December 2003 - cypherpunks-legacy

A Legal Strategy
by Secret Squirrel 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Let's say you are James Joyce and you are writing "Ulysses" on your nice little Linux machine. Because you fear persecution, you use encrypted virtual disks. Because you are clever, you have ten such disks. One contains your drafts of "Ulysses", four contain harmless information, and five contain noise. The jack booted thugs kick down your door and drag you to jail. The Judge orders you to produce the pass phrases of all the disks or be penalized for contempt of court. Now, you are in an interesting situation. You can't give the passwords for half of the disks, but you are unable to prove this. This means you have nothing to gain by giving the pass phrase to the "Ulysses" disk - you will always be seen as holding out. Even if you convince the Judge that some of the disks are noise, you have no reason not to include the "Ulysses" disk in this set. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNF1945aWtjSmRH/5AQGEMQf/Rv6ZMLV/Jw9lnKa2p9QjDd3L3oukDfL7 X/WEA4MpNJ80AHLfL9yro58iElJe8hSN0Ld6T56Cusw32numtO10du553ACTzeWP 6ktMokhKfsHFbmzbGu2U/ajlymEU3CwcD8sBkEJlCJ6J1E57jTaPpaxn6dPjak9p EmSQD3LoI9C/soacZOJPbNoMu2WA9Xb+tQ+RDfwU2jkZnqjdjLt0WKz2GpiMA3EY fQ2p69U0nKICyS/r7l8hM5aVMihxuexY7w1BNCKVSKIjGO+K0Niqz/APj782hKfy 3O1LHOmxcqVtxOTIZ9c1P8mSYpN/E4My8vcen9bp8a5GBzkIeVdQTQ== =RpFf -----END PGP SIGNATURE-----

2 1

One Time Pads (Real Ones!)
by Mix 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One time pads are under rated, in my view. Not only are they secure forever, but the executive branch of the U.S. government says they are exportable. I've been thinking about how practical they are. One diskette holds about 150 messages. The people we trust tend to be people we communicate with a lot. An exchange of one box of diskettes should last a long time in most cases. The first 128 bits of the pad can be used as a key to identify it. This the recipient can figure out how to decode it by hunting through his or her key collection for the one that matches. When keys are exchanged, additional information can be exchanged and associated with each key. Length, for example. This means no length fields are needed because it can be recovered from the key itself. There are probably more examples. One time pads are self authenticating. For increased security, the use of a double one time pad is a good idea. Both correspondents generate key sets. The message is encrypted using one key from each key set. Again, no identifying information is needed, because the recipient can look for pairs of keys that work. If these key sets are exchanged through separate secure channels, they will be especially hard to compromise. Also, each user can be confident that the message is secure with regard to key material if they have generated the keys themselves. Keys should be destroyed immediately after use. This means that the only time the rubber hose attack is effective is during message transit. Key destruction is a hard problem, though, because it is difficult to be confident that the key has been completely erased from a disk. Use of diskettes improves the situation. Other media might be better, such as static memory. There is no good reason not to wrap one time pads in other encryption protocols. It is hard, maybe impossible for some algorithms, to crack a message when the contents have the appearance of noise. This means that it is hard to tell who is using one time pads and when they are doing it. Naturally, the user will send many messages which consist of noise, indistinguishable from a one time pad. This gives the user plausible deniability, especially if the practice is common. If the wrapper encryption protocol has not been compromised at the time of use, it has the pleasing result that it buys time. Should the message be recorded and filed on tape at Ft. Meade, and the encryption protocol broken ten years later, the user will have a very difficult time producing the key material. Key generation is an inadequately solved problem right now. There are chips which generate streams of random bits, but it is impossible to tell if they have been compromised. A home brew hardware based random number generator with a serial interface is probably the best way to go. The output of this device could be XORed with other source of randomness to increase confidence. One time pads seem practical to me. Comments? Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNF1/WZaWtjSmRH/5AQER3Af+M+T31s+VOdrCE61a0kbp0fe3Eyosoub2 YkAWZs48knTFgtAS0sv5IRrKparKaKdgAQISscBSuW5YXGi9WJCA2/3+2/+iwvrK 1tIoEDF+fYaq6/a2yiyI4PVZ8qPMpyLayZ3K89P8N8zzuQSMS6pB7yOf4waOufcF 6nAmcVG8/O4BddID15XiKbdc7QSpHKK2R3LlwrS4ZQBHyhYvC5Quo41SHNiWIGjO N6zMkBKuDXEpjmnX9O1LRelT7hEMX0ss6b4ZTmFw39NXwDwgFahP+C2/Zw+Kt0Je +/PNDJXWWQDWovVrCW2yKmpKeTPgxTJ1R4aEpt2CBwdQlMqVwpVrAg== =O5oZ -----END PGP SIGNATURE-----

