustain its new iron fist on dissidents and members of the National League for Democracy. Among other news here's a message sent through the mailing list of the US organisation CyberPOLIS. ---fwd message--- >>From: George Sadowsky <George.Sadowsky(a)nyu.edu> >>Subject: Re: Burma Bans modems >>RANGOON, BURMA, 1996 SEP 27 (NB) -- Burma has made owning, using, >>importing or borrowing a modem or fax machine without government >>permission a crime, punishable by up to 15 years in jail, according to a >>report by United Press International. >>Burma's military government has imposed what's called "The Computer >>Science Development Law" which empowers the Ministry of Communications, >>Posts and Telegraphs to specify what exactly can be restricted, UPI >>reports. >>UPI quotes the government-run newspaper New Light of Myanmar as saying >>the same punishment is prescribed for anyone who sets up a link with a >>computer network without the prior permission of the ministry, or who >>uses computer network and information technology "for undermining state >>security, law and order, national unity, national economy and national >>culture, or who obtains or transmits state secrets." >>UPI reports that in July a diplomat, Leo Nichols, died in prison after he >>was sentenced to a lengthy term for illegal possession of fax machines. >>It's clear from this action that the SLORC, i.e. the "State Law and Order >>Restoration Committee" (sic!) understands full well the benefits and >>importance of the Internet and other forms of electronic communication to >>open societies, and is determined to deny these benefits to its citizens. >>Given its recent history and the quasi-imprisonment of Daw Aung San Suu >>Kyi, this new action is perfectly consistent with the government's >>previous abysmal record. >>Countries who would deny open Internet access to its citizens might well >>pause to consider if they wish to be associated with the current >>government of Myanmar in doing so. ... c y b e r P O L I S ----------------------------------------------- C o m m u n i c a t e T h i s C u l t u r e ( Christopher D. Frankonis -- baby-x(a)cyberpolis.org ) ---end of fwd message--- ------------------- FURTHER INFOS According to other sources--international press reports and electronic forums like Usenet's *soc.culture.burma*--it turns out that Ms Aung San Suu Kyi, 1991 Nobel Peace Prize and NLD leader, saw her telephone line cut on Friday, Sept. 28 on the evening. That was the beginning on a widespread crackdown on dissidents and a ban of NLD meetings. University Street, where Ms Suu Kyi lives, was blocked to avoid demonstrations. Hundred of citizens and NLD supporters were detained, some were released by mid-October. The Web site http://freeburma.org is a well known relay for the Burmese diaspora, especially the daily newsletter BurmaNet, which offers a rich compilation of dissidents' communiqués and Western newspapers articles and editorials. Ms Suu Kyi writes a daily letter from her home in Rangoon which is published in the Japanese newspaper Mainichi Shimbun (in japanese, http://www.mainichi.co.jp) - a translation appears daily in soc.culture.burma. It seems that the letter (surely copied on an audio tape) continues to be shipped ouside the country to be published in the Tokyo-based newspaper. Furthermore, other reports claimed that Burma doesn't have any official connection to the Internet. It seems to be true, but a Burmese and US resident found that the domain name "mmnic.net" (mm for Myanmar) was reserved by the Burmese governement in February, 1994. The operation was made possible with the help of the Internet provider Asia Pacific NIC based in Tokyo, Japan. A spokesman confirmed he reserved the domain on the behalf of Burma's State, and that it was dedicated to a future Internet connection. * * * * * MEDICAL PRIVACY AND PGP ---fwd message--- >Sender: dfickeisen(a)cpsr.org (Duane Fickeisen) > Subject: cr> Health Info Database Misused > >An AP story from Tampa Bay appearing in the Palo Alto Daily News asserts >that a public health worker took a laptop and disks with confidential >lists of people with AIDS and HIV home and to a gay bar to check out the >HIV status of potential dates and offered to look up names of people his >friends were interested in dating. One person asserted that he had warned >friends away from potential dates, telling them that their names were "on >the list." Another claimed that people interested in dating him backed >away after the health worker talked to them. The County Health Department >has fired him, although he claims he did nothing wrong. The former health >worker also owns and lives in a funeral home. The state had permitted such >databases to be removed from offices and taken home until they changed >their internal rules two weeks ago. > >Raises anew questions about privacy and confidentiality of records, >security, and misuse/abuse of information for personal and private gain. >This ought to be raised up as an example of abuse in response to the >announced plans for a national health information database. > >Duane H. Fickeisen, Interim Director >Computer Professionals for Social Responsibility ---end of fwd message--- As far as I can remember, Phil Zimmermann, speaking during the international encryption conference in Paris on Sept. 25, mentioned this story to explain how easy it was to have his privacy on personal medical records beached. And that to encrypt this sensitive information may be the ultimate solution. Zimmermann is president of PGP Inc., which develops computer security software based on his popular program Pretty Good Privacy (http://www.pgp.com) * * * * * NEW YORK's CDA ON TRACKS ---fwd message--- >============== >VTW BillWatch #61 > >VTW BillWatch: A newsletter tracking US Federal legislation >affecting civil liberties. BillWatch is published about every >week as long as Congress is in session. (Congress is in session) > >BillWatch is produced and published by the >Voters Telecommunications Watch (vtw(a)vtw.org) > >Issue #61, Date: Thu Oct 17 01:17:52 EDT 1996 > ... > >FREE NOV. 3RD SEMINAR ON NY STATE INTERNET CENSORSHIP BILL > >To learn more about this free cybercast seminar see http://www.vtw.org/speech/ > >New York state recently passed a bill that criminalizes expression >online that is currently legal in print. When it goes into effect on >November 1, World Wide Web pages, Usenet postings, and email lists that >fall under the law may become subject to criminal prosecution, as might the >Internet providers that host them. > >But don't panic! VTW and the Netly News (http://www.pathfinder.com/Netly/) >are putting on a seminar to educate you on the history of the bill, the ins >and outs of it and what you should ask your own lawyer, as well as the >status of any pending legal challenges. > >Who should attend? >------------------ >Anyone who publishes information on the Internet, including through >World Wide Web pages, Usenet, Email lists, or interactive chats. >Attorneys whose clientele include any of the above. >Journalists whose beat include the Internet or online services. >....and you! ... >Who will be there? >------------------------------- >Speakers marked as "invited" have told us they intend to come, but have >informed us of potential conflicts that same day that might interfere with >their attendance. > >Live speakers . Rep. Jerrold Nadler (D-NY) invited: Opening remarks . >Shabbir J. Safdar, President (VTW Center for Internet Education) . >Steve Barber, Legislative Counsel (VTW): How will this bill affect you, and >what you should ask your own attorney . >Ann Beeson, Litigation Staff (ACLU) invited > >Speakers available online through interactive chat >Diana Jarvis, Staff Counsel (VTW Center for Internet Eduation) >Stephen Filler, Law Offices of Stephen C. Filler invited ... >Where and when is this seminar? >------------------------------- > >The seminar will be held at Outernet, Inc, home of bway.net at, > >Outernet, Inc. >626 Broadway, Suite 3-A >(Very close to the Broadway/Lafayette stop on the F train) ... ---end of fwd message--- -------------------------------- the lambda bulletin, 2.11 http://www.freenix.fr/netizen =+= the lambda bulletin -> www.freenix.fr/netizen =+= =-= Jerome Thorel, Journalist, Paris (Planete Internet Editor) =-=

