December 2003 - cypherpunks-legacy

e$, Liquidity, and Economic Granularity
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Flame-bait warning. The last week or so, I've been trying to cobble together some business models for electronic commerce, particularly how the banking system fits in. I'm posting some of the more far-out stuff for discussion here. To get here, I've had to thrash some stuff that's probably obvious to the cypher-gerontocracy. I beg their indulgence in advance, because some of the stuff I'm going to yak about probably has been been said here numerous times in prehistory. I'd like pointers to those discussions, FAQs(?), etc. as I couldn't find specific mention of them in the file heirarchy at soda. As it is, I've bumped into some interesting stuff to me, and thought I'd share... Hokay... Here goes. One of the things I like about e$ is that strong crypto provides the linkages to disperse it into quite small units and still reunite quite usefully into big batches for the purposes of financial markets. This is necessary, because like all technology, successful new stuff usually creates a superset of the old stuff. It has to offer the same functionality and add a significant improvement. Here's how. Let's start with where people keep their money. It can be said that given the size of a bank's average retail demand deposit account, and the interest and fees on those accounts, it might at some time behoove people to keep their disposable money *in cash* on a personal hard drive somewhere, probably at home, and probably backed up offsite for security. The principal reasons that people have checking/savings accounts these days are pretty much as follows: 1. to protect that money from theft, 2. to be able to conveniently safely spend that money in small increments with checks or with ATM cards, 3. (recently) to be paid through direct-deposit mechanisms, 4. to get interest on the money while it sits there. I think that reasons 1,2, and 3 can be taken care of with e$ protocols, and that for most demand deposits, 4 is not meaningful because fees outweigh interest most of the time. You might as well keep your money at home. Like a lot of other things, retail demand deposits are largely an industrial phenomenon. With e$, information technology does to banking what it did with the industrial telephone network. A heirarchical network is replaced with a geodesic one, and demand deposits, except as concentrator points for large institutional cash distributions, cease to be meaningful in an economic sense for individuals. When people accumulate surplus money (:-)) and want to sell that money to an entity in the financial community, the transaction can be taken care of with automated secure transmissions of e$. Organizational concentrations caused by efficiencies of scale would tend to dissapate as well. Imagine if Peter Lynch's replacement(s?) could run Magellan as he saw fit and had all his fund concentration and distribution activity taken care of automatically without the cost of the Fidelity administrative armature. He'd still drive a multi-billion dollar fund. His customers would still hold shares of Magellan. However, those customers would be doing business with an automated digital cash transaction server, which would take their money or redeem their digital shares of Magellan for it's current market value following whatever redemption criteria exist in the funds prospectus and deposit agreement. The disbursement/concentration code's already there in Sybase and on the Heavy Iron (yes, it's still there...). The user interface just needs changing. With a digital cash transaction server, there is no need to train a cast of thousands of clean-scrubbed young econ majors to answer the phone. (Fidelity Joke: "Camp Fido. It's a great place to work if you're parents can afford to send you there.") Grove's Law tells us the iron keeps getting smaller. So, our Lynch-analog could (in theory) have a small cash transaction server handling his client relations while spent his time looking out the window at Marblehead, at his Quotron-replacement, or at his collection of Ren-n-Stimpy cartoons. With e$, the capital markets could still operate the way they always do, but with more functionality. The growth of communications technology originally allowed financial information to move more quickly. Then, centralized information technology allowed transactions to be processed more quickly. Finally, distributed information technology allowed decisions to be made more quickly. The increased functionality contributed by strong crypto enables decision-making ability to be pushed out of investment firms and onto the network, the same way that automated switching technology created more more nodes in the telephone network. Here's how that could happen. Most serious individual equity investors know what p/e ratios and book values are, and what they mean. Software can allow them to understand and manipulate fixed-income concepts like duration, convexity and total return. This means that people can do more and more sophisticated things with their money and get better returns. The first limitation for sophisticated individual transactions is small transaction size. However, it's possible to see how if they're trading on their own, investors could take "physical" delivery of e$-based investment instruments. A person's "portfolio" could consist of various "securities" physically resident on a storage medium that they physically control. Because of the automation of transactions allowed by this kind of "physical delivery", the minimum certificate sizes could come down for the most common securities. For uncommon securities or market strategies, it is possible to envision the ability to anonymously concentrate large purchases of various positions, much in the way odd-lot trades are consolidated in the equity markets today. The second limitation is the ability to securely communicate these transctions with the markets. I suppose that's a straw man to those on this list, but as you've probably guessed, this is the most important part. Strong crypto allows you to send money and money equivalents over the network with the confidence that it doesn't get waylayed. Thats *real* important for the efficient function of capital markets. ;-). I bet that the roles of the really important players in the capital markets won't really change much. Portfolio managers still function like editors. They add value by synthesizing information. The people on the sell side, the investment bankers, securitizers, and pool-builders, etc. all still create securities so that markets can cope with technological change in information technology. (A charitable way of looking at *those* guys, anyway...) The thing that holds this all together is strong encryption and it's various offspring, including digital cash and other forms of e$. This crypto-stuff has a lot of really spiffy applications in finance and financial operations. I *love* this place.... ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

