December 2003 - cypherpunks-legacy

Try It Before You Buy It!
by Andy Barber 17 Dec '03

17 Dec '03

Imagine this: A network program that lets you: TRY IT BEFORE YOU BUY IT! This is unlike ANYTHING you have seen before. Like joining a network marketing program in reverse! You get to try it out, w/ no obligation, see if it works, and THEN decide if you want to participate in the actual money-making end of it! Best of all, it COSTS YOU NOTHING!!! It's totally free. Visit our Web-Site at: http://www.crt-enterprises.com/downline.htm register FREE You have NOTHING to lose, and possibly EVERYTHING to gain! Email abarber(a)vgernet.net, Put "FREE" in subject. Thank you

1 0

New Product in beta: SecurText
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sat, 1 Mar 97 02:12:26 -0500 From: <softpub%toolz.UUCP(a)vec.net> To: Softlist(a)vec.net Subject: New Product in beta: SecurText [Software Entrepreneur's Mailing List] [p1198: Sat Mar 1 02:12:17 1997] >From: "Wormhole Technologies, Inc." <Erik(a)wormhole-net.com> We have been developing SecurText for over a year now and we finally have a beta. SecurText is an anti-hacker, anti-virus, e-mail enhanced network product. It is a versatile, elegant, easy-to-use alternative to PGP. It runs on Windows 3.1, 3.11, and Win 95. Our commercial release will be fully S/MIME compliant, have built-in e-mail functionality for totally seamless sending and receiving of secure messages and attachments, and protect against viruses. Check out our free beta at http://www.wormhole-net.com. Note that, due to export controls on encryption, this version does not give you military strength encryption so do not use for actual privacy or security. For the actual, military strength version you must send me your name, US mailing address, plus $3.50 for s/h, and I will send it to you. Send to: Wormhole Technologies, Inc. (softpub member) 6 Ash Avenue West Orange, NJ 07052 By the way, I would really like this beta circulated as much as possible and to get as much feedback as possible. Kindly provide me with an e-mail address when you download and I'll send you a short questionnaire (just 6 questions). Thanks. --------------------------- Very truly yours, ERIK P. WEINGOLD, President/CEO Erik(a)wormhole-net.com Wormhole Technologies, Inc.<tm> keeping the net free with cryptography<tm> http://www.wormhole-net.com -- Send Software Entrepreneur's Mailing List postings to: -- softpub(a)toolz.com -- Send mailing list add/change/delete/gripes to: -- softpub-request(a)toolz.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Pro-CODE Bill
by John Young 17 Dec '03

17 Dec '03

We've put the new Senate Pro-CODE encryption bill announced by VTR here last week at: http://jya.com/s377.htm (23K)

1 0

Re: Depends / Re: Senate spams
by Toto 17 Dec '03

17 Dec '03

Dale Thorn wrote: [snip--left nut] > it would be nice > to try to draw more of a connection between the ideas and ideals and > the reality of the list, otherwise, we'll all wind up looking like > hypocrites. If I post missives misinterpreting your own words and intentions, then you may no doubt be seen as a hypocrite to the gullible, or to those who choose to limit their world view by reading my posts and killfiling yours. In either case, I don't think this is a reason for you to lose a lot of sleep. > I personally don't see anything wrong with limiting > postings to subscribers, as long as subscriptions are open to all. > I also don't see anything wrong with warning a poster about commercial > messages, or other technical problems such as attaching really huge > files to go to the list, since all uncensored forums do this and > everyone I know of agrees with it. To have this option seemed to me to be an area of common agreement among CypherPunks list subscribers at the time of the 'Laker's fans named Bubba' mailboming of the list via forged subscriptions to a sports forum. The attempts to label, as hypocrites, those who thereafter complained about the fascist measures taken by self-appointed list saviors, are nothing more than anal-retentive smoke blowing. I have an efficient ISP provider and can, for a reasonable price, not worry about excessive download time, etc. The real-world reality is that there are those for whom paying to download the results of mailbomb attacks constitutes a denial of service to them. There are undoubtedly also others whose financial and personal time constraints may make a filtered version of the list attractive to them, and thus lead to them retaining their interest in crypto issues, instead of losing interest. I have not seen any of the anti-censorship elements in the CypherPunks suggest that there should not be alternatives available for those whose personal needs and/or interests are better served by various methods of filtering. To attempt to force UCE/Spam on those ill-equipped to deal with it serves no purpose other than to lessen the number of people who will have information in regard to the issues surrounding strong crypto. > The "problem" here (if there is one) is determining SPAM and the like > on a case-by-case basis. Suggestions have been floated here, but as > far as I know, none have been implemented. Igor has implemented spam-attack measures, and has been straightforward in both revealing these measures and asking for opinions in regard to his actions and proposals. I do not anticipate Igor resorting to furtive methodologies in self- servingly manipulating posts but, at the same time, I monitor what is going on in the background of the various lists. I regard 'trust' as something that should be undertaken with one's eyes open, just the same. > The real test, of course, > is when deletions do occur, whether there are any complaints, and > how those complaints are handled. Thankfully, the CypherPunks list will likely never lack for paranoid subscribers to raise warning flags whenever nefarious activities take place in regard to the list (or when the computer 'burps', either). It is up to the individual subscriber to separate the realities from the delusions. (I myself count on the space aliens to provide me with advice and support from the messages I receive from them when the Scotch I drink shorts out the spaces between the mercury fillings in my teeth. You may have a different method.) -- Toto ----------------------------- "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Pro-CODE Crypto Bill
by Toto 17 Dec '03

