December 2003 - cypherpunks-legacy

commercial data recovery
by Zooko Journeyman 17 Dec '03

17 Dec '03

[Note-- I am not subscribed to ietf-open-pgp at this time. My apologies if this submission from a non-subscriber is unwanted. I will be brief. --Zooko] Adam, I applaud your effort to steer discourse toward productive work re: GAK, CMR, CDR. I haven't thought about your idea enough to have a definite opinion, but at first blush it seems a promising strategy to design high-security and forward-secrecy for communication but recovery/sharing features for stored data. I wonder if it is too much early-days to start talking about advanced protocols e.g. secret-splitting in IETF-Open-PGP? Probably so. Better just punch out a standard with current tech... Hm. What about the idea of storing your data remotely (for cost-efficiency, safety, etc.) using encryption to maintain your privacy? In that case, the distinction between comms and storage keys is blurred. A company may choose to e.g. store all long-term data at Zooko's Backup Server, encrypted in such a way that some combination of corporate keys (controlled by individual employees and/or departments) is necessary to decrypt each package of data. This would open the door, as you fear, for a government to mandate that _its_ key be added to each set, with authority to open any package even without the cooperation of any corporate keys. I'm not sure how to weigh the relative risks and benefits. I (ever so humbly) think that Zooko's Backup Server would be a great value for businesses, and that part of that value would be the ability to make data unlockable by various keys, both for administrative/internal security purposes and for robustness against accidents and saboteurs. Zooko's Backup Server can be physically located in a country free of such intrusive organizations, but of course it is the intrusive organizations of the _client's_ country that become important with that kind of protocol... Regards, Zooko P.S. There is already a company whose name I have forgotten that offers hard-drive backups over TCP/IP. They use some encryption but I don't know how strong.

10 18

ipnat problems continued
by Matthew Patton 17 Dec '03

17 Dec '03

I've tried varios purmutations of the map rules to no positive effect. map ppp0 192.168.1.0/24 -> 206.142.xx.yy/32 portmap tcp/udp 10000:20000 repeat except substitute ^^^^^^^^^^^^^ with 0.0.0.0 or ppp0. Neither works. I ran tcpdump on ppp0 on the gateway and sure enough, the box is sending down the modem link 192.168.1.10 (the particular LAN host trying to initiate an outside connection) as the source IP. Now if everything were correct shouldn't it be the IP addr of the local end of the PPP link as hosted on the gateway box? (ie 206.142.xx.yy) ipnat -l has never once shown any indication of active connections. Either nat is seriosly not working under stock v2.1 (anyone prove it does work?) or there are some undocumented and not exactly obvios dependencies with regard to kernel options. Can someone please mail me a kernel config that is guarenteed to work on a stock v2.1 box for i386 architecture? BTW, how come kernal option IPNAT isn't documented ANYWHERE? It's not even in the ALL file. -------- Windows95: noun. 32-bit extensions and a graphical shell for a 16-bit patch to an 8-bit operating system originally coded for a 4-bit microprocessor, written by a 2-bit company that can't stand 1 bit of competition. (author unknown)

2 1

Why CMR is bad civic hygene;the short version
by Bruce Schneier 17 Dec '03

17 Dec '03

The FBI has publically stated that they want to ban unescrowed encryption. A couple of years ago, people like Brock Meeks and EPIC predicted this; they were universially regarded as alarmists. The problem with corporate key escrow is that it puts an infrastructure in place that can very easily, with a simple switch of public policy, turn into GAK. Diffie has said that the FBS's position is a strawman, and that some kind of voluntary system will be put in place as a compromise. Then, in a few years, eliminating the voluntary nature will be seen as "closing a loophole." Technological infrastructure moves very slowly. Political moods can move very quickly. If companies (like PGP) install a key escrow infrastructure, it will take one well-timed disaster to convince Congress to pass a law putting the whole thing under government control. As Phil Zimmermann said many years ago (I have no idea where he stole it from): "It's poor civic hygene to install technologies that may someday facilitate a police state." Data recovery is essential for stored corporate data. This is a seperate problem than corporate key escrow. Communications keys (used for email) are fundamentally different than storage keys (used for files). Someone sent me email recently and told me that those keys are treated the same in PGP; I have trouble believing that this is true. And if everyone is bashing PGP Inc badly over this, it's because people expected more out of them. A company like TIS, who gets significant (I originally wrote "most of its," but I don't know if that's true anymore) funding from the NSA anyway, is expected to roll over for the Feds. PGP Inc was not. Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis,MN 55419 Fax: 612-823-1590 http://www.counterpane.com

1 0

PGP Key Escrow and Congress
by Bruce Schneier 17 Dec '03

17 Dec '03

The attached is from Barbara Simons of the U.S. ACM. Note item 4, where Congressional staffers point to PGP as an example of key escrow software being possible. To those of us fighing the government control of cryptography, this is not helpful. Bruce -------------------------------------------------------------------------- Date: Mon, 13 Oct 1997 13:27:03 PDT Reply-To: "Barbara Simons" <simons(a)VNET.IBM.COM> Sender: ACM US Public Policy Committee <USACM(a)ACM.ORG> From: "Barbara Simons" <simons(a)VNET.IBM.COM> Subject: Hill ... Blues To: USACM(a)ACM.ORG On Thursday and Friday of last week I met with Hill staffers of the following Congresspeople: Sen. Feinstein, Sen. Boxer, Rep. Eshoo, Rep. Campbell, and Sen. Kerrey. As you may have noticed, there was a Ca. theme to the group, with the exception of Nebraska's Kerrey, of S909 fame. Both Feinstein's and Boxer's staffer suggested that I speak with Kerrey's staff, which is how I ended up meeting with Christopher McLean, Kerrey's Legislative Counsel, and Lorenzo Goco, who is Special Assistant to the Vice Chairman of the Senate Select Committee on Intelligence. My discussion with them was very interesting and somewhat lively. I don't know whether or not they had noticed our letter in opposition to S909, but they at least appeared to be surprised when I said that we had written such a letter, a copy of which was given to each at the meeting. I had the strong impression that McLean and Goco had had a hand in the writing of S909. They certainly were well versed in the arguments. Here is some of what they said: 1. S909 impacts only the government, NOT universities that receive government funding for networks. This is not our interpretation of the bill, and I'd be interested in hearing from some of the lawyers who are on USACM as to whether or not they agree with McLean and Goco. 2. If we are concerned about the well being of the computer industry in the U.S., we should be supporting S909, since the alternatives are either a more draconian bill or no bill at all, with the maintenance of the status quo export restrictions. They claim that Clinton will veto any bill that does not contain provisions that address some of law enforcement's concerns. 3. If we are concerned about inappropriate behavior vis-a-vis key escrow or recovery, we should be supporting S909, since it includes strong penalties for unlawfully revealing or obtaining others' keys. 4. The NSA states that key recovery is doable and will not jeopardize national security. And there is an existence proof for key recovery software in the new PGP release. 5. Yes, they would like to see widespread use of key recovery, but their idea is to encourage the development of encryption with key recovery by using the buying power of the government to cause widespread and inexpensive key recovery encryption to come into being. 6. They are simply doing what the NRC report recommended, namely "testing" key recovery on the government without imposing it on the citizenry. 7. Key recovery or key escrow are simply attempts at maintaining the status quo for law enforcement, who are now able to wiretap at will. Some of these are old arguments that we've been hearing for a while, but some are newer. In particular, points 4 and 6 are difficult to refute without getting into some technical details. Both points also undercut the argument that a key recovery infrastructure potentially weakens security. After all, the NSA thinks it's secure enough that it can be used by the government. Barbara