DECLINE AND FALL
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com SS> The important issue for Cypherpunks is how we should respond to this SS> seemingly inevitable increased mobility of capital. Does it pose a SS> threat to privacy? I'd say that those moving the money around the world would be deeply interested in privacy - their own. Not necessarily for nefarious reasons, but to protect the competition from knowing what they are doing. A 800-pound gorilla like the Fidelity Magellan Fund takes elaborate precautions to not alert the market as to what they are buying and selling. Thus, I assume, they deeply value their own privacy. Will the capital moving about the world be hostile to cypherpunks et al? I doubt it. Instead, they'll probably cherry-pick the best of crypto technology and use it for themselves. Besides, big money generally isn't thrilled by governments and usually views national boundaries as an annoyance, a view shared by many on the Net. * RM 1.4 B0037 *

1 0

Re: OJ`S CELL PHONE
by peter honeyman 17 Dec '03

17 Dec '03

a cellular phone that is turned on is in periodic contact with the local antenna. certainly the cellular provider knows what cell a mobile phone is in; that's how calls are directed. in fact, anyone can monitor the paging channel to make a primitive tracking device. (some folks on this list know much more about this ... perhaps they'll speak up.) peter

1 0

Re: MAIL: anon mailing list
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Say somebody wants to run a mailing list as you propose. I think they > should just run the list at the same address unless the remailers can > suitably pad, delay, and randomize incoming messages and redirect them > to the true list site (but then delay and randomization may lead to > loss of coherency on the list ;). If not, surely external observation >of the contact point will show where all the messages are headed. Hmm. I'd think that if the list address were an encrypted remailer path with several hops, it would be non-trivial to find the contact point by external observation. Would it even be possible? Regretably, probably so. An additional layer of security could be having the list address underneath all of the encrypted remailer stuff be an anon address at the server in Finland. Although it's probably quite easy to to determine your true address by external observation of anon.penet.fi, unfortunately. Still, the combination of chained encrypted remailer paths, and the finnish anon server would definitely make it dificult to determine the contact point. But I guess not as dificult as I had hoped. > The resources needed would be higher than a normal list since each > incoming message would need to be checked for a digital signature (or > the list could become victim to an anonymous mail bomber, and you Yeah, quite true. It would be impractical for a very large list. At least, if you wanted a list with more then maybe 70 members, you'd need to dedicate some machine to it, probably. Although maybe not; I don't want to concede that until it's actually tried to see how much proccesing power is required in practice. :) And yeah, it would take users who were actually committed to doing it, as most users of _this_ list (including me), don't even sign their messages, as you point out. If we won't even sign our messages, then I don't know who is going to be willing to sign, encrypt, append remailer path, to it. Although I guess if the list required it, as it would, then people might join the list and do the stuff, just for the principle of it. And automated shell scripts certainly help. You could have an automated shell script particularly for the mailing list that took cleartext, encrypted it to the list, signed it, appended the remailer stuff to the front, and sent it off to the proper remailer.