17 Dec '03

Alan Olsen wrote: > At 12:47 PM 3/2/97 -0500, John Young wrote: > >We've put the new Senate Pro-CODE encryption bill at: > > http://jya.com/s377.htm (23K) > There is an interesting addition to the bill that I have not seen discussed > here yet. The pro-code bill has added an "Information Security Board". This > provision worries me. It sound like a nice little rubber hose committee. > ("The House Committee on Unamerican Encryption"?) > Any opinions on this new development? As long as Senator Charlie McCarthy is heading the committee, then I can't foresee any problems. (But, for the record, I do not know Alan Olsen, and have never been associated with him personally, or member of any group with which he is associated.) Excuse me, I hear a pounding on the door... -- Toto ----------------------------- "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Pro-CODE Bill
by E. Allen Smith 17 Dec '03

17 Dec '03

Upon looking over the bill in question (helpfully provided in a more accessible location by jya), I do have some concerns over whether it allows for anonymous remailer export - it has a provision stating Nothing in this Act may be construed to affect any law intended to prevent the- (2) illegal or unauthorized distribution or release of classified, confidential, or proprietary information; or (3) enforcement of Federal or State criminal law. Which causes some question in my mind whether it would cover laws against or discouraging anonymous remailers. (While the Supreme Court would probably find outlawing anonymous remailers to be unconstitutional, laws discouraging their export or other lesser forms of harrassment might still pass muster, unfortunately.) -Allen

1 0

DES Challenge / Who'da Thunk It?
by Toto 17 Dec '03

17 Dec '03

It seems that all of the efforts to meet the DES Challenge are being sabotaged on one level or another. The des-challenge(a)muffin.org group have never been able to fly on more than one wing. The New Media Laboratories effort has been plagued by rogue clients and its participants being subjected to varieties of interference/trojan-horses. Peter Trei's software has been appearing on international servers, with bugs which don't match those in the original source code. Pointers to BryDES software have turned out to be misdirected, in many cases. I suspect that if the 'New Coke' had hired RSA's people, that we would all be drinking their 'imitation Pepsi' product, instead of 'Classic Coke', as God intended us to do. Crayola had the foresight to call upon RSA's expertise, and, as a result, the wool was pulled over the public's eyes and they came to accept the 'new' colors, even though they are part of the 'plot' against the Visual Illuminatti. Perhaps these new revelations will lead to people taking my posts to this list more seriously in the future. -- Toto ----------------------------- "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Pro-CODE Bill
by E. Allen Smith 17 Dec '03

17 Dec '03

The following provision also causes me some doubts about exactly what will be allowed for export: (B) Exception.--The Secretary shall prohibit the export or reexport of particular software and computer hardware described in this subsection to an identified individual or organization in a specific foreign country if the Secretary determines that there is substantial evidence that such software and computer hardware will be-- (iv) intentionally used to evade enforcement of United States law or taxation by the United States or by any State or local government. which could be construed to cover anonymous remailers, fully anonymous digital cash, anything set up to verify gambling fairness, and various other things of interest to Cypherpunks (including the use of PGP by, say, a drug "kingpin"). Admittedly, the "identified individual or organization in a specific foreign country" will help in limiting this application. -Allen