3 2

Re: Remailer hating Nazis (was Re: The BIG Lie (Jesus Confesses))
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Anonymous <anon(a)anon.efga.org> wrote: >> > If so, then burn in hell, Nazi scum-sucking weasel! >> > >> Ditto for Paul Pomes and Gary Burnore. > >I'm familiar with the role of Gary Burnore <gburnore(a)netcom.com> and that >of his DataBasix associates Belinda Bryan <eridani(a)ix.netcom.com> and Billy >McClatchie (aka "Wotan") <wmcclatc(a)primenet.com> in getting the Mailmasher >and Huge Cajones remailers shut down. Jeff Burchell posted a public >expose' of their harassment to Usenet back in June, apparently catching the >DataBasix folks off-guard. But what's the story with Paul Pomes? What has >he done? Paul Pomes was complaining about Jeff Burchell's huge cajones remailer to Jeff Burchell's upstream and employers about the same time the rest of the Databasix gang was doing it. Paul Pomes appears to be a part of the Databasix gang. >Perhaps the best thing that can be done with people like Burnore is to put >together an FAQ about their tactics, similar to what his "fans" have done >for the "Rev." Steve Winter. Then when Burnore tries to stir up trouble by >first fabricating anonymous "abuse" and then demanding that it either be >stopped and the culprit(s) identified (knowing in advance that's >impossible), or else that the remailer be shut down, someone can forward >that FAQ to the remailer's upstream provider, or whoever is being pressured >to pull the plug. And if Paul Pomes engages in the same dishonest tactics, >that needs to be done with him as well. Gary Burnore had a mongo page at http://www.netscum.net/burnorg0.html. So did Paul Pomes, Belinda Bryan, and the rest of the Databasix gang. Too bad it's down for now, but it'll be back.

2 1

spoofing as performance art
by Zooko Journeyman 17 Dec '03

17 Dec '03

Tim C. May allegedly typed something like: > > There's something about the Cypherpunks list that causes some people to > decide it would be a kewl act of performance art to disrupt it, distract > it, stalk it, and mailbomb it. > > And complaining never helps...it only stimulates their performance art juices. Hey, the jokes from Anonymous(ses) and Dmitri M. Vulis are the only reason I _read_ cpunks anymore! Oh yeah-- and that hilarious spoof about PGP, Inc. putting GAK-friendly features into their product. It's so funny that people fall for that old "PGP is in with the government" gag every time it comes around. Also, I'm looking for a job, I think. Or else a good university to go to. But mostly I'm just reading the hilarious Anonymous posts and spoofs. Regards, Zooko

2 1

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

shamrock(a)cypherpunks.to wrote: > I have watched this silly debate for some time now. PGP pulled an awsome > hack on corporate America, bringing strong crypto to thousands of > corporate drones, while Cypherpunks, the crypto elite, seems incapable of > reponding with anything other than to engage in frenzied mutual > masturbation fueld by GAK fantasies. > > This is sad. Very sad. Lucky, did you actually read anything I wrote, or is this merely another knee-jerk response? If you can explain the following, then I'll accept that my fears are merely fantasies: 1. How PGP can prevent CMR being converted into GMR; their system builds all the code required to support mandatory encryption to FBI and NSA keys into every copy of PGP. 2. Why PGP prefer this option to almost identical systems which do not allow GMR. They don't even seem to be interested in discussing alternatives. These are the important questions we should be asking and noone on the pro-PGP side seems interested in answering them. Why? Frankly, this issue seems to be the most important since Clipper, and I'm amazed that so many cypherpunks are so dazzled by PGP's name that they refuse to sit and think these issues through. Mark

