December 2003 - cypherpunks-legacy

LAW_dno
by John Young 17 Dec '03

17 Dec '03

12-29-96. "Cybercash at risk/Money laws lacking" The laws that govern digital money are unclear, partly because governments have failed to revise finance rules to include the online realm explicitly. However, the feds want to be able to trace funds in some way in order to guard against online money laundering. Although no one wants interference from the government, some clear statements from lawmakers might help. ----- LAW_dno (10K)

1 0

[ADMINISTRATIVIUM] PGP
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

The arrival of warm weather is heralded by the pig shit (or whatever kind of shit Intel swines have for brains) getting soft in Tim C. May's mini-cranium and the resulting green slime seeping through his cocaine- and syphilis- damaged nose and onto his keyboard. )_( [@ @] Tim C. May |/ \| \O/

1 0

FCC Access Charge Proceeding
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Date: Sun, 29 Dec 1996 10:19:56 -0600 >Reply-To: telecomreg(a)relay.doit.wisc.edu >Originator: telecomreg(a)relay.doit.wisc.edu >Sender: telecomreg(a)relay.doit.wisc.edu >Precedence: bulk >From: NJF <NJF(a)commlaw.com> >To: Multiple recipients of list <telecomreg(a)relay.doit.wisc.edu> >Subject: FCC Access Charge Proceeding >X-Comment: Requests (UNSUBSCRIBE/HELP) to: listserver(a)relay.doit.wisc.edu >MIME-Version: 1.0 >Status: U > > I have placed on our Web site at: > > http://www.commlaw.com/pepper/Memos/InfoLaw/access.html > >an analysis of the FCC's Notice of Inquiry on whether ISPs should be >required to pay access charges. We also have available the full text of >the NOI (long) for downloading in Word and WordPerfect formats. > > This is an extremely important proceeding for anyone doing business >online. If the RBOCs get their way, the cost of connecting to the Net >could go through the roof. Pepper & Corazzini is preparing to file >comments and reply comments on behalf of interested parties. This will >be a very time-consuming effort as we anticipate voluminous comments to >be filed by a large number of companies. We are prepared to file joint >comments and replies on behalf of companies supporting the present >policy of exempting ISPs from access charges. This will enable a large >number of firms to participate at a nominal cost. Please contact me if >you are interested. And please feel free to circulate this to any list >that may be relevant. > >Neal J. Friedman >Telecommunications and Information Law >Pepper & Corazzini, L.L.P. >1776 K St., N.W. >Washington, DC 20006 >njf(a)commlaw.com >Voice: 202-296-0600 Fax: 202-296-0600 >Web Site: http://www.commlaw.com >> >

1 0

Random ITAR violations
by Blake Coverett 17 Dec '03

17 Dec '03

I was looking through the current rfc index for something else a few minutes ago when I noticed rfc2040 from the end of October. Machine readable C code for several modes of RC5.

1 0

Re: "Structuring" of Communications a Felony?
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 10:57 PM -0800 12/28/96, Lucky Green wrote: > >>IMHO, this closes the door on the foreign contracting loophole used by C2 >>and others. It is now illegal for US persons to finance or contract out >>overseas crypto development, since doing so will obviously assist in >>proliferation. While not unexpected (I offered a bet on Cypherpunks that >>this would happen. Nobody took the bet.), this provision sets a dangerous >>precedence. The technical assistance prohibitions of the past have been >>transformed into general prohibitions against "financing, contracting, >>service, support, transportation, freight forwarding, or employment". >> >>Again, IANAL. > >Nor am I, but I have a "prediction" to make in the spirit of Lucky's types >of predictions of doom. > >I predict that we will see within two years a law making it illegal to >"structure communications" with the intent to avoid traceability, >accountability, etc. > >This would be along the lines of the laws making it illegal to "structure" >financial transactions with the (apparent) intent to avoid or evade certain >laws about reporting of income, reporting of transactions, etc. > [snip] > >How long before the U.S. Code declares "attempting to obscure or hide the >origin of a communication" to be a felony? That would rule out orninary >mail without return adresses, but I think there are ample signs we're >already moving toward this situation (packages that could be bombs >putatively require ID, talk of the Postal Service handling the citizen-unit >authentication/signature system, etc.). > [snip] >You heard it here. > >--Tim May Tim, I think that this is highly unlikely. The SC has ruled repeatedly that anonymous speech is a foundation of American politics (e.g., the Federalist Papers). Care to make this prediction a bet? -- Steve