1 0

Re: Depends / Re: Senate spams
by Toto 17 Dec '03

17 Dec '03

snow wrote: > I think that any reasonable person could assume that missives f > from "mailer-daemon" could safely be excluded from the list. It is doubtful > that anyone out there has such a login, and if they do, well, it is stupid > enough that ignoring it would be doing them a favor (After a while they > _might_ get the idea that no one with a clue SENDS mail "mailer-deamon", > and change their login. I'd like to see a show of hands to see how many list members have received any posts from nancy.net/sally.net/conentric.net that they didn't personally delete without reading. These people don't seem to realize that the CypherPunks aren't interested in finding out how to "Make Big $$$ At Home, Licking Your Own Dick", because we do it anyway, without any expectations other than our own, personal reward. I do find snow's post rather embarassing, however, since I just sent an email asking mailer-daemon to marry me. It's bad enough being rejected, but being auto-rejected really cuts to the bone. -- Toto http://bureau42.base.org/public/xenix/xenbody.html

1 0

Guardian on EU-FBI Wiretap Pact
by John Young 17 Dec '03

17 Dec '03

Thanks to CM. The Guardian Weekly, Volume 156, Issue 9 Week ending March 2, 1997, Page 4: UK to join FBI phone taps Richard Norton-Taylor and Alison Daniels BRITAIN has secretly agreed with its European Union partners to set up an international telecommunications tapping system in co-operation with the FBI, it was revealed on Monday. The agreement covers telephones and written communications -- telexes, faxes and e-mail. To make tapping easier, telecommunications companies will be obliged to give security and intelligence agencies the key to codes installed in equipment sold to private customers. Detailed plans are being drawn up by officials in a secret network of EU committees established under the "third pillar" of the Maastricht Treaty, covering co-operation on law and order issues. Civil liberties groups, while agreeing that there was a need for such an agreement to fight against serious crime, said the plans raised a number of privacy and data protection issues and must be the subject of a full public debate. Britain is an enthusiastic supporter of joint action in this area, which is conducted on an inter-governmental basis with no role for the European Commission, the European Parliament or the European Court of Justice. It is an area where the EU's "democratic deficit" is most evident. Key points of the plan are outlined in a memorandum of understanding signed by EU states in 1995, which is still classified. It reflects increasing concern among European intelligence agencies that modern technology will prevent them from tapping private communications. EU governments agreed to co-operate closely with the FBI in Washington as they work out detailed plans. ----- As posted yesterday, for a report on EU-FBI wiretapping: http://www.privacy.org/pi/activities/tapping/

2 1

No Subject
by Bohus Simek 17 Dec '03

17 Dec '03

1 0

Re: Blowfish
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim C[retin] May prefers to have sex with little kids because his own penis is like that of a three-year-old. _ o |<)_/# Tim C[retin] May TT <T

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 3 Mar 97 6:45:58 PST remailer email address history latency uptime ----------------------------------------------------------------------- weasel config(a)weasel.owl.de -++++++++-++ 1:22:34 99.99% hidden remailer(a)hidden.net *++.-# 5:22:40 99.98% balls remailer(a)huge.cajones.com ###--*.###-# 2:44:25 99.98% nym config(a)nym.alias.net +*#*#+**+-++ 16:11 99.98% exon remailer(a)remailer.nl.com *+#*#+#++#*# 2:24 99.95% winsock winsock(a)rigel.cyberpass.net ------------ 5:40:48 99.94% cyber alias(a)alias.cyberpass.net -+ *++*+ *** 28:51 99.63% extropia remail(a)miron.vip.best.com __.._--__.-+ 22:39:55 99.55% replay remailer(a)replay.com --**++**+*** 15:52 99.41% dustbin dustman(a)athensnet.com ---+---._. 3:25:41 99.03% middle middleman(a)jpunix.com - -- -_*--- 2:17:36 98.95% lucifer lucifer(a)dhp.com -++++++ +++ 44:00 98.82% reno middleman(a)cyberpass.net .- +- -. - 1:12:29 96.16% jam remailer(a)cypherpunks.ca ** *** +* 53:49 94.54% shaman remailer(a)lycaeum.org *+++++ + 24:17 91.73% haystack haystack(a)holy.cow.net ##-+*+ ## 9:05 91.47% mix mixmaster(a)remail.obscura.com . _ 91:28:31 89.63% squirrel mix(a)squirrel.owl.de -+++ 59:37 21.19% wazoo remailer(a)wazoo.com 37:27 -5.74% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Military Snooping
by John Young 17 Dec '03