4 3

InfoWar Epilogue 6 / The Geigerburg Text
by Bubba Rom Dos 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger <tm(a)dev.null> Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * Bubba Rom Dos ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- WORK AND NOT WORK Looking back over the events of my life since I wrote Witness and the experience of the Institute Summer School of 1962; it becomes more than ever clear to me that our understanding of man turns upon the problem of Reality. If the aim of existence is Self-Realization and if this is identical with God-Realization, then the connecting link that makes them one and the same is to be found in the meaning of the word 'Reality'. If all were equally real, then realization means the process of transformation that leads from the unreality or imperfect reality towards Reality in the fullest sense. The theme of this book is that there are both degrees and distinctive modes of Reality, and that there is a process that leads from the Unreal to the Real. This, in its turn, requires that there should be a means of effecting the transformation. This 'means' is what we call by the name of WORK. In the book there are few references to Work, either in the absolute sense as the process of universal realization, or in the relative sense of personal transformation. This is because those who participated in the discussions started from the premise that Work is a reality in both senses: absolute and relative. We were not concerned to discuss the authenticity of the process of transformation, but to understand it better. The obligation to work for Reality is the Categorical Imperative from which life derives its meaning. It is, as Kant showed in the Grundlage, the ultimate, irreducible, moral certainty from which are derived our notions of God, Immortality and Ethic. I have never been satisfied, nor I believe was Kant himself, with the Critique of Practical Reason. It does not convey the sense of urgency which we experience in contemplating life based on Work and life without Work. I was impelled to write this Epilogue by the impact of a vision or vivid dream that woke me from sleep a few nights ago. I found myself in some remote, antipodean place where people were living ordinary lives. I recognized not a few of them as people I knew or had read about and noticed with a sense of wonder rather than surprise that some were still living and others were dead. They did not notice this difference because in any case they were all ghosts. But they were all aware of being ghosts and wanted to turn into real people. From time to time, an aeroplane arrived with others who joined them and among the new arrivals were both living ghosts and dead ghosts. I was made aware that all was well with these people because eventually they would cease to be ghosts. Then I found myself back again nearer home; but this time I was taken to some kind of underground place. Here also were people more or less happily occupied with their daily lives and some of them were now living and others were dead. These also were ghosts but these ghosts were neither able to distinguish between life and death, nor did they understand that they were no more than ghosts. I knew that I must tell them about their condition and about the other place where ghosts were being transformed into real beings. When I spoke to them of aeroplanes that could take them over, they said that they would go only if an aeroplane would come back and assure them that there was a place for them over there. I remember very clearly explaining that once an aeroplane had gone over, it would never return. This seemed to them illogical and unreasonable and they took no more notice of what I said. Then I found myself in a kind of lift being taken back to the surface. I looked at the lift-man and said to myself, "If I were not colour blind I should see that his face is grey". Somehow, this observation brought home to me the terror of being a ghost and immense pity filled me for these people who had lost the possibility of becoming real. As I began to wake up, I said to myself: "What does it really matter that they are only ghosts? They are good, decent people, living good, decent lives and if they are satisfied with unreality why should they be disturbed? Their ghostly existence is also necessary." At that moment I awakened completely and saw, in a flash, the infinite significance of Work. It is the imperative of all imperatives, the source from which all life takes its meaning, the way to Reality and even Reality itself. Work takes many forms: but all forms have one common character: the Will to Reality. Whether active or passive, whether in solitude or in society, work is always one and the same: it is the dedication of the will to the realization of Reality. This dedication carries with it the obligation to share understanding with others and to serve the Work in its universal significance. That is why those who have seen the difference between ghost-life and real-life are compelled to speak of what they have seen-even to those who do not wish to hear. I am more than ever aware of the imperfections and even the errors in what I have written. I am ashamed to offer it as a "Spiritual Psychology" to those who are seeking for the Reality that is Work. Let it be taken as an essay and an attempt to share an understanding that is still in the process of being born. J.G. Bennett. January, 1964. {Excerpt from "A Spiritual Psychology" by J.G. Bennett} ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- Bubba Rom Dos "He who shits on the road, will meet flies upon his return." What is InfoWar? InfoWar is the voice that tells you that you can shit on the road, and not meet flies upon your return, if you spray the area with Agent Orange. InfoWar is the voice that tells you that you can spray the area with Agent Orange and not suffer any consequences to your own health, because you don't live here. InfoWar is the voice that tells you the people who do live here are Communists who need to be killed, with the help of Agent Orange, and people who need to be saved from both the Communists and the flies, with the help of Agent Orange. InfoWar is when the evening movie at the PX is 'Clockwork Orange' and your head starts pounding, as a ferocious battle begins between your awakened prenascence and the thundering voice which is screaming, "It is not synchronicityit is only a coincidence." InfoWar is when you can look at a picture of a napalm-burned child and tell by the color of their skin whether or not they are the enemy. I am not arguing for or against this or that battle, this or that war. I am only pointing out that anyone who returns from war the same as when they left for war, or with their sanity completely intact, in need of no healing Well, let me just say that they already live in a Virtual Reality within which the inhabitants of that reality do not realize that they are ghosts. ---------------------------------------------------------------------------- InfoWar is when you don't turn on the gasyou only put them in the ovens. InfoWar is when you don't put them in the ovensyou only turn on the gas. InfoWar is when you don't drop the atomic bomb, you only design it. InfoWar is when you have two types of nuclear bombs and you convince yourself that they both need to be dropped, not for testing purposes, but to end the war earlier, and to save lives. InfoWar is going to sleep praying that your Generals and Nuclear Physicists don't wake you in the morning to tell you that they have developed a third type of nuclear bomb, which must be dropped in order to shorten the war and save livesor a fourth, or a fifth. InfoWar is convincing you to develop nuclear software without a backdoor that you can use to prevent it from raining destruction on the innocent, because you are just a programmer, an engineer, a designer, a grunt, and these types of decisions are to be made by those who are trained to know when it is right for millions upon millions of people to die, and for the earth to be scorched beyond repair. InfoWar is convincing you to design surveillance software without a mechanism available to defeat it if it falls into the hands of the Destroyer. InfoWar is thinking that you are an island, and that your island only produces the tools and weapons that can be used for great Good or great Evil-thinking that those on other islands bear the responsibility for how those tools and weapons are used. ---------------------------------------------------------------------------- "If ye love wealth greater than liberty, the tranquillity of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams ---------------------------------------------------------------------------- Y2K not a 'bug'-it is not a 'design flaw.' It is a collaboration, in preparation for Apple has not collapsed 'in spite of' being Y2K compliant, but 'because' of it. The Congressional IRS investigation is taking place despite the fact that the agency is not doing anything that it hasn't been doing for years and years. When heads roll (out), new heads roll in. The Secret Lab Players are being given leading stage roles, in positions such as at the FBI Crime Lab, in preparation for What was CAMP (Campaign Against Marihuana Production) all about? It was a male bonding ritual between the Federal, State, regional and local law enforcement agencies. It was laying the groundwork to shipping tens of thousands of federal assault rifles to local and regional LEA's in preparation for Full featured scaleable Telemetry systems for power reticulation control and a host of other applications. Exciting innovations in Telemetry Systems. Designed and manufactured to your exact needs. http://www.tora.net/telemetry/telemetry.html, 1873 bytes, 11Aug97 "The average person's views of love are no longer based upon their relationship with each other, but upon what they see on TV." - President of Video Valentine "That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it." -News of the Weird "The '[ANY]' program cannot be 'fixed,' because it's working precisely as the politicians want it to." -Vin Suprynowicz <vin(a)lvrj.com> Assistant Editorial Page Editor of the Las Vegas Review-Journal ---------------------------------------------------------------------------- Subject: Check the Archives From: Ayn Rand <ar(a)dev.null> To: Tim May <tcmay(a)got.net> Tim May wrote: >There's something wrong when I'm a felon under an increasing number of laws. Atlas Shrugged wrote: >"You'd better get it straight that it's not a bunch of boy scouts you're >up against -- then you'll know that this is not the age for beautiful >gestures. We're after power and we mean it. Your fellows were pikers, >but we know the real trick, and you'd better get wise to it. There's no >way to rule innocent men. The only power any government has is the power >to crack down on criminals. Well, when there aren't enough criminals, >one makes them. Once declares so many things to be a crime that it >becomes impossible for men to live without breaking laws. Who wants a >nation of law-abiding citizens? What's there in that for anyone? But >just pass the kind of laws that can neither be observed nor enforced nor >objectively interpreted -- and you create a nation of law-breakers---and >then you cash in on guilt. Now that's the system...that's the game, and >once you understand it, you'll be easier to deal with." ---------------------------------------------------------------------------- Everything since the Big Bang has been plagiarism. Will the future plagiarize Hitler or Ghandi? One Free Will, one vote ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ----------------------------------------------------------------------------