1 0

Miss Canadian Slut International
by Bianca 17 Dec '03

17 Dec '03

Dear Mr. Beauvais, I noticed on a visit to your website that you are a "Proud sponsor of Miss Canada Int. 97/98." I was wondering if you are reconsidering your sponshership in light of the fact that they award the title to sluts and whores. I was watching Jenny Jones, and thought that the lady, Gabrielle, was a very nice young woman, and a good role model for young women, but a representative of Miss Canada International corrected my error by pointing out that the woman is a trashy whore for taking a job with a legitimante Canadian business which she disapproved of. Accordingly, I am informing all of my male friends that it will be perfectly acceptable to slip their hands up the skirts of future Miss Canada International contestants, since they are all sluts and whores. I was wondering if this also applies to the models you represent and work with, since you seem to be proud of an sponsering an organization that regards the bright and talented young women who represent them as sluts and whores. Do you also regard the women that you work with as sluts and whores? Sincerely, Bianca

1 0

Australian Key Escrow Bill Before Parliament for VPNs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Tue, 14 Oct 1997 17:08:36 +1000 From: Paul Montgomery <monty(a)apnpc.com.au> Subject: [Oz-ISP] Interception law IS a threat to ISPs A couple of ISPs in messages under the "Interception" heading have pooh-poohed the new interception law that is going through government processes at the moment. FYI, the following PC Week Australia story shows that it's not something to be sneezed at, if you want to differentiate yourself by offering remote access or VPN services that are secured using encryption. As mentioned in the story, Telstra, OzEmail, Access One, Connect.com.au and Magna Data are only the largest of growing band of ISPs who are already constructing VPNs for business customers. It's going to take more than an a packet sniffer to decrypt secure messages going through your network. If you're preparing a VPN trial with something like Data Fellows' F-Secure VPN software, which doesn't allow for key recovery, then you're up the proverbial creek as regards your obligations under this new law. You'll have to keep an extra key for the Feds, ASIO, NCA etc, and only use cryptography software that includes key recovery. You'll also have to be involved in a lengthy approval process with the Attorney-General's department and the ACA, which is dangerously open-ended. The system will be that you have to submit your plans for new secure network products every year, and the law enforcement agencies have a set amount of time to protest that they can't access it. This process will add three months, at minimum IMHO, to the development of new services. And yes, INTIAA has been keeping an eye on it, but they've been getting the wrong information from the Department of Communication. I wouldn't say they've been lied to, but they've been given the wrong end of the stick. - -- START STORY [from PC Week Australia, October 17, pp 1/38] New Law Hurts Net Security Security forces want access to encrypted ISP traffic By Paul Montgomery [reproduction for commercial purposes not allowed etc etc] The Virtual Private Network (VPN) revolution in Australia is being undermined by new legislation from the Liberal government that would weaken security on communications passing through Internet service providers (ISPs). The Telecommunications Legislation Amendment Bill, which went to a second reading in the Senate last week, is aimed at giving government agencies such as the Federal Police, ASIO and the National Crime Authority access to data and voice trafficand ISPs will have to fund its implementation. The bill threatens ISPs ability to provide secure remote access and VPN services, by compelling them to include an extra cryptographic key for police, in a weakened version of encryption that is called key escrow. Any modifications needed to encryption technology would not only weaken security, but mean extra costs passed on to corporate customers. Senator Richard Alston, the Minister for Communications, the Information Economy and the Arts, said in a speech to the Senate that interception was an essential service and that Attorney-General Daryl Williams would be given the power to determine the specifics of the proposed laws effect. Senator Alston recently took over policy coordination for cryptography (see PC Week, October 3, page 12), but the decision on this bill was made back in March. The introduction of some new telecommunications services have been significantly delayed, with obvious adverse consequences for business and consumers, Alston said, which sources say is a reference to Telstras OnRamp ISDN service. Alston also hinted that the government was lobbying switch vendors, at an international level, to include interception capabilities in their equipment. Chris Cheah, assistant secretary of the networks policy branch at Senator Alstons department and one of the officials involved in drafting the bill, confirmed that the bill applied to ISP-encrypted VPN and remote access services. If [ISPs] are offering VPNs which have built-in encryption, and theyre saying to their customers that they will deliver in a secure form to a person at the other end, then they will have to provide decryption, Cheah said. He stressed, however, that there would be no requirement for an ISP to decrypt an end users own encryption. Telstra, OzEmail, Access One, Connect.com.au and Magna Data are already offering VPNs, expected to be a lucrative market for network outsourcing, but a central part of the technology is the security gained from scrambling messages with strong cryptography, using such products as F-Secure VPN from Data Fellows (see page 16). Danny Ng, business development manager for Internet and intranet at Bay Networks, said that because Internet access is not an inherently high-margin business, many ISPs were looking to differentiate themselves by offering outsourced remote access or VPN services. VPN technology is evolving very quickly, and one of the cornerstones to it is security, which usually means encryption, Ng said. For major carriers such as Telstra, the delivery point could be the local exchange closest to the agency wanting the interception, but it would most likely remain at the premises for smaller ISPs, according to Cheah. If ISPs want to get into serious carriage service provision, they will be subject to the same provisions as telcos. That means being able to provide interception capabilities, Cheah said. The bill also removes the burden of keeping up with Internet technology from police and security agencies by ordering ISPs to prepare annual reports on their plans for new crypto services. Luke Carruthers, secretary of ISP representative body INTIAA (Internet Industry Association of Australia), said that the impression he had from meetings with the government on the bill was that ISPs would not have to decode encrypted transmissions. INTIAA is meeting with the Australian Communications Authority and the government this week to work out the details of the legislation. Carruthers will argue the ISPs case. I would expect this issue to be taken up fairly strenuously by the people who it affects the most, he said. - -- END STORY - -- Paul Montgomery, Net journalist for PC Week, lives like a JavaBean. mailto:monty@apnpc.com.au Tel: +61-2-9936-8793 Fax: +61-2-9955-8871 ------- End of Forwarded Message

