December 2003 - cypherpunks-legacy

Other c'punk lists?
by Anonymous 17 Dec '03

17 Dec '03

Hi are there any other cypherpunk lists? With all due respect this list has a *lot* of noise <g> Perhaps something with- out the anarchy. I enjoy the wild side of this list but I would also like something more targeted. Thanks in advance

3 3

Eureka! Mon Jan 19 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Monday's issue of Eureka! HARD CITY Ouch - you bet it's hard. What is? Stupid question! One visit to this website and the search for porn becomes more of a daily jaunt. It's simply packed with stuff to do and see, and what's more, it's FREE for a limited trial period! Hard City ......................... http://www.hardcity.com/ PLEASE VISIT THIS FINE EUREKA! PARTNER SITE Free Memberships on the net http://www.sexscandal.com We rank the very best sex sites. Free memberships all the time as we search the net for the hottest values and the best looking gals. LOUISE ON HOLIDAY This is a simple website of a young Yorkshire girl sunbathing in someones backyard. She starts out rubbing baby oil all over her body, then removes her bathing suit. This is one hot little lady. You have to see this one. One hot honey! ...... http://www.netcomuk.co.uk/~adrian_w/hols1.html MEXICAN PUSSY FIESTA Hola amigo's! This is a paysite but they have 5 images or so to sample. Click on sample pics, this leads to some pretty large high quality images of group sex, lesbians and facials. Stop by to see the lovely latina ladies spicy tacos, olay! ............. http://aruba.janey.com/~slurping/ TEENS PLAYGROUND This website offers up some great free pictures! Asian teens, big boobs and more. One set of tits in there is the biggest fucking tits I have ever seen! You have to see these boobs! ........................... http://www.vip-master.no/ YOUNG EXPOSED WOMEN Check out Sarah, Cybil, Denise and Colleen, you will be glad you did. Each girl is easy to find, click the thumbnail pix then your sent to a layout of each one. Sponge baths in the haybarn, legs spread wide. Blondes, brunettes, well built! Young Exposed Women ................... http://www.ywex.com/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here ... http://www.netscape.com/download/ 20vids+Chat .. http://209.1.31.175/chat/videochat.cgi?eureka CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat .................. http://137.39.63.229/chat/ General/Fun Chat ........ http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!....1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline.........1-800-644-8779 FREE: Live 1-on-1 (international call only)....011-678-77416 AMATEUR SITE OF THE DAY KARIN: Visit Karin and her hubby Albert to be transferred to the sordid affairs of German swingers. They are kinky and know how to have a good time! Couples like this make surfing worthwhile. ............................ http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY Adult Story of the Day: Read something for a change! Every day the Adult Story of the Day offers you a free erotic sex story for your reading pleasure............................. ............................... http://www.adultstories.com/ DAILY CARTOON ........... http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! .... http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ........... http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ....... http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ....... http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ..... http://eureka.abc-web.com/eureka/francais.htm ITALIANO ..... http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE . http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 ........................... http://137.39.63.229/?190 Pic 2 ........................... http://137.39.63.229/?191 Pic 3 ........................... http://137.39.63.229/?192 Pic 4 ........................... http://137.39.63.229/?193 Pic 5 ........................... http://137.39.63.229/?194 Pic 6 ........................... http://137.39.63.229/?195 Pic 7 ........................... http://137.39.63.229/?196 Pic 8 ........................... http://137.39.63.229/?197 Pic 9 ........................... http://137.39.63.229/?198 Pic 10 ........................... http://137.39.63.229/?199 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Re: how to release code if the programmer is a target for (fwd)
by Uhh...this is Joe [Randall Farmer] 17 Dec '03