1 0

InfoWar Epilogue 6 (Part III of 'The True Story of the InterNet')
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

[news] Pentagon computers broken into over 250 times
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Pentagon computers broken into over 250 times More than 250 U.S. Defense Department computer systems were broken into last year and the number of attempted break-ins was projected to double this year, a U.S. intelligence official said. The comments that Air Force Lt. Gen. Kenneth Minihan, director of the National Security Agency (NSA), made Saturday at an intelligence convention were released Thursday. Urging stepped-up awareness of cyber security issues, Minihan said the United States built its information infrastructure on a "poor foundation -- and we will eventually pay for it." See http://www.infobeat.com/stories/cgi/story.cgi?id=5585016-7b1 -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

1 0

Re: spoofing as performance art
by John Young 17 Dec '03

17 Dec '03

Indeed, it is hard to tell the difference between spoofing and grave pronouncements on threats to one's own interests under guise of national secuirty and/or personal privacy, for the truthful lying that accompanies each performance are identical. Spoofing has the ethical and humorous edge, however, in that it gives clues to its origin as entertainment -- let's us in on the joke -- while the seriously dramatic performer aims at dominating us with profundity, wisdom, righteousness, conviction and disdain for disbelievers in the blind faith of the performer in the importance of her responsibility to hector and lecture us into craven servility. All leaders suffer over self-importance and thereby demand ridicule to save us from them. Here's a Bronx cheer to the non-spoofers, who don't get that the joke's on them. Thank Zeus and Juno, as far as I've read here, cypherpunks has no implacably non-spoofers posting, though a few of us are pretty good at behaving seriously briefly, spoofing seriousness. And PGP is doing a fine sanctimonious act worthy of high ridicule, it's just conforming to what businesses and governments do to survive the disloyalty of employees and citizens who don't believe once-trusted leaders inevitably corrupted by power, fame and chance to forever escape work (corrupt me, do). They become parodies of themselves. Anonymous got it right: Bosses and Government, no difference, same liars and snoopers and non-spoofers who just don't get what's wrong with putting their interests before ours, we gobbling voracious maggots.

