December 2003 - cypherpunks-legacy

Free Stuff!!
by JC 17 Dec '03

17 Dec '03

Because your profile indicates you are a visionary, you have been selected to participate in a marketing study where you will receive FREE products at ABSOLUTELY NO COST TO YOU. If you do NOT want to receive FREE PRODUCT SAMPLES, discounts and other benefits only available to CLUB MAIL (tm) members, hit reply and put the word <REMOVE> anywhere in the response, and we will never email you again. BUT if you would like FREE PRODUCT SAMPLES, discounts, and other benefits, absolutely FREE with no strings attached, hit reply and include <MORE> anywhere in the response. Then, you will be enrolled in CLUB MAIL, "the place to get FREE STUFF and more" (SM) There is NO CHARGE and NO OBLIGATION, you just have to want to get the best stuff for less, even FREE. HOW IT WORKS: We have many manufactures of consumer merchandise ready and willing to send it to you just for the asking. CLUB MAIL is a new service connecting preferred consumers with top distributors and manufactures. These companies are willing to go all out to get your attention. Even, give away valuable products, with no strings attached!! These companies know that the best form of advertising is word -of- mouth. They are confident in their products and service. They know once you do business with them, you will want to tell your friends and neighbors. But, in order for any of this to happen, they need you! When you email us back a <MORE> anywhere in the reply, we will add your name to a select group. You will then get emails from us, about once per week, with information about FREE PRODUCTS and SERVICES, and SPECIAL DISCOUNTS available ONLY THROUGH CLUB MAIL!! SO WHY NOT EMAIL US BACK A "MORE" right now, and await the next great offer from CLUB MAIL! Sincerely, David Schulhof Head Coach, CLUB MAIL P.S. The more you respond, the more FREE products you will receive. We have many leading manufactures that would like to have you try their products, and are willing to give them to you, just to get your feedback. SIGN UP FOR "CLUB MAIL" now. EMAIL us back a "MORE" P.P.S. We have valuable products for FREE that we can send you information on right away. But we must first have your response with <MORE> as in MORE FREE STUFF on file. So don't miss out, email us back right away!!

1 0

File Systems
by JOlson 17 Dec '03

17 Dec '03

Are there any commercial/shareware/freeware versions of cryptographic file systems for any Windows environment?

2 1

HOT_sum
by John Young 17 Dec '03

17 Dec '03

3-03-97: "Congress Vs. President On Encryption" Last week a bill was reintroduced in the Senate to ease restrictions on the export of encryption technology. But the Clinton administration is preparing to back new legislation proposing additional controls over encryption software, according to sources familiar with the plans. The White House is preparing to back legislation that will deal with the liability issues surrounding trusted third parties. That legislation may seek to regulate the entities that will preside over digital signature and digital certificate authentication. "It's going to be a long, hot summer," Bidzos said. ---------- HOT_sum Return blank message with this key as subject for full article.

1 0

Microsoft Authenticode key security
by gbroiles-nospam＠netbox.com 17 Dec '03

17 Dec '03

Recent discussion on the cypherpunks list(s) talked about the feasibility of subverting Microsoft's security model by stealing their private key(s). The following snippet (originally sent to RISKS digest) might be of interest: >Date: Mon, 3 Mar 1997 19:23:15 -0800 >From: "Bob Atkinson (Exchange)" <bobatk(a)EXCHANGE.MICROSOFT.com> >Subject: Comments and corrections regarding Authenticode > >As the architect and primary implementor of the Authenticode code-signing >technology (boy, that'll get me mail :-) found in Internet Explorer 3 and in >Windows NT 4, I think my perhaps somewhat lengthy and clearly very biased >perspective on some recent articles might be of interest to others. >Bob Atkinson >[...] >For those curious: at the present time, the private keys with which >Microsoft signs code that it publishes are managed inside BBN SafeKeyper >boxes housed in a guarded steel and concrete bunker. Even were a SafeKeyper >to somehow be physically stolen, these cool little boxes have several >elaborate internal defenses designed to have the box destroy itself rather >than compromise its keys. As I understand things, a military variation on >the SafeKeyper technology is used as an integral part of launch control of >nuclear missiles on submarines in the US Navy. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: The Pro-CODE Bill could make things worse!
by Greg Broiles 17 Dec '03

