December 2003 - cypherpunks-legacy

OKC Bomber, or Cowardly Lion? / Re: IRS sending warning notes, violating ECPA?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Kent Crispin wrote: > > Anon pissed out: > > > I am just as certain that Tim has made a conscious decision as to > > >what level of risk he is willing to take to speak his mind and perhaps > > >make a difference in the events of his time, without merely being > > >egoistical, stupid, and suicidal. > As anon clearly points out, Tim toes the line with his speech, > carefully avoiding saying anything that escapes constitutional > protection. ... > Yes, Tim talks a brave talk. But... But...? ...he doesn't cut his dick off with an axe, to show how brave he is? ...he doesn't phone up the DEA and tell them, "I'm shooting heroin, but please don't raid my house?" ...he doesn't take out an ad in the New York Times to announce that he will be nuking D.C. at 4 p.m. on Friday? I once built a bar in Austin, Texas, named "Crazy Bob's Saloon." I put a diving board on top of the 1 1/2 story building and put an old bathtub on the sidewalk below, which I filled with water. All week long we advertised that at noon, on Grand Opening Day, Crazy Bob was going to jump off the diving board, and into the bathtub full of water. During our Grand Opening, 12 noon rolled around and Crazy Bob walked outside, with everyone following him. Crazy Bob looked up at the diving board, then looked down at the bathtub full of water. He looked back up at the diving board, once again, and back down at the bathtub full of water. Then he turned to the crowd, and said, "Folks, they call me _Crazy_ Bob, not _Stupid_ Bob!" Then we all went back inside and partied down. At the end of the night, when everybody had gone home, Crazy Bob and I took a bottle of whiskey up to the rooftop, had some drinks and discussed the fact that, as a man of honour, he was obligated to make the dive, despite the fact that the "sheeple" were more than satisfied by having an entertaining story to go home and tell their friends. Did he make the dive? It's nobody's business but his own. I was there, and at the right time, in the right place, with the right amount of liquor in me and a full moon egging me on, I just might tell you. But, regardless, it would still really be nobody's business except for Crazy Bob's. Perhaps Tim May is the _real_ OKC bomber, or perhaps he is the cowardly lion. (cringing when "Toto" barks :>) Whether Tim "walks his talk" or not is not my business, nor is it Kent's, or anyone else's business. One's public words may reflect their personal anthem, their own flag/values/beliefs, or their words may be merely the braying of mules. What matters is the value, or lack thereof, that we may personally glean from those words, to our own edification or detriment. However, the "rack" is not a "bicycle built for two." When we are put on the rack, to test the strength of our beliefs, then the pain, the certainty or doubt, the salvation or degredation, are all our own. I enjoy the outrageously strong opinions which do battle on the CypherPunks list, and I even have a mail folder titled, "CyberPissing," in which I save the posts which contain classic cheap-shots. I respect those who stand up for what they believe in and are not hesitant about attacking the faults they find in the logic or beliefs of others on the list. I consider it a "public service" when others take a shot that points out my errors/hypocrisy/stupidity, etc. It gives me the opportunity to say, "They are right. I should adjust my belief/attitude.", or say, "They are right, but so the fuck what? It is my personal predeliction to be an asshole about this, and it suits me just fine." It is my personal view, however, that the line between difference of outlook/opinion and spurious, personal slander is crossed when one stoops to denigrate the character of another list member by accusing them of what might be "conscious evils" such as comfortable cowardice, willful hypocrisy, or determined stupidity. Perhaps I will break down on the "rack" and deny all of my strongly held beliefs, but please don't accuse me of being a boastful coward who only holds to my beliefs when it is "safe" to do so. I may hold views which fail to remain consistent when measured against standards that reflect the knowledge and experience of others, but please don't accuse me of willfully attempting to espouse my views only to my benefit and at the expense of others. Sometimes I'm a fucking idiot and probably ought to be taken out and shot, but I strive to come by my stupidity "honestly," and not to use stupidity as an "excuse" to do evil. Tim May is a grouchy old CypherPunk with an itchy trigger finger and Kent Crispin has suffered the misfortune of having the the government secretly implant silicon chips in his brain that flash random images of current and past senators, congressmen and presidents repeating, "I am not a crook...I am not a crook..." I am certain that each of them is equally certain of their beliefs, and the decision as to which of them would make the world a better place by using the Dr. Kevorkian Gift Certificate I sent them for Christmas lies in the hands of the individuals who support or oppose their stance on various issues. My personal opinon is that we should "Kill them both, and let TruthMonger sort them out." Of course, I may be biased in this regard. After all, I am... TruthMonger

2 1

Re: EU Data Protection
by James A. Donald 17 Dec '03

17 Dec '03

At 08:13 PM 8/11/95 +0100, Derek Bell wrote: >In message <199508041840.OAA01729(a)clark.net>, Ray Cromwell writes: > What worries me about the *lack* of some form of data protection >legislation is that is allows someone to build up a database of information >which is a mishmash of truth, misunderstandings and lies. How would you feel if >"Concerned Citizens against Cryptography" compiled a list of all members >of this list, branding them as `dangerous, possibily criminal subversives'? It is called freedom of speech and freedom of association. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

MS BuoysTBS to Buy CBS?
by John Young 17 Dec '03

17 Dec '03

Here is an amusing AP headline from 8:30 PM EDT. Anybody know if it's a joke, or care? Microsoft Reportedly Considers Buying $1 Billion To $2 Billion Stake In Turner Broadcasting; Deal Would Help Turner Make Bid For CBS.

