December 2003 - cypherpunks-legacy

CTIA Downplays Code Crack
by John Young 17 Dec '03

17 Dec '03

(Bruce Schneier's rebuttal of this follows) TITLE: CTIA: Encryption of Digital Wireless Phones SOURCE: PR Newswire DATE: 3/20/97 12:10 PM CTIA: Encryption of Digital Wireless Phones Today, a group of professional and academic cryptographers will announce that it has "discovered a flaw in the privacy protection used in today's most advanced digital cellular phones." Following is a set of questions and answers that arise from that announcement. Q. Does this mean that eavesdroppers can listen in on my phone calls? A. No. The encryption discussed by the researchers involves the algorithm used to encrypt numbers punched on the keypad of a phone, not the algorithm used to encrypt voice transmissions. Q. Is it easy to break this keypad number code? A. Not at this time. It involves very sophisticated cryptological knowledge. The digital encryption system now in use is designed to inhibit interception by the unsophisticated. Any technology developed by one person can be broken by another with the application of sufficient technology. This announced attack requires multiple minutes -- up to hours -- of high speed computer processing to break a coded message. 0. What is the impact of this announcement on people who now use wireless phones? A. Virtually none. Approximately 95 percent of the wireless phones now being used are analog phones, not digital phones. The possible impact of this announcement is only relevant to some digital phones that are now being introduced to the market. Q. Why didn't the wireless phone industry develop phones that have unbreakable security? A. Standards for phone technology are developed within the confines of federal regulations and the realities of the marketplace. A wireless phone is a consumer product, not a spy v. spy technology adequate for national security. Such a unit would have cost, battery life and call set-up times which would make it unacceptable to consumers. 0. Does this announcement have any impact on the industry's efforts to stop phone cloning? A. No. During the past year, the industry has been very successful in introducing new technologies that prevent phone cloning. These authentication and "fingerprinting" technologies operate differently and are not compromised by the cryptography announced today. Q. What is the industry doing about this problem? A. Tom Wheeler, the president and CEO of CTIA, testified before Congress on February 5, about the need to strengthen the laws protecting the security of wireless phone calls. It is currently illegal to intentionally intercept a wireless phone call. Unfortunately, whereas federal law prohibits the sale and manufacture of devices designed to eavesdrop on wireless calls, it does not extend the prohibition to cordless phones and the newer digital frequencies. In regard to today's announcement, Wheeler said, "This is the horse nudging at the barn door and it is time to act before the horse is gone completely." CTIA is the international association for the wireless telecommunication industry. It represents more PCS and cellular carriers than any other association in the world. INTERNET USERS. News about the wireless telecommunications industry is updated several times each day on CTIA's World Wide Web site (http://www.wow-com.com) CTIA news releases and other information also are available an WOW-COM. NOTE: The cryptography researchers are Bruce Schneier, Counterpane Systems, 612-823-1098; Robert Sanders, University of California, Berkeley, 510-643-6998; David Wagner, University of California, Berkeley, 510-643-9435; and Lori Sinton, Jump Start Communications, 415-938-2234. CONTACT: For more information, please contact Tim Ayers, 202-736-3203, or Jeffrey Nelson, 202-736-3207, both of CTIA.

1 0

Schneier Rebuts CTIA
by John Young 17 Dec '03

17 Dec '03

(Thanks to DAW for the CTIA and Schneier forwards) Here's Bruce Schneier's press release rebutting the CTIA's assertions. Forwarded message: MINNEAPOLIS -- The Cellular Telecommunications Industry Association (CTIA) issued a press release discussing our recent cryptographic break against digital cellular phones. Following is a correction of some of their mis-statements. 1. While it is true that our paper did not discuss voice encryption, that does not mean that the voice encryption system is any good. As early as 1992 others -- including noted expert Whitfield Diffie -- have pointed out fatal flaws in the new standard's voice privacy features. The underlying technology is the Vegienere cipher, broken by the Union Army during the American Civil War. One cryptographer was quoted in the July 1992 Communications of the ACM calling the voice privacy protection "pitifully easy to break." Certainly digital cellular is harder to eavesdrop on than analog cellular--the latter just requires a scanner tuned to the correct frequencies--digital cellular voice security can be broken in real time by anyone with a little bit of budget, expertise, and desire. 2. While our break did involve sophisticated cryptographic expertise, our results have been published. While we have no intention of publishing our computer code, anyone able to understand our paper can implement our attack. It is not true that "any technology developed by one person can be broken by another with the application of sufficient technology." The Telecommunications Industry Association (TIA) could have designed secure algorithms to protect voice and messages; they chose not to. 3. While it is true that our announcement does not affect most people because they use analog phones, that is a misleading statement. Analog phones are even less secure; the whole point of digital cellular was that it was secure. This announcement affects both CDMA and TDMA cellular systems, but not GSM systems. 4. The phone industry did not develop phones with unbreakable security because they chose not to. It is possible, with today's technology, to implement digital cellular algorithms in cellular phones without affecting the phone's weight, power consumption, voice quality, or call setup. It takes more computer processing power to digitize the voice than it does to encrypt the digital voice. 5. It is true that our attack does not affect phone cloning. The TIA put more effort into preventing cellular fraud, because that directly affects their bottom line. Cellular privacy is much less of a concern, so they didn't bother doing a good job. 6. All the industry seems to be doing about this problem is releasing misleading press releases in an attempt to pretend that nothing is wrong. One moral of this story is that good security standards need to be developed in the open. The CTIA believed that keeping the details of their security measures secret improved the security of the system. This notion works, as long as the details remain secret. All good security systems are designed to remain secure even if their details are made public. To do otherwise is naive and foolish, similar to creating recipes without ever bothering to let anyone taste the food. The CTIA also pointed to the need for legislation to make this illegal. While important, this is not a solution. Listening in on analog cellular phones is illegal, but people do it all the time. Stealing cars is illegal, but Lojack is still in business. We need to protect ourselves with technology, not with legislation. Laws are a quick fix for an industry unwilling to devote resources to solving their problems.