17 Dec '03

[Choate said he wouldn't "address" my message if I didn't post it to the list, so...] > > Eternity delivers data. It's up to the user to verify that the data is > > what they want > > > The original question was how to verify the eternity server source code. > > Assume for a moment that as a user of an eternity server the source is the > data I want. Ok... [...] > > * A random user who has the public keys of at least (thresh) number of the > > cypherpunks, optionally the key of the author of the document/product before > > the system becomes questionable, perhaps by looking in the NY Times > > for 1 Jan 1999 which has a full page ad taken out by Cypherpunks Anonymous > > with the PGP public keys for the 100 leading cypherpunks. > > Pretty expensive and rather unrealistic I suspect. The NYT ad? I think that was at least partly a joke (besides, if some cypherpunks did take out an ad, I'd predict propaganda in 2/3 of the page and fine-print PGP-key fingerprints in the rest :). > Where does this random user come from? Why does it matter? As long as she's competent enough to choose good verifiers and verify that those verifiers verified the code in question, it all works out in the end. > What is '(thresh)'? What good would an anonymous key signature provide? Thresh is the number of signatures from trusted people/keys required to trust a section of code, a value set by the user. An anonymous sig would be very little good but I think he was talking about including the author's sig if he's not anonymous. > [...] How do we know that some number of these cypherpunks aren't turned? We don't. There is no way to operate without *some* trust; this reduces it from the code being shown to be secure if the author is not spookized AND The author is capable to check his/her code AND the key he signed it with is good to the code being good if those conditions are true for one (or a few) of the many cypherpunks on the user's trusted list who signed the code. > Are you proposing that the user test all 100 of the signatures? Well, I think he's proposing to have a script check them and the user personally make sure the script is doing what it should. > Which realistica[l]ly is the only way to verify any given one of them. Not > very many people will go to that extreme simply for grins and giggles. > > > * The piece of code to be verified is bloody long, that is, longer than > > any one cypherpunk can afford to verify alone (shooting practice, > > installing the minefields and poison gas sprinkler system, etc. take > > lots of time) Not to mention churning out that propaganda for the NYT ad, becoming tolerant to pepper spray, preparing various fake identities for use, proving Blowfish secure and then breaking it, constructing a doomsday weapon using only a straightedge and compass, etc. > > The standard is programs over ~10k lines is not comprehensible by a single > individual on a line by line basis. Might be, but this code has to be more than just understood -- it must be painstakingly checked for subtle flaws and bugs. Welcome to the world of adversarial quality control. > > > * The user can tell by visual inspection that a small compilation > > system does what they want it to do, and can understand basic logic > > enough to tell what signatures imply. > > 'small compilation system' of what? What who wants it to do? The author? > Mallet? The end user? The C/Java/whatever compiler, I suppose, and also the signature checker, and she's checking that they carry out their stated purposes. ... > > 2) The user wants to run the code, because it's Just That Cool. > > We're talking here about users who want to get data that is illegal or > otherwise incriminating or dangerous to one group or another. In particular > let's consider the situation of a Lebanese freedom fighter in Isreal or > perhaps a 'Free Burma' revolutionary in China. I think the issue was one of users who want to get eternity server source they can trust -- not necessarily getting it *from* Eternity. > > > 3) No one can verify the entire code. So, Cypherpunks begin signing > > small sections of the code with their own previously-established key. > > Their keys are established as their reputation is established on > > the list, or perhaps by personally meeting these people, in the > > traditional PGP web of trust scheme. There is no central Cypherpunks > > Registry, just a decentralized mesh. > > Which doesn't effect the ability of Mallet to resign that code at the users > end in order to break the users local security. Unless you're exposing a new weakness in the trust model PGP uses, Mallet can't do that, providing the user has done good key authentication and hasn't listed one of Mallet's goons as a trusted code-verifier. > > > 4) The user executes the compilation script. > > [material describing script verification deleted] > > Mallet can re-write said script [...] Yup, that's why the user has to check it by hand. Lots easier to check a script and a compiler for doing their functions than to check an eternity server for subtle bugs. > > > I fail to see how the specifics of Eternity are relevant -- it's > > just basically a PGP web of trust issue. The transport is irrelevant -- > > it's untrusted code until it's been verified by people the user > > trusts. > > The end user may not have people available to trust is the point. Well, if you can't verify it yourself and you can't trust other people to verify it, my advice is to give up; you cannot be sure of *any* public keys in that case, so any message you encrypt might be encrypted to one of Mallet's keys; any sig you check might be signed by one of Mallet's keys. > The reason the transport mechanism is relevant is that it is much easier to > spoof a verification script if the user is not going to be surprised with 24 > hour turn around on requests, whereas a responce time measured in minutes > lessens the window of opportunity to Mallet significantly. If Mallet is a NSA spook who's half as good as my hacker buddy Phat Atta and knew about the script ahead of time, the user can't trust the script without verifying it herself, whether it takes milliseconds or millenia to get the response. > > It may come as a surprise to you and others but not everyone in the world > can pick up a phone and call a 100 people all over the world and not raise > some suspicion. Ah, but either I am more mistaken than usual or you only need a few of the signers to be trusted, not all of them. > > > Implementing a keyserver in Eternity has the same issues > > While it is perfectly permissible to design Eternity or any data haven with > inherent key servers, I believe it is a bad idea from a design perspective > because it makes the code even larger, decreases the potential for monetary > motives for indipendant key servers to appear, and if the server is > compromised then the key server is also. Not sure, but I think he's talking about putting up a key server in Eternity (i.e., the rolling hills where data can roam without fear, as opposed to putting it in the Eternity). > It is more expensive if Mallet can be forced to deal with two [independent] > operators then a single monolithic operator. > > [rest deleted] --------------------------------------------------------------------------- Randall Farmer rfarmer(a)hiwaay.net http://hiwaay.net/~rfarmer