17 Dec '03

Lucky Green posted the message below elsewhere which raises provocative questions about military snooping on the Net to combat anonymizers and remailers: [Forward] At the FC'97 rump session, Paul Syverson from NRL presented a paper titled "Onion Routing". The description of the system sounds very much like Wei Dai's PipeNet. However, the development team seems to be unaware of PipeNet and the discussions about it that we had in the past. NLR has currently five machines implementing the protocol. Connection setup time is claimed to be 500 ms. They are looking for volunteers to run "Onion Routers". It appears the US military wants to access websites without giving away the fact that they are accessing the sites and is looking to us to provide the cover traffic. What a fortunate situation. They said that the source would soon be on the web page, but so far it has not appeared. http://www.itd.nrl.navy.mil/ITD/5540/projects/onion-routing/ [End forward] For those who don't want NRL snooping on their accesses, we've put three of the Onion-Routing papers at: http://jya.com/onion.htm http://jya.com/privnet.htm http://jya.com/hri.htm (a conversion from PDF)

1 0

Re: DES Challenge / Who'da Thunk It?
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Mon, 3 Mar 1997, Sean Roach wrote: > At 02:36 PM 3/3/97 +0100, James Morris wrote: > ... > >Actually, there's a theory that the secret recipies for Coke, Pepsi and > >Kentucky Fried Chicken are part of a biological chinese lottery, where > >the results are collected via satellite-based spectrometry of atmospheric > >methane radicals. Note that children who are too young for these foods > >will quite happily eat Crayola. > > > >More than this I cannot say. > > You might be interested to know that Pepsi owns Kentucky Fried Chicken. > Take a look at the supply trucks some time, Taco Bell, Hot & Now (whatever > that is), Kentucky Fried Chicken, and Pizza Hut are all Pepsico subsidaries. > I'd say that the chips are weighted heavily on one side. Hope you know > which numbers to bet on. I'd lay my $ on the suppliers of red dye #3, yellow dye #7, etc., and get Pepsi, Coke and Crayola fanciers all at once. Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

1 0

NSA Sued by Cryptographer
by John Young 17 Dec '03

17 Dec '03

We've received from Anonymous a copy of a February 28, 1997, complaint against NSA by an ex-Sandia cryptographer: http://jya.com/nsasuit.txt (41K) The cryptographer, William Payne, was: project leader for the Missile Secure Cryptographic Unit [MSCU] at Sandia between about 1982 and 1986. The MSCU was funded by NSA. Payne designed and built the hardware/software data authenticator for the US/USSR Comprehensive Test Ban Treaty for Sandia between 1986 and 1992. Payne held SECRET clearance when Payne worked for the Navy, DOE Q clearance, crypto and SCI access while at Sandia. The document says that Payne was a source for the Baltimore Sun story on NSA's "spiking" deal with CryptoAG*, and other stories, after he was fired in 1992 for attacking the quality of NSA's cryptography. It includes descriptions of agreements between Sandia and NSA, algorithms, critiques and procedures. A sample: Payne revealed to the public the value 31. "The algorithm required stepping two of its internal registers at a rate many times the data rate." NSA believes that 31 is classified. Payne believes that this is classification abuse. Therefore, Payne issued a FOIA to NSA crypto-mathematician Brian Snow also on June 10, 1996. I found no evidence that NSA possesses any special crypto skills, and apparently hides its deficiencies behind the veil of classification abuse. To the contrary, I discovered generic deficient crypto work. We brought this to the attention of NSA. Sandia even offered to help NSA fix its deficient crypto work. And NSA attempted to correct its deficient crypto work. Therefore, under 5 USC 522b I request access all technical documentation on, 1 Benincasa's original NSS/USO algorithm, 2 Benincasa's revision of 1, 3 The Unkenholtz - Judy GRANITE algorithm, 4 Your MSCU algorithm, 5 the clipper algorithm, 6 the STU III algorithms. I feel that published analyses of the above 6 algorithms will show the Clinton administration, congress, and the public that NSA possess no superior knowledge of crypto matters. Payne received no response from NSA. ---------- * "Cryptographic units were 'spiked' so that the crypto key was transmitted ['covert channel'] with the cipher text." For more on the CryptoAG story see: http://jya.com/cryptoa2.htm