17 Dec '03

At 12:36 AM 3/3/97 -0800, Tim May wrote: >(These items may not be banned for general export, given the language about >an "identfied individual or organization," but think of the new mischief >this will cause. For example, if remailers are used to evade taxes by some >individuals connecting to some sites, then exporters (like Eric Hughes, >Lance Cottrell, whomever is writing remailers these days) may have to jump >through large numbers of hoops to ensure that some specific site does not >get the software...this will effectively make export of remailers >impossible to legally do...as I read the language of the Bill.) I don't think that Pro-CODE can be used to control the dissemination of remailers. The bit of Pro-CODE at issue here (section 5(c)(3)(B) "The Secretary shall prohibit the export or reexport of particular computer software and hardware *described in this subsection* to an identified individual or organization . . if the Secretary determines that there is substantial evidence that such software and computer hardware will be . . (iv) intentionally used to evade enforcement of US law or taxation by the US or by any State or local government." (emphasis added) I read "described in this subsection" to refer to Section 5(c), and the best description I can find in 5(c) of computer hardware and software is "computer hardware, computer software, and technology with encryption capabilities, except computer hardware, computer software, and technology that is specifically designed or modified for military use, including command, control, and intelligence applications", in section 5(c)(1). So I don't think that this creates a new ability to control the dissemination of non-crypto hardware or software. (The Mixmaster remailer software, which does include crypto, would still be controlled.) The prohibitions on export to named individuals and organizations will be effectively useless with respect to those parties getting strong crypto - the only utility I can see in such a clause is to be used as a club against domestic sympathizers/allies of unpopular groups/people abroad. It also seems likely to lead to yet another round of worrying about whether the format of a particular distribution site on the Internet is sufficiently configured - if ProCODE passes, instead of asking "Are you a US citizen?", distribution sites will ask "Are you on the list of forbidden people?" Same difference. >And the other language--about how companies have to advise the government >about what they are doing, and the "review board"--are possibly ominous. Indeed. The "Findings/Purpose" text (Section 2), includes the following: "(16) The Federal Government has legitimate law enforcement and national security objectives which necessitate the disclosure to the Federal Government of general information that is neither proprietary nor confidential by experts in information security industries, including cryptographers, engineers, and others designated in the design and development of information security products. *By relaxing export controls on encryption products and programs, this Act creates an obligation on the part of representatives of companies involved in the export of information security products to share information about these products to designated representatives of the Federal Government.*" (emphasis added) and Section 5(c)(4)(A) reads: "Exports. The publisher or manufacturer of computer software or hardware with encryption capabilities shall disclose (for reporting purposes only) within 30 days after export to the Secretary such information regarding a program's or product's encryption capabilities as would be required for an individual license to export that program or product." The former has no real force, as "findings" aren't enforceable, but are intended for use by courts who are interpreting or construing a statute. But I don't see a technical reason why the latter wouldn't be enforceable. (Modulo the First Amendment, of course.) Another feature of Pro-CODE that I haven't seen discussed is that it restricts the *private* dissemination of code - e.g., a US programmer may make his/her code globally available (if it is "generally available, as is, and designed for installation by the user or purchaser", section 5(c)(2)(a)(i)), but a US programmer may not (assuming the current regulations, or similar regs, are in force) share code privately (say, pre-release) with foreign programmers. My hunch is that the drafters didn't intend this consequence, but I think it's a logical conclusion given that (a) Pro-CODE doesn't define "export", (b) current regulations define "export" as, roughly, providing software to non-US persons, and (c) Pro-CODE only allows "generally available, as is, and designed for installation by the user" software to be exported. So it still won't be legal for a US person to work collaboratively with a foreigner on development (even if the development took place in a public forum, like sci.crypt, the intermediate drafts probably wouldn't be "designed for installation by the user"), nor for a US person to write crypto for internal corporate use, or to share crypto code with friends overseas without making a public release. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Master of disinformation
by Casey Iverson 17 Dec '03

17 Dec '03

The rather large mass of Russian dung a.k.a. Dr.Dimitri Vulis KOTM wrote >> John Gilmore lied. Consider the irony of the Russian slime ball master of disinformation (probably trained by the KGB), calling someone *else* a liar.

4 3

ECPA/1997: the other shoe?
by Greg Broiles 17 Dec '03

17 Dec '03

I've seen discussion on various lists and in the media about the reissue of Sen. Burns' Pro-CODE bill (S. 377); I was poking around thomas.loc.gov for information about S. 377 and ran across S. 376, introduced by Sen. Leahy, the "Encrypted Communications Privacy Act of 1997", which implements a lot of legislation that cypherpunks types have been speculating about for several years now. I couldn't find an easily-accessible version of the bill's text on thomas, so I cobbled one together from the online version of the Congressional Register. It's located at <http://www.io.com/~gbroiles/ecpa1997.html>. I HTML-ized it in a hurry, so please rely on the official version when one becomes available. I haven't had a chance to go over it in detail, but it purports to do these things: Makes the use of any cryptosystem in the US, or by US persons on foreign soil, legal; Prohibits the implementation of mandatory key escrow Establishes standards and procedures under which key escrow agents may release escrowed keys (including criminalizing wrongful release and wrongful failure to release pursuant to court order/other authorization) Criminalizes the willful use of encryption to obstruct justice Confirms that it is legal to sell any cryptosystem within the US Sets standards for the release of keys to foreign governments I'll post a more detailed summary later when I've had a chance to go over the bill more carefully. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Wassenaar Arrangement
by Greg Broiles 17 Dec '03