8 10

VIB
by roland＠internetfleamarket.com 17 Dec '03

17 Dec '03

Fuck_God_Up_The_Ass, This is a VIB (Very Important Bookmark)! The Internet Fleamarket is available now to all Internet users locally, nationwide and worldwide. Sell what you don't need, offer your service and reach out to all. Or just visit us! http://internetfleamarket.com . Happy New Year!

1 0

cypherpunks suggestion
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

John -- Just got back after vacation... It is my understanding that cpunks list has been attacked by several clever tricks. I have a couple of suggestions on how to improve protection of this list: # Use the following recipe in .procmailrc for cypherpunks (or majordomo) # account: :0 * ^TOcypherpunks * !^X-Loop: * !^FROM_MAILER * !^FROM_DAEMON * !^X-Mailing-List: { # get rid of duplicates :0 Wh: msgid.lock | formail -D 65524 msgid.cache # add X-Loop:, etc :0 fhw | formail -I "X-Loop: cypherpunks(a)toad.com" \ -I "X-Mailing-List: cypherpunks(a)toad.com" \ -I "Precedence: list" \ -I "Errors-To: cypherpunks-errors(a)toad.com" # this recipe finally passes the submission to majordomo :0 | majordomo .... } The rest is not really anything for cypherpunks, and should go to /dev/null. - Igor.

1 0

Do you need the MOST powerful way to advertise?
by starr＠lakes.ring.com 17 Dec '03

17 Dec '03

cypherpunks(a)toad.com, Hi, saw you posting online and was wondering if you market products/services using your computer and would like to learn how to do so QUITE a bit better than what you are already doing?<g> If so, just say the words (words=MORE ORDERS) and I'll email a free, helpful file that could mean the online marketing difference between scintillating success and frustrating failure. OR! to get this profitable information free RIGHT NOW! INSTANTLY! send an email to star-conniestarr-netcontact(a)nicers.com (just put this in the to: field) and a free, complete information package will be emailed to you automatically in less than ONE MINUTE! ACT NOW! Sincerely, Connie Starr ps: don't forget the address to send for free information has one r in the first star and two r's in the second starr <g>

1 0

DCSB: Applying PGP To Digital Commerce
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Rodney Thayer Sable Technology Corporation "Applying PGP To Digital Commerce" Tuesday, January 7, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Rodney Thayer has 20 years experience in the software development business. For the past 10 years he has been designing, implementing, deploying, and troubleshooting networking software. He currently is the Principal of a consulting firm based in Newton, Massachusetts where he is involved in the implementation of communications products for a variety of customers, including software vendors, major end-user organizations, and several governmental organizations both foreign and domestic. He also writes and lectures on the deployment, troubleshooting, and implementation of data communications networks. Mr. Thayer will talk about how PGP can be used in the business world today, for exchange of information, digitally identifying documents, and other commerce applications. In this presentation, we will discuss the application of PGP, including mechanics, the cryptographic and legal issues, and the infrastructure requirements for it's use. The state of the art in digital message encryption is now at the point where it has become practical to use encrypted and digitally signed email for digital commerce. Recently, one scheme, PGP, has emerged from the realm of the cyberpunk as a legitimate tool for business. Commercial products are now available that support PGP encryption in electronic mail and for documents and digital storage. PGP is no longer a cult tool for computer junkies and cyberpunks. It is a legitimate, sound cryptographic technology that can be used, today, for digital commerce. As an increasingly crypto-aware business community searches for solutions, the question of how to use message encryption tools such as PGP becomes germaine to the business community. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, January 7, 1997 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, January 4, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: February David Kaufman 1996 in Review / Predictions for 1997 March TBA April Stewart Baker Encryption Policy and Digital Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: SafeMail 1.0b6 e32 iQCVAwUBMsb+IvgyLN8bw6ZVAQEhRgP/b5Q5u83gIUAqJYPHp6J/BxKUrFjy/fYH J4EqvEvjKrdWE0jcwE34ISf+qUmBS+rZZRYVMsQ8jiVa/uF8TwNNTEEe5kMUPpne UtKvuJOEosFURwGfR4OLoYu1NsqPNuzAD40dwfQDQGVcmTqNlivhikZByE4MTNVz bUlII450N/8= =IS1x -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: New crypto regs outlaw financing non-US development
by azur＠netcom.com 17 Dec '03