1 0

PC RND generator based on physical random
by jp＠jep.pld.ttu.ee 17 Dec '03

17 Dec '03

What you need is natural source of random. I have used clocking higher speed quarz generator with lower speed (10 x is ok ) unstable frequency oscillator and then taken parity of the result (4-5 bits is enough for most situations, depends of cource on distribution of LF generator values) . Variable Freq. oscillator is RC and higher quarz. Now as we are not willing to give up card slot (and PCB board area ands so on ) for just RND generator maybe it is good to find existing source of random in PC itself. So - do we have RC generator in PC? YES. We have 4 of them, to be exact. Most of us do not make much use of these ports, because most games do not support them correctly. But anyhow, joystick ports are there. IO card costs 10$ if you have not already got one. So I propose scheme for PC RND generator: 1. Make LF generator using Joystick ports 2. Use HF oscilltor of PC clock ( Program Execution, if any interrupts occur, it is no problem). 3. Find out the distribution of LF oscillator and calculate the needed Parity filter size. ( By parity filter I concider parity values of N last bits) 4. Use it

1 0

Hardware RNGs
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

pfarrell(a)cs.gmu.edu: > up IRQs, port addresses, etc. Does this suggest that a > Plug-n-play board would be more attractive? Just build it, on any platform. The key is the RNG, not the interface, which can be easily adapted to market demands. I take it that you don't plan to invest millions of dollars to start up, so _which_ interface you use first is not crucial ;-) There have been too many "let's do this" suggestions that degenerate into a discussion of the smallest details and disappear all together... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Neural nets crack RSA? AAARRGHH!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Jim choate <ravage(a)bga.com>: > As far as I am concerned if it could be done w/ a neural network, or Ouch. Neural networks are _deterministic_ (except, possibly, analog VLSI ones such as Mead's). Digital neural networks can't do _anything_ that cannot be done by algorithms; they run on Turing machines too. Why neural networks are 'magical' as Perry says, in certain classes of problems, is that they provide a way to perform complex algorithmic funtions through a relatively simple interface to humans. In any case, how "fuzzy" do you allow your relative magnitude function to be? Even if a function exists that compares keys with a magnitude difference of the order of 100 bits, it's useless. For your binary search method to work, this comparator function would have to be accurate when the difference is on the order of just 1 bit. Yeah, quantum computers ;-) ----------------From owner-cypherpunks Mon Jun 20 10:33:41 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA20571; Mon, 20 Jun 94 10:33:41 PDT Received: from src.honeywell.com (moon.src.honeywell.com) by toad.com id AA20548; Mon, 20 Jun 94 10:33:24 PDT Received: from tbird.src.honeywell.com by src.honeywell.com (4.1/smail2.6.3/SRCv0.25); Mon, 20 Jun 94 12:33:26 CDT id AA02136 for cypherpunks(a)toad.com at toad.com Posted-Date: Mon, 20 Jun 94 12:33:15 CDT Received: by tbird.src.honeywell.com (4.1/SMI-3.2) id AA29883; Mon, 20 Jun 94 12:33:15 CDT Date: Mon, 20 Jun 94 12:33:15 CDT From: bergstro(a)src.honeywell.com (Pete Bergstrom) Message-Id: <9406201733.AA29883(a)tbird.src.honeywell.com> To: cypherpunks(a)toad.com Subject: re: MAIL: secure mail Sender: owner-cypherpunks(a)toad.com Precedence: bulk >>>>> On Sat, 18 Jun 1994 21:05:04 -0500 (CDT), Karl Lui Barrus <klbarrus(a)owlnet.rice.edu> said: > What I've tried is to do a "|pgp -feat ecarp|rmail erc%khijol(a)apple.com", > but pgp just produces empty files! If I execute it by hand, it works. > Anyone know either (1) why it isn't working wnd how to fix it, or (2) > suggect a better alternative? > The problem may be this: pgp needs a path. > Try "| PGPPATH=/whatever pgp -feat ecarp | rmail erc%khijol(a)apple.com" > This is what I needed to do when I tried something similar with mh > and slocal. Keep in mind that if you have a site that follows CERT advisories, there are usually restrictions on which programs may be used to filter mail. My site requires a sysadmin to put an entry in a config file to allow any filter programs to work at all. One standard filtering program that works well is procmail. This will typically be "approved" by default and should keep your (Ed's) admin from having to be involved in your incoming mail. Pete

1 0

Stealth Crypto (Was: Re: Andy Grove on Clipper)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 2:28 AM 06/20/94 -0400, Ed Carp [Sysadmin] wrote: >I've read about (with interest) the so-called "stealth viruses", and how they >adapt to their environment - might crypto do the same thing? There is no way to to translate the idea that I can see. Stealth viruses work by patching the interrupts that AV programs watch- (on a PC- Macs and other platforms are conceptually different) INT 21h, etc. and the file attributes repoting mechanisms in DOS, and lie. It is hardware specific, and I don't see anyway to translate the concept to a networked environment in order to fool 'traffic cops.' I wonder about the mutation engine concept, though... -j

