December 2003 - cypherpunks-legacy

swiss buy centralized euro-smartcard system
by Michael Froomkin - U.Miami School of Law 17 Dec '03

17 Dec '03

http://www.hotwired.com/staff/pointcast/Features/1814.html A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: PGP 2.1
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On 3 Feb 1997 10:46:20 -0500, you wrote: >Mark Henderson wrote: >> >> Larry Johnson writes: >> > Hello, >> > Can any;one tell me how to get a version of PGP 2.1? >> > Thanks >> > >> But, why do you want version 2.1? >Because the guy who wrote it was let off after that on his jail Phil Zimmerman? >charges, so I'm not going to use anything he made after that if No, the charges were not "jail charges". They were for exporting munitions. He was let off after 2.5 or 2.6. The urban myth is that 2.3a is safe. You can read the source code yourself. 2.6.2 is fine. Older versions actually have some minor bugs. >I don't know why. >I'm not saying that he rolled over or nothin buyt I'm gonna be >paranoyd like he said in the book. I dont suposse he'd mind, >since he said it. You'd be using a version with holes in it. Why not read the source code of the new version and verify it's security yourself? (If you can't undertsand it, it won't matter which version you're using because you're trusting it no matter what.) >I'm not real smart sometimes but I'nm not a real lamer, either. >(I don't think) Well, start thinking.... Rob ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

No Subject
by Krenn 17 Dec '03

17 Dec '03

> Mark Henderson wrote: > > > > Larry Johnson writes: > > > Hello, > > > Can any;one tell me how to get a version of PGP 2.1? > > > Thanks > > > > > But, why do you want version 2.1? > > Because the guy who wrote it was let off after that on his jail > charges, so I'm not going to use anything he made after that if > I don't know why. > I'm not saying that he rolled over or nothin buyt I'm gonna be > paranoyd like he said in the book. I dont suposse he'd mind, > since he said it. > I'm not real smart sometimes but I'nm not a real lamer, either. > (I don't think) > No, you're not real smart. The source code is _provided_ with PGP. If you are paranoid, _read_ it. Krenn

1 0

Re: Key Security Question
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > > On the other hand, if the "repairman" replaced your pgp executable > > > with version 2.6.3kgb, which uses your hashed passphrase as the > > > session key, you're hosed. Or if he installed a keystroke sniffer, > > > or added a small radio transmitter to your keyboard, or whatever. > > > Depends on your threat model. If you need to be paranoid, > > > they've already gotten you.... > > > > If you're really paranoid, you can boot from a clean floppy and > > reinstall everything from your backup tapes. You do have a > > contingency plan in case your hard disk goes bad, or gets a > > virus, don't you? Well, if you're in doubt, exercise it. Face it, the only solution is to wrap your computer, cat, family, car and yourself in aluminium foil and burn your hard disk whilst chanting "yamma yamma yamma yaaaaamaa" Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

My Departure, Moderation, and "Ownership of the List" -Reply
by Eldon Jenkins 17 Dec '03

17 Dec '03

Sandy, I've been a member of this list off and on for the past few years. In reading this list daily for quite some time I feel that the filtering you are doing has made quite a substantial and positive change. Normally I would spend an hour or so at work filtering through the list deleting endless threads of nonsense just so I could glean the valuable information that is hidden in midst of the mindless chatter. Now the time I spend searching for information has been drastically reduced and I would like to thank you for this. While I am against censorship and moderation whole-heartedly I see this as a different case. You are not preventing anyone from posting, you just sort the posts and place them in their appropriate list. I see your efforts as more of an organizing project rather then censorship. I would love to see the list continue to be moderated. Just my two cents though. Eldon Jenkins USRobotics Programmer