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

>Mark, just remove the self signature on the user key. The message >recovery key packet goes away! That's all you have to do. Is that >so tough? This big threat, the dangerous CMR key, turns out to take >two seconds of user actions to be destroyed. Something this easy to >turn off will never be good enough for GAK. Gosh, so I can just remove that packet and all my mail will bounce. What fun. This seems to be one of the mantras which pro-PGP folks are chanting: 'But there are easy ways to work around it, just modify your copy of PGP and it will all work fine'. Indeed there are; I have no doubt that there is no way that anyone could entirely prevent me from communicating privately with a few people. But what happens when I want to check whether the local Blockbuster have a copy of 'Debbie does Fort Meade'; will they have modified their software so I can send mail to them without GMR? Of course not. So 99.9% of my mail will still be visible to the government. >People say, "Oh, but then the government will make everybody run the >policy enforcer and reject any mail not encryped to the government." >First, if they were going to do this, they could do it with old versions >of PGP too. Multiple recipients have been around practically forever. *IT'S NOT THE MULTIPLE RECIPIENTS THAT ARE THE PROBLEM, IT'S BUILDING THE 'MANDATORY VOLUNTARY' MULTIPLE ENCRYPTION INTO EVERY COPY OF PGP WHICH IS THE PROBLEM* This is the other mantra that PGP supporters chant 'Oh, but it could all be done with PGP 2.6.2 and a few scripts'. Of course it could, but only a few people would choose to use those filters. If the government were to set up SMTP enforcers in various choke-points around the Net (and I'm aware of the performance issues) then anyone using PGP would have to encrypt to the 'voluntary' FBI key or lose their mail. The Feds aren't going to issue every PGP user with scripts to do it, but if you build this facility into the software they can use it. >Second, it's a ridiculous idea which ignores how email works. More and >more people are running systems at home which could send and receive >SMTP mail. The trend is towards home servers which support the multiple >home computers people will have in the next decade. There's no way to >make those people run filters! Duh, of course they won't. But that email will go out over a TCP link to the SMTP port, where it can be checked on route by sniffers or proxies. How did the Chinese and Singaporeans restrict Net access? By blocking connections in the routers and Web proxies. This is the way to do it, not to force everyone to run an SMTP enforcer on their personal machine. >It has to be suggested, because it's the only >way this incredibly stupid scenario could be made to work. I can only >assume that people are blinded by emotions or they wouldn't suggest such >a bizarre idea. Yes, I must be, mustn't I. I mean, the Feds would never pass a law mandating that all Internet providers must provide SMTP proxies which enforce the GMR and block other SMTP connections; after all, they never passed a law mandating that telephone companies must provide wiretap access. Oh, they did, didn't they? >If the only >way the government can enforce GAK is by making it illegal for people to >receive email through paths which don't pass through government filters >we can all rest easy, because it will never happen. Yes, which is why they won't do it that way. In my last job, any SMTP access from my machine to any other on the Net was automatically routed to our local SMTP server which acted as a proxy. Why can't the Feds do this on the US Internet? >Or superencrypt to the real end user, like you suggested in your scheme. >Why is this OK as a privacy workaround for your idea but it doesn't >count for PGP? Firstly, that's not a "privacy workaround" in my system, it's to prevent traffic analysis. Secondly, again it's a workaround which will only be available to a small number of people. >Ignoring all the considerations above about what a stupid idea this is, >the fact is that a simple filter like this is incredibly easy to write. As I said before, the SMTP filter is not the evil aspect of your design, it's the enforced encryption to multiple recipients. >The fact is, nobody has come up with a scenario where PGP's CMR feature >can be turned into GAK in any practical way. I just have. Now try to explain it away. Mark

2 1

Save Money...Own your own Cable Descrambler!
by CableUs 17 Dec '03

17 Dec '03

Don't let your cable company force you to pay OUTRAGEOUS equipment costs to receive basic/premium channels. We are Midwest Electronics, Inc. America's LARGEST PROVIDER of cable converters and descramblers and we feel you shouldn't have to pay TOO MUCH any more! The Communications Act of 1996 approved by Congress and signed by President Clinton in February 1996 now allows cable subscribers to purchase cable converters and descramblers from independent vendors. We have 18 years experience in the cable industry. We carry most makes and models of cable converters and descramblers including Jerrold, Scientific Atlanta, Tocom, Zenith, Pioneer, Panasonic, Novavision and More. Our prices start at just $150.00. *** SPECIAL INTERNET OFFER *** Call us today at (800) 648-3030 M-F 8:00-5:00 C.S.T. with the model number of your cable company's converter/descrambler, usually found on top of your television, and receive a FREE Battery Charger with any combination unit purchase. *** ONLY THOSE NOTIFIED BY ELECTRONIC MAIL ARE ELIGIBLE *** Our SPECIAL Internet Promotion ends November 15, 1997. When calling please provide us with your e-mail address in order to receive your FREE BATTERY CHARGER!!! If are unable to take advantage of our offer at this time, but would like to receive our FREE CATALOG reply to us via e-mail at cableus(a)internetmedia.com with your mailing name or visit our WEBSITE at: http://www.midwestcable.com http://www.midwestcable.com More about us: * 30-Day Money Back Guarantee! * We Service What We Sell! * Personal Assistance Hotline! Note: No sales to TIME-WARNER or PARAGON cable franchise areas. ------------------------------------------------------------------------- If you would like to continue receiving updates on prices and other information from Midwest Electronics you may REPLY and type SUBSCRIBE in the SUBJECT line (Please be sure to include name, address and phone for your FREE CATALOG!). Otherwise, your address will be promptly removed from our lists and no further attempts will be made to contact you. -------------------------------------------------------------------------