17 Dec '03

> Lucky Green writes: [snip] >Finally, to the big one: >>Sec. 736.2 General prohibitions and determination of applicability. >> >>* * * * * >> (7) General Prohibition Seven--Support of Certain Activities by >>U.S. persons--(i) Support of Proliferation Activities (U.S. Person >>Proliferation Activity). If you are a U.S. Person as that term is >>defined in Sec. 744.6(c) of the EAR, you may not engage in any >>activities prohibited by Sec. 744.6 (a) or (b) of the EAR which >>prohibits the performance, without a license from BXA, of certain >>financing, contracting, service, support, transportation, freight >>forwarding, or employment that you know will assist in certain >>proliferation activities described further in part 744 of the EAR. >>There are no License Exceptions to this General Prohibition Seven in >>part 740 of the EAR unless specifically authorized in that part. > >IMHO, this closes the door on the foreign contracting loophole used by C2 >and others. It is now illegal for US persons to finance or contract out >overseas crypto development, since doing so will obviously assist in >proliferation. While not unexpected (I offered a bet on Cypherpunks that >this would happen. Nobody took the bet.), this provision sets a dangerous >precedence. The technical assistance prohibitions of the past have been >transformed into general prohibitions against "financing, contracting, >service, support, transportation, freight forwarding, or employment". > >Again, IANAL. > If they have not already done so, those currently doing work for/with C2 can form an off-shore company to manage and develop the crypto work. This off-shore company can then sell shares (private/public) to citizens and companies (both foreign and domestic) and use the proceeds to develop the software. Some of the investors (e.g., C2) could be offered the opportunity to become distributors and support the products in their respective countries. I doubt the Executive order can be interpreted to mean U.S. citizens cannot purchase stocks of foreign companies engaged in crypto. There are many companies (e.g., NEC, Siemans, Philips, ect.) which engage in development of crypto equipment which would not be exportable if they were produced in the U.S. Can the gov't deny us the right to invest in these and other offshore companies? Since those working for C2 are already doing so offshore (e.g., Australia and England, I believe) these parties would only need to separately incorporate an entity to conduct that portion of their current business now under contract to C2. --Steve

3 2

New crypto regulations
by gt＠kdn0.attnet.or.jp 17 Dec '03

17 Dec '03

Concerning the new crypto regulations: " Note to paragraphs (b)(2) and (b)(3) of this section: A printed book or other printed material setting forth encryption source code is not itself subject to the EAR (see Sec. 734.3(b)(2)). However, notwithstanding Sec. 734.3(b)(2), encryption source code in electronic form or media (e.g., computer diskette or CD ROM) remains subject to the EAR (see Sec. 734.3(b)(3))." This is a big question for me. How does the fact that the same exact information, when stored on magnetic media, cause it to lose its freedom of press protection? Has magnetic media never been tested in court for freedom of press applicability? What are the laws that outline the differences between magnetic media and printed media? Specifically, the one(s) that permit the non-protection of magnetic media? Does this mean that if a journal published an article on some strong non-key escrow encryption algorithm that included source code, it could not later offer that same article on a CD-ROM collection? or provide that same source code online?

11 14

Cryptanalysis Trainer
by John Young 17 Dec '03

17 Dec '03

We've transcribed from PDF to ASCII the cryptanalysis program in Appendix F of the US Army's Field Manual FM 34-40-2, Basic Cryptanalysis, September, 1990. http://jya.com/appf.htm Manual quote: "This program gives the capability to encipher and decipher messages in monoalphabetic and polyalphabetic substitution systems, produce a variety of statistical data about the encrypted messages, and print the results or save them to disk. Because of its limited purpose, the program does not support on-screen analysis. The printed results can be used off-line to aid in analysis, however. The program should be particularly useful in preparing examples and exercises for training cryptanalytic techniques."