1 0

Hardware RNG's
by John A. Thomas 17 Dec '03

17 Dec '03

Pat Farrell and others have been discussing hardware random-number generators. Since I've built such devices, I thought I'd put in my opinions. I used a reverse-biased transistor junction for the noise source. The noise is amplified by a three-stage op-amp circuit with about 60 dB of voltage gain in the passband and a 3-dB bandwith of 10 Hz - 3 KHz. A spectrum analyzer shows the noise is random, with no frequencies standing out more than others. The analog noise feeds an op-amp comparator wired as a zero-crossing detector. The output is a logic level which switches randomly, but on average, on and off about 50% of the time, respectively. This logic level gates a 5 MHz TTL oscillator, producing bursts of pulses of random length. These pulses are counted by an 8-bit counter, producing random 8-bit numbers. The outputs of the counter are latched and read through a PC bi-directional parallel port. Allowing the slowest changing bit to turn over 10 times between samples suggests a maximum sampling rate of 1000 bytes/sec. The chi-square test and the runs tests on these samples show very good statistical properties. For large samples (> 100,000 bytes), there seems to be a slight predominance of "one" bits (e.g. 0.6% difference). This is probably due to some factor in the sampling process which I haven't figured out yet. Anyway, exclusively-or'ing successive samples together removes this bias. I'd appreciate any ideas about this. I don't know what practical use this device has, except for those who need one-time pads, but it was fun to hack up and test. John A. Thomas b858jt(a)utarlvm1.uta.edu 75236.3536(a)compuserve.com PGP key available on request

2 1

Re: Crypto export legislation defeated in House Intelligence Cmte.
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> Brief update: The report is expected tomorrow. Initial > news from Intelligence Committee staffers is that the > crypto provisions of H.R. 3937 were axed with an > unbelievable 13-0 unanimous vote... > Has the official report been placed online, and if so, where? Thanks, Jim_Miller(a)suite.com

1 0

Re: Re:
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>The cypherpunks mailing list has once again been mysteriously purged. > >I've been receiving mail from cypherpunks all morning. > >-- >Lefty (lefty(a)apple.com) >C:.M:.C:., D:.O:.D:. I've received nothing. Nada. Zero

1 0

Re: Andy Grove on Clipper
by Stuart Smith 17 Dec '03

17 Dec '03

> > Not if you use Stealth for PGP which I released a few months ago after > > persuading "Henry Hastur" to write it. They can't *tell* it' non-compliant > > crypto. Sophisticated steganography is now needed however, since most noise in > > the digital domain is not white noise, like a Stealth PGP message would be (or > > at least different than normal digital noise). But even more so is needed nice > > Mac and Windows interfaces for the system that you can send to a friend, on a > > floppy. I suggest a voice mail utility. Then a critical mass is not even > > needed (security through obscurity). Remember, "Encryption always wins." They > > can't outlaw noise. > > True, but I think that the <insert name of your favorite spook agency here> > would have it's hands on any method almost as soon as it hits the streets. > I'd be interested in getting a copy to play with, but I'm curious - the methods > to validate that you have a proper message have to be there, anyway, and that > would seem to be your undoing. If you have to validate it, it can be scanned > for -- that's how they find viruses these days, too. Does your method take > that into consideration? I could imagine a future where, like viruses, crypto > used "adaptive crypto" or "adaptive signatures" to hide itself from detection... Well, I've played with stealth briefly, along with a few other interesting utilities, and it does look good. i.e. there is no way to validate proper messages. If you feed noise/junk/whatever into stealth, it will give you a pgp encoded message back. Every picture posted to alt.binaries.pictures.* could be run through stealth and a pgp file would result. Find which ones *really* were pgp files to begin with.. good luck.. What we have to worry about is making sure there is no way to identify the data that pgp puts out itself. That is, the encrypted data and the encrypted IDEA key. If I gave you random samples of noise and told you that one of them was an IDEA key encrypted by an RSA key, you shouldn't be able to pick it out. -- Baba baby mama shaggy papa baba bro baba rock a shaggy baba sister shag saggy hey doc baba baby shaggy hey baba can you dig it baba baba E7 E3 90 7E 16 2E F3 45 * 28 24 2E C6 03 02 37 5C Stuart Smith <stu(a)nemesis.wimsey.com>