1 0

Dissolving Choke Points
by pdh＠best.com 17 Dec '03

17 Dec '03

I was amused by the similarities of USG crypto policy and the moderation of the cypherpunks list. Recently a number of new regulations were announced to go into effect by a certain date. Requests for comments were made after the policy was announced. Many of us thought that was pretty sneaky. I feel the same way about the moderation plan. Moderation has been a failure. I'm pretty good at filtering and I can sadly report that there is very little signal out there. There are lessons to be learned here. One is that censorship does not promote a stimulating and creative dialogue. The cypherpunks list right now is about as interesting as hanging out by the 7-11. Another lesson is the danger of choke points. We can see how tempting it is for people to exercise their control. Even John Gilmore was unable to restrain himself from involuntary social engineering experiments. Who would we have considered to be more trustworthy? Toad.com is a choke point, not just in terms of moderation but in terms of the rate at which it can distribute messages. Let's replace it. What we want are many machines carrying the cypherpunks list. A message posted to any machine goes to all of the others. Each machine sends messages to its subscribers only once. Some of these machines should be across borders. The mail loop and multiple posting problems are solved by observing the message IDs. Fast implementation: use moderated mailing list software. Put a filter in the .forward file of the "moderator" account which looks at the message ID and forwards the message if it hasn't been seen already. The mailing list machines all subscribe each other. I've been looking for a stable machine with a good net connection to do this. I haven't found one. However, if we have many machines sharing the load, the stability of any one unit is not as important because the list will survive multiple "hits". Only the subscribers on one machine will be affected by having their messages delayed. This greatly reduces the work and responsibility for any one list operator. (As John will attest, keeping a machine running 24 hours a day, 7 days a week, rain or shine, is a lot of work.) Also, with multiple machines, each unit handles a small amount of the load. This makes more machines available and has less impact on people's net connections. Last I checked, there were about 1200 addresses on the mailing list at toad.com. All we need are about 10 machines to take 120 subscribers each. (This is a completely manageable load.) Do you have a Unix machine on the Net? Does it have sendmail and Perl? Then you have all that it takes to participate. Send me mail and I'll help you set it up. Peter Hendrickson ph(a)netcom.com P.S. I like and respect John and Sandy and I've learned a lot from both of them. While basically well-intentioned, they just made a mistake in this instance.

5 4

Moderation [Tim,Sandy]
by Lucky Green 17 Dec '03

17 Dec '03

Since it seems to be the topic of the day, here are some of my thoughts on moderating CP. o Moderation achieved what it could achieve. Spam is no longer clogging up the list. Insults, i.e., "Tim Mayo fucks children", are no longer polluting the list. o Moderation did not achieve what it couldn't achieve. The level of noise has been reduced, but signal has not been increased. This is sad, but true. The attempt was probably bound to fail, since many of the "top signal generators" have long left the list and are not about to come back. All that is remaining are a few diehards, such as myself, some TLA goons (knowingly or unknowingly) working against the cause, and many newbies and observers. I believe that Cypherpunks is beyond hope of recovery. In fact, each day Cypherpunk (as in cypherpunks(a)toad.com) lives on, it does damage to the cause. Let's kill the list. Once and for all. Let the hard core crypto go to Coderpunks, the politics to Cryptography, and the garbage into the void. I am well aware of the name recognition and reputation capital associated with CP, still I believe it best to *kill the list*. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy Maytag's father, an idiot, stumbled across Timmy Maytag's mother, an imbecile, when she had no clothes on. Nine months later she had a little moron. \\\ (0 0) _ooO_(_)_Ooo____ Timmy Maytag

1 0

swiss buy centralized euro-smartcard system
by Michael Froomkin - U.Miami School of Law 17 Dec '03

17 Dec '03

http://www.hotwired.com/staff/pointcast/Features/1814.html A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: Key Security Question
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > > On the other hand, if the "repairman" replaced your pgp executable > > > with version 2.6.3kgb, which uses your hashed passphrase as the > > > session key, you're hosed. Or if he installed a keystroke sniffer, > > > or added a small radio transmitter to your keyboard, or whatever. > > > Depends on your threat model. If you need to be paranoid, > > > they've already gotten you.... > > > > If you're really paranoid, you can boot from a clean floppy and > > reinstall everything from your backup tapes. You do have a > > contingency plan in case your hard disk goes bad, or gets a > > virus, don't you? Well, if you're in doubt, exercise it. Face it, the only solution is to wrap your computer, cat, family, car and yourself in aluminium foil and burn your hard disk whilst chanting "yamma yamma yamma yaaaaamaa" Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: "Secret" Postal Device stolen
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> So much for key escrow. *ding!* we have a winner! andrew

1 0

Re: Fortune, 3 Feb
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Mike McNally wrote: > > Big article in Fortune about e-mail privace. One little paragraph > about encryption ("scrambling"). Fairly clue-free overall, but > entertaining. > I found the article to be extremely silly, although it was probably useful for "management". Anyway, computer security is an oxymoron. - Igor.