1 0

Re: Internal Passports
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

Bob Hettinga wrote: >At 6:20 pm -0500 12/29/96, Timothy C. May wrote: >>What I think this means is a move toward a national ID card, replacing the >>confusing (to airlines, to government agents, etc.) mishmash of state >>driver's licenses, student ID cards, etc. > >"I've found that they issue a national ID card, it's time to leave..." > Lazarus Long, "Time Enough For Love", by Robert A. Heinlein "After Austria and Germany, Switzerland is my favourite country. I have spent the past 40 winters and 10 summers there. I love the place because it's clean, beautiful, very conservative and its people mind their own business." Taki, in today's _Sunday Times_(London).

2 1

lambda 2.13 - Parental control abuses and Crypto leaks
by jt＠freenix.fr 17 Dec '03

17 Dec '03

lambda 2.13 contents ... * Parental control abuses * Crypto Soap Opera : new leaked documents in France and at the OECD * Short-circuits : - U2's hacked: Big Lie in Cyberspace - Serbia's fight for democracy reach digital age - Radikal censorship (sorry for langage mistakes, the text has not been reviewed by an English third party) * * * * * Peacefire vs Cybersitter Parental control abuses * * * * * An insider quarrel between blocking-software CyberSitter and one of the Web site blocked has emerged recently. A US youth association against Net censorship, Peacefire (wwww.peacefire.org) claimed on December 7 : "Sometime today or yesterday, CYBERsitter put www.Peacefire.org on its list of blocked sites. Next time users of the program update their "filter file", they will see our web page blocked along with Playboy.com, Penthouse.com etc. (not to mention NOW.org, Members.GNN.com, and C2.org) Apparently, the company president read our page about CYBERsitter at: http://www.peacefire.org/censorware/CYBERsitter.html and didn't like it." Solid Oak Software (www.solidoak.com) owner of the blocking program, claims Peacefire put online some advices or tips to abort CyberSitter efficiency for teenagers; claimed one time of "copyright infringements"; and decided to urge Peacefire's IAP to block its account. Remember that these softwares were designed to allow parents to control their child's access to the Internet. "Parental control", as it is called, was suppose to give ways for parents to self-censor Internet content. But when people trust the technology and give too much faith to black-listed sites maintained by other individuals' moral standards, parents don't really keep on their "parental control" anymore. They even fail to tackle their own responsability towards their childs. On December 27 the CPSR (www.cpsr.org) wrote a protest letter to Solid Oak. Abstracts: "Your own description of your product provides a fairly concise description of CYBERSitter's restrictions: "any site that focuses on topics such as adult or issues, illegal activities, bigotry, racism, drugs or pornography". Using this list", the CPSR went on, "any determined individuals with web browsers might easily build a profile of sites that are blocked by CYBERSitter. Several members of our group dowloaded your demo, and quickly verified that your software completely or partially blocks access to sites such as the National Organization of Women (http://www.now.org) and the Yahoo search engine (http://www.yahoo.com) Since CYBERSitter's behavior can be easily categorized, Peacefire's publishing of a list of blocked sites does not justify blocking Peacefire's site, or any similar unsavory activities. ... By blocking sites that focus on topics such as [sex] and drug use, SolidOak may filter potentially educational materials regarding AIDS and drug abuse prevention." As Haselton wrote later, "Most letters to the president, Brian Milburn, at bmilburn(a)solidoak.com, or to their support staff at support(a)solidoak.com, are now being bounced with the message, "this account has been configured to reject all messages on this topic..." i would guess that their mail software at those accounts is rejecting all messages with the word "Peacefire" in the subject line, so remember to leave it out if you decide to write to them about this. (And thanks for your support if you do!)" P.S.