1 0

Mobile IP Resources -- Analysis of Security and Privacy in Mobile IP
by Bill Stewart 17 Dec '03

17 Dec '03

An anonymous poster to alt.cypherpunks recommended the attached article. http://www.neda.com/mobileIpSurvey/html/mobileIP_37.html Title: Mobile IP Resources -- Analysis of Security and Privacy in Mobile IP Go backward to Improving Reliable Transport and Handoff Performance in Cellular Wireless Networks Go up to Mobile IP Research and Technical papers Go forward to Variable and Scalable Security: Protection of Location Information in Mobile IP Analysis of Security and Privacy in Mobile IP http://www-i4.informatik.rwth-aachen.de/~andreas/PAPERS/SecurityPerformance… Authors: A. Fasbender, D. Kesdogan, and O. Kubitz Date: March 1996 In this paper we present a possible extension of the proposed Mobile IP and route optimization protocols, the Non-Disclosure Method (NDM). It prevents the tracking of user movements by third parties and gives mobile users control over the revelation of their location information, according to their personal security demands. We give an overview on Mobile IP protocols and briefly discuss these protocols in terms of security issues. We show that confidential location management in Mobile IP is an unsolved problem. Then we propose our method for providing untraceable communications in packet-oriented mobile networks. NDM is based on the idea of mixes, which has been suggested by Chaum for hiding the originator addresses of electronic mails. Our algorithm prevents the linkability of sender and recipient addresses in Mobile IP, can be easily adopted to other mobility supporting networks as well. We conclude our paper with performance aspects, discussing the trade-off between the level of security provided and the costs of NDM in terms of increased packet transmission delays. For this purpose, we present a new modelling approach for Internet connections, which is based on empirically derived packet delay distributions and their analytical description. Our results show that the overhead for confidential location management is not as critical as might be expected, and that a considerable delay reduction compared to mixes can be achieved. info(a)neda.com

1 0

Re: ONK?: SANS Network Security Digest?
by Pete Loshin 17 Dec '03

17 Dec '03

Thanks for the information. I basically just wanted someone involved (or someone who knows someone involved) to say, yes, this thing is real. How come they don't sign it? If I were a sysadmin subscriber, I'd probably be inclined to want to be able to certify the contents got to me intact. regards, -pl At 05:40 PM 3/20/97 -0500, Vin McLellan wrote: [stuff deleted] >The SANS Network Security Digest is published via email approximately >eight times per year. It's purpose is to help busy sysadmins and >security professionals gain confidence that they are aware of the >important security vulnerabilities and what can be done to resolve them. [more stuff deleted]