1 0

Security flaw in PGPverify of INN
by Lutz Donnerhacke 17 Dec '03

17 Dec '03

Hi, I was urged to send you the following information. I noticed CERT and tale itself. But tale claims that the problem is not a problem of pgpverify, it's a problem of some krauts trying to send checkgroups monthly using a bot. The checkgroups mentioned were send since a year. They do not include Date: and Message-ID: because these values were not predictable by the human signer and the bot does not know the passphrase to work with. In consequence there are checkgroups out there which can be resend at any time causing a lot of trouble, because the signature is still valid even if a new Message-ID: and Date: line are used. The obvious fix is to modify pgpverify to block such control messages. ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes. HTH Content-Type: application/pgp-signature

1 0

Telstra Australia admits it lied about net
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

http://www.australian.aust.com/computer/fulltext/c1014b.htm Telstra: We were wrong about Net By GEOFF LONG October 14: A Telstra official has admitted that the carrier overestimated the congestion problems associated with the Internet, one of the prime reasons given when it wanted to introduce timed local calls. Speaking at the launch of Telstra's Big Pond Business services, Big Pond general manager John Rolland said congestion caused by Internet users connecting for long periods was not as big an issue as they first thought. He added that the about-face was in line with similar findings from North American carriers and switch manufacturers Alcatel and Ericsson. Mr Rolland said that the main problem areas are where ISPs are situated, but that these were manageable: "What is clear is that in the medium term we will have hot spots, especially around ISPs." However, these could be addressed by working with the ISPs and managing connectivity better. The remarks came in response to Telstra promoting permanent modem connections as part of its Big Pond Business offering.

2 1

Re: Security flaw in PGPverify of INN (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== ---------- Forwarded message ---------- Date: Tue, 14 Oct 1997 17:34:11 +0200 From: Peter Simons <simons(a)RHEIN.DE> To: BUGTRAQ(a)NETSPACE.ORG Subject: Re: Security flaw in PGPverify of INN -----BEGIN PGP SIGNED MESSAGE----- I am replying to the "security problem" report in pgpverify written by Lutz Donnerhacke, which has been delivered via several mailing lists, including BUGTRAQ and Best-Of-Security. Normally I'd simply ignore this article, but this is so breath-takingly ridiculous that I have to set a few facts straight. Lutz Donnerhacke <lutz(a)IKS-JENA.DE> wrote: > I was urged to send you the following information. I noticed CERT and tale > itself. But tale claims that the problem is not a problem of pgpverify, it's > a problem of some krauts trying to send checkgroups monthly using a bot. > > The checkgroups mentioned were send since a year. They do not include Date: > and Message-ID: because these values were not predictable by the human > signer and the bot does not know the passphrase to work with. > > In consequence there are checkgroups out there which can be resend at any > time causing a lot of trouble, because the signature is still valid even if > a new Message-ID: and Date: line are used. > > The obvious fix is to modify pgpverify to block such control messages. > ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes. This is plain bullshit. pgpverify is working just fine and there's no security leak or malfunction in the script. The real story behind this 'report' is as follows: Lutz is the moderator for the german language de.* USENET hierarchy. One of his duties is to send out regular checkgroups and other control messages. What he did is that he didn't include the Message-Id and Date header into the signature of the control messages that he posted. He only signed headers like From and Subject. So he posted control messages with incomplete signatures for maybe a year, until this was first noticed and publicly addressed by Ralph Babel. The problem with these control messages is that anybody is able to re-post them with a new Message-Id and Date. Due to the correct PGP signature, most INNs will simply execute them, thus deleting all changes in the hierarchy since the checkgroups was posted originally. While this is not a major problem, it certainly is a problem, as all groups that have been created past a certain date can easily be removed, etc... When his mistake became public, he didn't stand up for it and created a new key to start posting correct control messages, rendering the old ones useless, he put the blame on Tale and his script instead. So please don't believe this "security flaw". pgpverify is working just fine and if the responsible person will use PGP correctly, there is no problem at all. -peter -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQCVAwUBNEORSw9HL1s0103BAQEgugP9FWJMNivNBqmJElzoQ6pXnwvS6QsbLjQG YrwHzvcYY3CAR7R446gr/WeuxW1JI1t9+yql8TNSvHeEXAX+qgz/ZMCjcjgjg0Pe j0BuVLBBfKuBoxGZDQybRybu3d5Xflqk07W9HjPP0tDtdkUcjndHr2J1Ea/J4zTd QgGNNUoZDFM= =brmw -----END PGP SIGNATURE-----

3 2

Magic money
by Eric Wilhem 17 Dec '03

17 Dec '03

Is the guy still around who wrote " Magic Money" and if so where can I communicate with him? Apparently his name is "Product Cypher". Thanks, Eric Wilhem

1 0

info
by Stefan D. Wolf 17 Dec '03

17 Dec '03

1 0

Re: Encyrption Program
by semprini＠theschool.com 17 Dec '03

17 Dec '03

This is in response to the several posts regarding the assumed weakness in the program I wrote: While it is true that PRNG's are not very good, because of the inherent lattice structure, I believe I found a way around that problem. To work around the lattice problem, I used a systm of cubic arrays. The program first creates sixteen cubic arrays, and fills them one space at a time with random characters. When the stream of characters to be XORed with the plaintext is generated, it picks a random cube and a random location with that cube. The resulting "random" character is then XORed with the appropriate character of the plaintext. If someone can prove to me that this method is stupid or easily breakable, I would actually be happy. So, those of you bent on proving that I'm wrong, I heartily encourage you to do so. As I mentioned before, you can download both the compiled version *and* the source at "http://www.brigadoon.com/~semprini/3dmx". If you are having trouble reaching that site, e-mail me and I will send you a copy via e-mail. Thank you for your interest and criticisms. They have been helpful. --Dylan