1 0

Re: ADMIN: lost messages (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Attila T. Hun" <attila(a)hun.org> > Date: Fri, 24 Oct 97 04:43:22 +0000 > Subject: Re: ADMIN: lost messages > Jim Choate <ravage(a)ssz.com> was purported to have > expostulated to perpetuate an opinion: > a:> Any clues? > > a:Things get lost on occassion? > pure bullshit and ego gratification. [much deleted] Put up or shut up junior. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

update.342 (fwd) [AIP]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 22 Oct 97 10:14:42 EDT > From: physnews(a)aip.org (AIP listserver) > Subject: update.342 > > PHYSICS NEWS UPDATE > The American Institute of Physics Bulletin of Physics News > Number 342 October 22, 1997 by Phillip F. Schewe and Ben > Stein > > ONE OF THE MOST CONVECTIVE FLUIDS EVER > OBSERVED IN THE LABORATORY has been created by [body deleted] > HIGH-PRECISION COSMOLOGY [body deleted] > SEVEN YEARS OF PHYSICS---the entire run of Physics News > Updates---is now available in searchable form on the AIP Website > at this address: www.aip.org/physnews/update. Just type in a term > or expression and up come references to items in past Updates. For > example: searching for "leptoquark" hauls up 2 items; "steven chu" > finds 3 hits; "DNA" results in 13. All past Updates can be viewed > by going to the archives. See also Physics News Graphics > (www.aip.org/physnews/graphics) our growing archive of physics > figures, most of which accompany Update items. Subscription > reminder: to add or delete your name from the distribution list, > follow these steps---send a message to listserv(a)aip.org, leave the > "subject" blank, and in the letter itself specify either the expression > add physnews or delete physnews. >

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

whgiii(a)invweb.net wrote: > No their system does not. For what the FBI and NSA want much more needs to > be done. Really? Read the message I sent after that one. Let's suppose it's 2007, PGP have 99% of the crypto market. CMR compatibility is incorporated into all their products. The FBI announce that from today all Internet providers must support PGP SMTP enforcers on all mail passing across their links, and block all other SMTP connections. Regardless of whether your mail is spooled on your ISP's hard disk, it will always pass through their link. All encrypted mail must now be encrypted to the FBI's key as well as the end user's key or it will bounce. So, tell me why "much more needs to be done". Tell me again why this can't be implemented. The only reason it *can* be implemented is that PGP build the feature into their software. > Not to mention that *ANY* crypto system can be turned into GAK if > the FBI & NSA get congress to pass the laws that they want. Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't care that any Perl hacker can write a script which builds CMR into PGP 2.6.2, because those scripts are restricted to those who wish to use them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!! How hard is this to grasp? > What PGP Inc. did was provide what their *customers* , you know the ones > that pay their bills and keep them in business, wanted in a timely fashion > with little modification to their current code while circumventing some of > the more draconian requests. Really? Did their customers ask specifically for PGP's flawed CMR implementation, or did they actually say things like 'Well, we want to be able to recover mail if someone dies or leaves the company'? If it's the latter, don't you think that PGP should take responsibility for implementing it in such a GAK-friendly way? You seem be repeating the other pro-PGP mantra 'oh, you're not thinking of the company's point of view'. I certainly am, which is why I want to see that they get the best, most secure system without any GAK-friendly features. Here's a quick example of how cool CMR is... let's suppose that loser(a)foo-bah.com upsets a customer and is working for a CMR corporation. Mr Irate Customer downloads some of that kiddie porn that we're told is all over the Net, and encrypts it to loser(a)foo-bah.com, but doesn't encrypt it to the company key. Mr Irate Customer mails hundreds of these images to loser(a)foo-bah.com. Their system bounces them. The security personnel at foo-bah.com notice all these bounces and snarf some of the messages. The security personell take these messages to Mr Loser, and force him to decrypt them. Shock, horror, what a hideous, insane pervert Mr Loser must be to be receiving all these messages. Mr Loser is handed over to the cops and taken away. He might not go to jail, but he'll lose his job. With a more rational implementation Mr Loser would receive the messages and see that they're obscene, and immediately report them to the security personnel who could track down the sender. But when the security personnel find them first, they immediately assume that Mr Loser asked for them. Now, if you want to be able to get people sacked, this is cool. If you work for a company with CMR, this is really bad. It is also unneccesary. > >These are the important questions we should be asking and noone on the > >pro-PGP side seems interested in answering them. Why? > > They have been answered time and time again, you just have not been > interested in listening. They have not. All we've heard are 'oh, don't worry, it can't happen, be happy' assurances with no basis in fact. Is it any wonder we aren't listening? > If this is such a life and death issue why don't you and some of the other > Cypherpunks Philosopher Kings get off your armchair quarterbacking write, > test, debug, and *market* your superior system?? Duh, because PGP has name recognition, and because by the time it was finished they'd already have a large part of the market. But note: I'll be very surprised if PGP CMR gets into the OpenPGP spec. Which means that any other compliant implementation of PGP will not be compatible with CMR. > Perhaps because the majority of the "PGP Inc is evil" crowd > here couldn't make a buck in the business world if their lives depended on > it. Oh sure, ad hominem, ad hominem. What the hell do you think I do all day? Why the hell do you think I'm spending so much time trying to show people what CMR's problems are when I could be making money? > I also find it interesting how there is "much weeping gnashing of teeth" > over PGP 5.5 , which does nothing that couldn't be done with 2.6, while > Netscape, RSA and the S/MIME crowd put weak crypto on every desktop?? Better weak crypto than GAK. Key-lengths can be increased, government surveillance infrastructure cannot easily be removed. Mark