1 0

Re: Voice Encrytion/Scrambling
by Lucky Green 17 Dec '03

17 Dec '03

At 05:09 PM 2/2/97 -0800, Huge Cajones Remailer wrote: >Can anyone comment on and give pointers to devices designed to >encrypt voice transmission over POTS lines? I am interested in >the respective sound qualities (if you've tried it) and >relative strengths of encryption algorithms. http://www.comsec.com/ Uses 2048 bit DH and 3DES. The voice quality is excellent. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

My Departure, Moderation, and "Ownership of the List" -Reply
by Eldon Jenkins 17 Dec '03

17 Dec '03

Sandy, I've been a member of this list off and on for the past few years. In reading this list daily for quite some time I feel that the filtering you are doing has made quite a substantial and positive change. Normally I would spend an hour or so at work filtering through the list deleting endless threads of nonsense just so I could glean the valuable information that is hidden in midst of the mindless chatter. Now the time I spend searching for information has been drastically reduced and I would like to thank you for this. While I am against censorship and moderation whole-heartedly I see this as a different case. You are not preventing anyone from posting, you just sort the posts and place them in their appropriate list. I see your efforts as more of an organizing project rather then censorship. I would love to see the list continue to be moderated. Just my two cents though. Eldon Jenkins USRobotics Programmer

1 0

Re: PCS Encryption?
by Greg Rose 17 Dec '03

17 Dec '03

David Lesher writes: >Greg Rose sez: >> >> The three different digital standards in North >> America are TDMA, CDMA, and GSM (in NY and DC >> only AFAIK). Newer analog phones use at least >> some of this, but I don't know much about them. > >? I always thought GSM was a specific application >of TDMA... Technologically, GSM *is* a kind of time division multiple access, but the term "TDMA" as I used it is meant to apply to North American IS-128(?) compliant things. They are definitely not interoperable. Greg. Greg Rose INTERNET: ggr(a)Qualcomm.com Qualcomm Australia VOICE: +61-2-9743 4646 FAX: +61-2-9736 3262 6 Kingston Avenue homepage. Mortlake NSW 2137 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45

1 0

Moderation [Tim,Sandy]
by Lucky Green 17 Dec '03

17 Dec '03

Since it seems to be the topic of the day, here are some of my thoughts on moderating CP. o Moderation achieved what it could achieve. Spam is no longer clogging up the list. Insults, i.e., "Tim Mayo fucks children", are no longer polluting the list. o Moderation did not achieve what it couldn't achieve. The level of noise has been reduced, but signal has not been increased. This is sad, but true. The attempt was probably bound to fail, since many of the "top signal generators" have long left the list and are not about to come back. All that is remaining are a few diehards, such as myself, some TLA goons (knowingly or unknowingly) working against the cause, and many newbies and observers. I believe that Cypherpunks is beyond hope of recovery. In fact, each day Cypherpunk (as in cypherpunks(a)toad.com) lives on, it does damage to the cause. Let's kill the list. Once and for all. Let the hard core crypto go to Coderpunks, the politics to Cryptography, and the garbage into the void. I am well aware of the name recognition and reputation capital associated with CP, still I believe it best to *kill the list*. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

