December 2003 - cypherpunks-legacy

Updated BBS listing (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From ravage(a)ssz.com Sun Feb 1 21:54:18 1998 From: Jim Choate <ravage(a)ssz.com> Message-Id: <199802020354.VAA26715(a)einstein.ssz.com> Subject: Updated BBS listing To: staff(a)ssz.com (Armadillo Group Staff) Date: Sun, 1 Feb 1998 21:54:17 -0600 (CST) X-Mailer: ELM [version 2.4 PL23] Content-Type: text Content-Length: 3010 Hi, I have updated the listing in Rasca's BBS list and it should show up in one of the future O'Reilly 'Learning Linux' books which we've been listed in since it was published. Jim ----------------------------------------------------------------------------- Hi Rasca, I would like to update the entry for my system, Solar Soyuz Zaibatsu (SSZ). The data that has been in the 'Learning Linux' listing has been out of date the last couple of years. I apologize for not correcting it sooner. It's pretty wild that we've been online in one manner or another since 1984 and involved in Linux since late 1992. The correct information is below: BBS Name: Solar Soyuz Zaibatsu (ssz.com) Phone Number: 512-451-6009 (28.8), 512-451-7060 (33.6) (account required) Online: ?, we're on Internet full time via ISDN Expires: ? Modem Speed (CCITT): 28.8, 33.6 City/Country/State (include region code): Austin, US, Texas (?) Whatever network it is on (i.e. FidoNet, etc.): Internet (ssz.com) First Time access to D/L Linux Files (Y/N): Y (if not request mount via staff(a)ssz.com) Allow File Requests - Fido style (Y/N): No, available anonymous ftp and temporary guest accounts (send request to staff(a)ssz.com) Free Access to Linux Files (Y/N): Y BBS Rating (1-5): 5 (what else?) We also support the 'Cypherpunks Distributed Remailer' (cypherpunks(a)ssz.com) 'Experimental Science Instrumentation Mailing List' (tesla(a)ssz.com) and are involved in the 'Austin Linux Group' (alg-l(a)lists.io.com) I also do consulting via 'The Armadillo Group' (consulting(a)ssz.com) We still support hobby/amateur science and technology via 'The Wired Society' (tws(a)ssz.com) We currently run Linux on x86, PPC, & SPARC machines as well as Plan 9. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Bush Gang Suspected In Assault On Presidency Bush Gang Suspected In Assault On Presidency
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Bush gang suspected in new assault on Presidency by Edward Spannaus and Jeffrey Steinberg In the midst of the worst global financial crisis in modern history, the United States Presidency has come under renewed, vicious attack from a combination of British and nominally ``American'' Bush-League circles. This latest attack, which one White House official long ago appropriately dubbed ``bimbo eruptions,'' centered around a Bush ``mole'' who was, unfortunately, allowed to operate inside the Clinton administration, and who now enjoys high-level security clearances in her post at the Pentagon. Linda Tripp, the central player in the renewed assault against President Clinton--staged around a purported sex scandal involving a young White House intern, Monica Lewinsky--was a Bush administration employee from 1990, until Bush left office in January 1993. At the urging of senior Bush administration officials, including Transportation Secretary Sam Skinner, Tripp was retained by the Clinton-Gore transition team in a clerical position, and later assigned to work at the Office of the White House General Counsel, under Bernard Nussbaum and his deputy, Vincent Foster. All the while, she was operating as part of a treasonous Bush-League ``fifth column'' within the Executive branch. While the ``Get Clinton'' media have attempted to portray Tripp as ``apolitical,'' she was, in fact, an ally, from the Bush administration period on, of then-FBI agent Gary Aldrich, who, in 1996, wrote a libellous book against President Clinton, {Unlimited Access: An FBI Agent Inside the Clinton White House,} which also revolved around bogus claims of White House sexual misconduct (see {EIR,} July 26, 1996, p.|72.) Aldrich was another Bush-League mole inside the Clinton White House. His embarrassingly fantasy-ridden book has been trumpetted by the London-based Hollinger Corporation, the leading British Crown media cartel; by its subsidiary, {American Spectator} magazine; and by ``Get Clinton'' money-bags Richard Mellon Scaife. Tripp emerged in 1995 as an asset of Whitewater Independent Counsel Kenneth Starr, testifying before the Whitewater grand jury and later before a Congressional hearing on the death of Vincent Foster. When Lloyd Cutler replaced Nussbaum as White House General Counsel, Tripp, who by then had been widely identified as an unabashed political enemy of President Clinton, was reassigned to the Pentagon, where she eventually got an $80,000-a-year job, which also involved her getting top-level security clearances. Tripp claimed, to anyone who would listen, that she had been transferred from the White House because she ``knew too much about Whitewater,'' a patent lie. Commenting on the role of Tripp as the linchpin in the latest Clintongate assault, Lyndon LaRouche called on Jan. 22 for Tripp's security clearances to be immediately revoked, pending the outcome of a thorough probe of her role in the sordid affair. ``She obviously needs her security clearances immediately pulled, given her role in what has all the earmarks of an illegal attack against the President, ostensibly on behalf of partisan Republican forces. I would certainly hope that there is no one in the Pentagon who would countenance such an obvious assault against a vital American institution, the Presidency. I would expect such treachery from the editorial page writers at the {Wall Street Journal,} but not from our military.'' - An earlier `eruption' - In the summer of 1997, Tripp surfaced again as part of an effort to hit President Clinton with a ``Profumo''-style sex scandal, telling {Newsweek} that the President had sexually harassed a White House aide, Kathleen Willey. Willey denied, under oath, that Tripp's allegations were true. This prompted President Clinton's attorney, Robert Bennett, belatedly, in August 1997, to denounce Tripp as a liar. While working at the Pentagon, in late 1996, Tripp had already begun to cultivate a close relationship with a former White House junior staff aide, 22-year-old Monica Lewinsky, who had been recently transferred to the Defense Department. It is unclear how the two women came to meet, but in short order, Tripp began to exert a significant amount of control over the younger woman. Tripp should be forced, under oath, to detail the circumstance under which she met and befriended Lewinsky. Tripp soon betrayed Lewinsky's confidence by surreptitiously--and, probably, illegally--taping telephone conversations with Lewinsky. By December 1997, Tripp and Lewinsky had {both,} mysteriously, been subpoenaed to give depositions to attorneys for Paula Jones, in her civil lawsuit against the President--a lawsuit instigated by British intelligence operator and former London {Sunday Telegraph} Washington correspondent Ambrose Evans-Pritchard. How Jones's attorneys came to know of the existence of Tripp and Lewinsky is one question that may hold a key to Tripp's role in the present attack against the President. It should be recalled that, prior to being named the independent counsel in Whitewater, Kenneth Starr had been paid by Richard Mellon Scaife, through the Landmark Legal Foundation, to prepare an {amicus curiae} brief in support of Paula Jones. Tripp claims that, on Jan. 12, 1998, she took 20 hours of tape-recorded conversations with Lewinsky to Whitewater Special Prosecutor Starr. The next day, Starr arranged for Tripp to secretly tape her meeting with Lewinsky at the Ritz Carlton Hotel near the Pentagon in Arlington, Virginia. At the time that Starr arranged for the FBI to secretly tape the Tripp-Lewinsky meeting, {he had absolutely no jurisdiction to probe President Clinton's relationship to the former White House aide.} Indeed, it is critical that a full-scale probe be conducted, to determine whether Tripp, who was in league with Starr from 1995, was taping her conversations with Lewinsky on her own, or, covertly, on behalf of Starr. At minimum, Starr vastly overstepped his jurisdiction; far more likely, he himself broke the law--along with Tripp--in a flagrant attempt to entrap and destroy President Clinton. - No U.S. precedent - In the 200-year history of the American Presidency, there have been occasional sexual scandals involving top government officials; however, never has such a personal scandal brought down the chief executive. There is only one country in the world where heads of government are brought to their knees through such tabloid scandal-mongering: Great Britain. In 1963, Harold Macmillan's government was brought down by a sex scandal involving Defense Minister John Profumo. It is, therefore, not surprising that a review of the various Clintongate scandals, from the 1993 so-called ``Troopergate'' affair to the present attack, reveals that British intelligence stringer and former {Sunday Telegraph} Washington correspondent Ambrose Evans-Pritchard has been the chief instigator. As early as May 8, 1994, in a {Sunday Telegraph} column, Evans-Pritchard boasted that he had been instrumental in getting Paula Jones to file her civil suit against the President. Evans-Pritchard has elsewhere boasted that his assignment, on behalf of the British Crown's Hollinger Corporation, has been nothing less than the total destruction of the Clinton Presidency. Writing in the Jan. 22 {Daily Telegraph,} Evans-Pritchard loudly bragged of his manipulation of Paula Jones: ``My impression after befriending her four years ago, before she took the momentous step of suing the President, is that her motive was sheer rage.'' ``Paula Jones has now achieved her object of inflicting massive damage on Bill Clinton, with shortening odds that she may ultimately destroy his Presidency,'' he continued. Evans-Pritchard accuses the U.S. news media of covering up the Clinton sex scandals, so that only the {American Spectator} or the British press will print the stories. ``What Paula Jones has done is to use the immense power of legal discovery to force the scandal to the surface. She has finally done the job that the American media failed to do so miserably.'' This was precisely the strategy that Evans-Pritchard had laid out in 1994, when he acknowledged on May 8, 1994, that he had had ``a dozen conversations with Mrs. Jones over the past two months.'' He furthermore admitted that ``I happened to be present at a strategy meeting last month on a boat on the Arkansas River,'' at which Jones's attorney ``was weighing the pros and cons of legal action.'' It doesn't ``matter all that much whether Mrs. Jones ultimately wins or loses her case,'' he wrote on May 15, 1994. ``The ticking time bomb in the lawsuit lies elsewhere, in the testimony of other witnesses.'' ``Put plainly,'' Evans-Pritchard blurted, ``the political purpose of the Jones lawsuit is to reconstruct the inner history of the Arkansas Governor's Mansion, using the legal power of discovery. In effect, the two lawyers and their staff could soon be doing the job that the American media failed to do during the election campaign and have largely failed to do since.'' Evans-Pritchard's motive, in contrast to Jones's ``sheer rage,'' is a deep, abiding hatred of the United States, and particularly, the institution of its Presidency. Anyone who joins Evans-Pritchard in this unfolding assault upon the Presidency, is joining the ranks of traitor Aaron Burr. A thorough probe of the current insurrection, beginning with a spotlight on Linda Tripp, is more than appropriate. >From Executive Intelligence Review V25, #5. -- John Covici covici(a)ccs.covici.com