1 0

Re: Yet another self-labeling system (do you remember -L18?)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 02:05 PM 7/26/97 -0400,James Love wrote: > Suppose on the other hand that someone had a page that people thought >should have a rating=adult tag. Well, the person who didn't use the tag >would just have to deal with whatever crap you would get for not >labeling. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^ That's not voulntary, as Tim stated. >If you thought your site had some constitutional right not to >label the content adult, then just don't label it. I really don't think >this will be that big an issue, Unless you believe that voluntary ratings in order to get listed in a search engine are wrong. >but I don't know (no one knows). I >think that a significant percent of porn sites would use the >rating=adult label in a second if they thought it would get people off >their back. Those that didn't use the label could just put up with the >consequences, whatever they are. I would expect (and hope) that the >rating=adult label would be used infrequently, mostly for sites >involving explicit sexual images. I don't think a rating=adult label >would be much of a barrier to teenagers who wanted access to this type >of material, since one could download a browsers in a few minutes that >wouldn't block the data. But like a childproof top on aspirin, it would >work pretty well with pre-teens, I imagine. Some pre-teens are smarter than that, and may thwart the system. Whose fault it it then if they see a page with porn on it? > Well, I for one don't like a Y=7 type system. It involves too much >information from the person rating the wage page. The more precision >you put in a rating system, the more trouble you get in. Keep it >simple, very simple. What if someone was a sex with sheep web site, >unlabeled? I don't care much. I wouldn't be surprised, however, if >Yahoo didn't give them the prominent listing they wanted, in the absence >of the rating=adult label. Therefore, don't use yahoo. Use one that doesn't promote censorship. > Maybe. Maybe not. Maybe it would "solve" the problem, without >legislation. I think it would be nice if the problem was solved >without legislation. But if the problem (and I think there is a problem) >isn't solved voluntarily, don't be shocked when Congress acts. And I won't be shocked when the Supreme court strikes that down. The problem can be solved, just let parents monitor their kids access. If that happened, there would be no need for this censorware and rating crap. > Are you calling me a lazy parent? What is the obligation of a >parent? To supervise a kids web browsing? Please, I think kids are >better off with more privacy, and less parental (and teacher) >supervision when they browse the web. Well, if they have that privacy, they often go to a site with images that some people consider obscene. That's when the parents, unable to accept their mistake for not being responsible, blame the webpage's author. > This simply isn't true. A lot of support for content labeling, >including systems which I find appalling, is from fairly typical >parents. This isn't a right wing or born again issue. Those parents probably are lazy in the first place. > Nothing will satisfy everyone. But reasonable people will support >reasonable solutions, and it might be the case that there are enough >reasonble people around to come up with a resonable system. You seem to favor the "Let's just do this to avoid hassle" thing that law enforcement and government types try to promote. If we were to, "avoid the hassle" with webpage ratings, we might as well "avoid the hassle" of using PGP and such so that we don't anger the government anymore. I'm not labeling my webpage, and no dickhead is going to tell me to.

2 1

some points on weak codes
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

various points have been made about the undesirability of weak voice scrambling mechanisms. I'd like to advance the position that the use of trivially-broken codes is better than no codes at all, as long as the owner is aware of the distinction. one of the goals of cypherpunks is not necessarily to get a secure world (that is a *long* term goal), but to get a world in which people are aware of the issues that cypherpunks are interested in. Encryption, privacy, etc. now, along these lines, even a widespread trivially broken code penetration would be better than none at all. this is a similar concept to that advocated by someone else on this list, namely PRZ's manual that talks about how you shouldn't use PGP on a shared system, and how you should only exchange keys in person, as being a little to extreme for the common man, for whom insecure crypto, along with the *understanding* that it is not totally secure. I think everyone here agrees on long term goals of widespread encryption penetration. but one way to bridge that gap is to just have "toy crypto". I see this deroated frequently on the list but it is probably a very, very valuable public relations mechanism. I mean, it's hard to imagine that in politics that distributing little plastic symbols called "buttons" would have any social effect, yet it has persisted since the invention of buttons. things like a cheap "purple" kit, promoted by the cypherpunks, not foolproof but easy to build and cheap to buy, would advance the agenda in the long run in a very valuable way. what we need to do is give people a variety of options to the interested public laypeople, just like Ford and that anecdote demonstrates. are we saying, "you can have any crypto that you want, as long as the NSA can't break it in 1000 years"? that's the equivalent of saying, "you can have any car you want, as long as its black". we must resist the illusion that there are only 2 kinds of crypto: insecure or secure. there is a continuum of crypto, and casual users should not have to worry about the capabilities of the NSA. IMHO we are sabotaging our main goals, launching into a deep discussion of the NSA's supercomputers and the theory of numbers whenever a newbie asks about what is available. again, weak crypto is probably better than no crypto in most cases, just because it helps improve public awareness. people can't even comprehend the idea of what is "weak" or what is "strong" until they even have a mental framework of what they are dealing with. ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | : : : : : : Vladimir Z. Nuri : : : : <vznuri(a)netcom.com> \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html

1 0

Re: Significance of PGPFone?
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:51 AM 8/12/95 -0700, you wrote: >* Finally, I have a "fax modem" on my Macintosh, as many of you do. Guess >what? I went and got a real fax machine. Lots of reasons. First, my fax >modem had to be installed just right...if inits or preferences got subtly >shifted, it stopped working properly. Second, sending things was a bitch. >(Had to have the scanner up and working, which was not often, etc.) Third, >robustness. We've got a box sitting next to the laser printer that receives faxes and prints them on real paper, which is more reliable (and quieter and lower-powered) than leaving the computer on, though it does require leaving the printer on. But for outgoing faxes, much of what I send is from the computer anyway, so it's less of a problem (though, without a scanner, I'm more likely to only fax stuff that I generated on the computer than drive to Kinkos...) Perhaps we also need to build PGPfax? #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

New Crypto Application
by Guillotine 17 Dec '03

17 Dec '03

Greetings fellow Cyphers... I'm creating a new _text_ cryptography program. The encryption algorithm, using a symmetrical is going to be as strong as legally allowed, and after copyrighting the program, I'm going to release the source code and explain everything about it (since it can be reverse engineered anyways). The reason I'm sending this e-mail to you is my request for more knowledge, and if you're like me, then you have an extreme thirst for knowledge! Any algorithm, key hashing, user interface, or other important suggestions you might have will help me immensely, and hey, maybe you'll get a free copy of this program when it comes out, but otherwise you will just have to wait until someone cracks the copyprotection because I'm going to make that extremely hard to do. I was going to call the program AlphaNumeric Encryption, but that says pretty much nothing... I might just call it something like Cipher Pad (or Cypher Pad if nobody cares that I use "cypher") , since it's only for text encryption. If you have a better idea for a name for this program, then please suggest it to me. Thanks, Guillotine