4 3

Re: PCS Encryption?
by Andrew Meredith 17 Dec '03

17 Dec '03

Greg Rose wrote: > > The three different digital standards in North America are TDMA, > CDMA, and GSM (in NY and DC only AFAIK). GSM is also a Time Division Multiple Access (TDMA) system. In it's original form it uses specrum around 900 MHz, which I believe not to be available in the US. Shame really, I can roam with my GSM phone over pretty much the rest of the planet ... except the US. Anyway, there are two higher frequency derivatives, PCS1800 & PCS1900, which have been deployed in the US. I'm not involved directly in the US market so I'm not sure where. I assume however that these are the systems to which Greg refers. > Newer analog phones use at least some of this, but I don't know much > about them. I'll ignore GSM. ^^^^^^^^^^^^^^^ Aww shame ;) > The conclusion is that neither way of doing it is truly > cryptographically strong, but both are a lot better than > listening to Princess Di call Newt "Squidgy" on a Radio Shack > scanner. GSM uses the A5 algorithm which *is* cryptographically strong, but is unfortunately considered to be top secret stuff. If, however, you were to pick up a copy of "Applied Cryptography, 2nd Edition" by Bruce Schneier you may find something of interest. I hope that you'll work out from my .sig why I can't say much more. Hope this helps Andy M -- ___________________________________________________________________ Andrew Meredith Senior Systems Engineer Tel: +44(0) 1793 565377 Network Engineering Tools Grp Fax: +44(0) 1793 565161 GSM Products Division Page: +44(0) 839 421153 Motorola SMTP: meredith(a)ecid.cig.mot.com 16, Euroway, Blagrove X400: QSWI016(a)email.mot.com Swindon, SN5 8YQ, UK SMS: 44860608008(a)sms.telco.mot.com ___________________________________________________________________

1 0

Dissolving Choke Points
by Peter Hendrickson 17 Dec '03

17 Dec '03

I was amused by the similarities of USG crypto policy and the moderation of the cypherpunks list. Recently a number of new regulations were announced to go into effect by a certain date. Requests for comments were made after the policy was announced. Many of us thought that was pretty sneaky. I feel the same way about the moderation plan. Moderation has been a failure. I'm pretty good at filtering and I can sadly report that there is very little signal out there. There are lessons to be learned here. One is that censorship does not promote a stimulating and creative dialogue. The cypherpunks list right now is about as interesting as hanging out by the 7-11. Another lesson is the danger of choke points. We can see how tempting it is for people to exercise their control. Even John Gilmore was unable to restrain himself from involuntary social engineering experiments. Who would we have considered to be more trustworthy? Toad.com is a choke point, not just in terms of moderation but in terms of the rate at which it can distribute messages. Let's replace it. What we want are many machines carrying the cypherpunks list. A message posted to any machine goes to all of the others. Each machine sends messages to its subscribers only once. Some of these machines should be across borders. The mail loop and multiple posting problems are solved by observing the message IDs. Fast implementation: use moderated mailing list software. Put a filter in the .forward file of the "moderator" account which looks at the message ID and forwards the message if it hasn't been seen already. The mailing list machines all subscribe each other. I've been looking for a stable machine with a good net connection to do this. I haven't found one. However, if we have many machines sharing the load, the stability of any one unit is not as important because the list will survive multiple "hits". Only the subscribers on one machine will be affected by having their messages delayed. This greatly reduces the work and responsibility for any one list operator. (As John will attest, keeping a machine running 24 hours a day, 7 days a week, rain or shine, is a lot of work.) Also, with multiple machines, each unit handles a small amount of the load. This makes more machines available and has less impact on people's net connections. Last I checked, there were about 1200 addresses on the mailing list at toad.com. All we need are about 10 machines to take 120 subscribers each. (This is a completely manageable load.) Do you have a Unix machine on the Net? Does it have sendmail and Perl? Then you have all that it takes to participate. Send me mail and I'll help you set it up. Peter Hendrickson ph(a)netcom.com P.S. I like and respect John and Sandy and I've learned a lot from both of them. While basically well-intentioned, they just made a mistake in this instance.