- The European Commission has submitted draft guidelines to member States concerning the Internet's content regulations. They were quite reserved about the real efficacy of content control specifications like PICS, but nonetheless approved it: http://www.echo.lu/best_use/best_use.html * * * * * French Crypto Sop Opera : other leaked documents * * * * * If you're an encryption addict and fluent in French, jump to the document published by Planete Internet magazine : http://www.planete-internet.com/crypto/decret It is a draft decree prepared by the SCSSI, the security agency, which draws a preliminary picture of future French "trusted third party" agencies (TTPs), or "key recovery agents". A brief summary of what the French electronic notary will look like: The government - The SCSSI * Will say which encryption product will be concerned; all crypto systems will be OK if a key recovery scheme is scheduled; (PGP and the like are not on the list of "approved" products); * Will decide which firm is OK to become a TTP; but no justification will be needed for negative requests; The TTP, "le notaire" * All commercial firms or entities (SA, SARL, consortiums...) will be concerned; * But all its members, CEOs or associates must be "French": like the majority of its finantial assets; * Will be submitted to "professionnal secret" and obliged to keep third party encryption keys away from illegal wiretapping activities; The (commercial) user * Will be obliged to use authorised encryption products; * Will engage itself to fully cooperate with the TTP; The (basic) user * Even if the sheme will not be mandatory, using encryption without the backing of a TTP will be considered illegal; * Huge finantial and logistical procedures will discourage NGO's, small companies and the citizen to protect legally its electronic communications. The new and fully complete policy is scheduled in France in the comming weeks. * * * * * PS - Leaked document from the OECD's crypto hearings Australians cryptographers at http://www.ozemail.com.au/~firstpr/crypto/oecd_dr2.htm published the draft paper that were on the agenda of the Dec. 16-20 closed-door meeting in Paris, revealing the broad and detailed policy toward an international cooperation for "lawfull access" to encrypted communications. * * * Short-circuits * * * U2 hacked? Big Lie in Cyberspace --------------- You surely read numerous stories about the U2 rock band that were "robbed" in Cyberspace by hackers that traveled through cables of a digital camera that broadcasted on the Internet views of their Dublin studio. Hackers put 2 new songs online from a site in Hungary, the story went on. Strange hacking, hey??! The story, which broke in the London's Sunday Times on November 17 (follomed by a naive Le Monde in Paris) was just dope -- a fake, phoney and bull story. Read, for example, what a fan from the Nederland says -> www.universal.nl/users/mirrorbal/u2.htm Number 1 : he told the real story to the Times which didn't even publish a word of it. What's the story? A videotape with 45 sec abstracts from both songs were released by Island Records-Hungary in November (it was the scheduled date for U2's upcomming album, but now scheduled in March!). And a guy simply put a microphone besides his TV and put the digital stuff online. Where's the hack? The Hungarian explains also the story, but didn't erase the songs from his server: w3.datanet.hu/~karpati/ Serbia's fight for democracy reach digital age --------------- Read David S. Bennahum's last MEME bulletin about Serbia's democratric fight: http://www.reach.com/matrix/. Bennahum spent one week in Belgrade and met democrats willign to create cyber-rights organisations like the EPIC or the CDT. Follow their fight daily on the Internet : http://eurasianews.com/erc/serbopp1.htm Radikal censorship --------------- A magazine banned in Germany, the leftist Radikal, available online in the Nederlands, was the target of German policemen on Dec. 11. After failing to urge Nederlands authorities to block the Web site last September, German police decided to act as usually, with the help of their Dutch counterpart and raided a house in Vaals. It turns out that they acted to block Radikal at the source : its paper version. Read the news on: http://www.xs4all.nl/~tank/radikal http://www.xs4all.nl/~felipe/germany.html * * * * lambda 2.13 - www.freenix.fr/netizen * * * * Jerome Thorel =-= Journaliste / Reporter =-= Paris, France lambda bulletin =-= Planete Internet Editor

1 0

PROTECT YOUR FAMILY
by IQ Mailer 17 Dec '03

17 Dec '03

*+*+ This message is provided under the strict C.A.R.E. Code of Ethics. (Conscientious Advertising through Responsible E-mail). You can view the code at: iq-internet.com/care.html PROTECT YOUR FAMILY My LIFECARD does exactly that. You or any member of your famil will have instant worldwide access to a wide range of potentially life saving medical and personal information in case of an emergency. SAFETY SECURITY PEACE OF MIND MYLIFECARD was the first TRUE medical emergency information card and is STILL the state of the art. You spend THOUSANDS of dollars a year to protect your family's health. You owe it to your family to spend a few pennies a day for MYLIFECARD. DON'T DELAY!!!!! FOR MORE INFORMATION: Type in the word INFORMATION in the body of your message and hit reply. *+*+ To REMOVE your name from our list *+*+ reply with NO MAIL in the subject line.