11 12

IETF working to define a public key infrastructure
by Rich Salz 17 Dec '03

17 Dec '03

Help define the internet's web of trust model ... >From: "warwick (w.s.) ford" <wford(a)bnr.ca> Message-Id: <"21210 Sat Aug 12 15:15:59 1995"@bnr.ca> To: pem-dev(a)tis.com, cat-ietf(a)mit.edu, ipsec(a)ans.net, e-payment(a)cc.bellcore.com, www-security(a)ns2.rutgers.edu, ietf-payments(a)cc.bellcore.com, pki-twg(a)nist.gov Subject: Proposal for New IETF WG on PKI Over the past couple of weeks, a group of interested individuals has been putting together a proposal for a new IETF Working Group to develop Internet standards for an X.509-based public-key infrastructure. The result is the draft WG Charter attached below. Since plans were announced last year to form this WG (and to shut down the PEM WG) it is considered reasonable to start up the new WG without the usual preliminary BOF at the next IETF. Steve Kent and I have offered our services to co-chair this group, and Chandra Shrivastava has offered to run a mailing list. The following mailing list has now been established for discussion of this proposal: ietf-pkix(a)tandem.com. To subscribe to the mailing list, send a messsage to listserv(a)tandem.com with the following in the body: subscribe <e-mail address> ietf-pkix Warwick Ford -------------------------------------------------------------------- Public-Key Infrastructure (X.509) Group IETF Working Group Charter --------------------------------------- Chair(s): Applications Area Director(s) Area Advisor: Mailing lists: General Discussion: To Subscribe: In Body: Archive: Description of Working Group: Many Internet protocols and applications which use the Internet employ public-key technology for security purposes and require a public-key infrastructure (PKI) to securely deliver public keys to widely-distributed users or systems. The X.509 standard constitutes a widely-accepted basis for such an infrastructure, defining data formats and procedures related to distribution of public keys via certificates digitally signed by certification authorities (CAs). RFC 1422 specified the basis of an X.509-based PKI, targeted primarily at satisfying the needs of Internet Privacy Enhanced Mail (PEM). Since RFC 1422 was issued, application requirements for an Internet PKI have broadened tremendously, and the capabilities of X.509 have advanced with the development of standards defining the X.509 version 3 certificate and version 2 certificate revocation list (CRL). The task of the Working Group will be to develop Internet standards needed to support an X.509-based PKI. The goal of this PKI will be to facilitate the use of X.509 certificates in multiple applications which make use of the Internet and to promote interoperability between different implementations choosing to make use of X.509 certificates. The resulting PKI is intended to provide a framework which will support a range of trust/hierarchy environments and a range of usage environments (RFC1422 is an example of one such model). Candidate applications to be served by this PKI include, but are not limited to, PEM, MOSS, GSS-API mechanisms (e.g., SPKM), ipsec protocols, Internet payment protocols, and www protocols. This project will not preclude use of non-infrastructural public-key distribution techniques nor of non-X.509 PKIs by such applications. Efforts will be made to coordinate with the IETF White Pages (X.500/WHOIS++) project. The group will focus on tailoring and profiling the features available in the v3 X.509 certificate to best match the requirements and characteristics of the Internet environment. Other topics to be addressed potentially include: - Alternatives for CA-to-CA certification links and structures, including guidelines for constraints - Revocation alternatives, including profiling of X.509 v2 CRL extensions - Certificate and CRL distribution options (X.500-based, non-X.500-based) - Guidelines for policy definition and registration - Administrative protocols and procedures, including certificate generation, revocation notification, cross-certification, and key-pair updating - Naming and name forms (how entities are identified, e.g., email address, URN, DN, misc.) Goals and Milestones: Sep, 95 Agreement on draft Working Group charter Nov, 95 Completion of initial strawman PKI specification Dec, 95 First Working Group meeting (Dallas IETF) Jul, 96 Submit PKI (X.509) specification for consideration as Proposed standard.

1 0

EYE_see
by John Young 17 Dec '03

17 Dec '03

8-13-95. NYPaper: "One Source, Many Ideas In Foster Case: Publisher Bankrolls Cover Up Theories." The theory of a Vincent Foster murder and a cover-up has been promoted by a handful of foundations and publications united by a common denominator: the money of Richard Mellon Scaife. "The death of Vincent Foster: I think that's the Rosetta Stone to the whole Clinton Administration," said Mr. Scaife, a newspaper publisher with half a billion dollars in the bank, during a two-hour interview. EYE_see (about 5K)

1 0

No Subject
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous says .... >will someone just CUT THE @#$%^&* FOSTER CONSPIRACY THEORIES?? >I'm getting F---ING SICK AND TIRED of all the BULL**** that and says.... >any good drill instructer. oh yes, so many of you pansies >need to get into a serious digital BOOT camp. learn some real and says... >"mind masturbating and drug fondling" parties every few >days with all the Hoi Poilloi Holier-Than-Thou pricks of >the world, the "cum of the net" ejaculating all over each >other, hehehehehehe what a bunch of effeminate nobodies... and says... >the most scurrilous swine for taking up PARRY's time with >your filling up this mailing list with GARBAGE? TRASH? >EXCREMENT? ODIOUS EFFLUVIA??? don't you know that it cuts and says... >UNIX SOFTWARE AND HOW TO WRITE A CORRECT DNS LOOKUP VIA >SOCKET LIBRARIES. are we cypherpunks, or cypherprogrammers? >GET A CLUE, PEOPLE. and says... >I'M GOING TO MAILBOMB THE WHOLE LIST. that'll teach the >@#$^%^&* bastards to mess with MY VALUABLE TIME. I say: Anonymous, you could learn to relax a little. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMC0LjI4k1+54BopBAQGGBwQAgovXJ5zJKFWs8h/hdwOW91MT22BBZwCf jo9WRwzuM2x6C2cDPM5ti5V0CNEG5RY64jXbd6By4At5ALN1Y671Mb2Eh51c9K6R EjG0Ihm1um0Knv50fsta0UqcH5r9YHl1AZAVAe2f7xPPYBA6M/0f5S7KUGhfcOgX yqX8pM5pKOI= =efaH -----END PGP SIGNATURE----- -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

1 0

Why does the feed always get hosed on a weekend?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It seems that everytime majordomo goes down is on a weekend. Why is that? - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMC5K9yoZzwIn1bdtAQH3igF+OiLvo0hfV8cGyATot6QF82UZVVc8JMTm yfoD6JSv0bUondWXt/4kVk/cUzEWFOz7 =/FnW -----END PGP SIGNATURE-----

1 0

SKIP (Security on the IP Layer) Sources
by Germano Caronni 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello everybody, I am not in the cyberpunks mailing list, but I feel you might perhaps be interested in this: the Swiss version of SKIP is now available as a pre-alpha source code release for IRIX, NetBSD, Nextstep and Solaris. You may get it from ftp://ktik0.ethz.ch/~ftp/pub/packages/skip. Have fun, Germano Excerpt from the README: ======================================================================== This is ENskip, pre-alpha 0.10. ENskip is a security module for the TCP/IP stack. It provides encryption, authentication and sequencing of packets on the IP layer between two or more machines. For more information on the SKIP protocol, see the Internet Draft draft-ietf-ipsec-aziz-skip-00.txt and following. You might also want to check http://skip.incog.com for information about the background, the protocol itself and future directions of it. ENskip is pre-alpha. If you are not absolutely sure what this is all about, you might want to read the draft, and perhaps reconsider using this package. No bug-fixes, installation help or any other support is granted. If you have any suggestions, comments or contributions to make ENskip work better, mail to skip(a)tik.ee.ethz.ch. Enjoy! M. Hauber and Ch. Schneider G. Caronni ======================================================================= - -- <...cookie space for rent...> Germano Caronni caronni(a)tik.ee.ethz.ch http://www.tik.ee.ethz.ch/~caronni PGP-Key-ID:7B7AE5E1 997C6DC4AF930A5D2D5D6AEAA196C33B -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMC5akrH8jId7euXhAQE2ugQApLxGxEyzZ3+dj+nC/QSoW97fErMevWcY pJ96Ge2Jk6Ct06qMgIsuQCEY8/SA9iZX4VYe7Pmg/orvc2kStgs3ApeV97ocLoWo 8YzFRH06K/X6Vrrps8vSBy0vtUD2FGQWvbiUviNDnN2O2kf7FqyoNbX3lIzdHQBF NVhs/+bMqHQ= =gozW -----END PGP SIGNATURE-----