2 1

Fwd: Internet security (VERY LONG)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Subject: Fwd: Internet security (VERY LONG) Date: Sun, 18 Jan 98 12:34:36 -0500 From: Somebody To: "Robert Hettinga" <rah(a)shipwright.com> Mime-Version: 1.0 ---------------- Begin Forwarded Message ---------------- Date: 01/17 3:25 PM Received: 01/17 5:24 PM From: Richard Fairfax, richard_fairfax(a)compuserve.com Reply-To: CSA Talk, csa(a)blueworld.com To: CSA Talk, csa(a)blueworld.com The following forwarded mail may have implications for clients with sensitive data. The field encription features in Troi FM Plug-in could prove to be a valuable asset. Richard Fairfax Oakwood Designs ---forwarded mail START--- From: gp-uk(a)mailbase.ac.uk,Net ----------------------------------------------------------------------- Aus: z-netz.datenschutz.spionage: A GLOBAL electronic spy network that can eavesdrop on every telephone, email and telex communication around the world will be officially acknowledged for the first time in a European Commission report to be delivered this week. The report - Assessing the Technologies of Political Control - was commissioned last year by the Civil Liberties Committee of the European Parliament. It contains details of a network of American-controlled intelligence stations on British soil and around the world, that "routinely and indiscriminately" monitor countless phone, fax and email messages. It states: "Within Europe all email telephone and fax communications are routinely intercepted by the United States National Security Agency transfering all target information from the European mainland via the strategic hub of London then by satellite to Fort Meade in Maryland via the crucial hub at Menwith Hill in the North York moors in the UK." The report confirms for the first time the existence of the secretive ECHELON system. Until now, evidence of such astounding technology has been patchy and anecdotal. But the report - to be discussed on Thursday by the commit- tee of the office of Science and Technology Assessment in Luxembourg - confirms that the citizens of Britain and other European states are subject to an intensity of surveillance far in excess of that imagined by most parliaments. Its findings are certain to excite the concern of MEPs. "The ECHELON system forms part of the UKUSA system (see 'Cooking up a charter for snooping') but unlike many of the electronic spy systems developed during the Cold War, ECHELON is designed primarily for non- military targets: governments, organizations and businesses in vir- tually every country. "The ECHELON system works by indiscriminately intercepting very large quantities of communications and then siphoning out what is valuable using artificial intelligence aids like MEMEX to find key words". According to the report, ECHELON uses a number of national dictionaries containing key words of interest to each country. For more than a decade, former agents of US, British, Canadian and New Zealand national security agencies have claimed that the monitoring of electronic communications has become endemic throughout the world. Rumours have circulated that new technologies have been developed which have the capability to search most of the world's telex, fax and email networks for "key words". Phone calls, they claim, can be automatically analysed for key words. Former signals intelligence operatives have claimed that spy bases controlled by America have the ability to search nearly all data communications for key words. They claim that ECHELON automatically analyses most email messaging for "precursor" data which assists in- telligence agencies to determine targets. According to former Canadian Security Establishment agent Mike Frost, a voice recognition system called Oratory has been used for some years to intercept diplomatic calls. The driving force behind the report is Glyn Ford, Labour MEP for Greater Manchester East. He believes that the report is crucial to the future of civil liberties in Europe. "In the civil liberties committee we spend a great deal of time debating issues such as free movement, immigration and drugs. Technology always sits at the centre of these discussions. There are times in history when technology helps democratise, and times when it helps centralise. This is a time of centralisation. The justice and home affairs pillar of Europe has become more powerful without a corresponding strengthening of civil liberties." The report recommends a variety of measures for dealing with the increasing power of the technologies of surveillance being used at Menwith Hill and other centres. It bluntly advises: "The European Parliament should reject proposals from the United States for making private messages via the global communications network (Internet) a ccessible to US intelligence agencies." The report also urges a fundamental review of the involvement of the American NSA (National Security Agency) in Europe, suggesting that their activities be either scaled down, or become more open and accountable. Such concerns have been privately expressed by governments and MEPs since the Cold War, but surveillance has continued to expand. US intel- ligence activity in Britain has enjoyed a steady growth throughout the past two decades. The principal motivation for this rush of development is the US interest in commercial espionage. In the Fifties, during the development of the "special relationship" between America and Britain, one US institution was singled out for special attention. The NSA, the world's biggest and most powerful signals intelligence organisation, received approval to set up a network of spy stations throughout Britain. Their role was to provide military, diplomatic and economic intelligence by intercepting communications from throughout the Northern Hemisphere. The NSA is one of the shadowiest of the US intelligence agencies. Until a few years ago, it existence was a secret and its charter and any mention of its duties are still classified. However, it does have a Web site (www.nsa.gov:8080) in which it describes itself as being respon- sible for the signals intelligence and communications security activ- ities of the US government. One of its bases, Menwith Hill, was to become the biggest spy station in the world. Its ears - known as radomes - are capable of listening in to vast chunks of the communications spectrum throughout Europe and the old Soviet Union. In its first decade the base sucked data from cables and microwave links running through a nearby Post Office tower, but the communi- cations revolutions of the Seventies and Eighties gave the base a capability that even its architects could scarcely have been able to imagine. With the creation of Intelsat and digital telecommunications, Menwith and other stations developed the capability to eavesdrop on an extensive scale on fax, telex and voice messages. Then, with the development of the Internet, electronic mail and electronic commerce, the listening posts were able to increase their monitoring capability to eavesdrop on an unprecedented spectrum of personal and business communications. This activity has been all but ignored by the UK Parliament. When Labour MPs raised questions about the activities of the NSA, the Government invoked secrecy rules. It has been the same for 40 years. Glyn Ford hopes that his report may be the first step in a long road to more openness. "Some democratically elected body should surely have a right to know at some level. At the moment that's nowhere". See also in this week's issue: Pretty good Phil bounces back (a report on the consolidation of the reputation of Phil Zimmermann, creator of PGP). 14 October 1997: Europe's private parts to expand * * * * * ------------------------------------------------------------------------- Hilfe zu den BvD Mailinglisten? An- oder Abmelden? Mail an bvd-majordomo(a)ibh.tfu.uni-ulm.de, Subject: egal, Text: help ODER: http://www.fh-ulm.de/bvd ---forwarded mail END--- ----------------- End Forwarded Message ----------------- <Somebody's .sig> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