17 Dec '03

Has anyone had any luck finding the actual text of the Wassenaar Arrangement? The Arms Control & Disarmament Agency has a summary/factsheet available on its web site (mirrored, I believe, on JYA's web site) but I haven't been able to find a copy of the actual text. I spoke with someone this morning at the ACDA who said that the actual text "has not been released by our government" and that to his knowledge it had not been publicly released by any government. I'm faxing a FOIA request to their legal folks this morning (talked to someone in their general counsel's office who said he wasn't sure if it was available via FOIA or not) but I suspect I won't get it. Has anyone actually seen the text of the thing? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

5 5

Re: Having the smarts to retire early
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > I never reply to these 'bot-generated things, but this one really does > crack me up: > > At 9:48 PM +0100 3/4/97, Anonymous wrote: > >Timothy C[retin] May is another loser who pays for got.net > >because he lacks the mental capacity to gain net access as > >a perk of either employment or academic achievment. > > > > ,,, > > ($ $) > > -ooO-(_)-Ooo- Timothy C[retin] May > > > An alternate interpretation: that I had the smarts to make enough money to > retire at age 34 for the rest of my life. Being that I'm now into my 11th > year of said retirement, I'd say paying $20 a month to got.net for > unlimited usage is a lot better deal than either "employment" or "academic" > subsidy. I'd even pay $100 a month, if that was my only choice, to ensure > freedom from the constraints and disclaimers forced upon corporate and even > academic users. > > Oh, and my first "academic" Net connection, modulo the Net not being very > advanced or usable in those days, was in 1973. > > --Tim May I feel sorry for Tim May. He's so bored, he reads 'bot fodder. I suppose he studies the bounce messages from mailer deamons too. WARNING: COCKSUCKER JOHN GILMORE IS FORBIDDEN TO REDISTRIBUTE MY E-MAIL FROM ANY MAILING LIST ON HIS TOAD.COM COMPUTER. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 5

Re: ECPA/1997: the other shoe?
by John Young 17 Dec '03

17 Dec '03

Thanks for pointing this. We got a TXT version from GPO Access and put it at: http://jya.com/s376.txt With a link to your HTML. On Waasenaar, we've written a few folks about finding a full copy, but so far the word is the same as State's: none has been publically released. Hope you get it. When the pact was first discussed at State a recorder transcribed "Vasinor (phonetic)," so that term might turn up in searches. As you noted, for those interested, we've put a few Waasenaar docs at: http://jya.com/acda.htm Back to your FOIA to CIA, and the Agency's referral to FCC: I wonder if there might not be something to that lead. As you must know, the legislation covering national telecommunications security puts the FCC in the center of infowehr C4I. Excuse this cite to a pro citer, the NatSec Telecomm leg is at: http://jya.com/47cfr2.htm This might support the CIA's intel that FCC is the chokepoint for CPI for the IC.

1 0

RE: Microsoft Authenticode key security
by Bob Atkinson (Exchange) 17 Dec '03

17 Dec '03

Actually, and sort of to the point, no, the keys never actually ever the BBN box, except as part of a backup procedure in which they are extracted in a doubly-encrypted form for which for security reasons you need the manufacturer's help in restoring. To this day, no human or computer other than the box itself knows the key. Bob > -----Original Message----- > From: Toto [SMTP:toto@sk.sympatico.ca] > Sent: Wednesday, March 05, 1997 9:18 AM > To: gbroiles-nospam(a)netbox.com > Cc: cypherpunks(a)toad.com; Bob Atkinson (Exchange) > Subject: Re: Microsoft Authenticode key security > > Greg Broiles wrote: > > >From: "Bob Atkinson (Exchange)" <bobatk(a)EXCHANGE.MICROSOFT.com> > > >Subject: Comments and corrections regarding Authenticode > > > > > >For those curious: at the present time, the private keys with which > > >Microsoft signs code that it publishes are managed inside BBN > SafeKeyper > > >boxes housed in a guarded steel and concrete bunker. Even were a > SafeKeyper > > >to somehow be physically stolen, these cool little boxes have > several > > >elaborate internal defenses designed to have the box destroy itself > rather > > >than compromise its keys. > > Bob fails to mention, however, that, as a backup system, the keys > are > also written on pieces of masking tape attached to the underside of > his keyboard. > -- > Toto > http://bureau42.base.org/public/xenix/xenbody.html