1 0

Who Else is Reading your Email? (From Cu Digest, #7.67)
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Normally, I don't like reposting things to this list. However, I am going to report this from the most recent version of CuD, because I think it hits a very important nail right on the head. Not just that PGP is going, but it puts all of the terms we on this list have been bantering around for the last couple of years into ones that laymen can understand. I sincerely thing that this is the kind of push we need to make as a whole to bring about social change on the net (and social change is what is needed). Ie, PGP is good because 1) it keeps people from reading your email (like an envelope) and 2) it makes sure nobody forges your messages by allowing you to digitally sign them. Anyways, sorry for the report, please flame lightly :-) - --------------------------------------------------------------------- Date: Wed, 09 Aug 1995 19:25:49 -0400 From: kkc(a)INTERLOG.COM(K.K. Campbell) Subject: File 1--Who Else is Reading your Email? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye WEEKLY June 29 1995 Toronto's arts newspaper .....free every Thursday ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye.NET eye.NET WHO ELSE IS READING YOUR EMAIL? Part 1 of a 2-part series on PGP by K.K. CAMPBELL I recently conducted an overseas interview with a "computer security person at a highly sensitive facility." Mr. Security explained that the potential misuse of the computer resources of this site was a serious concern, a danger to thousands. This instilled in him a peppery dash of paranoia about who was using what machine for what purpose. In discussing this, the name of a certain, rather net.famous individual arose. I was surprised to learn this individual was well-known in international security circles. This individual is considered a "risk." I was informed that this person's email is "monitored." To spell it out: people were reading and collecting all the email the "risk" wrote. Without the target's knowledge. Without any form of warrant. Most netters think such intrusion involves someone "hacking a password." Wrong. When you hit the "send" command for email, your missive seems to (poof!) magically appear in the recipient's mailbox. Person to person. The ultimate intimacy. Wrong again. Email is actually passed through a number of computers. The operator of one of those machines can effortlessly read your email. Any one who "breaks into" such a machine can inspect your mail. Once in, they can tamper with files so that all your email is copied to another location, without you being aware of it. But not everyone wants to "break into" a computer. In the above case, email was copied "in transit." When email is transferred from machine to machine, it is made readable. So if you intercept a copy (through "sniffers"), you can read it. Everything this individual had written over the last couple of years has apparently been intercepted and read. His file is huge. With Canada news media in a tizzy about "regulating the net," how long before CSIS requests funds to start collecting posts with buzzwords in the network data flow? POSTCARDS It should be the first lesson every newbie learns: email ain't secure. An email is like a postcard: it travels through the many sets of hands in delivery and any set of hands can read it if so inclined. Most postal employees don't, for two reasons: there is so much mail they haven't the time, and most postcards are so boring, who the hell wants to? The same goes with the system administrators who oversee the shunting around of all your cyberscribbling. Most don't snoop, but some do. Need I remind you that, er, sysadmins are not a monolithically mature-and-well-adjusted breed imbued with highly developed moral principles... What can you, the lowly downtrodden, rights-less end-user, do? You have three strategies: -- no precautions: who cares if anyone reads what you write/receive; -- minimal coding, easy to crack, but enough to stop casual snoops -- kind of like "virtual envelopes"; and -- PGP. PGP stands for Pretty Good Privacy -- a humble title to be sure, considering that the U.S. government/military wants to ban the thing. And why? Because PGP has the power to thwart their zillion-dollar spy efforts by imbuing everyday folk with the cryptographic might of the best "puzzle palaces" around the world. The elegantly powerful encryption device is the offspring of Colorado resident Phil Zimmermann (prz(a)acm.org) He basically took all the (very public) papers on cryptography, stirred it together and voil=E1: instant "threat to democracy" -- if you buy the government/military propaganda. (More on Zimmermann and the cryptographic spook backlash next issue [below].) What PGP does is solve that decades old spy/cryptography dilemma: How can one send secure messages to absolute strangers over an insecure medium? PGP exploits two historical developments: -- home computers gave commoners the computational power to use the sophisticated cryptography algorithms; and -- the advent of public key encryption in the late '70s bade farewell to Ilya Kuryakin and Napoleon Solo. Computers were originally designed (back in World War II) to be sophisticated code breakers. Today, government/military bureaucracy (especially in the U.S.) still operate with that attitude: computer cryptography is a military weapon. In those Cold War days, the only way to send secure messages over insecure channels (telegraphs, phones, mail, etc.) was to first deliver a "cryptographic key" via secure channels. The key was something like a little code book; the secure delivery channel was usually a dour-faced courier with a black bag handcuffed to his wrist. "Deliver this or die doing so, 007..." BE AN INTERNATIONAL ARMS DEALER! Governments and mega-corps could afford to send satchel-toting couriers overseas, but us proles had little hope of doing that. So citizens were always vulnerable to mail-opening, phone-tapping spooks. PGP uses two keys -- a public key and a secret key. Anyone can use your public key to encrypt a message to you, and only you can then decrypt it with your secret key. As long as your secret key remains secret, no one can read that message -- not even the person who encrypted. The idea is to spread your public key around in Key Exchanges, like phone books. For details on this complex subject, try _PGP: Pretty Good Privacy_ by Simson Garfinkel (O'Reilly & Assoc., http://www.ora.com, $29.95 paper). Or _The Computer Privacy Handbook_ (Peachpit Press, http://www.peachpit.com/peachpit, $31.95 paper). Both go beyond technical details and delve into the sociopolitical issues around privacy. Where can you get PGP? All around the world. PGP is freeware -- you can use it endlessly without cost. But remember: The U.S. State Department export restrictions classify cryptographic materials to be munitions. Exporting it from the U.S. is a serious matter. For those uninterested in becoming international arms smugglers, do an Archie search for "PGP" or try Toronto's Interlog at ftp://ftp.interlog.com/pub/pgp . Read newsgroups alt.security.pgp and sci.crypt for discussions. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMC5FqjokqlyVGmCFAQEIogQAqMhbVQnCI9ElX0rVYQO/7cuY+YWqLQhh 9bZOsis9Tfp2ko9KJ9Dpek8wHo/I3ODCPbY3flxwE/q6ogU1DJvJXYzWtc7fmbOH QI2038hRnnt8bsMei/WQEunuo5iGCAzrTuOG/PkfkB2GsM4/5b6jaHlWCCSIdGoz JzyXt0dMJoE= =kR1W -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Who Else is Reading your Email? (From Cu Digest, #7.67)