CAD Stego (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 19:31:38 -0500 > From: John Young <jya(a)pipeline.com> > Subject: CAD Stego > This repeats a suggestion from 1994 about using computer > assisted design programs to conceal text or other data: > 3. The scale feature is useful to reduce, say, a text > of any length, or any digital object, to the size of a pixel. Assuming your color palate is deep enough to support the compression. > 4. Or, the text can be distorted by scale and dimension > to appear to be a line serving another function. Don't you think they are going to wonder why *that* line is so varied in color? Or assuming deep color pallettes, why so many colors are selected when only a few dozen are actualy used in the drawing? > Then the message could be distorted or hidden as > described above, for piggy-backing on an innocent- > looking document issued, I suspect they'll wonder why that particular file is so much larger than the other graphics files with the same number of layers. > 7. Big shortcoming: how to securely transmit the location > (virtual coordinates) of the hidden message and what Look for the pixel that has the unique color mapped onto it. > 8. Medium shortcoming: Full-featured CAD programs are > expensive, however, the popular lite versions are cheap > and can usually read the pricier output. And can't handle more than a few dozen colors and limited layering. This suggestion is unworkable in application. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Voice Coding Controls
by John Young 17 Dec '03

17 Dec '03

DM notes of the BXA Wassenaar rule for voice coding: After looking at some of the Wassenaar docs, I was surprised to see that the CCL wants to regulate speech encoders that operate at less than 2400 bps. Surprising because it was encoding, not encryption, that was being regulated. This is disturbing. This at first seemed to put some of the Nautilus development team's software in jeopardy, but I believe that by the letter of the law (or regulation) that all coders in Nautilus are not subject to the CCL, as they only go as low as 2400 bps and not less than. For citations of voice coding in Category 5 - Telecommunications: http://jya.com/bxa-wa-cat5.htm#5A001b10 http://jya.com/bxa-wa-cat5.htm#5A991b6a

1 0

Re: non-transferable signatures (Re: Crypto Kong penetration.)
by James A. Donald 17 Dec '03

17 Dec '03

-- At 10:48 PM 1/16/98 +0000, Steve Mynott wrote: > SMIME of course despite bad cypherpunk karma is easy and > maybe even works between mailers. Easy indeed, if all the keys from Verisign are correct and secured. It is indeed very easy to use SMIME. To use it so that it actually accomplishes the intended result is not so easy. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG Np4QfrajG+6u2ZHUc2AFBH0uTX9nCJxCUi7E2bpk 3CGDysj2FaqaZYBM4bRe6dvLCkbb0ltwLns5aFPQ9 --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the state. http://www.jim.com/jamesd/

1 0

Re: CAD Stego (fwd)
by John Young 17 Dec '03

17 Dec '03

Jim Choate wrote: >This suggestion is unworkable in application. Why the focus on color, the easiest thing to avoid using, or layers, ditto? Superfluous for serious CAD, these dainty decorations from Martha Stewartville. Most messages could be concealed in "hatched" objects, bit-bloated as they are, indistinguishable from the elements used to hatch. All black and white; maybe a dot of red for cashmere dupe. In fact, CAD is so bloated with dumb cad-jockey features, and sleazebag work-monitoring logs, it puts most ordinary programs (even air-boss MS) to shame, and could hide a herd of rustled Mex longhorns as easily as the Bush family hides dryhole oil reserves, without any more trickery than sandpapering new boots to look worn. Anyway, Jim, I gather from your remarks that you've not fiddled for endless low-paid months and years to figure out how to cheat the evil bosses and automatic work-snoop feature, while onion-siphoning the Net for horny fare under guise of urgent file transfer to foam-mouth ne'erpays. Underground (so to speak) swapping of digital work avoidance tips is a huge use of global bandwidth riding on the backs of big fat docs for globular structures for maggoty thugs. (Although not nearly as gigantic as the porn trade stego-supporting Net infrastructre growth -- over 50% of Net traffic and rocketing.) Who knows how much illicit info is riding the porn river in and out of the most secure sanctums of tyrants?