4 3

Re: Having the smarts to retire early
by Sean Roach 17 Dec '03

17 Dec '03

At 11:47 AM 3/5/97 -0700, Graham-John Bullers wrote: > >On Wed, 5 Mar 1997, Dr.Dimitri Vulis KOTM wrote: ... >> I feel sorry for Tim May. He's so bored, he reads 'bot fodder. >> I suppose he studies the bounce messages from mailer deamons too. >> >> WARNING: COCKSUCKER JOHN GILMORE IS FORBIDDEN TO REDISTRIBUTE MY E-MAIL FROM >> ANY MAILING LIST ON HIS TOAD.COM COMPUTER. > >Vulis keep your pervert voice off the list. I don't know which person I dispise more. The person unjustly slandering another for any reason. Or the person telling him that he has no right to an open forum. No, I take that back. I'd rather have ten foulmouthed text wizards dragging my name through the mud, with my self to defend my name as opposed to even one person declaring that they leave "for the public good". As for argument, I have no problem with arguing, so long as neither tells the other to "get lost" so everyone else can have some peace and quiet.

1 0

Ming-Ching Tiew's crypto programs
by Bill Stewart 17 Dec '03

17 Dec '03

Ming-Ching Tiew <mctiew(a)csi.po.my> posted the following article to sci.crypt. Aside from its content being interesting, it poses an interesting set of problems for ITAR proponents (:-) - he's Malaysian, working from Malaysia, but his web page is on a US-located free-web-page server. Some of the code on it is marked US-only; other code is world-readable and on a machine in Germany. ======================================================================= Subject: Cryptlib-based Win32 File Encryptor Date: Tue, 04 Mar 1997 21:01:28 -0800 From: Ming-Ching Tiew <mctiew(a)csi.po.my> Organization: Unconfigured Newsgroups: alt.security.pgp, sci.crypt, comp.security.pgp.discuss Here at which you look for my Win32 File Encryptor which uses "Cryptlib" :- http://www.geocities.com/SiliconValley/Heights/8298 The program is provided in source and binary. Non-US people should follow the re-direct and get it from the non-US site. Some of the highlites ( all crypto-features derived from Cryptlib, credit to Peter Gutmann ), (1) You don't use PGP for encryption and decryption. PGP is only used for Key Management. (2) This is not a shell. (3) Configure encryption options thru' GUI and save to registry. For example, if you don't like IDEA, use something else, like Blowfish. Find out for yourself "Cryptlib", the most comprehensive and yet freely available crypto library. Ming-Ching ======================================================== # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: The Pro-CODE Bill could make things worse!
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"gbroiles(a)netbox.com" "Greg Broiles" 5-MAR-1997 10:04:19.81 >I don't think that Pro-CODE can be used to control the dissemination of >remailers. The bit of Pro-CODE at issue here (section 5(c)(3)(B) "The >Secretary shall prohibit the export or reexport of particular computer >software and hardware *described in this subsection* to an identified >individual or organization . . if the Secretary determines that there is >substantial evidence that such software and computer hardware will be . . >(iv) intentionally used to evade enforcement of US law or taxation by the >US or by any State or local government." (emphasis added) >I read "described in this subsection" to refer to Section 5(c), and the >best description I can find in 5(c) of computer hardware and software is >"computer hardware, computer software, and technology with encryption >capabilities, except computer hardware, computer software, and technology >that is specifically designed or modified for military use, including >command, control, and intelligence applications", in section 5(c)(1). >So I don't think that this creates a new ability to control the >dissemination of non-crypto hardware or software. (The Mixmaster remailer >software, which does include crypto, would still be controlled.) Umm... non-encrypting remailers aren't much use. While something could be worked out (as for most current Type 1 remailers) allowing hooking in PGP or whatever, I would wonder whether that would make the remailer program itself have "encryption capabilities" - a la the "crypto hooks" restrictions in current export regulations. This would be even more of a problem for remailers using socket links and DH superencryption to prevent remailer operators from being pressured to decrypt intercepted messages. These prohibitions would also prohibit or at least restrict export of technologies such as decense and the anonymizer in versions (as is preferable) using encryption, except _possibly_ (see above) those hooking in encryption from outside. Circumstances in which such could be used to defeat US laws include a decense server being used to prevent the tracing of an in-US pornographic site, if (heaven forbid) the CDA (or a lesser version, such as one requiring labeling or going by a "harmful to minors" standard) is found constitutional. >The prohibitions on export to named individuals and organizations will be >effectively useless with respect to those parties getting strong crypto - >the only utility I can see in such a clause is to be used as a club against >domestic sympathizers/allies of unpopular groups/people abroad. It also >seems likely to lead to yet another round of worrying about whether the >format of a particular distribution site on the Internet is sufficiently >configured - if ProCODE passes, instead of asking "Are you a US citizen?", >distribution sites will ask "Are you on the list of forbidden people?" Same >difference. It is rather reminiscent, yes. If, for instance, all it requires is a check on whether the domain name indicates the _certainty_ of being from such a country, then it won't be extremely onerous... but I'm certain that the government will try to interpret it in the most restrictive way possible. -Allen