1 0

The Continued Attack on Cash (Was: "The Right of Anonymity"...)
by Black Unicorn 17 Dec '03

17 Dec '03

Mr. May said: >Suffice it to say that I find nearly all cases where someone is "demanding" >personal information to be cases where the government has required them to, >for various unseemly purposes, or in cases where credit is being arranged. Of late I tried to pay off a rather large American Express bill. Suddenly, AMEX won't take cash in excess of $1,000 in any single billing period (30 days). The large sign on the wall indicated the substance of the new rule (or the old rule newly enforced) and added that customers "may be required to produce two forms of identification including a government issued identification card and a social security number." Here's a situation where the payor is (theoretically) positively identified to the payee (including ssn), where credit has already been established, and where records are certain to exist for all transactions which are being paid for. The AMEX Corporate card was once a wonderful tool to preserve anonymity with. One could issue several cards for a domestic company, 100% owned by an offshore, and settle in cash. Properly done, this was perfectly legal. Well, once upon a time anyhow. I find it extremely alarming that a general transaction like this can be illegal where almost no case can be made for a danger of money laundering or some kind of support of the "underground economy" (except perhaps that I'd have Pablo Escobar pay off my Amex to compensate me for my illegal smuggling flights, but that's a bit thin in my view). Increasingly, I try and find explanations for these kinds of regulations which do not include a paranoid rant about governments making sure they maintain a firm set of records on every citizen for whenever it might be "needed," (or wanted). Increasingly, this becomes a difficult mental task. Increasingly, it is difficult to make cash transactions. In the end that seems to be the point. Make it difficult to pay with cash. Make it suspicious to pay with cash. Make it an attention getter if you pay with cash. Sound paranoid? Try this. I'd like everyone who reads this to try and go 45 days without using plastic or writing a check. Just 45 days. If you don't grow alarmist very quickly (like in the first week) I'd like to hear your experience. If nothing else, try adding up a few months of finance charges, yearly fees on your credit cards, transactions fees, check fees, interest lost on no-interest checking accounts... see what you're paying to keep people from looking at you like a criminal. There's an interesting new awakening in personal finance right now which advises, among other things, "pay in cash, die broke." I'm interested to see how this "pay in cash" advice, which I have followed religiously years before it was put in print, clashes with post-modern financial regulation. I know things have gotten really out of hand because the phrase "No, I'll pay with cash," which I find I have to use more and more often, turns more and more heads and is met more and more often with a cross look from a teller and a finger pointed at a large sign bearing the heading "Restrictions on Cash Transactions." When the question becomes "Which credit card will you be paying with?" and no longer does one hear "How will you be paying for that?" I think people better start thinking about what's happening. (I'm not on cypherpunks anymore, mail me directly).

2 1

The Continued Attack on Cash (Was: "The Right of Anonymity"...) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 02 Feb 1998 00:51:11 -0600 > From: Black Unicorn <unicorn(a)schloss.li> > Subject: The Continued Attack on Cash (Was: "The Right of Anonymity"...) > Sound paranoid? Try this. I'd like everyone who reads this to try and go > 45 days without using plastic or writing a check. Just 45 days. If you > don't grow alarmist very quickly (like in the first week) I'd like to hear > your experience. I've been doing it for many years. Don't have a checking account, don't own a credit card. I do have a saving account with a local credit union and go in every 3-4 days and withdraw what I need for the next 3-4 days. Pay every bill in cash or money order. I'm not going into how I invest my excess capital. If my employer needs me to travel I do it on their plastic. The only irritating thing I find is that I can't walk into grocery stores any more and get money orders larger than $700 and many won't do it for more than $400. I have to pay my rent each month with a $400 and a $397 money order in order to meet the $797 amound due because I'm too lazy to drive the extra 6-8 blocks to the one who will do the $700 money orders. Other than that I don't have a problem at all. I'm going to go tomorrow and buy a new laptop at around $1500. I intend on paying with a wad of $100 bills. Bet you they don't look twice nor will they ask for ID. I've actualy never had a problem paying cash, never had anyone turn real money down... ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 3