1 0

REMAIL: Remailer that only remails to other remailers
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

One of the problems in convincing people to run remailers is that they don't want to have to deal with complaints. Someone posted awhile ago that they would be willing to run a remailer that would only remail to other remailers. This would enhance the security of remailer chains while not creating too many political problems for sensitive sysadmins. If anyone's still interested, here's how to do it: ftp cs.cmu.edu cd /afs/andrew.cmu.edu/usr12/mg5n/public get ghio.cp.remailer.tar.gz This is a copy of the remailer that I run on kaiwan. gunzip and untar it. Modify remailer and sendlatents with the proper directory names for your system. Now, you need to modify a line at the end of block.c. Change if (match==0) printf("%s",argv[1]); to if (match!=0) printf("%s",argv[1]); Now it is a pass-address filter instead of a block-address filter. Now put the addresses that you want the remailer to be able to send to in blocked.addresses (you can rename the file in the remailer csh script.) Now create a PGP key for your remailer, set up a .forward file to 'remailer' and you're all set...

1 0

Majordomo
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Was it my breath, or did Majordomo go down again? ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

No Subject
by John Young 17 Dec '03

17 Dec '03

How can I check a newly downloaded PGP2.6 to verify that it is tamper-free before use and back-up? John Young

1 0

CYPHERPUNK OPERATIVE
by Sandy Sandfort 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Okay, somebody needs to fess up. I *know* someone on the Cypherpunks Channel is writing about the Clipper Chip and other crypto-privacy issues for /Expat World/. I thought I was the only one who had even heard of this newsletter for expatriates until I saw some of the crypto articles. Whoever it is, is doing a great job. In the June 15 issue, in the article, "How Big Brother Wants to LIsten, Too," the writer coined the term "Al Gorewellian." Gotta love it. If the writer of these articles is reading this note, please let us know who you are. You deserve the recognition. (If you want to keep a low profile, how 'bout sending me private e-mail? I'd like to discuss some things with you.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLgYBPU5ULTXct1IzAQEINgQAhzypoIDVoX5bad9Vd8psttmS5ClRbKqr vNA7L88jallJzrmUL5NZv6SO7NPAFxQzC2bnS2KJv4MpyRFl+ZYIku2cQZfQWShY 3TLUXuqK9HVHED7rCzq3Xq1Kny/fZZ9U74PSLe8fi+L9xsL5Ht0yDEmBYCG3REkv J0npF+9FCHw= =xgFs -----END PGP SIGNATURE-----

1 0

Real truth about Cell phone tracking
by rusty＠hodge.com 17 Dec '03

17 Dec '03

1. Cellular phones "register" (the proper term) themselves whenever they move into a new cell (the coverage area provided by a base or tower - not the proper term. They do this by scanning the control channels when the current one falls below a certian signal strength. If you have cellular monitoring equipment, you will see the registration confirmations transmitted on the control channel, complete with the MIN (mobile identification number, or cellular phone number). The MTSO (mobile telephone switching office) knows what MINs are registered in each cell at a given time. 1a. A cellular phone can be "tracked" if it is turned on. It does not have to be in use. 2. If you are in a fixed position, and your phone is going between service and no service modes, you are at the edge of coverage area, and some of the time the control channel is falling below the scan threshold. It then tries to register with another cell and another until it is successful. It is scanning control channels when the no service lite is on. 3. There is a test mode defined in the NAMPS standard that causes a phone to begin transmitting on a designated frequency. And since the mouthpiece on a cellular phone is not switched off when the phone is on hook, you can easily bug someone's car this way. 4. Many of the cellular-based vehicle tracking systems only use the cellular phone to transmit data back to company headquarters, and do not determine location via triangulation or doppler direction finding techniques. These are not reliable enough for moving targets due to all the RF reflections. Also, my (limited) experience with doppler-based triangulation DFing shows how hard it is to DF a modulated FM signal. And since all cellular phones are transmitting a SAT tone (a 6kHz-ish supervisory audio tone) all the time, I think this would be very hard to do. 5. In major metro areas, individual cells cover extremely small areas... often every mile or two on the freeway, you will see another cell site. So you know exactly where to send a helicopter to. 6. For under $1000, you can buy a box which hooks up to a PC and controls a scanner and decodes the cellular control channels (and reverse channel data too). This includes software for following cellular calls as they hop from cell to cell, paging requests (get a phones attention), and displaying the MINs that register in a given cell (or cells, but you need one receiver for each cell you are monitoring!). 7. From the moment your phone starts ringing, there is an audio path back to the MTSO. When your phone is ringing, it has been assigned a channel and is transmitting. Pressing the send button to answer the phone sends a signal to the MTSO telling the switch to connect the landline to the channel the phone is on. This is especially evident on Ericcison switches (like LA Cellular uses). -- Rusty Hodge <rusty(a)hodge.com>