2 1

Re: Dissolving Choke Points
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

i do have unix (linux) and stuff, but i can't take a lot of subscribers -- maybe 200-300 or so. i actually wrote a proposal for a mailing list without a central control point, with several advantages being impossibility of control, absense of a single point of failure, and cryptographic verification of honesty of moderators. if there is any interest, i will post it here. igor Peter Hendrickson wrote: > > I was amused by the similarities of USG crypto policy and the > moderation of the cypherpunks list. Recently a number of new > regulations were announced to go into effect by a certain date. > Requests for comments were made after the policy was announced. Many > of us thought that was pretty sneaky. I feel the same way about the > moderation plan. > > Moderation has been a failure. I'm pretty good at filtering and I > can sadly report that there is very little signal out there. > > There are lessons to be learned here. One is that censorship does > not promote a stimulating and creative dialogue. The cypherpunks list > right now is about as interesting as hanging out by the 7-11. > > Another lesson is the danger of choke points. We can see how > tempting it is for people to exercise their control. Even John Gilmore > was unable to restrain himself from involuntary social engineering > experiments. Who would we have considered to be more trustworthy? > > Toad.com is a choke point, not just in terms of moderation but in > terms of the rate at which it can distribute messages. Let's > replace it. > > What we want are many machines carrying the cypherpunks list. A > message posted to any machine goes to all of the others. Each > machine sends messages to its subscribers only once. Some of > these machines should be across borders. > > The mail loop and multiple posting problems are solved by observing > the message IDs. > > Fast implementation: use moderated mailing list software. Put a > filter in the .forward file of the "moderator" account which looks > at the message ID and forwards the message if it hasn't been seen > already. The mailing list machines all subscribe each other. > > I've been looking for a stable machine with a good net connection to > do this. I haven't found one. However, if we have many machines > sharing the load, the stability of any one unit is not as important > because the list will survive multiple "hits". Only the subscribers > on one machine will be affected by having their messages delayed. > This greatly reduces the work and responsibility for any one list > operator. (As John will attest, keeping a machine running 24 hours a > day, 7 days a week, rain or shine, is a lot of work.) > > Also, with multiple machines, each unit handles a small amount of the > load. This makes more machines available and has less impact on > people's net connections. > > Last I checked, there were about 1200 addresses on the mailing list at > toad.com. All we need are about 10 machines to take 120 subscribers > each. (This is a completely manageable load.) > > Do you have a Unix machine on the Net? Does it have sendmail and > Perl? Then you have all that it takes to participate. Send me > mail and I'll help you set it up. > > Peter Hendrickson > ph(a)netcom.com > > P.S. I like and respect John and Sandy and I've learned a lot from > both of them. While basically well-intentioned, they just made a > mistake in this instance. > > - Igor.