4 3

CDL is here!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from mega(a)cash-site.com ----- >From mega(a)cash-site.com Tue Oct 14 13:49:23 1997 From: mega(a)cash-site.com Message-Id: <199710141849.NAA10744(a)enteract.com> Date: Tue, 14 Oct 1997 14:46:05 -0400 X-Sender: mega(a)cash-site.com To: mega(a)cash-site.com Subject: CDL is here!! CDL - the "first" true software that will "change your life" Commissions paid direct from the field DIRECT to YOU!!! No more worries about receiving checks - YOU get paid first! The FIRST company to tap into the $200 billion dollar software industry as a "home business" Packed with software...loaded with value...$200+ CD packed full of software included! There's only ONE WAY to find out more - go download the software for FREE.....install it and look at it - it will blow your mind!! (backed by major corporations) Download your FREE copy today at: http://www.makecash.net/cdl A great way to "make some extra cash" Explosive Opportunity to get in FIRST!! REMEMBER - this is the FIRST in a multi-billion dollar field..are you going to watch us or join us!! We have full support: conference calls daily toll free sizzle line fax-on-demand FREE webpages WOW!!! FREE Download! http://www.makecash.net/cdl /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// ----- End of forwarded message from mega(a)cash-site.com -----

1 0

Hi from the Girls...... (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from 36568300(a)18565.com ----- >From 36568300(a)18565.com Mon Oct 13 20:04:20 1997 From: 36568300(a)18565.com Date: Mon, 13 Oct 97 15:26:38 EST To: mailmaster(a)fish.net Subject: Hi from the Girls...... Message-Id: <6730057729034.43209(a)fish.net> Reply-To: mailmaster(a)fish.net X-Pmflags: 340788480 X-Uidl: 1834e532395abb83946c924b47abc32f Comments: Authenticated sender is <mailmaster(a)fish.net> BEWARE!!! WARNING!!! NOTICE!!! This is an adult site. You must be 18 to enter. If you are offended by subjects of sexual nature PLEASE DO NOT ENETER!!!! In the event you enjoy sex you must join us for the youngest, hotest live sex on the net. You hear us, see us, and direct our every move. To join us now just click on the higlighted text below: http://youngnlusty.com Love, The girls at Young N Lusty ----- End of forwarded message from 36568300(a)18565.com -----

1 0

Cyber Promotions Selling Off Its Own Mailing List (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from cyberout(a)pleaseread.com ----- >From undeliver(a)pleaseread.com Mon Oct 13 20:24:07 1997 Message-Id: <199710140123.UAA09407(a)enteract.com> Date: Mon, 13 Oct 1997 21:07:02 -0400 (EDT) X-1: NEW! Click on http://www.cyberpromo.com for FREE AUTORESPONDERS! X-2: This server blocks unauthorized email relaying. X-3: Link To Anti-Relay Code X-4: THIS MAIL WAS SENT THROUGH IEMMC'S NEW REMOVE FILTRATION SYSTEM! X-Advertisement: Visit http://www.iemmc.org for name removal information. From: cyberout(a)pleaseread.com To: fulldatabase(a)pleaseread.com Organization: Cyber Sender 7.0 Subject: Cyber Promotions Selling Off Its Own Mailing List ANNOUNCEMENT: Cyber Promotions is SELLING OFF ITS OWN MAILING LIST! For the first time, you can own Cyber Promotions proprietary list of 2.9 million email addresses. This is the same list to which Cyber has sent its e-Mags and exclusives. This list has never been sold before! You can take advantage of Cyber Promotions hard work since 1994. Cyber has painstakingly collected these email addresses from the following sources... * Online classified advertisements * Subscribe requests * Autoresponder requests * FreeResponder owners * FreeRelay recipients * Online business-related profiles * Web visitors * Internic records * Web mall advertisers * ... and much more! Since many of the people in this database have been on this exclusive list for over 6 months, they have had many opportunities to unsubscribe. This list only includes people who have not requested removal. Very few of these email addresses are available from other sources. You can use this list over and over again. You stand to make big money if you market your product, service or opportunity to this database. Regular price will be $2995 -- ONE WEEK SPECIAL only $995 -- (SAVE $2000) YOU CAN BE ONE OF THE VERY FIRST PEOPLE TO BENEFIT FROM THE BEST MONEY-MAKING EMAIL LIST EVER! So, don't wait. Order this list today before your competitors get to it first! This list is available on CD-ROM. You can receive it via 2nd day Airborne Express. Call Cyber Promotions at (215) 628-9780 between 10am and 7pm Eastern, and ask for Brian or Alan. Dont delay! This is the list you've been looking for. 48 hour special: Order within 48 hours and receive free limited versions of Stealth Bomber (send 50,000 emails an hour from your local dialup account and cloak your account id) and List-X (collect your own email addresses). Call NOW! (For list removal, hit reply and type "remove") ----- End of forwarded message from cyberout(a)pleaseread.com -----