1 0

Extra Income
by friend＠Summers.com 17 Dec '03

17 Dec '03

*********************************************************************** Our Research Has Indicated That The Following Message Will Be Of Interest To You. *********************************************************************** Imagine what you can do with... UP TO $800.00 A WEEK EXTRA INCOME! Here's How To Get Started Let me tell you which companies to contact so you can start to receive your checks. They can be $200.00, $400.00, even $800.00 per week, depending on what you do. You can earn this excellent income right at home. And you work only when you want to. My name is Henry Summers. I investigate income opportunities that are advertised in magazines or by mail or are listed in home work directories and other sources. Then I talk to people who are actually using these opportunities. I ask how much money they make... and whether they enjoy the work. This helps me direct you to the best opportunities that are available today. Ones that people are using right now to earn all the money they want. Get Paid For Stuffing Envelopes. No Fees. Nothing To Buy. This easy work is very appealing, but most people do not know how to get it. That's because so many of the envelope stuffing programs being advertised are not what you expect. And you don't find that out until after you send in your money. Let me tell you the real facts. With true envelope stuffing... * You do not need to pay any fee or buy any materials to get started. * You do not do any advertising or handle any orders. * All printing, postage, and mailing lists are supplied free by the companies that pay you. * Your pay is based entirely on how many envelopes you complete. Rosie Martinez is an example of someone who earns money stuffing envelopes. The company delivers all the materials right to her door. She stuffs the envelopes, seals them, and applies the mailing labels and postage stamps that are supplied. Then she gets paid for every envelope completed. Rosie says, "I'm retired, and I enjoy having something to do. I usually watch television while I work. The home shopping shows are much more fun now that I have money to spend." If you'd like to do this kind of work, just follow the directions in Chapter 3 of my book "Real Home Income". Or try any of the other opportunities covered. Hundreds of companies are ready to help you make money. I'll tell you what each one has available now. Choose the kind of work you like and write to the companies who offer it. Pick any you want. You can work as an independent contractor for as many companies as you have time for. There are no qualifications to meet, so you will not be turned down. I guarantee it. If you don't like one company or you want to make more money, there are plenty of others you can try. Get Paid For Assembling Miniatures Gina Walker of Texas likes to assemble miniature furniture for doll houses. All the necessary materials are supplied by the company that pays her. She puts them together and sends them back to the company. Everything is conveniently handled by mail and UPS. The company sends her a nice pay check for each batch she completes. Gina says: "I really like the work, and the extra money helps pay my bills. I'm glad I found out about these companies." You can get paid the same way. And you don't have to make miniatures. You can choose from many other types of work. You can sew baby bonnets, assemble beaded jewelry, crochet doll clothes, make wooden items, assemble stuffed animals, paint figurines, weave rattan reed, and many more. You get the names and addresses of over 50 companies that will pay for things you make or assemble at home. No experience is required, and it makes no difference where you live. Almost all the companies supply the needed materials. Just do the work and get paid for each batch you send back. Wouldn't you like to get those pay checks? I'll show you how to get started fast. How I Made $800.00 Per Week After Losing My Job I became interested in home income opportunities several years ago when I lost my job. I sent for dozens of money making offers. Most were totally worthless. Others did not appeal to me. But circular mailing caught my interest... and it actually worked. In just six weeks, I was making over $800.00 a week working part time at home. It was better than my previous job. I soon paid off my bills and bought a new car. Yet that was only the beginning. As I learned more about it and tried different things, the money poured in even faster. It made a huge difference when I applied certain secrets that are used by the experts. I was amazed at how profitable it could be. In "Real Home Income" you'll learn how to use those secrets yourself. I'll tell you which companies to contact to get started. I'll show you some simple steps you can take to double your income without doing any more work. If you want, you can do all of this without handling any orders. Your name and address does not have to appear on anything you mail. You just mail circulars for companies and receive nice fat checks from them. With my proven methods, you can soon be earning more money than you ever imagined. Just follow my directions, and you can start receiving checks from the same companies I do. Receive One Dollar For Each Envelope You Stuff. Envelopes Come To You Already Stamped And Addressed. This easy work is advertised by over thirty- five companies. But they require that you pay $25.00 to $45.00 to register in their program. And then the program seldom turns out to be what you'd expect. That's where my book can help out. I describe the three kinds of mail programs that pay one dollar per envelope. But there is only ONE that I recommend. Not only is it more profitable overall, but you don't have to pay any fee to do it. Not even a dollar. Read about "The World's Best Dollar- Per- Envelope Program" in Chapter 4. How To Avoid Disappointment So many worthless offers are commonly advertised that many people give up before they come across a good one. That won't happen to you when you have my book. It tells you exactly how to recognize and avoid worthless offers. The most common ripoffs are covered in detail. This knowledge can save you a great deal of time and money. You can then take advantage of the many practical, down- to- earth opportunities that are described. Ones that enable you to start making money fast. Even just one extra source of income can make a big difference in your standard of living. Start To Earn Money In 48 Hours When you get the book, look over the many excellent opportunities. Each listing includes a brief description of what is offered. Write to the companies you like and request an application form. They have openings right now, and they'll be happy to get you started. You can begin to make money even faster if you choose one of the programs or plans that the book describes in detail. I'll tell you everything you need to know to get started. By taking a few simple steps, you can already be making money just 48 hours after you receive the book. Unlimited No Nonsense Guarantee "Real Home Income" costs just $29.95 plus $3.00 for postage and handling. I'm so confident you can make the money I've talked about that I back it with a lifetime, money- back guarantee. If at any time you feel the book has not helped you make all the money you want, just send it back. I'll promptly send you a full refund of everything you paid, including postage and tax. Start to enjoy more income and a better life as soon as possible. Please complete the order form and mail it today. Everything will be rushed to you by first class mail. Sincerely, Henry Summers P.S. I've recently discovered an amazingly profitable opportunity. One person I talked to made $20,000 in his first six weeks... working right at home in his spare time. It is not multi- level marketing. I've never seen anything like it before. I'l give you a toll free number to call so you can get started. Please Print and Mail This Order Form ----------------------------------------------------------------------------------------------- SUMMERS PUBLICATIONS # 30516 1010 Calle Cordillera, P.O. Box 3127 San Clemente, CA 92672 ( ) Yes, I would like to get started. Please rush me "Real Home Income" under your lifetime money- back guarantee. Enclosed is $29.95 plus $3.00 for postage and handling. $32.95 total. (If you live in California, please send $34.95) Name____________________________________________ Address___________________________________________ City, State, Zip_____________________________________ -------------------------------------------------------------------------------------------------