1 0

Filling Power Vacuums
by Timothy C. May 17 Dec '03

17 Dec '03

At 6:57 AM -0800 2/3/97, Sandy Sandfort wrote: >After reading through Tim's post, I don't think much would be >served by doing another point by point response. From Tim's >tone, it appears he is still seething about how this all came >about, so I'll just leave our two expressions of opinions where >they were. I have no wish to exacerbate any hard feelings Tim >may be having. Indeed, I have been seething for the past several weeks (off and on, as I am fortunately able to usually put it out of my mind and do other things with my mental energies....). I think I have figured out why I'm seething. It's about "power grabs." You see, in any anarchic situation, where reliance on self-control and self-filtering is emphasized, there is always a _temptation_ for some to "fill the power vacuum" and grab power. I learned in my years at Intel how easy it was to start bossing people around, and as I hired engineers and scientists, I built up quite a little empire. But I didn't like what it was doing to me, as it distanced me from the technology and also brought out "control freak" tendencies....I started worrying about how my people were using their time ("my" time), and I increasingly applied my own notions of what they should talk about and what were suitable topics for laboratory chatter. In other words, I became a censor. (Not a government censor, but a censor in the broader definition I've already cited.) So I gave it up. Even before eventually retiring from Intel, I elected to leave the management track and rejoin the "technical ladder," becoming one of Intel's so-called Principal Engineers. No longer could I control others, except through the example I set and the information I provided. And I was happy I had moved away from "the dark side of the force." (I accept the role hierarchies play in corporations. They can't be built with just people like me. They need leaders, controllers, power freaks, etc. But a virtual community like the Cypherpunks group is not such a heirarchical organization, and it needs few rules, leaders, etc. "We don't need no steenking leaders.") As this relates to Cypherpunks, I have steadfastly refused to consider any "management role," so to speak, in how the list is run, the formal policies, etc. I'm not saying there has been a call for management (though Detweiler used to rail against us for not having a management heirarchy, for not having rules and democratic procedures for "making decisions"), just that the power vacuum in anarchies such as ours is often an open invitation for someone to step in and "provide structure and guidance." I resisted any thoughts of doing this, and argued against this sort of thing whenever the topic came up in conversation. I chose to lead only by the posts I wrote and the ideas I worked on. There have been frequent calls over the years for the Cypherpunks to have a more permanent presence, perhaps even an office in Washington, D.C., such as the EFF had, the CPSR still has, and so on. And to have an Official Spokesman, a contact person for the media droids to contact. The calls for this have declined in the last couple of years, as people figured out that the Cypherpunks are not about having spokespunks for us, and that the media will just have to deal with the "anarchy" of having to herd cats to get information out of us. Now, of course, the message is being sent that Sandy Sandfort is in some sense the de facto leader, being that he determines what traffic goes out to the main list and what traffic gets bounced into the flames list. In fact, I'll make a prediction: The media will see that he is the chief censor and arbiter of worthiness and will increasingly contact him for the Official Point of View on various items they are interested in. It distresses me greatly that Sandy Sandfort has elected to move into this "power vacuum" to nominate himself as our Leader and Chief Censor. Foo on that. (I used to hear this at Intel, where the argument for a hierarchical structure was much stronger, to wit: "Tim, if you won't agree to manage others, you'll have to accept that people less technically competent than yourself are going to elect to become managers and they'll probably become _your_ manager in the not too distant future.") So, I sort of thank Sandy for helping me to realize certain things that I may not have explicitly realized before. Namely, I realize that I don't want the karmic burdens of power myself, preferring to lead only by the example I set and the ideas I generate. This is why "market anarchies" (books, music, ideas, all things where "no ruler" exists) appeal to me so much. And since I don't wish to assume the mantle of leadership, and don't see much need for leadership or global censorship (as opposed to locally contracted for filtering, a la Eric Blossom's list, or Siskel and Ebert giving recommendations, or ratings of restaurants, etc.), I am resentful and suspicious of people who _do_ step into the "power vacuum" to lead and control. Now I grant you that Sandy's form of leadership and control is relatively mild, but the very notion that Sandy can reject a long essay because of a couple of phrasings he dislikes (this was his "judgment call" point about why he (reluctantly?) allowed my post to go out) is a step in the wrong direction. And given our strong ideological bias toward market anarchies, this move toward censorship stands out like a sore thumb. At least the issue would be clearer if Sandy passed all posts through but deleted sections that offended him and marked deleted sections as "**CENSORED**." Yes, I'm seething. Sandy is right about that. I saw a group I helped create and spent thousands of hours on, writing articles and developing ideas choose--by fiat from the owner of the machine the list was being sent out from--to embrace the dark side, the control freak side. In the name of "comity," Sandy's term for the bonhomie he thinks he can cultivate, we lose our ideological purity. "Hey, even the Cypherpunks have embraced censorship." Instead of letting the power vacuum remain unfilled, and suggesting to people that they solve the problems it creates as best they can, Sandy jumped in to fill the vacuum. This is what I'm seething about. And even dropping the power grab at the end of the "experiment" will not stop this seething. Fuck it. --Tim May " Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: GAK cracking?
by C. Kuethe 17 Dec '03