1 0

FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from netbiz(a)mail2.c-flash.net ----- >From netbiz(a)mail2.c-flash.net Mon Oct 13 23:00:35 1997 From: netbiz(a)mail2.c-flash.net Message-Id: <199710140400.XAA11339(a)enteract.com> Date: Mon, 13 Oct 1997 22:57:49 PDT Date: Mon, 13 Oct 1997 22:57:49 PDT Subject: FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! X-Mailer: Emailer Platinum (tm) by Internet Marketing Inc. //////////////////////////////////////////////////////// Realizing that many of you do not wish to receive UCE, if you would please type REMOVE in the Subject Header, your name will be REMOVED permanently from our mailing lists. All addresses being sent to now have be cleaned through our REMOVE System. By typing REMOVE in the header, you will no longer receive mail from this address!! Thank You! ///////////////////////////////////////////////////////// This is a 100% FREE OFFER to get your own FREE HOME BUSINESS KIT. This is NOT a Scam, Nor a Pyramid Scheme, but is however a Legal Legitimate Network Marketing Business!!! This Business is a FULLY licensed Telecommunications Company operating with licenses in all 50 states. There are absolutely NO PURCHASE REQUIREMENTS to join our company. SORRY...THIS OFFER IS FOR US RESIDENTS ONLY!!!! THE FREE HOME BUSINESS KIT INCLUDES: 1) FREEDOM Bulk Emailer worth $400.00 2) CHECKR SOFTWARE, worth $200.00 allows you to accept checks over fax,phone, or email. 3) Over 30 Million Email Addresses 4) FREE PERSONALIZED WEB SITE 5) Premade Marketing Letters and Templetes 6) Over 1600 FREE Sites To Advertise Your Business 7) Personalized Guidance and Direction 8) Over 50% Savings on Long Distance Bills at only 9.9 cpm 9) Over 90% Savings on Calling Cards, with NO SURCHARGE! 10) 800/888 Personal or Business Phone Lines at 9.9cpm for only $1.50/month!! 11) Huge Income Potential!! 12) Monthly Residual Income!! 13) Plus Much, Much More!! BEFORE YOU READ ANY FURTHER, YOU NEED TO KNOW THAT THE FOLLOWING BUSINESS OPPORTUNITY WILL COST YOU ABSOLUTELY NOTHING! IT'S 100% FREE!!!!! Do You Know 3 People That Use Long Distance? Dumb Question Huh? If you GAVE those 3 people a FREE Business Kit including all the Necessary Software, Do You Think They Might Know 3 People Who Use Long Distance? What if You Told Them They Could: Save on every Long Distance Call! (24 Hours a Day!) Long Distance Rates as low as 9.9 cents per minute> AT&T, MCI, and Sprint can't touch this! 800/888 for your home! Avoid calling home collect! Perfect for kids away at college or even use it to check your messages. Your cost for this is the same 9.9 cents per minute! AT&T charges a $10.00 monthly service fee for this feature. It's ONLY $1.50 per month with us! No-Surcharge Calling Card! Save almost 90% with rates as low as 19 cents a minute! (MCI, Sprint, and AT&T charge 80 cents minimum surcharge per call.) Pick your own card number and PIN for convenience. One More Thing . . . Don't confuse THIS with phone "clubs" who charge a monthly fee ($10-$50) for the "rights" to get a discount. Remember, you don't have to join anything to receive any of these great communication services, like long distance, paging and calling cards! Introducing The Easiest, Most Profitable, and Fun Way to Not Only Save Money, but to Work Part Time at Home and Get Paid!!! Lets' Take a Look at the Realistic Income You Can Generate By Just Telling 3 People!! You Tell 3 People about this offer = 3 people Those 3 Tell 3 People about this = 9 people Those 9 Tell 3 People about this = 27 people Those 25 Tell 3 People about this=81 people Those 81 Tell 3 People about this=243 people Those 243 Tell 3 People about this=729 people Those 729 Tell 3 People about this=2187 people Those 2187 Tell 3 People about this=6561 people Now add up all 8 levels of people to get = 9,840 people YOU KNOW HAVE 9,840 PEOPLE ON YOUR SUCCESS TEAM Now The Fun Part!! We know just by human nature that people could spend an average of $25.00 per month on Long Distance. Some people spend 10 times that, and others may not spend any. For all practical purposes, lets say all 9,840 people spent only $25.00 per month on Long Distance. 9,840 people x $25.00/month = $246,000/month on Long Distance!! HERE'S WHERE YOUR REWARD COMES IN!! Because You Told 3 People and got the ball rolling you are now paid 2% commission on the total monthly phone bill in your team. That's $246,000 Dollars X 2% Commissions = $4,920.00/per month in your pocket!!! WOULD THAT HELP INCREASE YOUR LIFESTYLE A BIT? YOU KNOW IT WOULD!! BUT TELLING 3 PEOPLE IS VERY CONSERVATIVE!! What would your income be if you told 5 people? I can't tell you, because you wouldn't beleive me!! So is this for real, or am I just blowing smoke? You Bet It's For Real!! People using Long Distance Is as natural as the air we breath, and the food we eat. This can, and will happen if you do your part!! What is your part? 1.You need to Tell 3, Tell 4, Tell 5, etc. and spread around your ID#, mine is #AH603800 2.You need to work with your downline to make sure that they Tell 3, Tell 4, Tell 5, etc. 3.You need to stay in touch and teach them how to do what you just did!! My favorite saying is "Give a Man a Fish, and Feed Him For a Day! Teach a Man to Fish, and Feed Him For Life!" So What Do You Need to Get Started? You Need to Contact Me For More Detailed Information including the Toll Free Sign Up Number and Web Site...You can contact me at netbiz(a)mail2.c-flash.net and type "MORE INFO" in the subject header, or leave a message for me at 414-669-3722, and make sure you leave your email address and phone number. After you sign up FREE, send me an email at netbiz(a)mail2.c-flash.net, be sure to include your name, address, telephone number, email address, and your new ID# they will assign you, and I will rush out your FREE BUSINESS AND MARKETNG KIT, including FREEDOM BULK MAIL SOFTWARE, and CHECKR, check by fax or phone software. Plus Your FREE MARKETING START UP KIT!!! ----- End of forwarded message from netbiz(a)mail2.c-flash.net -----