ELECTRICITY CAN MAKE YOU RICH
by partners＠partnersnow.com 17 Dec '03

17 Dec '03

All of us are constantly bombarded by people hawking "unbelievable", "once-in-a-lifetime", "get-rich-quick" business opportunities. I graduated from Yale, became Commissioner of Housing in New York City, started a real estate development company, and now own an 83-year-old diamond-cutting company. Quite bluntly, I won't waste my time even listening to the pitch. And yet right now, I am telling eveybody I know (and, obviously, hundreds of people I don't know) about an opportunity available in the deregulation of electricity that sounds just as outrageous as all the phony talk we've heard in the past. The difference is that this is real. And the urgency comes from the fact that it will never happen again. You might choose to read no further, but you will never be able to say that you weren't there when business history was being made. MAKE NO INVESTMENT AND START PART-TIME Know up front that your participation will not require start-up costs of more than about $300 nor that you leave your current full-time job. You should also know that deregulated electricity in the US, albeit a $215-billion industry, is only one component in a global master plan that will soon tap even larger markets in internet commerce, telecommunications, and energy distribution. In all these markets, our participation will be in partnership with the most respected names in the corporate world. The structure of this precedent-setting Company has already been formed and the names of our partners will be announced over the next few weeks. We intend to do for all services entering homes, offices, and factories what the supermarket did to individual food shops and what the mall did to Main Street stores. The powerful trend to consolidation will naturally successfully extend to essential modern services because the benefits will be the same: lower cost and greater convenience. This is nobody's pipe dream. This is history in the making, and you can become a very rich player by finally being in the right place at the right time and taking action. DEREGULATION CAN ONLY HAPPEN ONCE By the year 2002, the domestic electric utilities industry will be fundamentally deregulated. That means that the out-dated, costly, monopolistic utility providers, which we have always accepted like death and taxes, will be forced to compete in the open market with lower-cost, high-tech, entrepreneurial, service-oriented private companies. In many states, the process has already begun. California's $20-billion industry will be one of the first to deregulate completely in 1998, along with New Hampshire and Rhode Island. Massachusetts and Pennsylvania are right behind, with many other states scheduling to start in 1998, too. Consumers will have the right to choose the source of their power and you will have the opportunity to sell it. And it has all been done before. In the 1970's, the airline industry deregulated and the resulting competition destroyed established companies and made fortunes for others. In the 1980's, AT&T lost its monopoly and now barely holds on to 50% of the market. The significant difference in the deregulation of electricity in the 1990's is that you are right now being given a chance to participate even before it happens. Our Company has developed the multi-million-dollar infrastructure to support its goal of becoming to deregulated electricity what MCI became to deregulated telephone. And the distribution of our electricity will be made only through independent entrepreneurs empowered by the Company to profit every time a customer turns on a light. Even more eye-opening, these "electricity entrepreneurs" will profit to an even greater extent from their monthly commissions on their customers' use of all the other services the new Company will offer: internet commerce, telephony of all kinds, home security, cable TV, and many more. With three or more services "bundled" together, studies have shown that customers are lost at a rate of less than 10% a year. This is true residual income. Compensation accrues from four main sources: (1) up-front agency fees paid to the Distributor when customers subscribe to our services; (2) up-front training fees paid to the Sponsor when new Distributors join the Company; (3) residual commissions paid to the Distributor as a percentage of customers' monthly use of the Company's services; and (4) executive bonuses paid to Distributors on the total volume generated by his or her entire organization. CAPITALIZE ON A PROVEN ROCK-SOLID COMPANY As I said, we are not looking for investors. Our parent is a 13-year-old, $1.4 billion, high-tech company with a D&B 5A-1, no debt, US Olympic Committee licenses, and operations in 23 countries all over the world. It is one of nine companies in the history of the United States that grew from start-up to one billion dollars in sales in less than ten years (others include Microsoft, FEDEX, Nike, and Home Depot). Our Asian division went public on the New York Stock Exchange with Morgan Stanley and Merrill Lynch as our underwriters. Most important, the Company has established a brilliant, highly-leveraged plan for growth that has empowered over 400 associates, working on their own schedules, usually out of their own homes, to reach an income level that in 1996 averaged $561,000 a year. Significantly, that track record was achieved in industries a small fraction of the size of deregulated electricity and our other future markets. Please be aware that there will be many start-up companies hustling to be players in this historic opportunity. There will be efforts by the utility dinosaurs to hang on to their markets. Be sure that your potential in this industry isn't undermined by the failure of the insubstantial up-starts or the collapse of the prehistoric giants. LIFE IS NOT A DRESS REHEARSAL In my role as President of a diamond-cutting company, I know the frustrations of a capital-intensive, high-risk, low-margin, slow-growth industry. As an Administrator in the medical community, my wife sees the deterioration in doctors' earnings and the downsizing and closing of hospitals everywhere. While many of the old ways of making money are gone, new opportunities abound. Deregulated electricity is the next big opportunity, structured by a genius hyper-growth Company that is already allowing my wife and me to continue our professional work full-time, while enabling us to develop part-time a perpetual income with unlimited potential. The partners we are seeking for this opportunity should be independent, open-minded, self-motivated, highly-principled entrepreneurs. Such a profile might seem demanding, but the financial rewards can be gigantic. I was skeptical, too, at first. But the more I investigated, the more I realized that this is the rare, legitimate, dynamic opportunity that people, not long from now, will look back to and lament that they they missed. Electricity deregulation has never happened before and will never happen again. There is no doubt that fortunes will be made as a result of deregulation and the Company's global vision. The only question is who will be along for the ride. And it might not be for you. There are always reasons. But clearly, if you continue to do what you've always done, you'll continue to get what you've always gotten. And if you've already gotten all the time freedom and all the money you've always wanted, this opportunity is probably not for you. But if you haven't, how long are you going to wait? For more information, please call 1-800-326-9253 or email me back and leave your name and daytime and evening phone number and the best time to call. Serious inquiries only please. /////////////////////////////////////////////////////////////////////////////// We practice responsible emailing. If you wish to be removed from future mailings, please reply with remove in the subject. ////////////////////////////////////////////////////////////////////////////////

1 0

BXA Meet
by John Young 17 Dec '03

17 Dec '03

Should anyone attend this a report would be welcome. Federal Register: February 2, 1998 (Volume 63, Number 21) Page 5353 ----------------------------------------------------------------------- DEPARTMENT OF COMMERCE Bureau of Export Administration Regulations and Procedures Technical Advisory Committee; Notice of Partially Closed Meeting A meeting of the Regulations and Procedures Technical Advisory Committee will be held February 25, 1998, 9:00 a.m., in the Herbert C. Hoover Building, Room 3884, 14th Street between Constitution and Pennsylvania Avenues, N.W., Washington, D.C. The Committee advises the Office of the Assistant Secretary for Export Administration on implementation of the Export Administration Regulations (EAR) and provides for continuing review to update the EAR as needed. Agenda Open Session 1. Opening remarks by the Chairperson. 2. Presentation of papers or comments by the public. 3. Update on implementation of the National Defense Authorization Act computer control regulations. 4. Update on the Wassenaar Arrangement implementation regulation. 5. Discussion on the ``deemed export'' rule. 6. Discussion on the encryption regulations. 7. Update on the License Process Review initiative. 8. Discussion on efforts to conform the Foreign Trade Statistics Regulations and the Export Administration Regulations on export clearance requirements. 9. Discussion on clarification of EPCI (Enhanced Proliferation Control Initiative). Closed Session 10. Discussion of matters properly classified under Executive Order 12958, dealing with the U.S. export control program and strategic criteria related thereto. The General Session of the meeting will be open to the public and a limited number of seats will be available. To the extent that time permits, members of the public may present oral statements to the Committee. Written statements may be submitted at any time before or after the meeting. However, to facilitate the distribution of public presentation materials to the Committee members, the Committee suggests that presenters forward the public presentation materials two weeks prior to the meeting date to the following address: Ms. Lee Ann Carpenter, OAS/EA/BXA MS:3886C, 14th & Pennsylvania Avenue, N.W., U.S. Department of Commerce, Washington, D.C. 20230. The Assistant Secretary for Administration, with the concurrence of the delegate of the General Counsel, formally determined on December 16, 1996, pursuant to Section 10(d) of the Federal Advisory Committee Act, as amended, that the series of meetings or portions of meetings of the Committee and of any Subcommittees thereof, dealing with the classified materials listed in 5 U.S.C. 552b(c)(1) shall be exempt from the provisions relating to public meetings found in section 10(a) (1) and (a) (3), of the Federal Advisory Committee Act. The remaining series of meetings or portions thereof will be open to the public. A copy of the Notice of Determination to close meetings or portions of meetings of the Committee is available for public inspection and copying in the Central Reference and Records Inspection Facility, Room 6020, U.S. Department of Commerce, Washington, D.C. For further information, call Lee Ann Carpenter at (202) 482-2583. Dated: January 27, 1998. Lee Ann Carpenter, Director, Technical Advisory Committee Unit. [FR Doc. 98-2393 Filed 1-30-98; 8:45 am]