6 5

Re: CMR versus GAK? (fwd) > Right to monitor
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: lutz(a)taranis.iks-jena.de (Lutz Donnerhacke) > Subject: Re: CMR versus GAK? > Date: 24 Oct 1997 13:01:12 GMT > * William H. Geiger III wrote: > >documents. This is the distinction between corporate access to plain text > >and GAK. The company *owns* the documents. They have a right to read them > >any time they want. If you don't want your *private* corrospondance to be > > The company *owns* all telephon calls mad from an to there office. So they > have a right to wiretrap and record all phone calls you does from the > company. If you don't want your *private* corrospondance be wiretraped and > recorded, prevent every phone call in private issues from the company. > Forbit your insurance agency to call you in the company, deny the school > attended by your children to phone you at work, if your childen is ill, ... It occurs to me that this entire question is really of much larger social import: - do babysitters in your home have an inherent right to not be monitored in case they harm the child? - do operators of vehicles on public roads have an inherent right to privacy about the vehicle? - do businesses have the right to monitor the uses that their systems are put to? - do public officials have an inherent right to privacy about their actions related to their office? etc. ad nausium... These various issues can be broken down into two simple questions that once answered genericaly can be applied to the specific cases. The bottem line is: Does the owner of a resource have an inherent right to control that resource and if so what are the boundaries? Does the user of a resource have rights outside the purvue of the owner of that resource and if so what are the boundaries? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Internet Child Pornographers Convicted [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > CNN logo > Navigation > > Infoseek/Big Yellow > > > Pathfinder/Warner Bros > > > > > Main banner AST. Working For Your Business. rule > > INTERNET CHILD PORNOGRAPHERS GET LONG JAIL TERMS > > October 23, 1997 > Web posted at: 3:24 p.m. EDT (1924 GMT) > > SAN JOSE, California (Reuters) -- Three members of an international > child pornography ring that used the Internet to transmit pictures > of children were sentenced to jail. > > The men were jailed for their part in a wide-ranging, Internet-based > conspiracy in which several children, aged 10 or younger, were used > in sexually explicit acts to produce pornographic pictures and > videotapes, the U.S. Attorney's office said. > > U.S. District Judge James Ware on Wednesday sentenced the three > members of the "Orchid Club" in a San Jose courtroom after a long > hearing that included poignant personal statements by the victims. > > The U.S. Attorney's office in San Jose said Ronald Riva, 38, of > Greenfield, California, was sentenced to 30 years in prison; David > Tank, 35, of Cheney, Washington, to 19 years and 7 months; and > Christopher Saemisch, 38, of Lawrence, Kansas, to 11 years. > > Copyright 1997 Reuters Limited. All rights reserved. > > > rule > > Related stories: > * Officials focus on Internet use in sex crimes - October 8, 1997 > * FBI: Internet pedophiles a growing threat - April 8, 1997 > * FBI cracks down on child pornography on the Internet - April 7, > 1997 > * 12 arrested in computer pornography sweep - September 14, 1995 > > Related sites: > > Note: Pages will open in a new browser window > * Crime on the Superhighway > * Child Safety on the Information Highway > > > > External sites are not endorsed by CNN Interactive. > > > _________________________________________________________________ > > Infoseek search ____________________ ____ ____ > > _________________________________________________________________ > > > rule Message Boards Sound off on our > message boards > > You said it... [INLINE] AST. Working For Your Business. rule > To the top > > © 1997 Cable News Network, Inc. > All Rights Reserved. > > Terms under which this service is provided to you. >

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

aba(a)dcs.ex.ac.uk wrote: > We didn't say: "don't have disaster recovery for stored data." (Well > I didn't and I don't think Mark did either). Yep. While there are much better options, I think PGP's CMR would be a tolerable short-term solution for stored data. The problem is that it's not for stored data, it's for email (or so 'Commerical MESSAGE Recovery') would imply. Note that solely using CMR for stored data would not require that the CMR 'feature' be built into freeware or personal versions of PGP, but only into the corporate version. That in itself would be a big win. Mark

2 1

Universal Piracy Service
by Dan Fabulich 17 Dec '03

17 Dec '03

While browsing I came across an announcement for the Eternity Service which mentioned that Eric Hughes gave a talk at DEFCON IV regarding a "Universal Piracy Network," but I couldn't find anything using web searches. Does someone have more information on this? -ACCEPT NO IMITATIONS-