1 0

Re: ECPA/1997: the other shoe?
by jim bell 17 Dec '03

17 Dec '03

At 07:51 AM 3/5/97 -0800, Greg Broiles wrote: >I've seen discussion on various lists and in the media about the reissue of >Sen. Burns' Pro-CODE bill (S. 377); I was poking around thomas.loc.gov for >information about S. 377 and ran across S. 376, introduced by Sen. Leahy, >the "Encrypted Communications Privacy Act of 1997", which implements a lot >of legislation that cypherpunks types have been speculating about for >several years now. [snip] >I haven't had a chance to go over it in detail, but it purports to do these >things: >Makes the use of any cryptosystem in the US, or by US persons on foreign >soil, legal; Which is somewhat illogical, because if we assume that things are legal until made illegal, and there is no illegal cryptosystem, that means that no bill can "make the use of any cryptosystem legal." (I understand, of course, that you may simply be saying that the bill pretends to do it...) >Prohibits the implementation of mandatory key escrow Again, somewhat of a non-issue, wouldn't you say? What with the 1st amendment, the government would have an enormous uphill battle to make key escrow mandatory anyway. >Establishes standards and procedures under which key escrow agents may >release escrowed keys (including criminalizing wrongful release and >wrongful failure to release pursuant to court order/other authorization) Key escrow agents (to the extent they currently exist and will exist in the future) are presumably entitled to contract with their customers whatever conditions and terms their customers desire. If that DOESN'T include sharing the key with the government, as far as I know that's entirely legitimate. ("impairment of contracts.") Also, I see no reason to believe that those agents will necessarily have copies of the keys in unencrypted form, useable by the government. >Criminalizes the willful use of encryption to obstruct justice Which, as Tim May points out, could imply practically any useage of crypto with the "appropriate" misinterpretation on the part of government, particularly encrypted remailers. Just what the Leahy bill last year appeared to be intended to do. >Confirms that it is legal to sell any cryptosystem within the US Again, that's unnecessary and redundant. >Sets standards for the release of keys to foreign governments > >I'll post a more detailed summary later when I've had a chance to go over >the bill more carefully. What we should be particularly suspicious of is any differnces between last year's bill and this year's. Somehow I doubt we'll see any desireable change; all the changes will be bad. Jim Bell jimbell(a)pacifier.com