1 0

Re: Real truth about Cell phone tracking
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Rusty Hodge <rusty(a)hodge.com> : 3. There is a test mode defined in the NAMPS standard that causes a phone : to begin transmitting on a designated frequency. And since the mouthpiece : on a cellular phone is not switched off when the phone is on hook, you can : easily bug someone's car this way. Woo! Built-in infinity-transmitter mode! (Just like ISDN actually) : 6. For under $1000, you can buy a box which hooks up to a PC and controls a : scanner and decodes the cellular control channels (and reverse channel data : too). This includes software for following cellular calls as they hop from : cell to cell, paging requests (get a phones attention), and displaying the : MINs that register in a given cell (or cells, but you need one receiver for : each cell you are monitoring!). These are selling on the black market over here in Britain for 3 or 4 K pounds. People who buy them use them to close phones, then sell time on the cloned phone over a weekend before it's discovered. G

1 0

List wiped AGAIN?
by Michael Handler 17 Dec '03

17 Dec '03

I thought it had been a little quiet... then I saw the subscriber list. Any idea *why* this keeps happening? -------------------------------------------------------------------------- Michael Brandt Handler <grendel(a)netaxs.com> Philadelphia, PA PGP v2.6 public key on request Boycott PSI, Inc. & Canter & Siegel <<NSA>> 1984: We're Behind Schedule

1 0

Re: Crypto export legislation defeated in House Intelligence Cmte.
by Claborne, Chris at ScrippsRanc 17 Dec '03

17 Dec '03

> So much for lobbying. > > Look, something is going on here that doesn't meet the eye. Nothing is > ever unanimous in Washington. These guys were told something by somebody > that caused them to vote like this. You can bet it had nothing to do with > terrorists, drug pushers, or pedophiles. Why don't you expend > some effort to find out what they were told and by whom so we could learn > what this issue is really about because it is NOT about "national security". > Think about it... If you've had the ability to listen to any voice or e-mail traffic you felt like with a simple telco set or inexpensive computer any time, anywhere you felt like, wouldn't you put up a fight? It's like trying to take a gun from a NRA member. Once you have a freedom to do something you aren't going to give up easy. It's only going to be more difficult since NSA, and other three letter orgs are part of the government. Our metro-police, FBI, CIA, XXX, have been able to tap phone and e-mail (illegally or with court permission, or in the name of "national security") as easy as plugging in a toaster. Once citizens start using crypto systems, these three letter orgs are going to have to work for a living. OK, so a crook is using crypto in his communications. Most are so stupid, getting the keys won't be that hard and even better... the crook will still think his comm link is secure. I'll stop here with my arguments for dropping the barriers to crypto. For NSA, finding the right string to pull is probably real easy. The only thing we can do is continue to apply pressure at all fronts. Educating the general public is on one front. EFF has other fronts. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Re: Beware of Roman Catholic Corruption
by gbe＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Don't let them lure you into following them into Hell. The 1611 > Authorized (King James) Version of the Holy Bible is the only book > that God ever wrote. All other alleged translations are frauds > written by the Devil himself. So what version of the scriptures did Jesus quote from? Gary B. Edstrom | Sequoia Software | PGP fingerprint: Internet: gbe(a)netcom.com | Programming Services | 2F F6 1B 28 6E A6 09 6C CompuServe: 72677,564 | P.O. Box 9573 | B0 EA 9E 4C C4 C6 7D 46 Fax: 1-818-247-6046 | Glendale, CA 91226 | Key available via finger What is PGP? Subscribe to alt.security.pgp and find out! -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLgaIwkHZYsvlkKnJAQHfJAP+NBbcCDGzobs2IKuBCro9+Cka9VtMrbqi NQY1SZRv6ZMUb7UwF5dd6J0rPJCwjzs9bLNWDxG643BHww0LWlc8+jfw0N6eZX7U jYeso6+jKwSA3+sVfygyI5WTOUe5dUqFQfzHuxDFzZrgej3eejLw16WiwuCRpViL sk345Pw5dQQ= =SlzJ -----END PGP SIGNATURE-----