1 0

2-way anonymous ecash ?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: Peter Foldiak <Peter.Foldiak(a)st-andrews.ac.uk> Newsgroups: sci.crypt On http://www.digicash.com/ecash/aboutcrime.html Digicash says: "... ecash is not at all well suited for black markets, extortion, bribes and tax evasion. The reason is that only the payer is anonymous, the recipient of the money has no anonymity at all. Furthermore, all money that the payee receives must be given to the bank. It is not possible to hide from the bank the fact that you received money (and thereby hide it from the authorities). So tax-evasion is definitely out. For people who operate black markets the same story holds. First of all, their income is visible. The second reason is far better: if any of the customers ever wants to, he can prove that a certain payment was made by him. This means that a criminal accepting ecash can be identified with the retroactive help one of his customers. ..." Is this really true under all circumstances? Can (some kind of) e-cash be made truly two-way anonymous, like physical cash?

1 0

Re: Presidential decrees and emergency powers
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>We've put the full 50USC Chapter 35 -- International Emergency Economic >Powers at: > > http://jya.com/50usc35.txt (284K) Thanks. This contains (among other things) the interesting Executive Order: >Continuation of National Emergency Declared by Ex. Ord. No. 12924 > >Notice of President of the United States, dated Aug. 15, 1995, 60 F.R. 42767, >provided: > >On August 19, 1994, consistent with the authority provided me under the >International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.), I >issued Executive Order No. 12924 [set out above]. In that order, I declared a >national emergency with respect to the unusual and extraordinary threat to >the national security, foreign policy, and economy of the United States in >light of the expiration of the Export Administration Act of 1979, as amended >(50 U.S.C. 2401 et seq.). Because the Export Administration Act has not been >renewed by the Congress, the national emergency declared on August 19, 1994, >must continue in effect beyond August 19, 1995. Therefore, in accordance with >section 202(d) of the National Emergencies Act (50 U.S.C. 1622(d)), I am >continuing the national emergency declared in Executive Order No. 12924. So the fact that Congress won't continue a law is justification for declaring an emergency which is justification for continuing it by presidential decree instead. Scary. Unfortunately it doesn't list all the earlier, expired decrees which would show what was originally used to start this thing off ("... the unusual and extraordinary threat to the national security, foreign policy, and economy of the United States in light of the British army currently marching on Washington" perhaps?) Peter.

2 2

RE: It is time to break Authenticode
by John Lehmann (SSASyd) 17 Dec '03

17 Dec '03

> Microsoft's recent arrogant and irresponsible reply to the Chaos > Computer Club hack on ActiveX requires response. An effective response > would be to steal the key of a major code signer and produce a signed, > malicious ActiveX control. Such an attack would demonstrate the > serious problems of Microsoft's security philosophy. > > ... > > The best avenue of attack is stealing the secret key of a respected > code signer. The target should be one of the major players, if not > Microsoft itself. Someone is sloppy to store their secret key on a It really should be Microsoft, for good exposure. > getting signatures right is well understood. Still, does anyone have > information on exactly how the signatures work? http://www.microsoft.com/kb/articles/q159/8/93.htm > > Stealing the key itself will almost certainly be an illegal act. > Morally, the demonstration signed control should itself not do damage. > Something like the Exploder control (which warns the user before > shutting down the machine) should be good enough to show the flaws of > ActiveX without causing trouble. The most interesting abuse the ActiveX thet I've heard of was a company that released an ActiveX control that modified the security manager used to verify and pass ActiveX controls, essentially registerring their company as a trusted provider. Thus once this one control was accepted, all other controls signed by that company were automatically accepted by the browser. The company quickly retracted the control and claimed that the authentication abuse was a feature put in while the control was in beta-cycle and accidently left in when it was finally released. Oops! (This was reported on the www-security mailing list, but I have lost the ref) Perhaps an interesting "nudie screensaver" control could be made to mail any Root.cer Cert.cer and Cert.spc (I guess) files lying around on the target computer to a well known mailing-list... One wonders whether it would even be illegal. *sigh* I suppose it would be. -- JJL