1 0

Lawyers on the rampage
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Newsday: Wednesday, March 19, 1997 Postal Service Probing E-Mailed Racial Jokes The U.S. Postal Service is investigating a risque glossary of phony "ebonics" terms that was sent on the service's electronic mail system. A postal workers' union labeled the e-mail a "vicious, racist message." The list of 16 words and their supposed meanings in common parlance among blacks is rife with sexual and racial stereotypes. It apparently was sent by a manager in New York using an internal home page. The list was presented as a tongue-in-cheek guide for managers to improve communications with office staff. In a letter Friday to Postmaster General Marvin Runyon, an American Postal Workers Union official said Runyon's response to the incident should "send a message to the entire postal community." "It is a vicious, racist message covered with black humor, and any rationalization would constitute an insult to those who it is intended to depict," wrote William Burrus, the union's executive vice president. A postal official agreed the message was offensive and promised a quick investigation. "We find the content of this message to be repugnant and highly offensive," said spokesman Roy Betts. "We have asked the postal inspection service to immediately get to the bottom of this matter." Two other major employers -- Morgan Stanley & Co. and Citibank -- were sued by black employees this year over e-mail messages the employees said contained racist jokes. The Morgan Stanley employees said the electronic mailing created a "hostile work environment." Both companies said they would not tolerate such behavior. Although the Postal Service message and Burrus' letter both reached Runyon's office, he said he had not seen them and no action was taken until postal officials received an inquiry from a news organization late Monday afternoon. Betts explained that Runyon was out of the office all last week. In addition to a stated commitment to diversity in its work force, the Postal Service has a zero-tolerance policy for racism. But Angelo Wider, the Postal Service's manager of revenue assurance and national president of the Afro-American Postal League United for Success, said: "We still have deep-seated racism in the Postal Service. It tends to stay in the closet, but every now and then it pops out in public." According to Wider, only 10 percent of postal managers are minorities, while 21 percent of the workers are minorities. A spokesman for the American Postal Workers Union, Tom Fahey, complained that the message was symptomatic of an attitude he said pervades Postal Service management. "We come across communications like this all the time, Fahey said. Betts insisted the message "does not reflect the Postal Service's policy and position." Washington Post, Thursday, March 20, 1997 E-Mail Humor: Punch Lines Can Carry a Price By Michelle Singletary The messages regularly travel between computer screens at workplaces across the country: Why beer is better than women. Ebonics 101. Top 10 reasons computers must be male. For many employees e-mail has evolved into a casual electronic conversation complete with jokes and gossip whether of the politically correct variety or what could be deemed, particularly in the eyes of someone of a different race or sex than the sender, as offensive. Employees typically assume their messages are private and will be seen only by the recipient. But because messages are routinely saved by companies, if they end up in the hands of someone for whom they were not intended, it's often not very funny and ultimately could be used against the employee and the company in a bias lawsuit. It also creates a potentially tricky civil-liberties issue for companies that don't want to monitor employees' e-mail, but don't want to get caught up in a lawsuit either. In the past four months, three major U.S. corporations-- R.R. Donnelley & Sons Co., Morgan Stanley & Co. and Citicorp's Citibank N.A.-- have been sued by black employees alleging discrimination as a result of messages sent via e-mail. Lawyers and technology experts say they believe the suits are the beginning of a wave of litigation in which employees produce e-mail evidence of sex, race or age discrimination. Also, lawyers searching for ways to prove or disprove discrimination routinely are asking companies to retrieve e-mail from their computer systems. ``Employees have this expectation that e-mail is private, but it's not and they don't understand that they can leave a footprint,'' said Frank Connolly, a professor of computer science and information systems at American University. ``The medium lulls you into a false sense of security that it probably shouldn't.'' Electronic mail, or e-mail as it is commonly known, is being used by nearly 80 percent of organizations to communicate and share ideas and information, according to a survey released last year by the Society for Human Resource Management. Estimates are that by the year 2000, about 40 million people in the United States will use e-mail, sending more than 60 billion messages annually. While e-mail quickly has become a common workplace tool, only 36 percgnt of organizations that use it have written policies addressing its use and only 34 percent provide training on the proper and improper use of e-mail, according to the SHRM survey. Legal and computer experts say e-mail use has added a troubling wrinkle to workplace discrimination. Such communication has replaced the kind of informal lunchroom conversations that might have taken place in the past. In fact, employees have become so comfortable with e-mail that they say things they never would write in a memo or utter out loud for fear of being overheard. And, unlike spoken conversations, e-mail messages are toneless and lack context, and consequently could be extremely damaging to a company if used as evidence in court. ``It's one thing to have testimony in court as to an alleged inappropriate comment made a number of years ago vs. a document where jurors see it in black and white,'' said Stephen L. Sheinfeld, a New York attorney who heads the labor and employment department at Whitman Breed Abbott & Morgan. Lawyers say workers who electronically send what might be viewed as racist jokes could be creating what legally is considered a hostile work environment opening themselves and their companies up to discrimination lawsuits. Companies, which often don't have policies on e-mail use and etiquette, can be liable for their employees' discriminatory actions, experts say, because legally e-mail sent from work is treated like any official record, such as a memo written on company letterhead. ``If an executive says something in an e-mail, it's as if he sent it through a memo,'' according to Jeffrey Neuberger, partner in the New York law firm of Brown, Raysman & Millstein, Felder & Steiner. As yet there isn't much case law on this issue. But plaintiffs' attorneys could show employees were harmed emotionally by being exposed to racist or sexist e-mail messages. Additionally, e-mail messages also could be used against companies with spotty or bad histories for hiring and promoting minorities and women. ``Claimants are now searching the e-mail systems looking for smoking guns and because e-mail is unerasable, it can come back to haunt an employer,'' Sheinfeld said. ``There is some really bad, bad stuff being sent,'' said Lauren Reiter Brody, a partner and co-chair of the employment-practices group at Rosenman & Colin in New York. One of the companies recently sued, R.R. Donnelley & Sons, a Chicago printer, is battling a racial-discrimination lawsuit based in part on 165 racial, ethnic and sexual jokes allegedly passed through its e-mail system. Morgan Stanley also has been sued over allegations that racist jokes were passed between co-workers through the company's e-mail system. And, last month, Citicorp's Citibank N.A. was sued in a class action in which two black employees allege that white supervisors and managers exchanged racist electronic-mail messages. In the Citibank case, the plaintiffs alleged that because of the electronic mail, they were subject to a ``pervasively abusive racially hostile work environment.'' In all three cases, the companies denied wrongdoing and stated they had taken measures to discipline employees who used the company's e-mail system inappropriately. In the Citibank and Morgan Stanley cases, the lawsuits allege that white managers circulated a list of words that were used in sentences designed to poke fun at the use of Ebonics, sometimes referred to as black English. In one example, submitted as part of the Citibank case, the word ``disappointment'' is capitalized and followed by the sentence: ``My parole officer tel me if I miss disappointment they gonna send me back to da big house.'' ``This kind of joke without a doubt has no place in the workplace,'' said Stephen T. Mitchell, a Manhattan lawyer representing the two Citibank employees who filed suit. ``You have a situation that people that have the power to promote and the power to terminate are ridiculing people that don't have that power.'' Mitchell said he has been contacted by more than a dozen other Citibank employees who want to join the lawsuit. In 1995, Chevron Corp. agreed to pay four women a total of $2.2 million in settling a sexual-harassment suit after the plaintiffs produced, among other evidence, e-mail containing sexist jokes about ``why beer is better than women.'' E-mail humor reaches across gender, racial and ethnic lines. A recent joke being circulated on the ``Top 10 reasons computers must be male,'' for example, contained as No. 10, ``They have a lot of data but are still clueless.'' Ultimately, the heightened concern about the liability generated by e-mail messages will cause more employers to begin monitoring the electronic mail sent and received by their employees, legal experts predict. ``I'm getting a lot of inquiries about e-mail monitoring,'' said D. Michael Underhill, a partner with Morgan, Lewis & Bockius, a District of Columbia-based law firm. Privacy advocates, however, caution employers not to overreact in responding to possible misuse of e-mail, saying that could cause other problems to develop. ``Employers shouldn't monitor e-mail unless they have strong reason to think someone is abusing it,'' said Evan Hendricks, editor of the Privacy Times. Legal experts recommend that workplaces have some form of monitoring e-mail and disclose this to employees. Some experts even suggest that companies routinely dispose of e-mail messages from backup computer systems the way they would other sensitive documents. They also say companies should develop immediately a written policy for e-mail and provide training on its proper use. Most importantly, such policies should prohibit the use of offensive language or jokes about race or sex, they said. Experts also caution employees of the same race and sex against sending one another off-color jokes. Patricia L. Morris, dean of the School of Education and Urban Studies at Morgan State University, said off-color racial or sexual jokes reinforce stereotypes. This is especially true for black workers who might be passing along jokes to one another about Ebonics, for example, at companies where African Americans are still striving to be paid and promoted on the same basis as whites. ``We shouldn't accept it from whites and we shouldn't tolerate it at all from each other,'' Morris said. USA Today, Thursday, March 20, 1997 Computer-Banking Bugs Turn Off Customers By Christine Dugas As more people sign up for computer banking and bill paying, some banks' systems are becoming overloaded -- causing delays and bounced checks. The industry says it is experiencing growing pains and is fixing the problems. But some customers are losing patience. Richard Rosett, a professor at Rochester (N.Y.) Institute of Technology, has been disconnected on several occasions while transmitting bill payments to Chase Manhattan bank. ``The only way to find out if the payments went through was to call Chase,'' he says. But then he was put on interminable hold. Once he clocked the wait at more than an hour. Rosett became more irate when he mistakenly was charged $21.95 in electronic banking fees. And Chase didn't respond to his electronic mail complaint, he says. So, he's taking his business elsewhere. Chase, the USA's largest bank, isn't the only financial institution with problems. ``Banks are victims of their own success,'' says Bill Burnham, a banking consultant at Booz, Allen & Hamilton. Since NationsBank launched its personal computer banking service a year ago, 320,000 customers have signed on. ``We were able to keep up with the growth until recently,'' says Smita Quinn, PC banking manager. Then customers encountered connection delays. They sometimes had to wait up to 10 minutes to speak to a bank representative by phone. So NationsBank curtailed its marketing push and beefed up its call center staff. Chase says it also is increasing its phone staff -- from 50 people to 150 by the end of April. Ed Valenski, senior vice president in charge of the call center, says Chase tries to resolve problems, but many are beyond its control. That's because Intuit Services handles payment processing and other computer services for about 40 banks, including Chase. Connection delays and service interruptions cropped up because the company couldn't handle the growing volume. Intuit Services recently was sold to CheckFree, a large national payment processor, which says it now has ironed out the problems. But it was too late to help Pam Toner of Fairfield, Conn. Toner says her August home-equity loan payment didn't go through because of a glitch in Chase's PC banking service. And the late payment ended up on the Toners' credit report. Now Chase is trying to clear up the mess by writing the credit agency. To make up for such problems, the bank has sent some customers flowers. But Toner didn't get any. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: PGP Security
by Greg Broiles 17 Dec '03