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm resending this message because I think it's important and because the list went down again but appears to be back up now. :-) ======================================================================== Normally, I don't like reposting things to this list. However, I am going to report this from the most recent version of CuD, because I think it hits a very important nail right on the head. Not just that PGP is going, but it puts all of the terms we on this list have been bantering around for the last couple of years into ones that laymen can understand. I sincerely thing that this is the kind of push we need to make as a whole to bring about social change on the net (and social change is what is needed). Ie, PGP is good because 1) it keeps people from reading your email (like an envelope) and 2) it makes sure nobody forges your messages by allowing you to digitally sign them. Anyways, sorry for the report, please flame lightly :-) - --------------------------------------------------------------------- Date: Wed, 09 Aug 1995 19:25:49 -0400 From: kkc(a)INTERLOG.COM(K.K. Campbell) Subject: File 1--Who Else is Reading your Email? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye WEEKLY June 29 1995 Toronto's arts newspaper .....free every Thursday ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye.NET eye.NET WHO ELSE IS READING YOUR EMAIL? Part 1 of a 2-part series on PGP by K.K. CAMPBELL I recently conducted an overseas interview with a "computer security person at a highly sensitive facility." Mr. Security explained that the potential misuse of the computer resources of this site was a serious concern, a danger to thousands. This instilled in him a peppery dash of paranoia about who was using what machine for what purpose. In discussing this, the name of a certain, rather net.famous individual arose. I was surprised to learn this individual was well-known in international security circles. This individual is considered a "risk." I was informed that this person's email is "monitored." To spell it out: people were reading and collecting all the email the "risk" wrote. Without the target's knowledge. Without any form of warrant. Most netters think such intrusion involves someone "hacking a password." Wrong. When you hit the "send" command for email, your missive seems to (poof!) magically appear in the recipient's mailbox. Person to person. The ultimate intimacy. Wrong again. Email is actually passed through a number of computers. The operator of one of those machines can effortlessly read your email. Any one who "breaks into" such a machine can inspect your mail. Once in, they can tamper with files so that all your email is copied to another location, without you being aware of it. But not everyone wants to "break into" a computer. In the above case, email was copied "in transit." When email is transferred from machine to machine, it is made readable. So if you intercept a copy (through "sniffers"), you can read it. Everything this individual had written over the last couple of years has apparently been intercepted and read. His file is huge. With Canada news media in a tizzy about "regulating the net," how long before CSIS requests funds to start collecting posts with buzzwords in the network data flow? POSTCARDS It should be the first lesson every newbie learns: email ain't secure. An email is like a postcard: it travels through the many sets of hands in delivery and any set of hands can read it if so inclined. Most postal employees don't, for two reasons: there is so much mail they haven't the time, and most postcards are so boring, who the hell wants to? The same goes with the system administrators who oversee the shunting around of all your cyberscribbling. Most don't snoop, but some do. Need I remind you that, er, sysadmins are not a monolithically mature-and-well-adjusted breed imbued with highly developed moral principles... What can you, the lowly downtrodden, rights-less end-user, do? You have three strategies: -- no precautions: who cares if anyone reads what you write/receive; -- minimal coding, easy to crack, but enough to stop casual snoops -- kind of like "virtual envelopes"; and -- PGP. PGP stands for Pretty Good Privacy -- a humble title to be sure, considering that the U.S. government/military wants to ban the thing. And why? Because PGP has the power to thwart their zillion-dollar spy efforts by imbuing everyday folk with the cryptographic might of the best "puzzle palaces" around the world. The elegantly powerful encryption device is the offspring of Colorado resident Phil Zimmermann (prz(a)acm.org) He basically took all the (very public) papers on cryptography, stirred it together and voil=E1: instant "threat to democracy" -- if you buy the government/military propaganda. (More on Zimmermann and the cryptographic spook backlash next issue [below].) What PGP does is solve that decades old spy/cryptography dilemma: How can one send secure messages to absolute strangers over an insecure medium? PGP exploits two historical developments: -- home computers gave commoners the computational power to use the sophisticated cryptography algorithms; and -- the advent of public key encryption in the late '70s bade farewell to Ilya Kuryakin and Napoleon Solo. Computers were originally designed (back in World War II) to be sophisticated code breakers. Today, government/military bureaucracy (especially in the U.S.) still operate with that attitude: computer cryptography is a military weapon. In those Cold War days, the only way to send secure messages over insecure channels (telegraphs, phones, mail, etc.) was to first deliver a "cryptographic key" via secure channels. The key was something like a little code book; the secure delivery channel was usually a dour-faced courier with a black bag handcuffed to his wrist. "Deliver this or die doing so, 007..." BE AN INTERNATIONAL ARMS DEALER! Governments and mega-corps could afford to send satchel-toting couriers overseas, but us proles had little hope of doing that. So citizens were always vulnerable to mail-opening, phone-tapping spooks. PGP uses two keys -- a public key and a secret key. Anyone can use your public key to encrypt a message to you, and only you can then decrypt it with your secret key. As long as your secret key remains secret, no one can read that message -- not even the person who encrypted. The idea is to spread your public key around in Key Exchanges, like phone books. For details on this complex subject, try _PGP: Pretty Good Privacy_ by Simson Garfinkel (O'Reilly & Assoc., http://www.ora.com, $29.95 paper). Or _The Computer Privacy Handbook_ (Peachpit Press, http://www.peachpit.com/peachpit, $31.95 paper). Both go beyond technical details and delve into the sociopolitical issues around privacy. Where can you get PGP? All around the world. PGP is freeware -- you can use it endlessly without cost. But remember: The U.S. State Department export restrictions classify cryptographic materials to be munitions. Exporting it from the U.S. is a serious matter. For those uninterested in becoming international arms smugglers, do an Archie search for "PGP" or try Toronto's Interlog at ftp://ftp.interlog.com/pub/pgp . Read newsgroups alt.security.pgp and sci.crypt for discussions. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMC5SVDokqlyVGmCFAQFaVQP/ZhMQ76OKza2p8Peo6ywghqcfGtqv9aM4 VQesZ0BHq2hAFPQUCWP2iR3shdnSTdtZgYutYzwrnlpVe+CLtpy7+zIRBWscGWVP W2je/CiWcpmrmtnA0d71Kp7bkPcpRJCo9l8CGyktjUKQMRsz5spRidtBOw+/Dm8g 7HhNw0DTdEU= =8ZlA -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