2 1

Re: NSA Sued by Cryptographer
by John Young 17 Dec '03

17 Dec '03

I spoke this morning with cryptographer William H. Payne in NM (505-292-7037), who confirmed that the NSA suit is authentic. He spoke freely about it and said he was pleased that it was being publicized. There's more to tell, he says, and is doing so through several pipelines. Says NSA is crimping him financially in retribution, so he may go offshore to make a living fighting their shitty crypto shenanigans. ----- To see the suit: http://jya.com/nsasuit.txt

1 0

More on NSA Suit
by John Young 17 Dec '03

17 Dec '03

We've received another doc by cryptographer William H. Payne that preceded his NSA suit, sent to the Director of NSA, which claims to contain classified information on NSA crypto algorithms: http://jya.com/nsasuit2.txt It amplifies information in the suit, and includes provocative material that was suit-and-tied for court. There's governmental information via Altavista about Mr. Payne's parallel dispute with DOE.

1 0

Forgery detection
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timothy C[retin] May is another loser who pays for got.net because he lacks the mental capacity to gain net access as a perk of either employment or academic achievment. ,,, ($ $) -ooO-(_)-Ooo- Timothy C[retin] May

1 0

Re: toad
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Asgaard <asgaard(a)cor.sos.sll.se> writes: > Why is cypherpunks(a)toad.com still appearing in headers > and even on the From: line on many messages? > Wasn't toad supposed to have shut down the cp list > at Feb 20? > > Asgaard > John Gilmore lied. So, what else is now? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: PR
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Toto <toto(a)sk.sympatico.ca> writes: > So apparently, from this cop's point of view, my desire to save money > on computer peripherals is 'nasty' business, and I have to expect to > duck flying bullets so that he can attempt to administer the death > penalty to some kid stealing a car radio. The only person with any business administering the death penalty to the kid stealing a car radio is the car owner. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Free Stuff!!
by JC 17 Dec '03

17 Dec '03

Because your profile indicates you are a visionary, you have been selected to participate in a marketing study where you will receive FREE products at ABSOLUTELY NO COST TO YOU. If you do NOT want to receive FREE PRODUCT SAMPLES, discounts and other benefits only available to CLUB MAIL (tm) members, hit reply and put the word <REMOVE> anywhere in the response, and we will never email you again. BUT if you would like FREE PRODUCT SAMPLES, discounts, and other benefits, absolutely FREE with no strings attached, hit reply and include <MORE> anywhere in the response. Then, you will be enrolled in CLUB MAIL, "the place to get FREE STUFF and more" (SM) There is NO CHARGE and NO OBLIGATION, you just have to want to get the best stuff for less, even FREE. HOW IT WORKS: We have many manufactures of consumer merchandise ready and willing to send it to you just for the asking. CLUB MAIL is a new service connecting preferred consumers with top distributors and manufactures. These companies are willing to go all out to get your attention. Even, give away valuable products, with no strings attached!! These companies know that the best form of advertising is word -of- mouth. They are confident in their products and service. They know once you do business with them, you will want to tell your friends and neighbors. But, in order for any of this to happen, they need you! When you email us back a <MORE> anywhere in the reply, we will add your name to a select group. You will then get emails from us, about once per week, with information about FREE PRODUCTS and SERVICES, and SPECIAL DISCOUNTS available ONLY THROUGH CLUB MAIL!! SO WHY NOT EMAIL US BACK A "MORE" right now, and await the next great offer from CLUB MAIL! Sincerely, David Schulhof Head Coach, CLUB MAIL P.S. The more you respond, the more FREE products you will receive. We have many leading manufactures that would like to have you try their products, and are willing to give them to you, just to get your feedback. SIGN UP FOR "CLUB MAIL" now. EMAIL us back a "MORE" P.P.S. We have valuable products for FREE that we can send you information on right away. But we must first have your response with <MORE> as in MORE FREE STUFF on file. So don't miss out, email us back right away!!

1 0