1 0

Re: PGP CAKware & IETF controlled Open-PGP standard
by Omegaman 17 Dec '03

17 Dec '03

Adam Back writes: > Jonathan Seybold <jseybold(a)pgp.com> writes: > > Adam, one aspect of your suggestion puzzles me: > > One thing which concerns me most is KNOWING when a message I send > > (or receive) could be read by someone else. The PGP CMR scheme makes this > > very clear: if there is an extra CMR key, the message may be read by > > whomever controls that key, if not, only the recipient may decrypt the > > message. > > If, however, the message is secretly re-encrypted to a corporate > > storage key AFTER it is received, I will never know that. > > You will if you mark the key with this information. This is a straw man anyway. You don't know this now. Someone you are communicating with could already be forwarding plaintext to a third party unbeknownst to the sender. This is a "do you trust the recipient" issue. > What I _am_ arguing is that in designing systems to provide companies > with data recovery mechanisms that you should a) not weaken security > more than necessary, and b) that it would be nice if you used a method > which doesn't introduce GAK compliancy for communications keys. > > I presented I think in plenty of detail an alternate mechanism which > is both non-GAK compliant, and more secure. So what is the problem? > Is there a technical flaw in my solution? No. But there is in their's(PGP Inc.) as I think you and others have amply demonstrated. The technical issues alone are enough to reject usage of PGP5.5's CMR features. It intrigues me that there has been virtual silence from PGP employees on the technical issues. Only Hal Finney via the IETF-Open-PGP has come anywhere near commenting upon this. I haven't seen anyone from PGP Inc. comment on your data-recovery implementation ideas. In my optimistic moments, I take this as a sign that internally, PGP inc. is giving consideration to producting more sensible and effective solutions. (Maybe even as outlined here) > > This means, I believe, that they should NEVER INVOLVE HIDDEN BACK > > DOORS THAT USERS ARE NOT AWARE OF. > > Agreed. You can flag backdoors with either solution. See above. The prescence of flags does not prevent this. By definition I might add ;). Trust issues, etc. are involved. > It works well enough, but it could be made much more secure, by > separating storage key functionality from transient message key > functionality. This would also give you the chance to resolve the > articificially created need for GAK compliancy, which arises because > you are being forced by this lack of distinction between key > functionalities to use one key for both long term storage and what > should be transient communications key usage. Hal Finney's description of key sttributes indicate that implementing separate storage keys would not be hard for PGP Inc to implement in the next release. > Decentralised control is good, of course, but the pgp5.5 and SMTP > policy enforcer is a ready to roll GAK system. Of course, other companies could have (and will) implement similar systems. That PGP, with it's reputation and stated policies, would is surprising. Hopefully, PGP will live up to their reputation by realizing this misstep and correcting it with a more secure, less GAK-compliant implementation. > The PGP bashing PGP observes is an attempt by the pro-privacy crypto > community to influence PGP to re-think the GAK compliancy, and to > point out the more secure way to implement corporate recovery of > stored email messages without GAK compliancy. > > I reserve the right to bash any company which attempts to field GAK > compliant software. The "bashing" in this notoriously harsh forum has been rather tender in my view. Perhaps the perception of "bashing" is based on recognition (and guilt) that the CMR mechanism is flawed and goes against "the spirit of PGP." Methinks, y'all doth protest too much. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

New Mailing List: Terrorism
by John Gilmore 17 Dec '03

17 Dec '03

Sounds like some "civil rights oriented" EMS, fire, law enforcement, intelligence community, etc people should join, and let the rest of us know what they are doing... John From: churton.budd(a)mediccom.org (Churton Budd) Date: Sat, 11 Oct 1997 10:55:40 GMT TERRORISM --------- TERRORISM is intended for discussion about terrorism response and prevention, including intelligence gathering and emergency responses. Topics include weapons of mass destruction, suspicious activities, educational and funding opportunities, politics, and response ideas. TERRORISM is an open forum to EMS, fire, law enforcement, intelligence community, disaster preparedness & response, and military personnel with an interest in preventing and responding to terrorist incidents. Announcements about new educational opportunities and grants are welcome, as are new products, services, or technologies directly related to terrorism response. Listname: terrorism Post to: terrorism(a)mediccom.org subscription command: subscribe terrorism sent to: listserv(a)mediccom.org

1 0

why Phil Zimmermann should be speaking out against pgp5.5 and CMR
by Adam Back 17 Dec '03

17 Dec '03

(Readers may notice PRZ's email address on the Cc line, this is an open letter addressed to him). In the debate on the controversial pgp5.5 commerical message recover (CMR) system, I noticed someone made the comment that they couldn't see what the big deal is with enforced multiple crypto recipients who aren't also message recipients, as pgp2.x has had non-enforced multiple crypto recipients for ages. I will put the case for why this practice should be avoided for security reasons. I would like to also put the case of why the enforced multiple crypto recipient construct should be avoided in building messaging systems where the designers would like to avoid building GAK compliant systems. The security reasoning is simple: there are is an extra door into the encrypted data: via the CMR key. Introducing an extra door reduces security, because there are now two keys which could be compromised to gain access to the data. That was simple. Possibly not that major a problem, perhaps both keys are so well secured that the additional leakage is academic. In that case, fair enough. Now the GAK compliant case: Firstly it is important to understand the subtle but very significant difference between enforced crypto recipients who aren't message recipients and normal pgp2.x style multiple crypto recipients. This difference is as much to do with the way that mail clients and plugins have used the pgp2.x multiple crypto recipients in fielded systems as with the actual messaging packet differences. A message recipient is someone who's email address is listed in a To: Cc: or Bcc: field in your mail client. A crypto recipient is someone who will be able to decrypt the message. Pgp is a hybrid crypto system, a message consists of the email encrypted with a randomly generated symmetric key, the session key. The session key is in turn encrypted to the public key of the recipient, these are called Public Key Encrypted (PKE) packets. To implement multiple crypto recipients pgp simply tacks on as many PKE packets as there are crypto recipients; each PKE packet being the session key encrypted to the public key of one of the crypto recipients. Now in most fielded PGP email plugins, and clients which take notice of Cc: and Bcc: fields, the number of crypto recipients ties directly with the number of message recipients. This makes it difficult therefore for the existing systems to automate encryption to a third party without software modifications. If a company which is hoping to become a market leader (a hint PGP) were to retain this functionality, GAKkers would find it difficult to use this software to effectively impose GAK. Sure you can Cc: your message to the NSA key. This would be voluntary GAK. Carl Ellison and a number of others suggested this whimsically years back. As in "What's all the fuss about voluntary key escrow, I'll implement voluntary key escrow for you right now, get DIRNSA to generate a key, and I'll sign it, and put it on the keyservers -- end of problem". Carl Ellison had a very good point. The government doesn't want voluntary key escrow, they want as some suspected all along mandatory key escrow, they want GAK (the GAK term is coincidentally another Carl Ellison meme). The reason this is voluntary GAK is that the user in most mail systems would have to go to some concious effort to do this, and may forget some of the time. (It's difficult to make "forgetting" a 5 year jailable offense). Now I'm well aware that some email clients, and MTAs will no doubt allow you to forward copies of all your email transparently to another party. (Please don't flood us with replies describing such functionality). But this is not really the point; it doesn't matter if you can forward copies of your encrypted email "thoughtpolice(a)nsa.gov" -- they can't decrypt it with out the recipients key. Now we come to the danger of PGP Inc's CMR mechanism. CMR breaks this traditional premise that the crypto recipients correspond one-to-one with the message recipients. What it allows is instructions to be given in a public key that tell the software to encrypt messages intended for the owner of this key to two message recipients. This means that for example: If Phil Zimmermann is using his own companies pgp5.0 mail client (and I presume he is), that if the US Government were to pass a law requiring everyone to generate new CMR keys that he would be able to comply without changing his software. This is why I would argue that even pgp5.0 is GAK compliant, it knows how to understand CMR public keys. (I am not actually sure if the pgp5.0 mail client can generate CMR public keys, but the pgp5.5 one can for sure, I'd welcome clarification on this point). The new mandatory GAK law would mean that if he didn't generate a CMR key he would go to jail. So he complies. The terms of the law dictate that the CMR recipeint in individual's mail clients must be "thoughtpolice(a)nsa.gov". Now the next time one of PRZ's favourite resistance groups that he likes to tell us stories about send him an email thanking him for the useful piece of software he provided them with, the USG can listen in because the pgp5.0 software which the resistance fighters have presumably also upgraded to will understand PRZ's CMR key. The USG will if it suits their purposes sell this information to the government in the originating country, and they will have the death squads go kill the resistance fighters if they can determine their identities from the leaked message. This kind of makes a mockery of what PRZ and the PGP brand stands for. Now the pgp 5.5 defenders at PGP Inc will jump up at this point and tell us that this is not so because pgp 5.0 has ability to strip out the second enforced recipient. Well it does. However, PGP Inc has come up with another related clever innovation: their SMTP policy enforcer. This ensures that when resistance fighters attempt to send PRZ email inside the PGP Inc offices (where they will be presumably field testing their GAKware software suite), that if they do take off the CMR recipient, that their mail will bounce. So not being technical crypto gurus, they will try not taking it off next time and the NSA will read the mail again, resulting in the resitance fighters death. Or perhaps alternatively if they really did want to send him email for an important reason, like perhaps to warn him that the corrupt government they were fighting against was going to introduce a law of mandating the use of pgp5.5 by all ISPs and individuals, they would have no way to reach him. This would suit PRZ quite well, because he probably wouldn't want to hear that. Actually it is possibly not fair to pick on PRZ, as I consider it somewhat likely than PRZ is dragging his feet internally to PGP, but is powerless to stop the corporate mindset now at the helm. And if so I apologise for making points at his expense. But also it is important that if PRZ is against this move, that he speak up. That act would have major significance in altering PGP Incs mind. It might also result in a parting of the ways, but I understand from attenders at a physical cypherpunks meeting in the US that PRZ when quizzed about PGP Inc corporate mentality meaning the company would eventually sell out to GAK, relayed that he would quit rather than have be associated with this. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Encryption Program
by Randall Farmer 17 Dec '03