1 0

USAF Hack mirror
by skeeve＠skeeve.net 17 Dec '03

17 Dec '03

Another hack mirror up.... http://www.skeeve.net/usaf/ so far I have: Central Intelligence Agency - http://www.skeeve.net/cia/ US Department of Justice - http://www.skeeve.net/doj/ Kreigman Furs - http://www.skeeve.net/kriegsman/ US Air Force - http://www.skeeve.net/usaf/ we these people never learn... put your webserver on CDrom today ;) anyone else know of any other mirrors... i heard www.nasa.gov recently got done.. anyone have a mirror i can add to the collection? --------------------------------------------------------------------- | Skeeve Stevens - MyInternet personal.url: http://www.skeeve.net/ | | email://skeeve@skeeve.net/ work.url: http://www.myinternet.net/ | | phone://612.9869.3334/ mobile://0414.SKEEVE/ [753-383] | ---------------------------------------------------------------------

1 0

Re: Cryptanalysis Trainer
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:05 PM 12/29/96 -0500, John Young wrote: >We've transcribed from PDF to ASCII the cryptanalysis >program in Appendix F of the US Army's Field Manual >FM 34-40-2, Basic Cryptanalysis, September, 1990. > > http://jya.com/appf.htm Why does it not surprise me that the code is in BASIC... BTW, the link to the PDF does not work. Seems the CGI they use to feed the pdf files is broken. (Or someone paniced and pulled it in a manner that broke the CGI. Would not be the first time...) --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

HOW TO HACK www.pgp.com -- stupid CGI script xploit
by Secret Squirrel 17 Dec '03

17 Dec '03

Go to www.pgp.com Go To "Keyserver" Go To "Query" In the search window, type `whoami` (note the back quotes). Watch for result. How stupid. Seems to be a common problem of cgi scripts. like the one in norway... xaxaxa

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 30 Dec 96 6:48:57 PST remailer email address history latency uptime ----------------------------------------------------------------------- haystack haystack(a)holy.cow.net +#*#+#+ 1:44 99.99% weasel config(a)weasel.owl.de +++++++ 1:06:00 99.99% lucifer lucifer(a)dhp.com +++++++ 33:39 99.98% mix mixmaster(a)remail.obscura.com -++++++ 1:11:39 99.98% nym config(a)nym.alias.net *##*### :19 99.97% reno middleman(a)cyberpass.net ------+ 1:37:49 99.97% squirrel mix(a)squirrel.owl.de ++++++ 1:06:32 99.96% middle middleman(a)jpunix.com ------ 2:20:53 99.86% dustbin dustman(a)athensnet.com _ .-*+* 17:45:40 99.70% balls remailer(a)huge.cajones.com **** +* 8:06 99.55% cyber alias(a)alias.cyberpass.net * **+* 29:35 99.50% exon remailer(a)remailer.nl.com *##** * 1:02 99.43% replay remailer(a)replay.com * -** + 1:13:13 98.96% extropia remail(a)miron.vip.best.com --- - 7:19:53 95.17% winsock winsock(a)rigel.cyberpass.net .-.- - 10:43:57 91.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

New crypto regs online
by Dave Banisar 17 Dec '03

17 Dec '03

Hola, The new regs for crypto exports are available at: http://www.epic.org/crypto/export_controls/interim_regs_12_96.html Dave ========================================================================= David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 PGP Key: http://www.epic.org/staff/banisar/key.html =========================================================================