1 0

let's do it: NYT ad with hash of fingerprints (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 23:21:38 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: let's do it: NYT ad with hash of fingerprints > I would have thought you would take out a cheap personals section > advertisement and print one hash output and a URL. The hash ouput > would be the hash of the hashes of a chosen set of public key > fingerprints. This doesn't provide the same sort of protection the original full page ad is supposed to provide. That full page ad will be accessible as a referenc a hundred years from now in just about every library in the country. The link to a webpage won't be. Distinctly different security animals. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

No Subject
by wabe 17 Dec '03

17 Dec '03

This is an e-mail which I am intentionally muddling by making it have very long lines and stuff. I plan on saving this too, to analyze later and try to recreate using some sort of silly "delete the misplaced carriage return" later. I'm not going to sign it though. So Bill Payne has the black box to sneakers but he won't publish it for fear the NSA will use it to read his e-mail and also because they pissed him off by trying to silence his critisisms of the way they handled something with Iran or something? I don't read legaleze very well.... -wabe

1 0

eternity economics (Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 21:40:28 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: eternity economics (Re: (eternity) Eternity as a secure filesystem/backup medium > Eternity helps here in that it obscures the poster's identity, and > reduces their exposure in that they personally don't have to send as > many messages. Eternity also helps ensure continued availability, at > least while somebody is funding that availability. True enough, the question becomes who does that continued funding help the most? > Releasing the data themselves is problematic. They may not wish to > accept the risk. Eternity provides a way to pay someone else to take > the risks in ensuring availability. Really? What is the difference? Mallet attacks the server itself who has only the resources available from the source, which I believe can assume safely, which is obviously less than the resource set of those who could actualy act upon or impliment the data under discussion. > The users is getting value for money from the eternity servers -- the > eternity server is providing the service of risk taking. Yes, at bargain basement prices that allow, if not even promote, a daddy warbucks to walk in and up the ante above what the source can pay. No, the source payment mechanism does not promote either server honesty or long term existance of controversial data. We're going round and round here, as I said earlier the views are diametricaly opposite. I would suggest we drop this discussion and let us see what happens over the next few years as it is clear that many people are working on different implimentations. Let's let the market decide which works best. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: how to release code if the programmer is a target for (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 15:15:22 -0600 (CST) > From: "Uhh...this is Joe [Randall Farmer]" <rfarmer(a)HiWAAY.net> > Subject: Re: how to release code if the programmer is a target for (fwd) > > Where does this random user come from? > > Why does it matter? As long as she's competent enough to choose good verifiers > and verify that those verifiers verified the code in question, it all works out > in the end. Because whether she is a honest user or one who is intent on subverting the system is relevant and must be taken into account. > We don't. There is no way to operate without *some* trust; I disagree. I believe it is possible to create a system which is secure and provably so, irrespective of something as nebulous as 'trust'. > Might be, but this code has to be more than just understood -- it must be > painstakingly checked for subtle flaws and bugs. Welcome to the world of > adversarial quality control. Been there it's part of what I do for a living, it's fun. > > Which doesn't effect the ability of Mallet to resign that code at the users > > end in order to break the users local security. > > Unless you're exposing a new weakness in the trust model PGP uses, Mallet can't > do that, providing the user has done good key authentication and hasn't listed > one of Mallet's goons as a trusted code-verifier. This is true if Mallet is attacking the key system, it is not strictly true if Mallet is attacking a specific user. > Yup, that's why the user has to check it by hand. Then the Eternity model is doomed to fail. 90%+ of users who might want to use a data haven model don't have a clue as to how it works or how to actualy check it. > Well, if you can't verify it yourself and you can't trust other people to > verify it, my advice is to give up; you cannot be sure of *any* public keys I disagree, though I am not able to prove it at this time. > keys; any sig you check might be signed by one of Mallet's keys. My point exactly. As with Adam, it feels like we are beginning to go around and around with nothing new to add. I would suggest that we drop the issue for the moment and come back to it at a later time with a little more reflection. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Signed document - a thought... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 21:06:28 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: Re: Signed document - a thought... > Sounds like you are describing something which is a variant of an > interlock protocol. The idea of an interlock protocol is that you > send out first a hash of what you are intending to publish. > > The MITM has a problem in deciding what to publish, because they have > to publish _a_ hash, but they don't know what it should be of. Exactly. I hadn't heard of the term 'interlock protocol', thanks for the tip. I'll look into it some more. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: let's do it: NYT ad with hash of fingerprints (fwd)
by John Young 17 Dec '03