17 Dec '03

At 11:38 PM 3/20/97 -0500, Mark M. wrote: >The fundamental problem with the current remailer network, as others have >noted before, is that it is a free service open to abuse by anyone. If >remailers were commercialized, this would eliminate the spam problem and would >provide the remailer operator with resources to legally defend him or herself. I don't think remailers get nearly enough traffic (at the moment, anyway) to fund a meaningful defense, civil or criminal. It takes a lot of messages at $.25 or $.10 each to come up with $10K or $20K. It's been ~ 2 years now since my remailer went down, but at that time traffic was pretty low. Also, charging for remailing is likely to alter the legal arguments available to a remailer operator hoping to avoid liability for traffic - in particular, I think it's likely to be a factor which argues in favor of finding contributory or vicarious liability for copyright infringement, since the remailer operator gains income through facilitating the infringement. Charging for messages will also change the availability of services like Raph's remailer stats - even a miniscule cost becomes significant if you're incurring it once per hour per remailer. It's a solution to the "spam" problem - perhaps the only solution - but it's got other consequences, too. >Consider the fact that Cyberpromo has managed to find an upstream provider >willing to provide connectivity to them, even though they are almost >universally hated by net users. They have been able to exist because there >is a commercial interest. I don't think a remailer will be able to come up with the kind of money that Cyberpromo has. If Cyberpromo were a $10/month shell account or a $20/month PPP account, they'd have been history months ago. >The obvious solution to this would be to run remailers in more civilized countries. I agree, especially if you define "more civilized" to mean "has an underdeveloped or underutilized legal system". :) -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0

Make "$9,780" and more !!
by save＠bellsouth.net 17 Dec '03

17 Dec '03

You have Nothing to lose! ME: "Do you own a personal computer?" YOU: yes. ME: "Running WINDOWS 3.xx or WINDOWS 95?" YOU: sure, why? ME: "Wanna make $9,870 cash in the next 48 days?" YOU: who would'nt? ME: "All from home, with INCREDIBLE potential for more?" YOU: really? what is it about? ME: "I own a SOFTWARE PROGRAM that explains the business. Do you want me to send you out one?" YOU: are you going to tell me what it is all about? ME: "That is not the way I work, the answers are in the program. Do you want the business package and software?" YOU: I have nothing to lose! If people are making that kind of money... I HAVE TO TAKE A LOOK! NEW!! NEW!! NEW!! NEW!! NEW!! NEW!! NEW!! NEW!! NEW!! COMPUTER BASED SOFTWARE BUSINESS SYSTEM CAN EARN YOU..... MEGA BUCKS!! If you've been looking for the ULTIMATE home-based business.. THIS IS IT!! It's simple, lucrative, & your ticket to the lifestyle you dream! Our computerized, software-driven business system is so simple to operate...... A CHILD COULD RUN IT! Does the potential of making thousands of dollars a week from home using a TOTALLY AUTOMATED SOFTWARE Business System excite you? If you own (or have access to) an IBM-compatible computer, and are willing to invest a hour or two a day to start -- with the potential of making MORE MONEY THAN YOU CAN IMAGINE-- THIS BUSINESS IS FOR YOU!! Our extraordinary computer-based software business is VERY EASY TO OPERATE. Your complete business package, including software, is only $24.95 up front (Money Back Guarantee), then you can decide. NO COMPUTER KNOWLEDGE NECESSARY!! STEP BY STEP INSTRUCTIONS PROVIDED. (p.s. This is as tough as it gets) STEP 1 : Insert disk into computer. Push a couple of buttons. Sit back and have a cup of coffee while your computer and printer crank out $20 purchase orders. Place in window envelope (no tedious hand addressing!). Stick on one of those self stick stamps. Mail. STEP 2 : Insert disk into computer. Push a couple of buttons. Remove disk and insert into envelope. Mail. Repeat as required. STEP 3 : Go to mailbox. Collect a ton of $20 mail orders. Repeat daily. STEP 4 : Laugh all the way to the bank. If this sounds like the kind of "work" you could easily get used to, RUSH your address and $24.95: ------------------------------------------------------------------ ------------------------------------------------------------------ SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE-- SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE--SAVE-- *(ACT NOW!! In the next 10 days AND RECEIVE THE SOFTWARE & BUSINESS PACKAGE AT AN INCREDIBLE 60% OFF!!, with the same "NO RISK" 100% MONEY BACK GUARANTEE!!) Don't delay, you have ABSOLUTELY NOTHING to LOSE and EVERYTHING to GAIN! **(FREE BONUS--$19.95 Value)** *BONUS, Act NOW and you will receive a 175 page, E-Book called "Your Complete Guide to the Internet". It will give you all the in's and out's of the internet. A must for everyone!! RUSH: YOUR ADDRESS and $9.95 cash, check or money order payable to: Vision Unlimited (In next 10 days) ------------------------------------------------------------------- ------------------------------------------------------------------- TO: Vision Unlimited 316 Pine Ridge Ln Lavergne, TN 37086 1(615)254-2894 (24 hr. message) 30 day, No-questions-asked Money-back Guarantee on $24.95 business package if you are Dissatisfied with it for any reason whatsoever. *non activated software disk only. Please allow 7 days for shipping. For expedited delivery, please add $3.00 for Priority mail. Removes honored in 24-48 hours.