1 0

Just another government fuckover: New crypto regulations
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- books are and have been protected prior to the US Constitution. one can presume books with crypto source code would be protected accordingly; one Federal judge (Patel in SF) has ruled source code is protected under freedom of speech and therefore can be published; yet another judge in the Washington area has ruled it is not. There is no question the feds will appeal Patel's ruling in the Ninth Circuit (known to be pro rights in general, but difficult to predict). eventually it will go to the US Supreme Court. my personal opinion is the Supreme Court will rule against it using a rationale that the actual source code sections of a book can be classified as can any other intellectual property under the National Security Act. Secondly, they will not consider that form of speech an inalienable right. I had my rounds with the bastards years ago, no fucking humour whatsoever, and prone to use the IRS to enforce what the courts could not afford to enforce due to the requirements of disclosure in the courtroom at the time (which have since been plugged); and if that does not work, set you up for financial fraud, fraud by wire, or dope. Today dope is the perfect charge; it has been whipped into a frenzy by the feds and their CIA infiltrated media. let me assure any doubters the real extent of terror which the spooks can apply. the US Government has not been a legal government for years; it is a private club which can be bought, and its services sold to the highest bidder. It is a collection of whores who are part of a cabal of the very rich and powerful; it is totally unaccountable to the public it represents. Waco, Ruby Ridge, and the bombing of their own federal building in Oklahoma City in order to scare Joe Couch Potato into giving up personal freedoms for security are perfect examples of a government drunk on it owns powers. Just like Oswald, they have a perfect patsy with the defendants in OKC. P.J. O'Rourke states it correctly: "And the Clinton administration launched an attack on people in Texas because those people were religious nuts with guns. Hell, this country was founded by religious nuts with guns." O'Rourke also said: "Giving money and power to the government is like giving whiskey and car keys to teenaged boys" and there is no better example than the cocaine stoned, reckless mentality of Bill Clinton. an important fact to keep in mind in US judicial review: few of the judges can be relied on 1) to resist pressure from the Feds and 2) to take the rights of the people seriously and as 'inalienable rights.' this may sound pessimistic and cynical, but the courts have been sliding, in some cases rather quickly, to a position that echoes the UN Bill of Rights: the UN's "International Covenant on Civil and Political Rights" (ICCR): Article 18 states that "everyone shall have the right to freedom of thought, conscience and religion" but specifies that "freedom to manifest one's religions or beliefs may be subject only to such limitations as are prescribed by law and necessary..." in other words, I do not think we will see the feds permit the use of books to export cryptography. this almost becomes irrelevant outside the academic world in the provisions of the regs which effectively block hardware or software products and in effect seem to cut off the loophole of US companies funding overseas operations and importing the results, etc. the new regs basically ban it all ways. and the new regs are not the supposedly improved and friendly versions promised --they are draconian. books are an intellectual 'solution' to the problem. the real problem is the hardware. in order to negate governments and their virtually stated intentions of blocking our inalienable freedoms, particularly freedom of speach, we must be able to distribute universal crypto worldwide, and be able to improve it as the shadow governments of the various spook shows improve their ability to break our code. this last round on the ITARs blew out distribution. asking visitors to your web sites if they are U.S. citizens is not going to be sufficient for Bubba's goons: Janet Reno and Jamie Gorlich. the only real solution is guerilla warfare; anonymous distribution; overseas' establishment of clearing houses for updates and source code. freedom of information is just that simple; there are no compromises. Patrick Henry said: "Give me Liberty or Give me Death." publish, publish, and civil disobedience. Patrick Henry used handbills. knowledge is knowledge --get it in the public domain, and in the public's hands even if you must go door to door like a fuller brush salesman... but your product is free and it is for their freedom. don't waste your time getting out the vote; get out there and fight. contribute. if you do not have the balls to do it, you are not for freedom. the only natural cure for corrupt government is bright sunshine. and a rope. == Tyranny Insurance by Colt Manufacturing Co. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMsd+nb04kQrCC2kFAQGxVQP5AUM06j8anB3MLUzMUe8WjOqhVwPjSd7d RhaGyrRwAdSpU1CPSYNX9+zsTnaJtgsN0rQYLrbKQD1eKDPKAQlnz5vJ6SAVhRwi nNF2e4Pj/wD7SVBwHFmjsaOpWmNx9+ON++/EZNbs3c3nH/2n7tiC7eJJcte+apNE G3lwdSSxXhU= =MD+E -----END PGP SIGNATURE-----

5 10

Re: Export proposal
by Lucky Green 17 Dec '03

17 Dec '03

At 10:24 PM 12/29/96 -0800, sameer wrote: [...] > Stewart Baker has been quoted as saying that banned "easily >scanned printed texts" isn't far away. (Rebecca Vesely's Wired News >article) The language of the new regulations supports this view. It seems to me that the USG wanted to ban easily scannable text, but wasn't sure how to best define "easily scannable". This is a property that is difficult to define. Once they come up with a workable definition, expect the regs to be amended. >We are now just one step away from non-GAK crypto being >illegal in the US. As Michael Froomkin has noted, this will require an act of Congress. I expect the administration to send a pro-GAK bill to Congress in 1997. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