17 Dec '03

Jim Choate wrote: >This doesn't provide the same sort of protection the original full page ad >is supposed to provide. That full page ad will be accessible as a reference >a hundred years from now in just about every library in the country. The >link to a webpage won't be. Printed ads are sometimes not archived as widely as news articles, due to the cost of reproduction, distribution and storage. The same is true, though, of personals and other types of throwaways. One possibility is to buy an ad on the NYT Front Page which is often sent as an image around the world separately from the full paper, and on which one can buy a tiny ad for about $800 for two lines of text 32 characters long (ID must be included). That's the rate for a one-timer. Adam, could you reduce the requisite gob to fit 64 characters? Each extra line runs about $300. However, bear in mind that a news article is cheaper and will be archived for eternity (until Asteroid Endall); cheaper, that is, if you can pukedrunk a reviler.

2 1

Re: let's do it: NYT ad with hash of fingerprints (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 20:04:40 -0500 > From: John Young <jya(a)pipeline.com> > Subject: Re: let's do it: NYT ad with hash of fingerprints (fwd) > Printed ads are sometimes not archived as widely as news articles, due > to the cost of reproduction, distribution and storage. My experience with libraries is that they subscribe to the entire paper. Place it in their archives and then at some time in the future micro-fiche the whole paper. I have never seen a library that picked and chose what got archived in their paper morgue's. I have done research on newspapers going all the way back to the civil war, I have yet to find one that wasn't archived in toto, ads and all. > The same is true, though, of personals and other types of throwaways. True but the point was that the data these short ads point to is *not* archived by the same entity or necessarily any entity. Is your webpage being archived by your local library? I be the New York Times is. > Adam, could you reduce the requisite gob to fit 64 characters? Each extra > line runs about $300. Your going to compress 100 cypherpunks 64-bit keys (I prefer 128-bit) down to 64 characters without data loss? I wanna see *that* compression algorithm. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Onion routing
by ulf＠fitug.de 17 Dec '03

17 Dec '03

To protect against timing analysis, Onion routing uses encrypted and padded links, and the connection between the user and his local onion router is assumed to be secure. Obviously, padding offers protection against external adversaries only. The onion routers themselves know when an anonymous connection is opened, how much data is transferred, and when it is closed. So in contrast to the mix net (where it is sufficient to use one honest mix in a chain), honest onion routers that are used between two cooperating onion routers do not offer additional protection. Onion routers have a fixed number of neighbours. If the first onion router does not have any honest neighbours, there is no anonymity. Generally, the maximal connected component of honest onion routers forms the anonymity set. Does that mean that every onion router needs to maintain many encrypted links, or is there a more efficient solution?

4 4

NTY compression proposal
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It has been proposed to compress the keys from 100 cypherpunks down to a 64 character add in the NYT. Let's consider the math a moment to determine if this is realizable. Each key will require some sort of identifier, to make it simple lets assume 8 characters to identify the cypherpunks and 8 bytes to represent their key (64-bits). This mean that each line will contain 16 bytes. With a hundred entries that is 1600 bytes or 12800 bits. Now 64 characters of text in a newspaper represents approx. 64 6-bit characters (we can't use a full 8-bit because the paper doesn't normaly support that many characters in normal text). This provides us with 384 bits. The proposal leads to a requirement for an algorithm with an average compression factor of: 12800/384 or 33.33:1 with no data loss. That's a pretty hefty compression factor for average responce. Is there a loss-less algorithm which provides this level? ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Barry Smith (FBI) to speak on encryption policy
by Dr. Alan Sherman 17 Dec '03

17 Dec '03

The UMBC Security Technology Research Group presents A Law-Enforcement Perspective on Encryption Policy Barry Smith Supervisory Special Agent, FBI moderated by journalist Peter Wayner 3:30pm - 5:00pm Friday, March 6, 1998 Lecture Hall V (LOCATION SUBJECT TO CHANGE) University of Maryland, Baltimore County http://www.cs.umbc.edu/events/spring98/crypto.shtml The second lecture and discussion in a two-part forum on encryption policy. Journalist Peter Wayner will introduce and moderate the event, which is free and open to the public. In Part I, freedom activist John Gilmore and Fritz Fielding (Ex-Associate General Councel, NSA) gave their divergent views, focusing on the Burnstein case. Barry Smith will articulate the needs of law enforcement to conduct lawful wiretaps; he will advocate the use of key-recovery techniques to achieve this end as a way that provides adequate privacy to law-abiding citizens. Schedule: The event will begin with a brief (10 minute) introduction by Peter Wayner. Following Barry Smith's talk, which will last approximately 45 minutes, there will be an opportunity to ask questions for approximately 20-30 minutes. Questions: Attendees are encouraged to ask questions in advance by sending email to sherman(a)cs.umbc.edu Directions: Take Exit #47B off interstate I-95 and follow signs to UMBC. LH V is on the 100-level of the Engineering Computer Science (ECS) Building, directly behind the University Center. There is a visitor's parking lot near the I-95 entrance to UMBC. Host: Dr. Alan T. Sherman Associate Professor, Computer Science sherman(a)cs.umbc.edu http://www.umbc.edu (410) 455-2666 This event is held in cooperation with the UMBC Intellectual Sports Council Honors College Phi Beta Kappa honors society CMSC Council of Majors IFSM Council of Majors