1 0

huge test
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

1 Additional 2 Add ## 3 Add ## 4 Add Stuff at bottom

1 0

PGP Media Sues NSI To Open the Domain Name Registration Market
by mf＠MediaFilter.org 17 Dec '03

17 Dec '03

PRESS RELEASE PGP Media, Inc. New York, New York March 20, 1997 PGP Media Sues To Open the Domain Name Registration Market PGP Media, Inc., d/b/a name.space(tm) (http://namespace.pgpmedia.com) ("PGP"), announces that it has commenced an action in Federal Court in New York City against Network Solutions, Inc. ("NSI"), seeking, among other things, to open access to the domain name registration market to allow open, unrestricted competition for the offering of Domain Name registration under potentially limitless Shared Top Level Domains. PGP believes that the Internet has long since become a vibrant and maturing market in which certain de facto monopolists, operating for profit, have been allowed to flout the laws of the United States and other countries which are expressly aimed at preventing such conduct. A copy of the Complaint in that action is now available on the name.space(tm) web page referred to above. With the commencement of this case, PGP is now accepting registrations of domain names under an expansive list of Shared TLDs. An initial registration under a TLD listed on the name.space(tm) web page may be made for $10. When, as a result of the lawsuit or otherwise, the names registered become universally resolvable and the PGP Name Servers become "root," an additional charge of $15 will be imposed to fully register the name for the first full year of use following such universal resolvability. PGP intends to charge a $25 renewal fee for each subsequent year of use of names registered through its registry. In addition, PGP iS also accepting suggestions for additional Shared TLDs to be added to the PGP Registry. The fee which will be charged for such additional Shared TLDs has not yet been determined. For additional information regarding the lawsuit or to receive regular updates, please contact mjd(a)pgpmedia.com.

1 0

Re: FBI Visits JPUNIX
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

In regard to an email which was purported to be subjected to suppression Anonymous wrote: > The first time it was sent via a remailer, it was bounced for ill- > defined reasons. The second time it was sent, the remailer was shut > down, and remains shut down. Mark M. wrote: > Speaking as "XXXXXXXXX" (or, at least, one of the "XXXXXXXXXs"), I did receive > the following message which originated from "TruthMonger." Shortly after I > received the message, anon.nymserver.com closed down all of its free, > anonymous accounts due to "abuse." Anonymous continued: > Efforts to send it through a second remailer also failed, with no > notice from the server of any problems being received. Other email > sent through the remailer at the same time encountered no difficulties. Later the same day John Perry wrote: > Due to an FBI investigation that was opened recently naming > myself and jpunix as suspects, I have decided that the heat taken by > remailer operators due to those individuals that can't control > themselves has become unacceptable. The message in question is below. Draw your own conclusions. XXXXXXXXX, I thought I would reply privately to you, since you seem to at least have a willingness to allow the possibility of compromises to the security of the encryption methodologies behind PGP programs, among others. To begin with, I'm not sure whether you realize it, or not, but the Navy's spook tenacles run deeper, and extend further, than those of any of the more notable or visibly involved agencies who lurk in the background of security and privacy issues. One of the reasons for this is that their physical existence could be said to mirror the Internet in many respects. The very nature of their 'global' home (the sea), has always permitted them access to people and regions which are denied to others. Also, they are often in the position to be involved in what looks to be merely the 'transporting' of people and information. Whether providing escort services or getting drunk in foreign bars, the expertise of naval intelligence has always lain in the area of observation, first and foremost. By far the greatest tool of intelligence agencies on the Internet, has been traffic analysis. Their techniques are sufficiently sophist- icated that I would not be surprised to find out that they can tell more about us from our Internet activity than can be learned from the satellites capable of reading the newspaper over our shoulder as we sit in the park. Traffic analysis involves all measurable quantum of information, the chief concerns being the patterns and timing of data transfer, from which everything ranging from content and motivation can be deduced. If you wish to think in terms of back-doors, then you would be well advised to go beyond the concepts of 'passwords' and 'holes' and try to think in terms of patterns and timing, and other such 'structures' which are peripheral to concerns regarding 'code' and 'mathematics.' i.e. As well as considering the 'content' of what a program returned, you must also consider 'when' the program returned the result, and the patterns in the timing, as well as the content. An analogy could be made to a person who, being interrogated, answers all questions with a predictable rhythm and then 'pauses,' however slightly, in answering a certain question. You can see that what is revealed by the 'content' of the answer can be greatly insignificant compared to what is revealed by the 'delay' in answering. To expand your concept of 'back-doors' and 'holes,' you have to ask questions such as: "Does it take a program or hardware longer to return a result of '0', than to return a result of '1'?" "What factors can be introduced into the hardware and/or software that can influence the patterns and/or timing of various processes and the results they return?" "Can key searches be made more efficient by analyzing such things as rhythm, syntax, etc? What 'details' or 'qualities' of an individual, group, or 'arena of concern' can be analyzed for the purpose of being able to group them into structures which can be searched for?" "How can 'assigning' a value to certain sequences of numbers be used as a pattern to 'filter' the input data into a form which is easier to analyze?" You are aware of 'tricks and techniques' that apply to mathematics and are widely known. i.e. The process of shifting and adding numbers when multiplying by the number '11'. However, what about those quantum of information which are of no consequence to those seeking for the 'final result' of that multi- plication? Can the peripheral effects of mathematic calculations be used to analyze what has taken place, to narrow the scope of inquiry? My nephew describes numbers as getting 'wider' as they get larger, and he does quick checks of his result through his 'feel' for how much 'wider' a number should be when he is done, even in complicated equations which he ill-understands. (He reminds me of Steven Wright, who claims that someone told him that his socks didn't match, and he replied, "Sure, they do. I go by thickness.") I am currently working on a project which involves merging chaos theory with traffic analysis and other processes to analyze the effects that algorithms display when processed through the filters of varying hardware and software structures and methodologies. The RSA algorithm and accompanying RSAREF subroutines were our first focus, for the very reason that there were certain factions behind the scenes of the Zimmerman/RSA agreement who seemed to have an inordinate amount of interest in the subroutines being chained to the algorithm (for reasons that have nothing to do with patent protection). Those whose expertise goes far beyond my own in this area look at the initial results of the analysis as confirming that their is a 'relationship' between the RSA algorithm and the RSAREF subroutines which will enable them to break the system down into workable units for fairly quick analysis. What is interesting is that the results from small probes into other encryption systems show the same potential for exploitation using varying analysis methodologies and processes. (One fairly well-known encryption routine is almost lame enough to reveal its secrets to anyone with a pencil and a stopwatch, as well as the file size and time it takes to encrypt.) While I would rather you didn't publicize the preceding information, as a general rule, I think that is something that should be shared with anyone who is seriously focusing their efforts on better methods of encryption and analysis of encryption methodologies. I am aware of two other groups who are working along the same lines, although with a narrower range of variables than ourselves, and I am certain that there must be more than a few other entities out there who are also pursuing this line of research.