1 0

Re: Having your own computer means never having....
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >Beyond that, unrestrained encryption is dangerous to corporations, because > >what's to stop a ticked off employee from encrypting everything in the office > > What to stop him/her from shredding everything in the office? This is a > personnel/legal problem; there's nothing special about the use of > cryptography (except that it might be reversable). Reversability is the main difference - the disgruntled fired ex-sysadmin can encrypt everything and promise to restore it for big bucks plus amnesty. On the other hand, hiding the backup tapes and shredding everything is relatively reversable as well, and has the advantage that you can threaten to sell it to the competitors, so it's not much different. When I was an undergrad, an ex-sysadmin left the University, and a week or so after he was gone, the database system announced that it would self-destruct in a week. They had to keep the system shut down for a couple of weeks and change the system clock while they hunted for the time-bomb, and the same sort of thing could be done in many modern systems without crypto, though crypto makes it easier.

2 1

ADMIN: MajorDomo Meltdown
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

Humm, seems as I have my work cut out for me tonight, as majordomo zeroed out the list again and is having problems with it's temp files (filling up a second disk here at toad.com) Eric Hughes and I freed up 15 megs on the disk where majordomo keeps the cypherpunks list, and I tought that would give me the time to do the fix right (and speend the weekend not hacking...). Turns out that the disk filled up again tonight, this time with 12+ megs of bounce messages from Cypherpunks subscribers durring the last 9 days. Seems we have some major problems to solve still with the basic mail list technology. I have 11 hours to make a major meeting, so I am going to go back to hacking the software and see how much I can get running tonight. I will install a backup from a few days ago, some of you will have duplacates that we will have to remove yet again, sigh, thats the way it goes. If you have futher questions or problems, please contact me. ||ugh Daniel Muchtimes Postmaster hugh(a)toad.com

2 1

Re: Keep Out--The Journal of Electronic Privacy
by John.Schofield＠f903.n102.z1.fidonet.org 17 Dec '03

17 Dec '03

rr> About "Keep Out": you might want to be more precise in your blurbs. As rr> things stand, I'm leery of trusting anything I might see in rr> your journal. rr> RSA is not broken, as far as I know. If you have verifiable details that rr> it has, that'll be quite a scoop. If you meant to say "the _factoring_ of rr> RSA-129," well, you should have said that instead. My apologies to the net. RSA is certainly not broken, and I was aware of that when this press release was written. My word choice was sloppy. In the article, the information comes from people I have interviewed who have direct, first-hand knowledge of the effort--people like Arjen Lenstra, who wrote the software that made the factoring possible. rr> > * An interview with Phil Zimmermann, including his thoughts on rr> privacy in the digital age, export controls on cryptography, the rr> copyright on RSA (the algorithm used in PGP), and information on his rr> struggle with US Customs over exporting PGP rr> A publisher, of all people, really needs to understand what a copyright rr> is. Note that we cannot copyright ideas, only our expression of those rr> ideas. Referring to a copyright on "the algorithm used in PGP" is rr> nonsense. Instead, PKP holds licensing rights to a system _patent_ on rr> using RSA to perform public key encryption. Again, I used sloppy language. And again, my apologies. This is certainly not the last mistake I will make. There will be errors in Keep Out. However, I will do my damndest to make sure Keep Out remains as accurate and unbiased as it can be. And when I make mistakes, I trust Cypherpunks to let me know about them, so I don't repeat the mistakes. It's a damn sure bet I won't be making these two errors again! --John Schofield -- : John Schofield - via mcws.fidonet.org - Public Access (213)256-8371 : ARPA/INTERNET: John.Schofield(a)f903.n102.z1.fidonet.org : UUCP: ...!cheshire!mcws!903!John.Schofield : Compu$erve: >internet:John.Schofield@f903.n102.z1.fidonet.org

1 0

ADMIN: Test message
by hugh 17 Dec '03

17 Dec '03

This should only be goin to the list maintainers. ||ugh Daniel

1 0