1 0

Jim Bell Update
by John Young 17 Dec '03

17 Dec '03

Date: Sun, 01 Feb 1998 Hi, John. Received a letter and phone call from Jim, as below. -------------------------------------- . He had a little altercation with a fellow prisoner ("through no fault of my own" - he thinks he was set up) and his privileges were reduced for 35 days, so that he could only make one phone call each week. . In reference to the bad publicity (all those articles and news alerts) which his case received, he speculates that the government gave a copy of AP to a 'think tank' like Rand, etc., with the request to figure out how to stop or delay AP. But it is his conclusion that AP is unstoppable, although: "I think that one last (temporary) hope for government is to delay AP. Chances are good that the "think tank" decided thatt the best way to delay AP is to discredit me, its author. It was a desperate gamble, particularly because the act of harrassing me automatically gives AP more publicity. That's the reason they will fail; the more they try to "get" me, the worse it will be for them." He wants it noted that his writing and discussions of AP ideas are in the sense of a "prediction", a "warning", or even a "vision", not an advocacy of it. . Regarding his guilty plea, he said it was because he realizes that he did do a few things wrong and that, although he did think that some of the charges against him were overblown and distorted, there was enough of a risk of being found guilty that it didn't make a lot of sense to contest them. He adds, "I also felt (and still do, of course) that government had already 'lost the war' so to speak." . He expects to be out around mid-April. Upon his release he wants to go to some of his favorite restaurants, and to have several BIG pizzas. He hopes he can get his old job back as electronics designer, and has some ideas he wants to work on for a virtual reality peripheral device which will bring everyone steps closer to the Star Trek Next Generation 'holodek'. - end

1 0

RE: Dr Dobbs crypto CD
by Trei, Peter 17 Dec '03

17 Dec '03

I called them up a couple weeks ago to ask about this. The person I talked to had clearly fielded this question quite a few times. The story he gave is that preparation of the master CD was farmed out to some particular individual contractor who was stalling. I got the impression that I was being told that the contractor was apparently imcompetant, and could not turn in a usable master in a timely fashion. There was also some mention of the possiblity of 'legal difficulties', though I was given no details on that. Peter Trei ptrei(a)securitydynamics.com > -----Original Message----- > From: dlv(a)bwalk.dm.com [SMTP:dlv@bwalk.dm.com] > Sent: Saturday, January 31, 1998 12:14 PM > To: cypherpunks(a)toad.com > Subject: Dr Dobbs crypto CD > > The DDJ I just got (March 98) has a full-page ad for the crypto CD > (p.113) > saying inter alia "New Release! fast Search Engine" > > Has anyone received even the "old release"? > > --- > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, > 14.4Kbps [Trei, Peter] I called them up a couple weeks ago to ask about this. The person I spoke to had clearly fielded this question quite a few times. The story he gave is that preparation of the master CD was farmed out to some particular individual contractor who was stalling. I got the impression that I was being told that the contractor was apparently imcompetant, and could not turn in a usable master in a timely fashion. There was also some mention of the possiblity of 'legal difficulties', though I was given no details. I'm still waiting for my copy. Peter Trei ptrei(a)securitydynamics.com

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) This remailer list is somewhat phooey. Go check out http://www.publius.net/rlist.html for a good one. Last update: Thu 23 Oct 97 15:48:06 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hera goddesshera(a)juno.com ------------ 5:03:45 99.86% nym config(a)nym.alias.net +*#**#**### :34 95.82% redneck config(a)anon.efga.org #*##*+#**** 2:00 95.44% mix mixmaster(a)remail.obscura.com +++ ++++++* 19:18 95.27% squirrel mix(a)squirrel.owl.de -- ---+--- 2:34:19 95.16% cyber alias(a)alias.cyberpass.net *++***+ ++ 11:26 95.11% replay remailer(a)replay.com **** *** 10:06 94.93% arrid arrid(a)juno.com ----.------ 8:50:34 94.41% bureau42 remailer(a)bureau42.ml.org --------- 3:38:29 93.53% cracker remailer(a)anon.efga.org + +*+*+*+ 16:32 92.80% jam remailer(a)cypherpunks.ca + +*-++++ 24:14 92.79% winsock winsock(a)rigel.cyberpass.net -..-..---- 9:59:18 92.22% neva remailer(a)neva.org ------****+ 1:03:02 90.39% valdeez valdeez(a)juno.com 4:58:22 -36.97% reno middleman(a)cyberpass.net 1:01:28 -2.65% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Clarke denies pedophilia [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > AUTHOR OUTRAGED AT REPORT HE IS PEDOPHILE > > Arthur C. Clarke seeks postponement of knighthood > > Clarke Clarke > > COLOMBO, Sri Lanka (AP) -- A British newspaper report that Arthur C. > Clarke is a pedophile is false, his spokesman said Monday, and the > science fiction writer is consulting lawyers. > > "I am outraged by the Sunday Mirror's allegations, and I am seeking > legal advise," Clarke said in a brief statement read to reporters by > his secretary, Roshan Amarasekhara. > > "Mr. Clarke is very upset by the false reports," Amarasekhara added. > > Clarke was quoted at length discussing sex with young men in the > sensationalist British newspaper's report Sunday, a day before > Prince Charles was to fly to Sri Lanka to confer the honorary > knighthood Queen Elizabeth granted the author late last year. The > prince will also take part in the former British colony's 50th > independence anniversary celebrations. > ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Bush Gang Suspected In Assault On Presidency
by Bill Stewart 17 Dec '03

17 Dec '03

EIR is one of the mouthpieces for the Lyndon Larouche cult. I ran across them in an airport recently, and was surprised to find they're now strongly behind Bill Clinton; I'd thought that a few years ago they were accusing him of being a tool of the Tri-Lateral Commission, though perhaps it was some other group of anti-TriLateralists. At 10:22 PM 2/1/98 EST, covici(a)ccs.covici.com wrote: >Bush gang suspected in new assault on Presidency > >by Edward Spannaus and Jeffrey Steinberg > >In the midst of the worst global financial crisis in modern history, the >United States Presidency has come under renewed, vicious attack from a >combination of British and nominally ``American'' Bush-League circles. ... >From Executive Intelligence Review V25, #5. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