1 0

Re: This list
by Dale Thorn 17 Dec '03

17 Dec '03

Chris Melancon wrote: > I joined this list several weeks ago to learn more about encryption and > related topics. To the few posters who have passed on something useful, > thanks. To the 99.44% of you who are more interested in talking about > who is performing fellatio on who or slamming Timothy May from as many [snippo] > Consider me unsubscribed, and may those of you who work so hard to make > this list the useless crap it has turned out to be continue to suck as > much as you deserve. Ooh, poor baby. Don't let the door hit you in the ass on the way out.

1 0

Secrecy Report
by John Young 17 Dec '03

17 Dec '03

The "Report of the Commission on Protecting and Reducing Government Secrecy," boosted in the NY Times today is available in PDF format at: http://www.access.gpo.gov/congress/commissions/secrecy/index.html It criticizes government's unwarranted use of secrecy as a means of control. The main report is 155 pages long with appendices of 120 pages, including a history of the abuse of secrecy in the NatSec era. It also has a section on "Information Insecurity" which addresses impending moves by the gov to deal with threats to the Racketeer-Influenced "if you knew what we know" Criminal Org. The NYT report and editorial is at: http://jya.com/newsec.htm

1 0

Re: The Pro-CODE Bill could make things worse!
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:44 AM 3/5/97 -0800, Greg Broiles wrote: >"Exports. The publisher or manufacturer of computer software or >hardware with encryption capabilities shall disclose (for reporting >purposes only) within 30 days after export to the Secretary such >information regarding a program's or product's encryption capabilities >as would be required for an individual license to export that program >or product." > >The former has no real force, as "findings" aren't enforceable, but are >intended for use by courts who are interpreting or construing a statute. >But I don't see a technical reason why the latter wouldn't be enforceable. >(Modulo the First Amendment, of course.) Can it be construed as a "taking"? (Or was that just an "excise tax", payable in intellectual property rather than in money?) Unless the information required for an individual license is substantially less under the New Regime than under the Ancien' Regime, they're asking for a lot of information - in the past, it's included source code, documentation, etc., as well as customer data. What restrictions are there on government use of this information apply? State governments, e.g. California, have a history of ripping off copyright and refusing to accept lawsuits against themselves - can the Feds do the same? Maybe they can't refuse to let you export any more, but can they threaten to publish your source code on http://www.dockmaster.mil/warez/ if you don't do what they want?.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: EU-FBI Wiretap Pact and CALEA (Digital Telephony)
by Toto 17 Dec '03

17 Dec '03

jim bell wrote: > > At 02:25 AM 3/3/97 -0800, Tim May wrote: > >So, either the reporters here have it wrong, by implying CALEA and the > >joint U.S.-U.K. agreeement applies to _e-mail_, or in fact CALEA is being > >seen as applicable to e-mail. If the latter, then things are in much, much > >worse shape than many of us feared. > > > >If this interpretation is upheld by the courts, we are in a state of war. > >--Tim May > > Indeed, we are. Notice also that there appears to be no illusion that > these kind of bills are being done due to public demand: News on this > subject is essentially nil, particularly in the mainstream news media. When one begins adding up all of the ways in which the country is being regulated and legislated 'outside' of the influence of the voters, then it becomes apparent that we acually live in a demon-mockracy. It makes for great news when some 'little guy' manages to 'slip one by' Big Brother, but the reality is that the court system is ruled by money and power. As in the example stated above, much of the legislation proffered by those elected bears little resemblence to issues that are of genuine concern to the electorate. Any issues that the government can't ramrod through using the methods above become matters of 'National Security'. The 'law of the land' then ceases to apply, as 'Emergecy Measures' and secretive regulatory agencies write the law with no voting and a single stroke of the pen. The government even has the power to negate the ability of the individual or group to act in their own interest simply by making laws and regulations vague and/or complicated enough that it is unfeasible to act simply because of the time, energy, and funds required to do so--not to mention the 'risk' involved. Through use of regulatory approval, or witholding of such, the government has the ability to influence the fast-moving course of various areas of technology. Does anyone here want to make large investments in a product that they 'may or may not' be able to sell? This forum has members in all areas of expertise surrounding crypto issues, but can anyone state, unequivocally, all of the finer points surrounding legislation, regulation, etc., in this area? (Even if you think you 'can' legally do this-or-that, are you going to do so if told by the government that you can't and will be subject to prosecution and/or financial loss?) Do you expect for the laws to apply equally to all in areas of major government interest? Some companies are 'approved' for export, while, on very questionable legal basis, others are 'denied' approval. Do you expect this type of gladhanded regulatory approach to be any different for CypherPunks remailers, versus military Onion Routers? When some remailer operator is 'set-up' by the Right Reverend G. Stooge on a pornography bust, or by G.I.Joe on a terrorism bust, do you expect the target to be a CypherPunk or a Vice-Admiral? The fact of the matter is, the government is fully capable of burying the facts on any area of interest they wish, under cover of defending us from the 'bad guys' lurking in the bushes, and once every four years they step into the limelight to decide who gets to spend the next four years passing another mountain of legislation that, inch by inch, eats away at the rights and freedoms that are theoretically guaranteed by the Constitution. One has to wonder just how many times in history a vote in favor of restricting the privacy and rights of citizens was gained by trading off a vote affecting 'hog futures'. -- Toto http://bureau42.base.org/public/xenix/xenbody.html