17 Dec '03

Although I don't know the PRNG in Visual Basic (the one 3dmx uses) well enough to do much real analysis, the description of an attempt to correct a problem in it shows a weakness in the "enhanced" version...here's a slightly abridged/clarified copy of the message I sent the author about it. ------------------------------------------------------------------------------- <headers snipped> ... > While it is true that PRNG's are not very good, Well, there isn't any big problem with PRNGs as a class -- RC4 is based on a PRNG, and it's okay to use as long as you know its limitations (i.e., just so you don't try using the same key twice or anything similarly silly). ... > I believe I found a way around that problem...I used a syst[e]m of cubic > arrays. The program first creates sixteen cubic arrays, and fills them one > space at a time with random characters. When the stream of characters to be > XORed with the plaintext is generated, it picks a random cube and a random > location with[in] that cube. I can't do much real analysis since I don't know how Visual Basic's PRNG works, but with a truly secure PRNG like one you would see in a good stream cipher, you can't predict x bits of the PRNG's output with more than 1/2^x probability of bring right without doing exhaustive search of the keyspace. However, your arrays almost surely won't be filled with the *exact* same quantity of each character, so, even if the bytes in your PRNG's output are selected randomly from the arrays, some bytes are more likely to be a byte in your "enhanced" PRNG's output than others. Therefore, given a bunch of the stream, one can guess the next 8 bits of the PRNG's output with more than 1/256 probability of being right, meaning your PRNG doesn't fit the bill. To sum it up, no matter what Visual Basic's PRNG does, that method *can't* be 100% secure. ... --------------------------------------------------------------------------- Randall Farmer rfarmer(a)hiwaay.net http://hiwaay.net/~rfarmer

1 0

Re: proposal: commercial data recovery
by goddesshera＠juno.com 17 Dec '03

17 Dec '03

On Tue, Oct 14, 1997 at 10:37:21AM +0100, Adam Back wrote: > > If we take the design goal of designing a commercial data recovery > system which is not GAK compliant, we can most succinctly state this > design goal as the task of ensuring that: I take a certain sad pleasure in reminding people that among my first posts on this list I warned that cypherpunks had better design a commercial key recovery system, or one they didn't like would be forced down their throats. Attila now spouts my line exactly, Adam is busy designing (though he still can't bring himself to use the term 'key recovery', being meme-dominated as he is), and Tim nods approvingly. Good luck, gentlemen -- you should have been doing this a year ago. -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html This message was automatically remailed. The sender is unknown, unlogged, and nonreplyable. Send complaints and blocking requests to <goddesshera(a)juno.com>.

1 0

Re: the case for separate comms keys
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Death rays from Mars made Adam Back <aba(a)dcs.ex.ac.uk> write: >You can also acheive the same flexibility with an extra indirection with >symmetric storage keys (optionally held in escrow). In fact I think this is >what later versions of Peter Gutmann's SFS do. The reason he uses for this is >that it allows you to change your passphrase without re-encrypting the whole >disk, because the _actual_ disk encryption key is encrypted itself with the >hash of your passphrase, rather than using the hash of the passphrase directly >as the key. There are also a few other reasons for doing this, and I've extended the idea used in SFS for use with my cryptlib encryption toolkit. Instead of encrypting just the key, you also encrypt the algorithm details, ie: E ( algorithm, algorithmInfo, key ) passphrase E ( data ) algorithm, algorithmInfo, key This makes the job of an attacker somewhat harder because even if they have some means of performing a reasonable attack on the second encryption step, they won't know exactly what it is, so even if it only has a 40-bit key they might need to search half a dozen algorithms before finding the right one. This makes it a lot harder to just brute-force everything going past in the hope of finding something useful. This is especially entertaining for algorithms like RC5 and Safer, where you can produce dozens of variations by playing with algorithm parameters, in effect adding extra bits to the key length. As Adam mentions, you can also escrow[0] the second key (which SFS does using a threshold scheme with the parameters controlled by the user). In this way the user can change their password without destroying the ability of the escrow to access the data. Finally, using the session-key mechanism means you never encrypt two lots of data using the same key, and means you can encrypt a single message for multiple recipients just like the public-key equivalent. Peter. [0] This is "escrow" used in the true sense, not the GAK euphemism. It's completely under the control of the user, it's optional, and it's intended for recovery of stored data when you forget the passphrase.