4 4

SmartCards in the news
by Information Security 17 Dec '03

17 Dec '03

Also see: http://www.zdnet.com/pcweek/news/0112/12bio.html ---guy --------------------------------------------------------------------- This article is from Internet Computing (http://www.zdnet.com/icom/) Visit this page on the Web at: http://www.zdnet.com/icom/content/anchors/199802/02/smarten.net/ --------------------------------------------------------------------- [ Features ] February 02, 1998 Smart Cards Smarten the Net By Albert Pang For many contractors to the U.S. Department of Defense, the Internet will become an important ally this year, helping them resolve one of the most daunting challenges when doing business with the government: Getting paid on time and with a minimal amount of hassle. Thanks to a new breed of smart cards backed by sophisticated Web applications, 200 defense contractors will start receiving electronic checks (e-check) from the government via secure Internet e-mail through a pilot program launched in January 1998. The contractors will use their smart cards to access the mail box, validate, and endorse the checks. They will then forward the checks to BankBoston or NationsBank, the two authorized banks, that will deposit them into their accounts. The smart cards, which include digital certificates developed by GTE Cybertrust, will play a critical role in helping the defense department and other agencies comply with a mandate that requires most of the 800 million payments the government makes every year be converted to electronic form by January 1, 1999. Because of the mandate, the number of smart-card applications in different stages of development within the government has doubled to more than 900 in the past year, says Jim Hagedorn, a spokesperson for the Treasury Department. That's good news for vendors such as Anthony Caputo, chairman of Information Resource Engineering (IRE) in Baltimore, which develops the smart cards and the readers for the e-check program. "It will create a nice revenue stream," Caputo says, adding that his company has issued 100,000 smart cards to government and corporate customers mostly for use in private networks. Now with the Internet, the smart card market could grow substantially, especially in Asia and Europe. "Smart cards are the ultimate personal network computers," capable of handling everything from simple tasks such as identification to complex ones such as online banking and electronic commerce, says Philip Yen, senior vice president of chip platform at Visa International in Foster City, CA. [TABLE NOT SHOWN] Both Visa and its rival MasterCard are engaged in smart-card pilots around the world, promoting the use of stored-valued chip cards that run on private networks or the Internet. For example, AT&T Universal Card is working with Mondex, the electronic cash venture majority-owned by MasterCard, to sign up a small number of online merchants for a pilot program that will allow Internet users to buy products from them using smart cards issued by AT&T. However, analysts expect acceptance of smart cards in the United States to be slower than that in other countries because of privacy concerns, interoperability issues (Visa and MasterCard use different operating systems, for example), and the desire to put as many complex applications as possible on a single card. Albert Pang is the online editor of the Internet Computing MagaSite Send e-mail to apang(a)zd.com. --------------------------------------------------------------------- Copyright (c) 1998 ZDNet. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of ZDNet is prohibited. ZDNet and the ZDNet logo are trademarks of Ziff-Davis Inc.

1 0

A new crypto-campaign, from Time/Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 2 Feb 1998 12:07:24 -0500 From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu ***** SHOULD THE GOVERNMENT READ YOUR CYBERMAIL? Time Magazine February 9, 1998 Page 20 A few years ago, ED GILLESPIE was busy orchestrating the Republican takeover of Congress as the G.O.P.'s top spinmeister. Now the man behind the Contract with America is shifting to high tech as he battles a new foe: a plan to ban software capable of encoding messages so securely that police can't crack them. A law proposed by the FBI would mandate an electronic peephole in all encryption programs so that government agents can read your files. The FBI claims this is necessary to protect against criminals. But Silicon Valley chiefs see this as a threat, and are equipping Gillespie with a multimillion-dollar lobbying and media budget. Joining him to woo Democrats is lobbyist JACK QUINN, former counsel to Bill Clinton and ex-chief of staff to Al Gore. --By Declan McCullagh/Washington ********** For details on the new encryption campaign, check out today's Netly News (netlynews.com) at: http://cgi.pathfinder.com/netly/opinion/0,1042,1722,00.html -Declan -------------------------------------------------------------------------- POLITECH -- the moderated mailing list of politics and technology To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: subscribe politech More information is at http://www.well.com/~declan/politech/ --------------------------------------------------------------------------

1 0

Re: County Mounties Spit on the 4th Amendment
by Anonymous Sender 17 Dec '03

17 Dec '03

>Oh! The 4th amendment? That dusty old thing? When the scumbags >are kicking in your door which would you rather have protecting >you: a raggedy old piece of paper or a Prince George County >Mountie SWAT team in full ninja dress and the latest high-tech >law-enforcement goodies? Thought so. Cup's at the end of the >counter comrade. Have a nice day. You couldn't be talking about Prince George, Canada, could you? "Mounties" are Royal Canadian Mounted Police (RCMP), and are limited to Canada, and Disney World.

4 4

Airline ticket information -- help
by Declan McCullagh 17 Dec '03

17 Dec '03

I'm trying to find out what airline flight someone is taking. I have a name and know the general travel plans and likely date. How can I find out the airline, flight number, and seat number? This is somewhat urgent. (You have my assurance that the purpose is legit.) If anyone has any ideas, I'd appreciate the help. Thanks, Declan

4 4

Re: The Continued Attack on Cash (Was: "The Right ofAnonymity"...)
by Tim May 17 Dec '03

17 Dec '03

At 10:51 PM -0800 2/1/98, Black Unicorn wrote: >Mr. May said: > >>Suffice it to say that I find nearly all cases where someone is "demanding" >>personal information to be cases where the government has required them to, >>for various unseemly purposes, or in cases where credit is being arranged. > >Of late I tried to pay off a rather large American Express bill. > >Suddenly, AMEX won't take cash in excess of $1,000 in any single billing >period (30 days). The large sign on the wall indicated the substance of .... It's worth noting (again) that a very simple technological/social solution to the "credit card companies have records on people" problem, the one often cited by "privacy law advocates" as the reason for a Data Privacy Act, is easily found. Namely, remove any impediments to the issuance of credit or debit cards unlinkable to the True Name of a user. A card issuer could feature this as a Privacy Card, either backed by transfers of backing capital to accounts, or using Chaum-style methods. This is fully feasible using Chaumian credential-revealing mechanisms. (Cf. Chaum's seminal "Transaction Systems to Make Big Brother Obsolete," in Communications of the ACM, November 1985. Updated a few times and available in reprints or other places. Try search engines for latest locations.) However, the trends are in just the opposite direction, as both Black Unicorn and Bill Stewart have noted in this thread. Between the War on Drugs, the laws about money laundering, the fears of tax evasion, and the general burrowcrat desire to record the movements and actions of citizen-units, such a Privacy Card would be frowned-upon. Various roadblocks, ranging from "know your customer" restrictions on banks to anti-money-laundering laws, would be thrown up to stop any such Privacy Card. The real solution is easy. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 5

FDA Registered and FDA Certified
by MAILER-DAEMON＠toad.com 17 Dec '03

17 Dec '03

Exclusive New Oral Transmucosal Weight Control Disc & Transdermal Patch, both FDA Certified & Registered with National Drug Code #'s. Developed by 10 year old Pharmaceutical Company. For detailed information reply to: timcoent(a)usa.net