17 Dec '03

On Mon, 3 Feb 1997, tmcghan(a)gill-simpson.com wrote: > Just days after a U.S. graduate student cracked the most powerful > computer encryption system allowed out of the country, the Commerce > Department announced it would allow three companies to export an > even stronger system. [snip] > Companies said products with just 40-bit long keys, the old limit, > were too easy to crack. The approvals came just days after Ian Goldberg, a > graduate student at the University of California, cracked a message > encoded with a software key 40-bits long. > > The government did not name the companies given permission to export > stronger, 56-bit programs, but Glenwood, Md.,-based Trusted > Information Systems acknowledged that it was one of the three. Why does it not surprise me that TIS gets permission to export 56-bit (DES?) ? They do key recovery (is it GAK?) They brag about government consulting. The clients they will admit to having are listed on: http://www.tis.com/docs/products/consulting/govt/govcon.html and, purely unsubstantiated rumors here, but I've heard (seen) TIS, NSA, FBI and other "friends" of ours all together in the same paragraph. Conspiracy? Maybe... This is both good and bad.... yes, longer codes are now exportable, but only to / by certain people? I notice that the new cipher length is 56 bit...same size as DES? hopefully that's just a coincidence (yeah, right) or maybe somebody's starting to see the real world where people download pirate cryptosystems and says "so let's export bigger ones and make a buck off it, too..." (yeah, right) PLUR chris -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls <c100305(a)wolfcreek.cs.ualberta.ca> http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL lives at http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Another ActiveX hole (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-------+..........................................................+------- + ^ + : Ray Arachelian : #include <std_disclaimer.h> :../|\.. \|/ : ray(a)earthweb.com :.....................................:./\|/\. <--+-->: ................ : My oppinions are my own and do not :.\/|\/. /|\ :voice: 212-725-6550 : neccesairly represent those of my :..\|/.. + v + :....................: employer. :....... .... http://www.sundernet.com ...personal.email sunder(a)sundernet.com ..... ---------- Forwarded message ---------- Date: Mon, 03 Feb 1997 13:26:44 -0500 From: Andy Breen <abreen(a)earthweb.com> To: yak(a)earthweb.com Subject: Another ActiveX hole hmmmmmmmmmmmmm.... ------------------ DMK: An application of covert channels. From RISKS Digest Vol 18, Issue 80. Date: 1 Feb 1997 05:12:02 GMT From: weberwu(a)tfh-berlin.de (Debora Weber-Wulff) Subject: Electronic Funds Transfer without stealing PIN/TAN The Berlin newspaper "Tagespiegel" reports on 29 Jan 97 about a television show broadcast the previous evening on which hackers from the Chaos Computer Club demonstrated how to electronically transfer funds without needing a PIN (Personal Identification Number) or TAN (Transaction Number). Apparently it suffices for the victim to visit a site which downloads an ActiveX application, which automatically starts and checks to see if Quicken, a popular financial software package that also offers electronic funds transfer, is on the machine. If so, Quicken is given a transfer order which is saved by Quicken in its pile of pending transfer orders. The next time the victim sends off the pending transfer orders to the bank (and enters in a valid PIN and TAN for that!) all the orders (= 1 transaction) are executed - money is transferred without the victim noticing! The newspaper quotes various officials at Microsoft et al expressing disbelief/outrage/"we're working on it". We discussed this briefly in class looking for a way to avoid the problem. Demanding a TAN for each transfer is not a solution, for one, the banks only send you 50 at a time, and many small companies pay their bills in bunches. Having to enter a TAN for each transaction would be quite time-consuming. Our only solution would be to forbid browsers from executing any ActiveX component without express authorization, but that rather circumvents part of what ActiveX is intended for. A small consolation: the transfer is trackable, that is, it can be determined at the bank to which account the money went. Some banks even include this information on the statement, but who checks every entry on their statements... Debora Weber-Wulff, Technische Fachhochschule Berlin, Luxemburger Str. 10, 13353 Berlin GERMANY weberwu(a)tfh-berlin.de <http://www.tfh-berlin.de/~weberwu/

1 0

Re: Moderation [Tim,Sandy]
by Lucky Green 17 Dec '03

17 Dec '03

At 12:28 PM 2/3/97 -0800, Peter Hendrickson wrote: >At 11:38 AM 2/3/1997, Lucky Green wrote: >> I am well aware of the name recognition and reputation capital associated >> with CP, still I believe it best to *kill the list*. > >If you don't like the list, why not unsubscribe? That won't solve the problem. The list has become counterproductive. It is impossible for other lists to provide a real forum for the discussion of the topics that this list used to be about while CP still exists. At the same time, CP has long stopped providing such a forum. CP is draining energy from its subscribers and the cause. Kill it! Kill it now! -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