1 0

Re: Blue Box Plans & hacker bbs's
by Pyros Everflame 17 Dec '03

17 Dec '03

Check out these sites: L0pht heavy industries <a href="http://www.softaid.net/nuke/marks.html">Mad Dingo's Bookmarks</a>

1 0

RE: Goodbye
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Blanc Weber <blancw(a)microsoft.com> wrote: >It all depends, as usual, on the individuals involved - on the quality >they bring to the subject, to the list, to the enterprise. >Interesting question: what do elite sophisticates *do*, once they've >reached their pinnacle? Harlan Ellison suggests one possibility in his 1967 story titled: The Prowler in the City at the Edge of the World. James

2 1

RE: Q.E.D. reply to petty MESSger
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Deadwood <ipgsales(a)cyberstation.net> wrote: >To paraphrase John Dean, the truth will always come out and your >ass braying will never stop that truth. >Don Wood Be careful of what you wish for. You may just get it. James

1 0

Crypto Raid
by John Young 17 Dec '03

17 Dec '03

In a coincidence with the Biham/Shamir smart card attack, AP reports October 20 on an Israeli raid of News Datacom Research for $150 million tax fraud, allegedly because locally developed crypto products were smuggled out of the country. News Datacom develops and markets encryption systems for pay-TV based on Shamir's work, and he is a part-owner. Recall that Markoff's story on DFA cited Bahim's experience with pirate-TV and smart-card tampering. FiTi ran stories last May about the company's financial derring-do, which we've placed with the AP report at: http://jya.com/keylok.txt We've also put the Biham/Shamir DFA post and NYT article at: http://jya.com/dfa.htm

1 0