1 0

Re: The Continued Attack on Cash (Was: "The Right of Anonymity"...) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Attila T. Hun" <attila(a)hun.org> > Date: Mon, 02 Feb 98 18:07:57 +0000 > Subject: Re: The Continued Attack on Cash (Was: "The Right of Anonymity"...) > >I've been doing it for many years. Don't have a checking account, don't > >own a credit card. I do have a saving account with a local credit union > >and go in every 3-4 days and withdraw what I need for the next 3-4 days. > >Pay every bill in cash or money order. > > first, the use of the credit union includes your SSN and > they have a total cash transaction at least on your primary > expenses. Wrong. I go in once a week and pull out money in a lump sum. I then budget that money myself. The only thing they have is a sequence of deposits from paychecks and withdrawals to cash. > if you have "consulting" income which can be > converted to cash, and dont deposit it, then you can do you > 'high on the hawg' living with the cash --until they bring > the IRS CID along and look at your 'imputed' income which is > almost indefensible in their kangaroo courts. I either take the fees in check and deposit them or else take 'in kind' trade (eg I did a job if installing Win95 for a customer on some laptops he'd bought via auction. There was a Tadpole 3XP Sparcbook on there. I took it for my fee). > >I'm going to go tomorrow and buy a new laptop at around $1500. > > what are you getting for $1500? out here in the boonies > we dont see those kind of prices. Looks like a Toshiba Satellite 445CTX (133MHz Pentium). > well, in the first place, you live in Texas where the > attitude to the Feds is rather strong --not as strong as our > attitude in rural Utah where the usual transaction is in > cash. out here, a Fed is the same as a revenuer in Eastern > Kentucky or Tennessee. reminds me of the Fed approaching a > child and telling him he'd give him $5 if he took him to his > father (still) --the boy asked for the money up front. when > the Fed asked why, the boy said: "...'cause you aint coming > back". You don't know Texas or Texans very well... ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

whit diffie on national radio
by Russell Nelson 17 Dec '03

17 Dec '03

FWIW, Whit Diffie is on NPR's Talk of the Nation RIGHT NOW. Find your local NPR affiliate, usually in the low end of the dial. -- -russ <nelson(a)crynwr.com> http://web.crynwr.com/~nelson Crynwr Software supports freed software | PGPok | Freedom is the primary 521 Pleasant Valley Rd. | +1 315 268 1925 voice | cause of Peace, Love, Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | Truth and Justice.

1 0

distributed cryptographic attack demo
by Jon Cooper 17 Dec '03

17 Dec '03

hi, i'm trying to do a demo of a distributed object technology and it seems to me that many cryptographic attacks would be facilitated by our approach. do you have any ideas for what a neat distributed effort might be? the ones i've thought of just don't seem too exciting: * GNFS of RSA modulus * attacking SSL * brute-force RC5 attack i'm looking for something that would be a sort of viscerally engaging attack, something that will make people who aren't necessarily number theorists or cryptographers take note. any input would be helpful! *jon PS - note that I'm not on cypherpunks so a direct reply would be most highly appreciated.

2 1

Eureka! Tue Feb 3 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Tuesday's issue of Eureka! PINKBITS Voted the #1 Teen (18+) site on the web, this is one pay site you don't want to miss out on! Here's just one quote from a satisfied member: "This site delivers awesome value. I have been a member of 3 other sites, and this is the best by far. It has the best pics, more live video, younger girls and more hardcore cumshots than the other sites put tog- ether". And we have negotiated a special FREE trial member- ship for Eureka subscribers, so don't take our word, go see! PinkBits .. http://207.33.10.198/cgi-bin/gate1/pbm/pb_0024/0 PLEASE VISIT THIS FINE EUREKA! PARTNER SITE Playgal - No.1 in Internet Hardcore! http://www.playgal.com/playgal/banner_eureka.html Playgal presents FREE LIVE FUCKING, and over 2,000 FREE XXX MOVIES! XXX 4 EVERY 1 Overall this site looks pretty good. Click on the View Free Sample Pics to get to the good stuff. Once over that fence your in! There are thumbnails of some hot looking babes! Wet bush filled with hard dick. Not a bad combination! XXX 4 Every 1 .................... http://www.xxx4every1.com DO ME LIVE Do me too! Do this, do that and do the other. If she lets you! This is a paysite but they have a pretty juicy free picture section. Girl on girl, shaved pussy, dildo, panties, and clit rubbing images. Stroke your browser over there! Do Me Live ........................ http://www.domelive.com/ CYBERJOY Basic text links that deliver! Check out first time, that is one big black log, and she is enjoying it! Cum shots and links that will take you all over the place. See the Hungry for pussy picture. That tramp looks possessed! Take a look. Cyberjoy .......... http://www.cyberjoy.inter.net/adult3.htm ADULT CHARTS Here is one to see. Go there right now. Tons of free pix! Click on the free pictures area and your in. Take your pick of anal, cum shots, oral sex, girlgirl, teens, group action, I could go on more but you get the idea. High quality jpeg images that load quickly! These are some of the best free porno pix on the internet. Grab your mouse and get surfing! Adult Charts .................... http://www.adultcharts.com BRAND NEW - HOORAY! THE ADULT SEARCH ENGINE Now adult surfers have our very own search engine, directly designed to only list adult sites, and so run fast because all other types of site are ignored. Check it out today! Hooray! -----------------> http://eureka.abc-web.com/hooray/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here --> http://www.netscape.com/download/ College teens -----> http://207.240.169.122/teens/start.html CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat -----------------> http://137.39.63.229/chat/ General/Fun Chat -------> http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!--->1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline-------->1-800-644-8779 FREE: Live 1-on-1 (international call only)--->011-678-77416 AMATEUR SITE OF THE DAY Octavia: "Caught you looking" is the motto of this sweet 23- year-old coed's web page. She loves to show off, and claims that she gets off thinking about all the horny guys checking her out. Her photos exhibit her exhibitionist streak and are of extremely high quality. Get caught looking at Octavia - it's well worth sneaking a peak! ---------------------------> http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY T-Bone's Sex Club: T-Bone gives you a new selection of erotic stories illustrated with nasty hardcore pics! Last week was Slut Wife week... what will it be this week? Visit T-Bone and find out! ............... http://www.rawsexx.com/ DAILY CARTOON ----------> http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! ---> http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ----------> http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ------> http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ------> http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ----> http://eureka.abc-web.com/eureka/francais.htm ITALIANO ----> http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE > http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 --------------------------> http://137.39.63.229/?030 Pic 2 --------------------------> http://137.39.63.229/?031 Pic 3 --------------------------> http://137.39.63.229/?032 Pic 4 --------------------------> http://137.39.63.229/?033 Pic 5 --------------------------> http://137.39.63.229/?034 Pic 6 --------------------------> http://137.39.63.229/?035 Pic 7 --------------------------> http://137.39.63.229/?036 Pic 8 --------------------------> http://137.39.63.229/?037 Pic 9 --------------------------> http://137.39.63.229/?038 Pic 10 --------------------------> http://137.39.63.229/?039 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

distributed computing
by Jon Cooper 17 Dec '03

17 Dec '03

I'm in the planning phase of a demo which should demonstrate the power of a distributed object technology which I'm working with. Any ideas for neat crypto-related distributed computation demos would be much appreciated. I've thought of: * brute forcing RC5 (lots of people are doing this already) * factoring attack on RSA modulus * Certicom's ECC challenge But I'm looking for something with more of a sort of gut-level appeal. Cracking SSL packets might be good. Hrmm. thanks for any input ... *jon

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

subskribe cyferpunks bill(a)whitehouse.gov

1 0

Re: The Continued Attack on Cash (Was: "The Right of Anonymity"...)
by Black Unicorn 17 Dec '03

17 Dec '03

At 06:07 PM 2/2/98 +0000, Attila T. Hun wrote: > I did-- tried to lay $14K out for a Mercedes (25 years ago). > they wouldnt take it. so I went and picked up two $7K > cashiers from two different banks. same thing with a pair > of Lycoming IO540 aircraft engines: 2 8s and a 9 --stay > under the $10K transaction. Careful. This may well be illegal now. Structuring transactions to avoid reporting requirements is a felony. (I'm not on cpunks, mail me).