1 0

movie "good will hunting"
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

highly recommend this movie, "good will hunting". excellent script that will leave you startled at times. plot is that a young kid from a very rough background who is a janitor at MIT seems to be a math genius possibly on the level of Ramanujan. reason I am posting here: there's a really great rant by the character at one point as he sits in an office with an NSA rep and a medal-laced general and insults them about a job offer in the agency to work under classified conditions. the NSA rep offers him math research into state of the art theory but requires that the work be classified. I think there is a line about how the NSA has 7 times the budget of the CIA but they don't like to make that well known. (one might say it was sort of a rant on the morality of confidentiality. <g>) if anyone would care to tape this and post a transcript I think it would be very interesting to other cpunks. its a rare reference to NSA in the popular media. of course not on the level of "sneakers" as far as crypto references, but an interesting snippet nonetheless, and I think that some people here might identify a lot with the protagonist.

1 0

Re: CAD Stego (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 21:37:28 -0500 > From: John Young <jya(a)pipeline.com> > Subject: Re: CAD Stego (fwd) > Why the focus on color, the easiest thing to avoid using, > or layers, ditto? Superfluous for serious CAD, these > dainty decorations from Martha Stewartville. The reason I addressed them is that they were what you brought up. Those dainty decorations are critical to every industrial use of CAD that I have ever been exposed to or used in an industrial setting. I'll have to disagree with your opinion on their utility. > Most messages could be concealed in "hatched" objects, > bit-bloated as they are, indistinguishable from the elements > used to hatch. All black and white; maybe a dot of red for > cashmere dupe. Ok, let's address hatching from the perspective of use as a means to encrypt data. Let's further use AutoCAD since it is by far the most used in industrial settings. I think you will find that most other CAD programs use one or more of the methods in AutoCAD. AutoCAD offers a standard set of hatching objects via the HATCH and BHATCH commands. In both cases the actual hatch patterns are 1-bit patterns meant to be tiled. The HATCH command itself is normaly used for gross backgrounds and such because it doesn't respect object boundaries. The BHATCH command does respect object boundaries and is used much more in industrial and machine drafting. In both cases the color of both the background and line color must be specified. The hatching pattern is then simply tiled across the appropriate area. It is possible to add other non-standard hatch patterns but again, they are 1-bit deep and tend to be regular so there isn't a lot of room to put data. It is possible to include AutoLisp routines to do such hashing but I fail to see how one would stego encrypted data in source code describing how to draw the pattern. There are two means to store reference to those patterns in a file. The first is simply to include a pointer to a standard table of hash patterns that every copy of the program will understand. I suspect that there isn't much room there for stego. Now if we extend the standard hash table we are required to include those hash patterns in our file and suitable coding to tell the foreign program to include them appropriately. I don't see a lot of room there for stego. The alternate is to include the actual hash pattern in the file specificaly not linked to the hash table, in other words an indpendant object we will manipulate through normal mechanisms. While I will agree that if you could guarantee that Mallet didn't actualy view the file as a graphic but rather as a file via some sort of character editor (eg od -c or od -h as the simplest) there isn't much room for getting caught. However, if you were to bring it up as a graphic and view it you find the actual hash pattern is limited because it can be of only a particular size for the hashing display and handling routines to handle. CAD programs at their basest level understand a limited set of objects; coordinate pairs, sets of such pairs for drawing lines, and color. Other geometric objects (eg circles or hatches) are usualy built up through some sort of algorithmic application of these basic objects. In the better CAD programs those objects are routines that are shared as standard functions in the program or through a cookie-cutter mechanism. The way new functions are added is to add some form of PDL (eg AutoLisp) function. The cookie-cutter mechanism usualy is limited by the 1-bit depth and the limited size of the patterns. Let's look at the mechanism that most CAD and graphics programs use for color manipulation. In very few programs that I have ever come across are the colors of each pixel actualy represented by some depth that allows the full range of colors for every pixel. In general some color map mechanism that takes a limited set of colors (usualy arrayed in a table) and allows the program to select a given color from that table. Such special effects as color cycling are created by writing a program that dynamicaly changes the color stored in each member of that table. This is very fast and allows every pixel for a given color to change in concert instead of the delay of having to go to every pixel and test its color and then change it; very slow. The way that most programs allow more colors than allowed by a given color table is they create some sort of interrupt for each line of the dispaly when the display gets a retrace pulse. When this pulse happens (on a 1024 x 768 it occurs every 1/768 seconds - a long time by computer standards) a routine changes the color map to the one appropriate for that line of the display. Some higher performance displays use a d/a mechanism so that each pixel on the display is addressible. These sorts of displays allow the color map to be changed for each pixel but they are very expensive in hardware and list price, both tend to limit the applicability to commen stego exchange outside a limited group. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: let's do it: NYT ad with hash of fingerprints (fwd)
by John Young 17 Dec '03