2 1

encrypt_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [World Book 1997 Multimedia Encyclopedia. Built upon the questions kids ask most. IBM] [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: U.S. Bill To Ban Internet Gambling Introduced Next Story: Rational Unveils Software With Microsoft _________________________________________________________________ Thursday March 20 2:56 PM EST Clinton Admin. To Offer Encryption Bill Shortly WASHINGTON - The Clinton administration plans to introduce legislation soon that would clearly affirm that encryption users in this country are free to use any type or strength of encryption technology, a senior administration official said. Currently, no such explicit law is on the books. Under Secretary of Commerce William Reinsch also told a Senate Commerce Committee hearing the bill would explicitly state that participation in so-called "key management infrastructure" would be voluntary. Key refers to the password or software "key" that can read encrypted information. The bill also would: -- Spell out the legal conditions for the release of "recovery information" to law enforcement officials. The bill also provides legal safeguards for third-party "key recovery agents" who have properly released such information. -- Criminalizes the misuse of keys and the use of encryption to further a crime. -- Offers, on a voluntary basis, firms that are in the business of providing public cryptography keys the opportunity to obtain government recognition. Such recognition, Reinsch said, would allow firms to "market the trustworthiness implied by government approval. The testimony came in a hearing on two bills introduced by Senate lawmakers that would remove almost all export curbs on encryption technology. The administration's newest export policy, enacted through executive order in November and in effect since January 1, allows export of stronger encryption than previously allowed. But it requires companies to incorporate features within two years allowing the government to crack the codes by getting access to the software keys. Administration officials said they opposed the export provisions in the two Senate bills, saying that the export liberalization goes too far. The bills were offered by Sens. Patrick Leahy (D-Vt.) and Conrad Burns (R-Montana). Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: U.S. Bill To Ban Internet Gambling Introduced Next Story: Rational Unveils Software With Microsoft _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

Re: PGP Security
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:markm@voicenet.com to Harka <=- In> The fundamental problem with the current remailer network, as others In> have noted before, is that it is a free service open to abuse by In> anyone. If remailers were commercialized, this would eliminate the In> spam problem and would provide the remailer operator with resources to In> legally defend him or herself. Currently, there is no modivation for an In> operator to continue the service when legally threatened. Personally I believe, that the fundamental problem with remailers is, that there are simply too few of them. If there were a few hundred or even thousand around the world, it would be much harder to crack down on the R-network and the individuals, who run the remailers. In need is a remailer program, that even not so technical people could easily run from their common Windoze machine. Jgrasty's winsock remailer is a good step in the right direction (although it didn't work for me personally). Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMzJEKTltEBIEF0MBAQGgfwf/QePG5nHUjZajUjmskX/CwW+WSvMcDE13 +EiILayy/lE4WQQeGCK8Q0/gcmVqTNtvug3gSRYyUqmadDgzfAlpFg4Vn5pv3I1Z Spf8WNiRpQ1EhHIXPaW4zwMRvAAeySQG/WMmRFzzYWSb2MydlHy3e/XhDy8OtBe3 5IwcGimZE+820eXgdXdCPM2xg3Bri8tUlqBvrVvD+hPi8e5hw3eNc/i1Jf1GP4+w WIhLLzkRe+AYxXEpUrK5c2D1HiNO3KRWqmTiufTjXHZPnu8DW5BXODTbBoqnyOBi syCctfLGD85zFo199FYVsQ4ThFE897qo3U4v9JQuHifRw0GQS5GCiQ== =f+dR -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

gambling_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [IBM DB2] [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Wired Summit Newsroom Echoes To Click Of Mice Next Story: Clinton Admin. To Offer Encryption Bill Shortly _________________________________________________________________ Thursday March 20 2:57 PM EST U.S. Bill To Ban Internet Gambling Introduced WASHINGTON - A bill to ban all forms of gambling on the Internet has been introduced in the U.S. Senate. "Given the tremendous potential for abuse, addiction and access by minors, online gambling should be prohibited," Sen. Jon Kyl, an Arizona Republican, said. He was joined by two other Republicans and three Democrats in offering the bill. Currently, only computer gambling on sports events is prohibited. The legislation would extend criminal penalties to companies who offer all types of computer gambling. Communications companies regulated by the U.S. Federal Communications Commission would be required to discontinue services to any companies they carry that offer gambling. Kyl said the bill also eliminates ambiguity about the definition of bets and wagers to make any form of online betting illegal. The bill was introduced on the same day as the U.S. Supreme Court heard arguments about a 1996 law banning transmission of sexually explicit material on the Internet to anyone younger than 18. The Clinton administration argued that the law should be upheld to protect young children. Opponents said it violated free-speech rights of adult Internet users and should be found unconstitutional. A decision in the case is due by July. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Wired Summit Newsroom Echoes To Click Of Mice Next Story: Clinton Admin. To Offer Encryption Bill Shortly _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Toto 17 Dec '03