1 0

Re: CVS: cvs.openbsd.org: ports
by uk1o＠rz.uni-karlsruhe.de 17 Dec '03

17 Dec '03

Hello! [older mail] According to Warner Losh: > In message <199709160731.JAA11130(a)waldorf.appli.se> Niklas Hallqvist writes: > : To people with commit access: committing to ports won't work, it's a > : sup mirror where files will get overwritten. Instead discuss changes > : on ports@ and when good, mail to imp@ with explanations for > : consideration of including into FreeBSD. > This particular patch was committed to the FreeBSD tree last night. > I do think that there will come a time when OpenBSD needs to have its > own ports tree. 95% of this tree could be a mirror of the FreeBSD, > but there are some interesting issues that need to be resolved that > haven't been (like the libcrypt issues). How about suggesting a make variable HAS_LIBCRYPT to the FreeBSD people? We could set it in <bsd.own.mk> or something like this (to a value meaning "we don't have it and we don't need it either), and FreeBSD could do similar. Another way were patching the third party program's Makefile accordingly. We should introduce a patches-${OPSYS} directory having precedence before the patches directory of a port. Thus we could maintain our special patches for ports which need them while continuing to use the FreeBSD ports where they work out of the box. I see now that this is already implemented in <bsd.port.mk>, so we could just USE that. > Warner Regards, Felix.

3 2

Re: CVS: cvs.openbsd.org: ports
by Warner Losh 17 Dec '03

17 Dec '03

In message <E0xLTBc-0001Bo-00(a)rover.village.org> uk1o(a)rz.uni-karlsruhe.de writes: : How about suggesting a make variable HAS_LIBCRYPT to the FreeBSD people? : We could set it in <bsd.own.mk> or something like this (to a value : meaning "we don't have it and we don't need it either), and FreeBSD could : do similar. The problem isn't in the BSD make files, but rather in the makefiles of the ports. True, many FreeBSD ports' patches add -lcrypt blindly to the makefile, but that could change. : Another way were patching the third party program's Makefile accordingly. : We should introduce a patches-${OPSYS} directory having precedence before : the patches directory of a port. Thus we could maintain our special patches : for ports which need them while continuing to use the FreeBSD ports where : they work out of the box. I see now that this is already implemented in : <bsd.port.mk>, so we could just USE that. There already is the patches-${OPSYS} that can be used for this purpose. Warner

1 0

I have seen the future.....
by tech21＠tectel.com 17 Dec '03

17 Dec '03

I HAVE SEEN THE FUTURE And it will change your world soon... I receive a lot of telephone calls. All of them interesting-some of them fascinating. Seldom though, do I receive a call that I would truly refer to as "compelling." That is, of course, until my phone rang about 3 weeks ago. I still can't believe it. Odd call. Gentleman wanted some information-specific information. Of course I had a few questions that I needed answered first. "What's the product?" "Can't tell you," came a rather hollow reply. "Can't tell me? Why not?" I pressed, becoming increasingly more curious-and irritated-by the moment. Seeming to change the subject he said, "We want you to come take a look, and give us your opinion." "Come where? And give you my opinion on what?" "We'll send you a plane ticket." Three days later, I found myself staring out the window of that early morning Delta flight as we made our final approach, wondering what in the world I have got myself into. Met with the founders and the young man who had invented the technology. I guess it was about 55 minutes into the presentation that I understood what these guys were up to, and the profound effect this was going to have upon the world-our world. While I sat there riveted on the CEO's every word, transfixed by the passion emanating from his steel blue eyes, I felt like some character in a spy novel, conspiring on a plot to overthrow the government. One day, I'll tell you the whole story. What you ask could have such a profound effect upon our world? THE TOTAL DESTRUCTION OF THE TELE-COMMUNICATION INDUSTRY AS IT CURRENTLY EXISTS!! I've recently been invited to the high technology company discussed above. It is a new publicly traded company. It will be the Microsoft of the telephone industry. It is extremely well funded and has patented high technology. The proprietary technology is the most significant advance in over 100 years of tele-communications. Protected by 2 patents covering 48 applications, we have a private network infrastructure at a pre-opening investment of approximately 23 million dollars. We are not re-sellers of Long Distance time; rather a direct competitor to AT&T and others. To illustrate the potential of this proprietary technology: the internal cost of AT&T to complete a call is calculated at approximately 3 cents per minute; MCI and Sprint the second and third largest competitor based on cost of approximately 4 cents per minute. Our private network "compression technology" can accomplish the same call for as little as 2/ 100th of a cent per minute. For example, AT&T and MCI just announced they were going to cut their basic rates by 5% during the daytime and 15% during the nighttime. On a 15 minute coast to coast call AT&T's new price will be $4.65 during the day for their average customer, our regular price to every customer every day (24 hours per day, 7 days per week) is $1.18. We can afford to beat AT&T pricing because of our technology. But you ask, do I have to use any special equipment. Absolutely not. Just pick up the phone and call the party you want to reach. Pricing is only the tip of the iceberg with our new technology. Our multimedia products are going to make your life so much easier. Star Trek is here, right now and our smart communications platform will bring it to you. AT&T, MCI, and Sprint, look out there is a new major player in town. We will only work with a limited number of individuals to launch this company. If you think you have what it takes or have proven that you do, do not wait a moment longer. This is a ground floor business opportunity, with a compensation package potentially 300% more lucrative than our nearest competitors. Would you agree I have something here that spells opportunity? If yes, we need to talk further, immediately. Call for information and cassette 1-800-741-6240 or e-mail us at technology(a)tectel.com Please indicate your name, address, and telephone number in the body of your response. ************************************************************ Removal Instructions... It is in no way my intention to send anything to anyone who is not interested in the information; If you would like to receive future updates, simply reply to this message with "subscribe" in the subject line to subscribe(a)tectel.com and indicate your name, address, and telephone number in the body of your response. Please complete all information. If we do not hear from you, you will be automatically removed from future updates and will not be contacted again.

1 0