EYE_see
by John Young 17 Dec '03

17 Dec '03

8-13-95. NYPaper: "One Source, Many Ideas In Foster Case: Publisher Bankrolls Cover Up Theories." The theory of a Vincent Foster murder and a cover-up has been promoted by a handful of foundations and publications united by a common denominator: the money of Richard Mellon Scaife. "The death of Vincent Foster: I think that's the Rosetta Stone to the whole Clinton Administration," said Mr. Scaife, a newspaper publisher with half a billion dollars in the bank, during a two-hour interview. EYE_see (about 5K)

1 0

Q's on Number Theory/Quadriatic Residues
by Ben 17 Dec '03

17 Dec '03

I've been trying to get myself up to speed on some of the protocols in _Applied_Cryptography_ and my woeful lack of number theory is showing through crystal clear. While a course on number theory is in the works for the fall, right now, I'm sort of curious and would appreciate any sort of response I can get to the following questions from those of you to whom number theory is not as much of a stranger. 1)In AC on page 293 in the section on the Feige-Fiat-Shamir, there is a chart which lists the residues, their inverses and their square roots, all modulo 35. The chart, which I have reproduced below, baffles me--at least the part for the square roots: -1 -1 v v sqrt(v ) 1 1 1 4 9 3 9 4 2 11 16 4 16 11 ***9 29 29 ***8 ***How are these square roots? 9 is certainly not the square root of 11, nor is 8 the square root of 29, even modulo 35. 2)By the same token, on the previous pages Schneier uses the expression (1/v), which I take to mean "the quantity one divided by the value -1 of v", while the example expresses it as (v ) which I take to mean "the inverse of v." Are these two expressions interchangeable or is this something that I should have found in the errata? 3)Speaking of errata, where can I find a copy? 4)Now, going back to the number theory, I've got a few more questions re: quadriatic residues. a)On page 293, the residues are listed as, "the possible quadriatic residues" Is it possible to predict the possible quadriatic residues, or is an exhaustive search of the values from on the interval [1,n] necessary to find the quadriatic residues of modulo n? 5)From what does Feige-Fiat-Shamir derive its security? Obviously not discrete logs, but I'm not sure I understand the protocol sufficiently to be able to see where it derives its security. To those of you who aren't interested, thanks for reading so far, and with this we return you to your regularly scheduled conspiracy rants, personal attacks, and other random nonsense. To those of you who can respond, any assistance is appreciated. Ben. *********************************************************************** Ben Samman Samman(a)cs.yale.edu I'm on vacation now, so e-mail will recieve a latency of +/- 24 hours. PGP Key available from keyservers

2 1

Re: Q's on Number Theory/Quadriatic Residues
by Ben 17 Dec '03

17 Dec '03

At 05:47 PM 8/13/95 PDT, Derek Atkins wrote: >> -1 -1 >> v v sqrt(v ) >> 16 11 ***9 >> 29 29 ***8 >> >> ***How are these square roots? 9 is certainly not the square root of >> 11, nor is 8 the square root of 29, even modulo 35. > >Bzzt! Try Again. If you use bc, you will notice that 9^2 mod 35 == 11 >and 8^2 mod 35 == 29... You should go take your number theory class! Definitely. Is there an easy way to get from the 29 to the 8? I can see how it goes the other way, but what I didnt' see was how, if given 29, I could get the 8? (Euclid's?) > >> mean "the inverse of v." Are these two expressions interchangeable >> or is this something that I should have found in the errata? > >Yes. It is the multiplicative inverse. This is very basic math. Go >re-read your 7th-grade algebra book: > v^(-1) == 1/v Ok. I wasn't thinking of multiplicative inverse when doing this--I guess I wasn't in the right frame of mind. >Take your number theory class, and if you can't figure out after that, >re-ask the questions. I'll take the course, but you still needn't be so swarmy about it. Ben. *********************************************************************** Ben Samman Samman(a)cs.yale.edu I'm on vacation now, so e-mail will recieve a latency of +/- 24 hours. PGP Key available from keyservers