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Embedded in Tim C. Maypole's babblings are preposterous lies, wild distortions, child pornography (both as graphic descriptions and in JPEG format), ethnic slurs, and racial epithets. o o o o o /~> <><><> <> Tim C. Maypole o...(\ |||||| ||

4 3

Re: truth (lack thereof) and the press
by Toto 17 Dec '03

17 Dec '03

Attila T. Hun wrote: > WHEN CULTURES COLLIDE > By Bob Djurdjevic > > The Mexican government itself is working to infiltrate and subvert > our government. They are working to grant dual nationality or > citizenship to encourage Mexican to become U.S. citizens so they can > "vote for Mexican interests" in the United States. > The United States is being > invaded by Mexico. The intent is to retake the American Southwest and > rename it Aztlan. Those who resist are called racist and will are > subject to attack. > > Published in THE WASHINGTON TIMES > BOB DJURDJEVIC, August 18, 1996 Think how much greater the threat would be if the U.S. was actually run by the voters. -- Toto http://bureau42.base.org/public/xenix/xenbody.html

1 0

Secure checksums
by nobody＠hidden.net 17 Dec '03

17 Dec '03

Timmy C. Mayhem's abysmal grammar, atrocious spelling and feeble responses clearly identify him as a product of the American education system. >\\\|/< |_ ; (O) (o) -OOO--(_)--OOOo- Timmy C. Mayhem

3 2

RE: Microsoft Authenticode key security
by Peter Trei 17 Dec '03

17 Dec '03

William H. Geiger III writes: > In <L0c53D131w165w(a)bwalk.dm.com>, on 03/05/97 at 07:44 PM, > dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) said: > > >"Bob Atkinson (Exchange)" <bobatk(a)EXCHANGE.MICROSOFT.com> writes: > > >> Actually, and sort of to the point, no, the keys never actually ever the > >> BBN box, except as part of a backup procedure in which they are > >> extracted in a doubly-encrypted form for which for security reasons you > >> need the manufacturer's help in restoring. > >> > >> To this day, no human or computer other than the box itself knows the > > >But do we necessarily believe what Microsoft people say? > > If Bill Gates got on national TV and told the world that the sky was blue > I'd have go outside and look for myself. Actually, around Redmond, gray skies are much more common. Really guys, If you want to attack Authenticode (and I personally consider it a bandaid on a dangerous system), then stealing or buying the key is not the approach to take. I see two possible approaches to prove it's weakness. 1. If they are using RSA, factor the public key. This depends on it's length. Considering the amount of cpu people seem to be able to muster for distributed cracks, etc, I suspect that 512 bit keys will soon be vulnerable (equiv = RSA 155). 2. Write a Trojan Horse ActiveX control which disables the Authenticode checking, then covers it's tracks. No, I'm not working on either of these. Peter Trei trei(a)process.com Disclaimer: I speak for myself, not my employer.

2 1

Re: Speech
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Homosexual Charles Platt <cp(a)panix.com> writes: <garbage> > Dmitri Vulis was kicked off my ISP many months ago for allowing multiple > logins under his user name and password, presumably so that his friends at > Brighton Beach could share his account without paying the $10 per month > for email+Usenet. At the very least, this indicates a certain ... um ... > lack of class. <more garbage> This is a lie with no basis in reality whatsoever. I'm glad that CHarles Platt and other homosexuals are dying from AIDS. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1