5 4

An update on MS private key (in)security issues
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

A fortnight ago I posted a message exposing a number of weaknesses in the way various Microsoft security products handle users private keys. A few days before I was due to vanish for a security conference (where it was very difficult to contact me), the article started getting a bit of attention. This is a general response which clarifies several issues relating to the original message. First, Russ Cooper (moderator of the NT Bugtraq mailing list) made some wildly inaccurate claims about the article. I've had a bit of feedback which indicated that it wasn't even worth dignifying this stuff with a response but I've written one anyway, at least for the original NT Bugtraq messages he posted (the stuff he put on a web page is just more of the same). You can find it at http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms2.txt (even if you don't want to plough through the whole thing, you might want to read the last two paragraphs for a giggle). After this, Microsofts spin doctors leaped into action and posted a response to the article. I've replied to this one in a bit more detail, since it raises several important issues. Comments on Microsofts Response ------------------------------- >Microsoft's Response to Recent Questions on the Recovery of Private Keys from >various Microsoft Products >[...] >With the exception of the details about a possible PKCS-12 attack, all the >issues raised in the recent discussions are specifically aimed at Microsoft's >base CSPs, not at CryptoAPI. The base CSPs are the royalty-free, >software-based CSPs provided with Windows NT 4.0, Windows 95, and Internet >Explorer. These attacks do not apply in general to other CryptoAPI CSPs and do >not indicate any fundamental concerns with the security of the CryptoAPI >architecture or applications built upon it. This statement is mere obfuscation. As Microsoft have said, every single (recent) copy of Windows NT, Windows'95, and MSIE (and, presumably, other products like IIS and Outlook, which rely on them) ship with these CSP's, therefore every recent system comes with this security hole installed by default. In addition, the CryptExportKey() function is a standard CryptAPI function, which is described by Microsoft with the text "The CryptExportKey function is used to export cryptographic keys out of a cryptographic service provider in a secure manner" (obviously some new use of the term "secure" with which I wasn't previously familiar). There's nothing in there that says "Only the Microsoft CSP's support this" (some may not support it, but by Microsofts own admission the default used on any recent system does indeed exhibit this flaw). >Microsoft products do not "store" private key material using PKCS-12, contrary >to recent descriptions on the Internet. I was unfortunately somewhat unclear in my article, I've fixed up the online version at http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms.txt. To summarise, if you want to get at an exported key stored on disk, you can use the pre-4.0 key file/PKCS #12 key file flaws. If you want to get at the current users key, you can use the CryptExportKey() flaw. >The example of breaking a PKCS-12 data blob, which was given in discussion on >the Internet, is not an attack on the "weak" cryptography of PKCS-12. Rather, >it is simply a dictionary attack (long known and well understood in >cryptography), This statement is accurate. As Microsoft have said, dictionary attacks have been known to the computer industry for a long, long time (several decades). For example the Unix password encryption uses 25 iterations of DES to protect users passwords from dictionary attacks (this is rather inadequate now, but was appropriate more than two decades ago when it was introduced). If this is a well-known flaw which the entire industry has known about for decades, why are Microsoft's very latest "security" products so extremely vulnerable to it? As I mentioned in my writeup, I published an attack on the exact format used in older MS products more than 1 1/2 years ago, but Microsoft made no attempt to fix this problem at the time. It wasn't until I published the current writeup that they finally addressed it. >One statement by the original poster argues that Microsoft managed to design a >security format that actually makes it easier to break into the protected >data. As stated above, a number of well respected companies were involved >extensively in the design and review of PKCS-12 before it became a standard. The problem is that Microsoft ignored the other companies recommendations for increasing security. I'll refer people back to the original writeup for mention of the various security features which were added to PKCS #12 and subsequently ignored by Microsoft. PKCS #12 is just a basic modification of PFX, which was a purely Microsoft invention, and Microsofts implementation of PKCS #12 does indeed make it very easy to perform the attack I described (you'd have to read my writeup for the full technical details in which I describe each individual flaw which, as each is exploited in turn, make it progressively easier and easier to recover a users private key). In addition (as I mentioned in my original message), Microsoft use RC2/40 to encrypt the private keys, which means that no matter how good a password you choose, the default PKCS #12 format private key produced by MSIE can be recovered in a few days with fairly modest computing power. There already exists a Windows screen saver which will recover RC2/40 keys for S/MIME messages, and the prize of an RSA private key is a much higher motivating factor than the "Hello, how are you?" typically found in an S/MIME message. As Microsoft point out, Netscape can indeed handle RC2/40-encrypted files, however they usually use triple DES and not RC2/40 (they encrypt the private key components - the really valuable part of the PKCS #12 payload - with triple DES and the other odds and ends with RC2/40). Since Netscape also iterate the password and MAC processing, they aren't vulnerable to the attacks which the Microsoft software is vulnerable to, even though both are based on the same PKCS #12 standard. >Exploiting Internet Explorer > >One of the fundamental requirements to perform any possible cryptographic >attack discussed in the recent postings is the assumption that a malicious >entity could somehow access to data on a user's computer system, without the >permission or knowledge of the user. This is a large leap of faith. > >Users that are using Public Key Certificates today are generally sophisticated >and savvy users, Bwahahahahaha! Sorry, I guess I should explain that in more precise terms. Now I'm not trying to claim that the average Win95 user isn't as sophisticated and savvy as Microsoft seem to think, or that relying entirely on the sophistication of the average Win95 user for security is a dangerous move. However these statements do seem to completely ignore the reality of the situation. Let me go into the background of the weaknesses a bit further. When I tested the weaknesses, I asked some "guinea pig" users to send me their exported keys, with the promise that I'd destroy the keys and not keep any record of where the keys came from and so on. Because of this I can't give exact figures, however here are a few data points: - More than half the keys (I can't remember the exact figure) were in the older, pre-4.x format. This indicates that the majority of users (or at least of the crypto-using guinea pigs) are still running old versions of MSIE which contain a number of widely-publicised problems, including precisely the weaknesses required to run arbitrary code on the machine or read files off the machine. One of the respondents commented that the key was "the key I use with Outlook", I'm not sure what that says about the origins of the key. Another key was one used with IIS for a web site which runs an online commerce service that processes credit-card based orders. This must have been an older version of IIS since the key was in the pre-4.x format. - When I asked two of the people why they were still using an old version, the responses were "It came installed with the machine when we bought it" and "It does what I want, so I haven't upgraded". I expect most users of the older version would have a similar reason for using it. In a company of 20 people (some of whom participated in this test), only two were running 4.x. These people are all highly competent software developers (presumably this includes them in the group of "sophisticated and savvy users" which MS were referring to), however none of the remaining 18 wanted to risk installing MSIE 4 because of the extent with which it messed with their system, possibly jeopardising their development work. Therefore most of these "sophisticated and savvy users" were still running old, insecure versions of MSIE, and weren't going to upgrade any time soon. - For the two remaining 4.x users in the company, both are still using straight, unpatched 4.0 because they considered it painful enough to download all of 4.0 and they didn't want to bother with an upgrade just yet. This makes them vulnerable to the bug pointed out in the l0pht advisory. - When I informed one of the guinea pigs of the recovered password, his response was "Now I'll have to change my login password" (the others generally restricted themselves to some variation of "Oops"). This comment confirms that users do indeed sometimes use their login password to protect their private keys, so that a