1 0

My pseudo-anonymous dream list
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There was some talk on Friday about "nym" servers similar in operation to anon.penet.fi. I was meaning to provide some commentary on Friday, but it kinda got pushed back by a lazy weekend. Anyways, I wanted to toss some non-technical things into the fray about what I'd like to see in a good "nym" server. If you grow weary from my wish-rants, press 'd' now :-) ============== Anon.penet.fi is arguably one of the most used anonymous servers on the Internet. One of the chief reasons it is used so much by so many so often is because it is also the easiest to use. Posting to a newsgroup or mailing to another person is handled without having to think about anything. This is quite unlike most anonymous remailers which require quite a bit more work (for the lay person) for only one-way mailing. Any future remailers (and for the purpose of this message, assume "remailer" means a pseudo-anonymous remailing mechanism like penet.fi) will need to maintain the ease of use that penet.fi has. No messy headers of embedded command lines. Just send the message to an address and it's taken care of. There are, however, a great number of internal improvements that could be made that would both improve user-end usefulness AND improve overall security. 1) Multiple Remailers: I'd like to see multiple (maybe >12) remailers that utilize the same database, upgraded by batched processes once or twice a day or "broadcast" realtime to all the reamilers in the web (probably the latter is better). In this way, a person with a pseudo-ID of FOO, could be addressed as FOO at ANY of the remailers. The primary purpose of this is to allow easy chaining (see below), but it might also serve to distribute much of the load around the net. Penet.fi is grossly overloaded, so a solution to that needs to be found. 2) Encrypted Databases: One of the failings of anon.penet.fi that has been exploited by by various LEAs is the fact that the database of users is accessible by the operator. Any properly designed 'nym' server should have a totally encrypted database. Thus if your local LEA roams by demanding to know the name of the person associated with an ID, the best the operator can do is to give them a copy of the encrypted entry from the database (or, I suppose, the entire database :-) 3) Limited ID lifetime Another failing, IMHO, with penet.fi is that ID#'s have an unlimited lifetime. I think any remailer should limit the lifetime of any ID to no longer than 12 months, with six months being the default, and 3 months being an option (plus, of course, a manual cancelation on the part of the user). When an ID is expired, it is removed entirely from the database and NOT reissued again. 4) Chained Mailings Because you have many remailers operating, all messages should be randomly chained through them. Perhaps the default number of hops is three, with the user-definable of 1 to 20. This means that while I might send a message to alt.sex.abuse.recovery(a)anon.mit.edu, it might end up being posted from anon.berkeley.edu after passing through anon.umn.edu and anon.toad.com. It makes traffic analysis that much more difficult. Before a chaining is done, the remailer should ping the target remailer to make sure it is up, so that mail isn't sitting in the queue. All chained mail should also be encrypted. 5) Encryption/Signature Validation Any message that is emailed PGP signed should be validated by the remailer (with the User having to email in their public key as part of the registration process, if they so choose, or remailers can use the keyserver). If the signature is valid, a line is added in remailer information section to the effect of "Message PGP Validated" and then sent PGP signed by the remailer. (the original sender's PGP signature is removed). An encrypted message should simply be PGP Signed by the final remailer posted/emailed to the destination Because there are multiple remailers (chained), only the final remailer should sign the message. 6) Two-way This goes pretty much without saying. If I send mail to somebody or post to news through a remailer, the person who received the message should be able to reply to my anonymous mailbox and I get the message (signed, of course, by the remailer). 7) Option Validation In order to change any of the options on your ID (ie, the expiration date of your ID, or to expire it immediately, or to set the number of "hops" you want to chain through), you should have to submit a PGP Signed command message. Then, similar to a LISTSERV that confirms subscriptions and unsubscriptions, a message is sent back asking you to "ok" these changes. This return message is sent as PGP encrypted email to your public key. When you decode it, you are given a, say, 10digit code string that you need to mail back to confirm the changes. If you don't, it doesn't. This helps keep down spoofing of messages changing your options without your ok. It's not perfect, and isn't totally secure, but it will catch many. In addition, you encourage the use of PGP by requiring it for changing any options. You can still use the remailer without PGP, but you can't access the options and are stuck with the defaults. However, one item that should not be allowed to be changed is your email address. If you move from foo(a)blah.com to blah(a)foo.com, you need to get a new ID, and expire the old one (or it will die by itself within a year). 8) Robust Web of Remailers Remailers come and go daily. Any pseudo-anonymous remailer web needs to be able to handle that fact. Thus, a mechanism needs to be put into place to allow for easy adding of a new machine (if it's easy, more people will do it) with minimal maintanence. In addition, if a remailer disappears (say, because somebody caught wind of it and ordered the student to turn it off :-), the rest of the remailer web needs to be able to survive. Of course, that particular address will be dead, but with apprpriate FAQs posted around, people should be able to quickly find another address that uses the same database. 9) Proper PR This beeds to be properly advertised as well. Penet.fi, whether good or bad, has a reputation of being a breeding ground for law-breakers. Any web set up needs to be pushed as nothing more than a "P.O. Box" on the Internet or some such. In reality, nothing is different, but in the public light, it would work better. 10) There is no number 10 ===================== Hmm, guess that's about it. Comments are appreciated (really they are :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMC6dmTokqlyVGmCFAQFrdAP/c/tWh9EtobXW4mTWKaWf7B+uaLJjQ/fW UwTkJKIsZYsoj3fzeTMN4lLNd0x2sIJdB+uCduTCm6UFPzlYVa9GKk2TmO+odtvd 4sCjqnYb0JDmxSWO2lC6OW6GiswTabpCbJ/tq4eSMHXZkM/UYfN3HQjupDQ7nPny VpxcAlNHueQ= =IUA6 -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Phone Card Risks
by Duncan Frissell 17 Dec '03

17 Dec '03

One of the plethora of TV Magazine shows featured Tim McViegh and phone cards last week. Maybe I should post to Risks. According to the story, Tim McViegh bought a bunch of phone cards from "The Spotlight" (famous Klan paper) which carried the Spotlight brand name. He made lots of calls. Later, the Fibbies who checked all the phone records for room and pay phones at the motels where TM was staying came up with lots of calls to the 800 number of the vendor who was actually switching calls for the Spotlight phone cards. The vendor found the card number(s) that matched those calls and all the other calls that matched those card numbers. They made it seem like such a match was a big thing. Perhaps their transaction database was not well developed. In any case, they wrote a little software and gave the Fibbies a list of all of TM's calls. There are supposed to be lots of calls to fertilizer dealers, his sister, and others. Very interesting. This is an obvious risk in the use of phone cards that anyone should be able to figure out for themselves since it is the same risk that pay phones have always had. If the Fibbies can find out what telephones you have used, they can get those records and trace things from there. This problem has occurred before for "right wing" nuts and the Mafia. Several years ago after members of The Order robbed an armored car in northern California, the Fibbies found a nearby motel where a bunch of suspicious characters had all stayed together and traced calls from the pay phone outside to various wives/girl friends and broke the case from there. Likewise Mafiosi in their NYC social clubs have often shown bad phone habits using the nearest pay phone, etc. If a pay phone is used enough and well-enough known to the Fibbies, it even becomes worthwhile to tap it. So buy lots of phone cards from different dealers (*never* The Spotlight), use phones unconnected to you, don't make too many calls from the same phone or using the same card, and be sure to destroy the card preferably before you use it (the only significant thing about phone cards are the numbers which can be stored in an encrypted file). An easy way to accomplish much of the above is to hang out in big cities instead of the boonies. It's a lot easier to find an unlinked phone (unlinked to you, that is) in the city than in the country. DCF "'Well, he hit what he was aiming at.' Marine DI discussing the fact that the guy up in the tower at the University of Texas shooting people was an ex-Marine."

2 1

Re: Bet e$ on how long it will take for PGPFone to make it overseas!
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:20 PM 8/13/95 -0400, you wrote: >I bet e$50 that PGPFone will have been exported 24 hours after its final >release has been announced to this list. Who is willing to take the bet? >Perhaps someone is willing to bet at less time? Not a chance I'd take this bet! 1) My e$ haven't arrived.... 2) If there were a serious risk of you losing, I know you're a good law-abiding guy, but you might have a "friend" who would help you out by exporting it in a hurry :-) 3) 24 hours sounds like a reasonably safe upper limit for the export time. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

Re: Bet e$ on how long it will take for PGPFone to make it overseas!
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <giggles> 24 minutes was a more reasonably safe upper limit. I just wondered why Alex got to have all the fun! Maybe I should move across the water or something? </giggles> >3) 24 hours sounds like a reasonably safe upper limit for the export time. ># Bill Stewart, Freelance Information Architect <sadness> RIP, Mick RIP, Jerry </sadness> Love Always, Carol Anne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMC8QSIrpjEWs1wBlAQHEGAP+J+jnpkQGsSFYzc2zrZuDztjKEatcxiWK ShfjjYvfjZKRMyuk1A6vl3UjMKjZaevdLcC2slgRzzU2KKCclwM7rQLcmgTrJKkZ 4v71bKnqDxBqx8WlPAKjj8RhACy296X7KX2AqetmBLoZGl2dwCxzbuZ1l7Zw7pQ9 jeuahRi4raw= =lN/A -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