2 1

Re: "Structuring" of Communications a Felony?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:11 PM 12/29/96 -0800, Timothy C. May wrote: > >For example, while citizen-units in the United States are free to move to >new locales without permission and without registration, unlike in some >countries, the tax collector expects a valid home (or at least mailing) >address on tax returns. There is no requirement that you list a home address just as there is no requirement that you have a home. A mailing address anywhere on earth is sufficient for tax purposes. The form *says* home address but no one's done any time for not putting one on the form (right Brian). Proving that you had another home than the one listed on the date you filled out the form is beyond the capability of even the federal government. The instructions even say "use P.O. Box only if the Post Office doesn't deliver mail to your home" but don't say anything about mail receiving services and so forth. If you know how, you can even wander into most rural post offices and get a P.O. box in an area that doesn't have home delivery without living in the vicinity or proving it. Addresses are much too slippery things to control very well with the US model. DCF

1 0

Re: "Structuring" of Communications a Felony?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:08 PM 12/29/96 -0800, Timothy C. May wrote: >As to the "anonymous speech" rulings, I mainly know of the 1956 Georgia >case, in which the Supremes struck down a law requiring that leaflets >handed out have a name attached. I don't know of more recent rulings, >especially ones related to the Internet. This was upheld by another recent case involving an anonymous pamphlet from an Ohio woman. >If origin-labelling is unconstitutional, as Steve claims, then on what >basis can the U.S. Postal Service require identification for packages over >one pound? Surely what is inside the package may be considered "speech" (by >those interested in pushing the point). The new rule doesn't require that ID be presented at the Post Office. You just have to present the package in person and fill out a form. They could try and require ID later, of course. >And there are many other situations where anonymity is no longer allowed, >where once it was. The gambling example Brian Davis brought up is an >example: for the purposes of tax collection, regulation of gambling, etc., >winners of nontrivial amounts must identify themselves. They have to identify themselves they don't have to present identification (an important distinction). Brian also pointed out that the guy could have avoided the problem if he'd been smarter. >1. A sharp increase in spamming, mass mailing, threatening letters, >etc....sort of like the "denial of service" and spamming/looping attacks >seen here on Cypherpunks, and being seen widely on the Net. This will >increase pressure to "do something about it." A Senator Exon type person >will introduce legislation to require e-mail be labelled. If they have yet to successfully mandate positive ID for bank or credit accounts, how can they expect to successfully mandate positive ID for something as ephemeral as an Email account? >In closing, I think the Supreme Court will, when it eventually agrees to >hear a relevant case, will differentiate between protected anonymous speech >in public forums and the labelling of sealed packages, sealed letters, and >sealed e-mail. They will argue along the lines of saying that the labelling >law is for the protection of society and not for tracking down dissidents. >The effect will of course be the same, but this will be the fig leaf which >allows them to uphold such laws. Though they have not done so over the several centuries we've had anonymous postal mail. DCF

1 0

IDEA ecryption algorithm in 8 bits ?
by Pavel Korensky 17 Dec '03

17 Dec '03

Hello, I hope that this mail will find his way to the mailling list. I have one question. For one small embedded application, I need some encryption algorithm which can be easily implemented in 8 bit microcontroller with 38 bytes of RAM and 1KB of ROM. I tried to modify the IDEA algorithm to 8 bit operations - all multiplications modulo 257, subkey length 52 bytes, block size 4 bytes. Simply, all operations are converted from 16/32 bits to 8/16 bits. Because I am no professional cryptographer, I would like to ask you, if there is some major problem with this modified algorithm. Something what makes the 8 bit variant completely useless ? Is it possible to use this encryption algorithm ? I know that this variant will be far less secure than IDEA itself, but I don't need so strong encryption. The amount of data for encryption will be small, approx. 16 - 32 bytes. Thank you for every information. Best regards and PF 1997 Pavel Korensky -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

1 0