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Kent Crispin wrote: >Words fail me. This is completely idiotic. Indeed. It's just as idiotic as people being killed for receiving encrypted mail in Iraq. It is, however, just as possible, and anyone who believes the contrary obviously hasn't worked for a big company before; I've seen them do far, far, more idiotic things in the past. Mark

2 1

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

>Gee, Mark, I thought it was the SMTP filter that did the enforcing. >Maybe if PGP didn't call it "CMR" but instead called it something >neutral like the "key link field". Duh, without the 'mandatory voluntary' encryption to multiple keys, the enforcer couldn't work. Sure, the Feds could say 'encrypt to the FBI key or else', but users wouldn't be able to do so automatically without getting scripts to do so and the revolt would be too large for even the FBI to handle. It must be done automatically in the software, or it won't work. >Let's see, your scenario involves putting super sniffers at strategic >positions throughout the net, and passing laws that not only supports >this, but makes it illegal to go around them. I suggest that if such >laws are passed PGP's software is the least of your problems. How is this significantly different from mandatory wiretap access laws which already exist? Since it only requires action on the part of Internet providers, it's not going to raise the kind of outcry that other more widespread laws would create. >To make it plain, Mark, I "explain it away" this way: fundametally, >your scenario assumes what it is trying to prove -- you assume that >incredibly draconian laws are in place, Incredibly draconian? In what sense? Having to set a bit in your generated PGP keys? It certainly would be draconian if the FBI passed such a law today and required everyone to dump their software in favor of new, GMR-enabled software, but all new copies of PGP are already GMR-enabled. In fact, the FBI could probably stage a public relations coup by giving away free copies of PGP to anyone who asked. Draconian would be coming around to your house and taking your keys by force. Draconian is not merely enabling an option which your software currently supports. The whole point of not wanting PGP to ship this system is that it would allow the FBI to snoop *without* truly draconian laws. Without the current CMR system the FBI would have to force everyone to change to new software; deployment wins. As I said, 'don't worry, it won't happen, be happy'. Nothing new. Mark

1 0

Forgery
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Forgery is the sincerest form of plagiarism.

1 0

IW resources
by Steve Schear 17 Dec '03

17 Dec '03

I was cleaning up my HD when I came across a 43 page PowerPoint presentation by Carlo Kopp called "The E-bomb - A Weapon of Electrical Mass Destruction." It contains a good amount of technology, use and threat assessment data for this sort of EW device. Very professional. It was given at IWC-V 1996. A good candidate for amateur experimentation ;-) A little alta-vista search brought up Kopp's home page (with links to the above paper) and a wealth of related material, in particular http://www.au.af.mil/au/2025, the Austrailian Air Forces Year 2025 look in to the future, with a link to http://www.xp.hq.af.mil/xpx, the US Air Force's Strategic Planning Directorate. Very good IW reading. --Steve

1 0

RE: PGP Employee on MKR
by Fisher Mark 17 Dec '03

17 Dec '03

>> Not to mention that *ANY* crypto system can be turned into GAK if >> the FBI & NSA get congress to pass the laws that they want. > >Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't >care that any Perl hacker can write a script which builds CMR into PGP >2.6.2, because those scripts are restricted to those who wish to use >them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!! But the changes to add GAK/GMR/CMR to PGP (or any other crypto product that permits multiple recipients) are close to trivial. Don't be fooled into thinking that if PGP takes this "feature" out (can't be a bug -- it's documented :) that that will make it a lot harder to add that feature back in once the appropriate laws are passed. Still, in retrospect, PGP's engineers and scientists should have thought about all the security implications of CMR -- they might have implemented CDR to begin with. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

2 1

The spoofers have gotten more sophistocated!
by vcarlos35＠juno.com 17 Dec '03

17 Dec '03

The people that have been spoofing Jason Bobier, Philip Zimmerman, and Randall Framer have recently become more sophistocated in their techniques. They started with barely disguised headers and moved to equally lame PGP signed messages (that nobody in their right mind would accept, since the public keys have NO TRUSTED INTRODUCERS). Next, they progressed to faking the server-bounce messages to avoid giveaway headers. For example, they did a very good forgery of a email message supposedly coming from PGP, even included the "shival.pgp.com" and "fusebox.pgp.com" portions with correct IP addresses and all. I have a feeling this problem will only get worse....

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

whgiii(a)invweb.net wrote: > There is a simple solution to that don't work for one if you don't like > their policies. I agree; that's why I don't. But I see an inconsistency here. PGP keep telling us that CMR isn't so bad because you can work around it, or superencrypt, or otherwise avoid the company's right to snoop on all communications. Yet you, who believe in this right, support CMR, which can be used to defeat that right, over simple escrow of employee's corporate communication keys. Why? Again, I'm not saying that the companies have no such right. Personally I'd rather escrow my corporate key than see widespread CMR in its current form. Mark

2 1