17 Dec '03

Adam Back wrote: >What do you mean that you must include ID? Someone must give an email >address, or phone number? Should be ok to fit one of those in the >remaining 24 - 32 chars. ID once meant name, address and telephone number, now a name, tel num and e-mail is okay (along with "Advt"). The NYT claims it owes this to its readers to show who's not who. The "ads" are called "reader notices" by the NYT, which calls to verify the bona fides of the purchaser. And they will not publish everything requested (no vitriol, darn it). There's vetting but mawky pleas swing the censor, indeed, the vetter seems to boost haywire to keep the mad buying. Is that not a Brit legacy, too? Here's the poop for arrangements (as of 1/96): Reader Notice The New York Times 226 West 43rd Street New York, NY 10036 Vox: 1-800-421-4571 Fax: 201-343-6703

3 2

Re: NTY compression proposal (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

All editing errors are my own, I re-formatted the original text to better address the points. Forwarded message: > Date: Sun, 18 Jan 1998 19:17:32 -0800 > From: Steve Schear <schear(a)lvdi.net> > Subject: Re: NTY compression proposal > Compression efficiency depends upon > 1) the entropy of the input data We are looking at selecting 100 64-bit keys out of a set of 2^64, that is not a lot of opportunity there, given a random key generation process, for a lot of commen patterns in the key set. If we don't have a lot of commen patterns in the text we don't get a lot of compression. > 2) the allowable losses In this case we can't afford any loss. > 3) finding an efficient algorithm to code for that entropy. Which if we do the math requires something in the neighborhood of 33:1, for a loss-less algorithm that's a pretty hurky boundary condition. > I think I'm on fairly firm ground assuming that key data entropy is very= > high and therefore little or no compressible is feasible. My point exactly, which would lead us to the conclusion that our requirement of a 33:1 compression factor is not realizable. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Future War on TDL...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Check out Futurewar on The Discovery Channel, it's been playing since 8pm Central. Bruce Sterling appears for a blipvert. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

ashcroft on encryption
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Sun, 18 Jan 98 17:51:16 -0500 From: vols-fan(a)juno.com (R L Johnson) To: ignition-point(a)majordomo.pobox.com Subject: IP: Senator Wants Back Door to Encrypted Data Closed http://www.wired.com/news/news/politics/story/9661.html Senator Wants Back Door to Encrypted Data Closed Reuters 3:15pm 14.Jan.98.PST WASHINGTON - Sounding the opening bell of a renewed battle over encryption policy, Senate Republican John D. Ashcroft has declared he would oppose legislation that would mandate that all software made in the Unites States be equipped with features that would allow government access to all encrypted data. "Americans must be free to communicate privately, without the government listening in," Ashcroft said in a statement Tuesday. "The privacy concerns here are fundamental and call for serious consideration by the Senate." The Missouri Republican said he would hold a hearing next month on the issue in the Senate Judiciary's Constitution, Federalism, and Property Rights subcommittee he chairs. Ashcroft's remarks followed a battle last year in Congress over regulation of encryption technology, which scrambles information and renders it unreadable without a password or software "key." Encryption has become an increasingly critical means of securing electronic commerce and communications on the Internet. But the scrambling capability can also be used by criminals to hide their dealings from law enforcement agencies. A bill approved by the Senate Commerce Committee last year would impose strong incentives to promote the use of encryption with a back door to allow covert government decoding of any information. And legislation approved by some committees in the House would go even further, requiring the back door in all products sold in the United States. Ashcroft said he opposed the Senate measure, sponsored by Bob Kerrey, Democrat of Nebraska, and John McCain, Republican of Arizona. Majority Leader Trent Lott asked Ashcroft to "pay special attention" to the issue, Ashcroft said. ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: subscribe ignition-point email@address or unsubscribe ignition-point email@address ********************************************** http://www.telepath.com/believer ********************************************** ------- End of Forwarded Message

1 0

Interlock Protocol
by Jim Choate 17 Dec '03

17 Dec '03

Hi, The Interlock Protocal (Applied Crypto 2nd. ed., pp. 49) is just exactly what I have been looking for to address the MITM issues in regards the data haven model I have been working on. I had completely forgotten about this technique. I should read AC more often...;) Thanks again for the pointer! ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0