RE: My Departure, Moderation, and "Ownership of the List"
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May With no false modesty I tried awfully hard to compose substantive essays on crypto-political topics, often more than one per day. (Others did too, but they seem to be tapering off as well, leaving the list to be dominated by something called a "Toto," the "O.J. was framed!" ravings of Dale Thorn, the love letters between Vulis and someone name Nurdane Oksas, and the occasional bit of crypto news. Ho hum. I'm glad I'm not reading the list in e-mail, and thus can easily avoid replying to these inanities... .......................................... Your thoughtful contributions to the list are missed, Tim. As soon as I realized that you had left the list I suspected it had something to do with its moderation. However, I must protest the inclusion of Toto's posts as one of the "inane". His posts were intentionally formulated to cause to stand out what was, indeed, inane - as he said, to "hold up a mirror". And he continually decried the list experiment, pointing out the philosophical contradiction of a moderated "anarchist" forum. If the antidote to bad speech is more speech, then he certainly provided some, although not on the level or style as yourself. And you may say that some of these posts are not worth replying to, but didn't I see you respond to one of Dale's, regarding a photo of Jessica-the-pilot which he keeps above his desk? .. Blanc

2 1

Information Warfare
by pdh＠best.com 17 Dec '03

17 Dec '03

The cypherpunks list has been under "attack" for some time. How have we managed it? Very poorly in my view. Some people have dismissed the idea that rogue governmental elements are behind some of our problems. Yet, there is no reason to rule out this hypothesis. The government has not always behaved well with regards to its perceived enemies in the last few decades. The FBI seems to infiltrate everything - even churches!. This is well documented. The CIA has worked hard on disrupting various political movements of which it did not approve using provocateurs and other conspiratorial dirty tricks. (I believe the FBI has, too, but I do not recall any documentation offhand.) We know that "Information Warfare" is the big thing in the defense establishment right now. It's all over their web pages. We see articles from the Kennedy School which seem to compare free speech with disease. Etc. Etc. We also believe that the things the Cypherpunks are interested in are on the radar screen. Maybe the Cypherpunks are, too. Is it unreasonable to ask whether some people are getting funding to experiment with disrupting "groups" like the Cypherpunks? I can easily picture people inventing all sorts of important sounding words like "psy-op" for what is little more than rudeness. Whatever the cause of the disruptions, the solutions are the same. Most of the proposals I've been hearing have to do with controlling the behavior of other cypherpunks and creating more structure. This is a mistake. It's clear that even the definitions of "spam" and "flame" are hard to nail down. The next idea will be to moderate on the basis of content. How will we decide what is content? Clearly that's much too important a question to leave to just one person. What we need is a committee to decide! What's next? Robert's Rules of Order? All of this detracts from the work we have before us. If you've ever been involved with a non-profit organization, you will know that enormous energy is spent on internal political scheming. That's a boring waste of time. Let's go down a better path. Let's think about the best way for each cypherpunk to manage disruptions. Please consider these suggestions: 1. Filter noise. I filter based on origin. If a kill file doesn't work, use a positive filter to read messages only from people who are worthwhile. It has been suggested that this doesn't work because some people post garbage, but also occasionally post something good. There's gold in the ocean, too. Why don't we retrieve it? If you don't want to manage a filter yourself, find somebody to do it for you. A number of people offer filtering services. Remember that in an open forum, noise increases with signal. The more worthwhile and interesting threads are on the list, the more worthless postings we are going to see, particlarly when people are consciously disruptive. 2. Post signal. Filters are useless when there is no signal. Signal comes from cypherpunks. You are a cypherpunk. 3. Birds of a feather flock together. When you respond to somebody, you mingle your on-line identity with theirs. Fly with the eagles. Peter Hendrickson ph(a)netcom.com

1 0