17 Dec '03

Attila T. Hun wrote, in blood: > on or about 970313:1533 TruthMonger <an7575(a)anon.nymserver.com> said: > + To reiterate my original observations: > +1. The development of RSA was funded and controlled by the spooks. i.e. > +- The National Science Foundation and the Navy. > +2. The campaign of persecution against Phil Zimmerman ground to a halt > +once he agreed to PGP using the spook-developed RSAREF subroutines to > +implement the RSA functions, instead of PGP's original subroutines. > about a year ago when Phil's prosecution was dropped, I wrote a > rather lengthy message here about PKZ, the prosecution turning to > vapour, surprise funding for PGP, Inc. (which is substantial), and > the issue of being compromised. What I found interesting about TruthMonger's missive was that the replies he received as a result of merely 'questioning' certain things regarding the holy icon of PGP, he got back replies/rants, from normally rational list subscribers, which were scathing rebukes to issues he or she hadn't even raised. I wonder if you had a similar experience with the post you mention. > ANYONE who has managed to walk away from a fed hate/hatchet job has > been compromised to some extent. No shit, Sherlock. > + If people with guns came to me and told me that software I had > +written now had to use their subroutines, instead of my own, then I > +would consider my software 'compromised', regardless of whether or not > +I could immediately discern any anomalies in it. > + It is far, far easier to 'build' a back-door, than to 'find' one. > > you got that one right! > just the ability to _backtrack_ into the algorithms is a start. > One piece of clear text and you're toast. You can't tell me the guy who designed the Rubik cube didn't know how to 'beat' it when he was done. > + It never fails to amaze me how the back-doors that software makers > +intentionally build into their products for their own convenience > +suddenly become 'bugs' when hackers, among others, take advantage of > +them. > + One hacker I know used to find most of his hacks into AT&T UNIX by > +screwing up his system (i.e. - corrupting the passwd file) and then > +calling in the AT&T support techs and observing their tricks and > +techniques (and then improving on them). > > ...ask a few of the old line unix hacks at Murray Hill (where I was > "granted" my name....) however, AT&T was never as bad as a few of > the others (Sperry comes to mind...) and most of AT&T's access > points were not open and exploitable without you enabling them (by > giving them access). I know a hacker who could get Support Techies to perform all of their secret black-magic in front of him just because he had the abilty to act extremely stupid. (If he asked you the time of day, you'd write it down for him, and explain it to him.) > however, 20 years ago, the feds were scary enough with "new" > crypto; 4 AM rousts that noone believed the feds would do. > warrants? yeah, right! If the feds arrested you, you were > "obviously" guilty or they would not have arrested you. I think we can expect the day to come when the Feds make their major public relations tune "If you don't have anything to 'hide', then why do you need crypto?", thus pointing out to 'decent folk' that the CypherPunks are all drug smuggling, tax-dodging pedophiles. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: encrypt_1.html
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:lynx_user@linux.nycmet to Harka <=- In> Clinton Admin. To Offer Encryption Bill Shortly In> WASHINGTON - The Clinton administration plans to introduce In> legislation soon that would clearly affirm that encryption users in In> this country are free to use any type or strength of encryption In> technology, a senior administration official said. In> Currently, no such explicit law is on the books. Obviously, by making a law, that strangely enough tries to legalize, what is legal already, the administration is trying to bait people into "voluntary" key escrow, which are in my opinion the actual main points of the law... In> The bill also would: In> -- Spell out the legal conditions for the release of "recovery In> information" to law enforcement officials. The bill also provides In> legal safeguards for third-party "key recovery agents" who have In> properly released such information. etc.etc... What a bunch of bullshit. Now, that the backdoor "Clipper" doesn't work due to enough awareness, they now try all the windows of the house of cyberspace to do their black-bag job of getting a lock on the front-door, that they'd have a master-key for... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMzJYADltEBIEF0MBAQFbFgf9HEgRLdqaE9jiWXBr8ztkLPTLAaQ5BfRE e4Q6KEYC/zGXUOEtxUEN755rIHo8PNwwSM7ovbEGf7La15O4AnNxRKbVvFbUWGTv nVw3eMDiy/mt11DqMQ316zAIv0sIpXJhspxHTSMWU++uIR3pVUGq31weFPUN4f4B RruaJwEmf1dvVVJkXHgDsrC8HiECSrBidvz57vfpeZpIj4BscEdycBEAH8zmnPic t3Hi9sc5Gc6DQz6ThbaMAj2bHhWEwPuw3GiKe2yzM6A2D/DeIZrlJ0dE2hK6DMXV jz2/DKNQYp9kS1d6vojPdYYEaPXR/upg6Otqno3SJ71DEMqcc49IDA== =vBCY -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

3 2

Cyberpromo hacked
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

http://www.anonymizer.com:8080/http://www.cyberpromo.com

1 0

Re: ADV Weekly Transcripts
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Regarding 1968 view of population control: _Stand on Zanzibar_ John Brunner Thanks

1 0

No Subject
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

BELIEVE the Children! Toto <toto(a)sk.sympatico.ca> writes: > Dale Thorn wrote: > > > > Really? Define _common_. I have lived in the Mid West for about 85% of > > > my life, and I know no one who learned these things from their parents. > > > > C'mon guys. Parents diddling with their kids is more than common - > > probably 1/3 of all fathers do something sexual with one or more > > of their children at some point. People just suppress it. > > I can't believe it could be that common without the government > finding a way to 'tax' it. Def: relative humidity - the sweat on snow's balls as he fucks his sister. BELIEVE the Children!