How to launder money (internationally) (fwd)
by jcaldwel＠iquest.net 17 Dec '03

17 Dec '03

-------- Forwarded message -------- Date: Sat, 12 Aug 1995 13:37:24 est From: Gary Livermore <gary.livermore(a)p4.f507.n300.z1.aen.org> To: Multiple recipients of list CHAT <CHAT(a)AEN.ORG> Subject: How to launder money (internationally) How dirty drug money is laundered internationally: [From National Geographic, Vol.183, No.1 Jan.1993, pg105] Titled: The Power of Money, by Peter T White, Asst. Editor, quoting his sources as the "Centre for International Documentation of Organized and Economic Crime, located in Cambridge, England. [begin this section] ================================================================== This as a real-life example: A U.S. organized crime group with a lot of hot cash forms a cozy relationship with the central bank of a British Commonwealth country. Diplomats of that country carry the cash out of the U.S. If it's $10,000 or more, they are supposed to report that to U.S. Customs, but they don't; they "externalize" the cash. It goes into the central bank and then into various dummy companies in different countries in return for shares in those companies. The money is thus "agitated," so it'll be just about impossible for investigators to follow. Then, to "repatriate" the money, dummy companies in the U.S. sell their worthless shares to investors in Britain - who are in fact in on the scam - and behold, the money is back in the U.S., clean! Now it buys legitimate businesses, banks, political power. An operation like this, involving highly placed officials, and businessmen, will cost quite a bit, maybe 35 percent, but once the system is in place, people will want to use it - not only drug profiteers but also arms dealers, terrorist organizations, intelligence agencies... A prime haven for such shady customers was BCCI, the Bank of Credit and Commerce International, headquartered in Luxembourg and the Cayman Islands with branches in 72 countries. It is said to have secretly controlled the First American Bank of Washington, D.C. After BCCI collapsed in 1991, having defrauded depositors of several billion dollars, it became known as the Bank of Crooks and Criminal International. ================================================================= [End, this section] Can you say Mena - Clinton - Whitewater, 3 times real fast?!? In the very next section, there is an interesting little number used by the bank/finance crowds, it's number "72". [begin this section] =========================================================== - the rule of 72. No one is certain who first developed the rule, but the principle is quite simple: Divide any number into 72 and the answer tells how long it will take for a sum to double in financial terms. Are you charged 18 percent interest on the unpaid balance of your credit card account? Eighteen goes into 72 four times - so the debt would double in four years. Say your annual raise is 6 percent; that number goes into 72 twelve times, so in twelve years your salary will double. The same holds true of any investment. And what if inflation runs at 6 percent a year? Then after a dozen years your money will be worth half as much, so in a sense you'll be back where you started. =============================================================== [end this section] Gee, now I wonder if the money-changers figured this into setting annual inflation rates! Kind of keeps the middle class down, and stuck in a rut. *****My footer********************************************************* "We conclude that the Reserve Banks are not federal instrumentalities for purposes of the FTCA (Federal Tort Claims Act), but are independent, privately owned and locally controlled corporations" Lewis v. U.S. F.2d (1982) *********************************************************************** ... Those who follow like sheep deserve to get fleeced. --- PPoint 1.92 * Origin: Arizona's West Coast. My Point, Exactly! (1:300/507.4) SEEN-BY: 102/975 106/64 108/155 124/4014 132/209 133/1007 138/179 147/3032 SEEN-BY: 203/8888 231/110 511 955 236/48 260/104 300/507 704 356/3 369/85 372/5

1 0

Changes in Operation..
by Flame Remailer 17 Dec '03

17 Dec '03

ATTENTION: The anonymous remailer operators at vishnu.alias.net and spook,alias.net have decided to activate the reordering option on both the Type-I (original cypherpunk) and Type-II (MixMaster). This means that there will be at least 5 messages in the outbound queue and they will be delivered randomly.

1 0

Australia crypto ill news: pointers
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

The following URL was posted by Ross Anderson (the author of the article quoted in RISKS): http://commerce.anu.edu.au/comm/staff/RogerC/Info_Infrastructure/Orlowski.h… This is a pointer for the full text of the Orlowski paper (the cause of much discussion on the future of crypto in Australia). Also Roger Clark's home page contains lots of interesting references for crypto policy, privacy, some info on CFP, etc, very interesting reading I found: http://commerce.anu.edu.au/comm/staff/RogerC/RogersHome.html Adam -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365

1 0

votelink - some discussions on Phil Z & ITAR
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

A short time ago on cpunks someone posted this pointer: http://www.votelink.com/ as there was a vote and associated discussion forum being offered on the subject of Phil Z, the (somewhat leading - incorrectly leading) question: "Should Phil Zimmermann be prosecuted for allowing release of his PGP encryption program on the Internet?" (The comment on leading question being prompted of course by the fact that Phil did not himself export PGP, nor put it on the internet, nor even put it on US BBSes. The way I understand the story was that a friend of Phil's posted the code to US BBSes, and that an unknown 3rd party posted it from there to the Internet. He is being investigated for "making PGP available in a form in which it could be exported", something different to what is implied by the question. In this light I find it difficult to understand how he could be held to have "allowed it's release on the Internet", something which even the State Department investigation is not I think accusing him of. Several people pointed this out in the discussion forum. A more accurate phrasing would perhaps have been: "Should Phil Zimmermann be persecuted for writing PGP?" but then that is no doubt biased in the opposite direction.) An interesting vote in any case, and the balance so far is: YES: 000,172 | ABSTAIN: 000,096 | NO: 001,508 The abstainers I think could be partly explained by the worry that the question was leading or incorrect, as this opinion was voiced in the discussion forum. Also an interesting thread was generated in the (WWW hosted) discussion forum about the legal problems implied by me posting these two snippetts of code (which I posted to the forum earlier): #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) ------------------ PGP.ZIP Part [024/713] ------------------- M!4HD";*K"$$=/!<29+_A`K9C/2+@"4<,5G(N0M`47K#'`T6"[&>M83PL=@FR 8ES%:6Q"(F9A#)K!&_;X4TXZ?(T]6(]`>$*.^]3K*K["(239)\@F MHA\"<%"5(%N->/2!'>X3XPU<0!Y,F``58RK(F;K#XD2,^`F[L09CT1>MH,7/ ------------------------------------------------------------- (hmm it seems that their WWW conversion chopped out some parts of it presumably due to it containing < and > symbols, so perhaps their fears were even further unfounded). They were alarmed by the implication that their WWW server now contained PGP code which they did not feel qualified to judge the implications, or correctness of. This prompted the posting to the forum of a rather worried sounding disclaimer by a votelink representative, to the effect that they were abiding by the Prodigy ruling, and so felt unable to remove the offending piece of ITAR breakage, and yet felt rather unconfortable with it's presence. I hastened to explain (after a certain cpunk kindly drew by attention to the discussion which I had neglected to check out after posting the 1st message) that the same dilema applies to numerous other forums, such as USENET news distribution sites, sci.crypt archives, cpunks archives, etc, etc. Generated some interesting discussion anyway. Adam

2 1