successful attack recovers not only their private keys but their login password as well. - One respondent commented that most of the code they downloaded from the net was unsigned, but they ran it anyway. This is probably typical of the average user. Although I've only been back for two days, I haven't yet managed to find anyone who has applied all the latest patches and kludges to their system which makes them immune to these problems. This includes at least one person who has a code signing key which could be used to sign malicious ActiveX controls. Therefore all of the guinea pigs could in theory have their private keys stolen. >Attacks against Authenticode signing keys > >[...] > >However, it is extremely unlikely anyone could be successful with a simplistic >strategy for stealing Authenticode signing keys and then using them. See my comments about about this. I could, right now, obtain at least one Authenticode signing key with which I could create a malicious ActiveX control. I'm sure that if I were serious about this I could obtain a number of others. >Second, anyone signing code using Authenticode technology is extremely >unlikely to leave their key material sitting on an end user machine routinely >used for browsing the Internet. I see no basis for this claim. Every developer I know uses the same machine for both code development and web browsing (in fact a number of users keep a copy of MSIE or Netscape permantly running on their machine so that they'll have something to do between compiles). Microsoft's statement seems to imply that users will be running two machines, one dedicated entirely to web browsing and the other to code signing. I find this extremely unlikely. >Attacks on Encrypted Key material > >There is some confusion over the algorithms and methods that Microsoft uses to >provide protection of encrypted key material in Internet Explorer when using >the standard Microsoft base CSPs. There were changes between Internet Explorer >3.0x and Internet Explorer 4.x specifically to address any possible concern. And the astounding thing was that, despite a complete rewrite of the code, the newer version offers no extra security at all, as my article points out. Both are equally weak, you just need to attack them in slightly different ways. >Key export attacks > >The original Internet posting raises concern about the CryptoAPI interface >CryptExportKey(). This function is fully documented and does indeed export >private key material in an encrypted format. The statement from Microsoft omits one important point here. Myself and another security researcher have been trying to tell Microsoft for more than four months (probably a lot longer, I didn't log the earlier mail) that this is a very serious security flaw. In all cases Microsoft's response was some variation of "We don't see this as a flaw". It wasn't until my warning was published that they finally addressed the problem, and even in this case (the program to set the CRYPT_USER_PROTECTED flag) it's only a quick hack to plaster over the cracks and allow them to declare the problem fixed. In fact it doesn't fix the problem at all. I'll post details in a fortnight or so when I've had time to test things, please don't ask me about this until then. >The presence of the CryptExportKey() function is to support functionality such >as migrating key material between machines for a user or creating a backup >copy of a key. It should be noted however, that many CSPs, including most >hardware based CSPs, do not allow exportable private keys and will return and >error in response to a CryptExportKey() request. However the CSP's installed by default on every recent system do allow the export. The fact that there may exist, somewhere, an implementation which doesn't exhibit this flaw really doesn't help the majority of users. >The posting also asserts that an ActiveX control could be downloaded from a >web page, simply ask for the current users key, ship the key off for >collection by an unscrupulous person, and then delete itself without a trace. > >If users run unsigned code, or code from an unknown origin, a number of >unpleasant things can happen. This could indeed occur if the key as been >marked exportable and the CRYPT_USER_PROTECTED flag is not set. Which was, until my warning, the automatic default action for Verisign, and is still the automatic default for many other CA's. This means that keys generated right up until a few days ago (and in some cases keys being generated right now) have, by default, no protection whatsoever. In addition I've just been sent mail to say that CRYPT_USER_PROTECTED still isn't the default with Verisign, you have to click a box asking for extra security or you get the usual default of no protection. To add to the confusion, a lot of documentation (including the Microsoft Developer Network (MSDN) online documentation on Microsofts web site) describes the CRYPT_USER_PROTECTED flag with "The Microsoft RSA Base Provider ignores this flag", which can cause programmers to leave it out when it is *essential* it is always included. Incidentally, MSDN also claims that Microsoft are "supporting" PFX, which is in direct contrast with the claims in their press release. >There was also discussion of 16 dialog boxes appearing to the user for their >password if the CRYPT_USER_PROTECTED flag is set. Certainly asking the user >too many times would be better than too few times, however in our tests, under >extreme (and uncommon cases), a user might be asked for their password at most >four times when a key is used with the Microsoft base CSPs. Perhaps the claim >came from an early beta release. The 16 dialog boxes problem was present in 4.0, and it's been confirmed as still being present in 4.01. This was apparently verified on Microsoft's own CryptoAPI mailing list (the claimed "beta" version was actually MSIE 4.0 final). >Microsoft is constantly working to improve the security of our products. Myself and another person had been trying to convince Microsoft for more than four months that things like CryptExportKey() are a major security hole. Their response each time has been some variation of "We don't see this as a problem". It simply wasn't possible to get them to acknowledge these flaws, therefore my posting of the details wasn't "irresponsible" (as some have claimed) but a necessity in order to get them fixed. When I pointed out several months ago that Microsoft were using, in their pre-4.x products, an exported key format which was identical to the one which I broke more than 1 1/2 years ago, their response was "What's the problem with this?". I would have liked to have included URL's for the CryptoAPI mailing list archives to prove that Microsoft were warned of these problems some time ago, but the CryptoAPI archive seems to be temporarily offline. Risks of a Private Key Compromise --------------------------------- One or two respondents have tried to play down the seriousness of a private key compromise, saying that I exaggerated the dangers in my original message. What I wanted to point out was how extremely valuable a users private key is, and how disappointingly little concern Microsoft seem to have for protecting this valuable resource. For example Garfinkel and Spaffords "Web Security and Commerce" (O'Reilly, 1997) contains the warning: "Today's PC's are no better at storing private keys once they have been generated. Even though both Navigator and Internet Explorer can store keys encrypted, they have to be decrypted to be used. All an attacker has to do is write a program that manages to get itself run on the users computer (for example by using [...] Microsoft's ActiveX technology), waits for the key to be decrypted, and then sends the key out over the network" (p.120). Including a function like CryptExportKey() (which hands over a users private key) makes this very attack possible. The potential damage which can be caused with a misappropriated private key is enormous. Consider the relative risks in the compromise of a logon password and a private key. With a logon password, the worst an attacker can do (apart from stealing possibly valuable data) is to trash the victims hard drive, which involves reinstalling the operating system (an action which many users are intimately familiar with). In contrast an attacker who obtains a private key can potentially drain the victims credit card, clean out their bank account (if the victim uses one of the emerging online banking services), sign documents in their name, and so on. The implications of that last point can be quite serious. Take for example the Utah digital signature act, which was used as a model by a number of other states who implemented or are implementing digital signature legislation. Under the Utah act, digitally signed documents are given the same evidentiary weight as notarised documents, and someone trying to overcome this has to provide "clear and convincing evidence" that the document is fraudulent, which is difficult since it bears a valid signature from the users key (this fact has been used in the past to criticise digital signature laws based on this act). In addition, under the Utah act and derived acts, anyone who loses their private key bears unlimited liability for the loss (in contrast, consumer liability for credit card loss is limited to $50). This leads to the spectre of a malicious attacker who has the ability to issue notarised documents in your name for which you carry unlimited liability. This is a lot more important than someone reformatting your hard drive, or stealing last months sales figures. Peter.

2 1