1 0

Jackboots in Canada
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AP 3/21/97 Quebec Spurred by a new outbreak of bombings, the Canadian government agreed Thursday to toughen laws to help Quebec stamp out a war between motorcycle gangs that has killed more than 30 people. [snip] ...Hell's Angels and Rock Machine...have been battling for control of the illegal drug trade in Canada. Canadian justice minister, Allan Rock, said the measures would include broadening laws on search warrants, electronic eavesdropping and bail conditions for arrested gang members. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMzKOOiKJGkNBIH7lAQHrAwP+P/0YSzXsLKlLe5YAzOVC0QB31uNhmvim HsSdPbulXccXCV0WIeG5uCtzCLXliR759KunfxEs2GithcIpfcDDKa4SFJv9+SVi PqmWXAxs+qNQ/uQqsDo97zuk+tNhO0631XRkh1LS+tL9Q6pCJfSpNl3Ntvhtyafv OD01c5tLwts= =AqwJ -----END PGP SIGNATURE-----

6 6

BXA on Crypto Plans
by John Young 17 Dec '03

17 Dec '03

Excerpt of BXA head William Reinsch statement on Goodlatte's SAFEncryption Bill HR 695 on March 20, 1997: The Administration has stated on numerous occasions that we do not support mandatory key escrow and key recovery. Our objective is to enable the development and establishment of a voluntary key management system for public-key based encryption. We believe the Administration's policy is succeeding in bringing key recovery products to the marketplace. Our attention is now turning toward how we can best facilitate the development of the key management infrastructure that will support those products. To that end, we will shortly submit legislation intended to do the following: Expressly confirm the freedom of domestic users to choose any type or strength of encryption. Explicitly state that participation in the key management infrastructure is voluntary. Set forth legal conditions for the release of recovery information to law enforcement officials pursuant to lawful authority and provides liability protection for key recovery agents who have properly released such information. Criminalizes the misuse of keys and the use of encryption to further a crime. Offers, on a voluntary basis, firms that are in the business of providing public cryptography keys the opportunity to obtain government recognition, allowing them to market the trustworthiness implied by government approval. ---------- Full statement: http://jya.com/bxahr695.htm

1 0

[alt.best.of.cypherpunks]
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks for the laugh. - ------- Forwarded Message From: snow <snow(a)smoke.suba.com> Subject: Re: PGP on AOL To: harka(a)nycmetro.com Date: Fri, 21 Mar 1997 07:46:08 -0600 (CST) Cc: cypherpunks(a)toad.com > Hi there, > I want to help a friend of mine to set up PGP. She's using Win 95 and > is on AOL. Can anybody recommend some good shells, that would make > make it easier for her? Remington .20 Gauge. Use the finest shot you can find, it tends to penetrate walls less. Good luck. - ------- End of Forwarded Message Zooko PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMzKSYUjbHy8sKZitAQHrUgL/TC6JSEVU8QZq00WGt0Yp76AT9pPdgog0 3IUpFE17b+QPz9Lwn1FprL6oaSnAZgz7qnuGj+nel3VNd1R/Tjfa/5qnFiDj++q7 a1+ScrPkfZKQy9DaL9VCavqvTZNoyur0 =7yuN -----END PGP SIGNATURE-----

1 0

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Kent Crispin 17 Dec '03

17 Dec '03

On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > Attila T. Hun wrote, in blood: [...] > > > > you got that one right! > > just the ability to _backtrack_ into the algorithms is a start. > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > how to 'beat' it when he was done. With all due respect, Toto, this is not a valid point. It is easy for someone to design and implement something they can't beat. Whether PKZ designed in, or was coerced into installing, a backdoor into PGP is an interesting speculation, but immaterial. The only real data you have is the code itself. -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

UK TTP Paper
by John Young 17 Dec '03

17 Dec '03

Forward from Cyberia-L: Making absolutely no comment on the subject of licensing of certification authorities, you may be interested in a UK paper entitled LICENSING OF TRUSTED THIRD PARTIES FOR THE PROVISION OF ENCRYPTION SERVICES - Public Consultation Paper on Detailed Proposals for Legislation, March 1997. You can obtain a full document at http://www.dti.gov.uk/pubs. E. Michael Power Coordonnateur Secrétariat au commerce électronique Ministère de la Justice Canada ---------- This paper links to David Herson, the reputed GCHQ spy who admitted the EU/FBI wiretap pact: Information on any of the current TTP projects can be obtained from David Herson (DG XIII/7) at the European Commission (e-mail david.herson(a)bxl.dg13.cec.be) or from the Commission Web site at www.cordis.lu/infosec/

2 1

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Toto 17 Dec '03

17 Dec '03

Kent Crispin wrote: > > On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > > Attila T. Hun wrote, in blood: > [...] > > > > > > you got that one right! > > > just the ability to _backtrack_ into the algorithms is a art. > > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > > how to 'beat' it when he was done. > With all due respect, Toto, this is not a valid point. It is easy > for someone to design and implement something they can't beat. > Whether PKZ designed in, or was coerced into installing, a backdoor > into PGP is an interesting speculation, but immaterial. The only > real data you have is the code itself. I wasn't referring to either PKZ or PGP, but to 'systems', in general. In designing systems of any type, one can often have elements of design which aren't in the blueprint. An example would be an architect who designs a room to echo (or not echo) sound in a certain way, for use as a concert hall or music studio. No amount of analysis of the blueprints will show this 'hidden' design unless the person looking is thinking in the same terms as the designer. Certainly, if the blueprints described the room as a 'sound room', then this might give some a clue as to the hidden elements, but still would not inherently reveal every aspect of what was involved in the design. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

WebWorld 9
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0