December 2003 - cypherpunks-legacy

proposal: "security spectrum scale" (SSS)
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

regarding the recent Markoff NYT article on NFS weaknesses, I agree it seemed to be overblown. but in fact I have been betting that feeling from *all* the recent articles on the netscape bugs etc (egad, am I mistaken, or whas there front page NYT coverage for a *buffer*overflow*? at least there was for a single *poorly generated random seed*!!). for example, in another, the fact that netscape had a buffer overflow in URLs was translated by a reporter into "a similar bug was used by Robert Morris in the infamous worm that infected the entire internet a few years ago" or something similar. it seems to me what is lacking in all this is a *security spectrum*. unfortunately security experts sometimes have a tendency to equate *any* security weakness with a catastrophic one. while this is a good approach in general, i.e. to be as conservative as possible, in practice there can be no doubt that some security weaknesses are far less severe than others. if the security *experts* conflate the issue of the *severity* of a security breach (and I see this happening all the time on this list), there is little surprise that reporters aren't figuring it out either. some of the really obvious example of the kinds of differences in security that are being conflated: client vs. server problems (server problems are far worse of course; the netscape bugs were mostly *client* problems), subnet vs. overall network problems, bugs that allow people to merely crash a system vs. submit arbitary code, etc. to aid this serious problem, I propose the creation of a UNIFIED SECURITY SPECTRUM RANKING. this would be a list of all the different types of security weaknesses a system can have, and their LEVEL OF SEVERITY. it would attempt to rank every type of security breach possible. then, when a new security weakness is discovered, it could be ranked A1 or B5 or C6 or whatever. this would be a sort of technological "richter scale" that would allow the novice to immediately understand that a given bug that was recently discovered (say, the recent netscape bugs) was, say, not really as potentially severe as the Morris worm. a press article might say something like, "the recent netscape bug was ranked a B5 on the security scale by experts. this means that an unauthorized intruder could break client software. the bug could potentially be as serious as A3, meaning that arbitrary code could be submitted. the other bug was classed B3, because it allows the detector to grab unauthorized data, but still be detected in doing so." etc!! I think it is pretty obvious how much of a positive effect this could have in quantifying and tracking and publicizing new bugs. it might make it impossible for a reporter to give an improperly alarmist position. for example, no one would take seriously an article that gets excited about a 3.6 richter scale earthquake. similarly, the reader might be able to draw his own conclusions if we came up with a sufficiently universal scale and it is widely used in articles. furthermore, this scale would tend to help the reporter/editor immediately know if a given bug report is newsworthy (if they continue to enthusiastically report bugs, although I wonder if this is a fad that may die out). and ultimately it might really help the issue of "proper attention to bugs". the public is getting a scare story for almost every new bug, and this is just not appropriate. to use my tired analogy, it is like the media putting every dinky earthquake item on page 1. another idea behind the rating: it might be a sort of matrix format, such as "a-6-alpha" where each of the elements indicates some kind of independent factor. for example the "a" might mean "client side", the "6" might mean "crash only", the "alpha" might mean "breach cannot be detected after the fact". however it shouldn't be so complicated that the novice can't immediately determine which of two rankings is more severe. now, I am really rather surprised that no such scale appears to exist currently. I highly suspect the NSA probably has a system for this but unfortunately it is not being used by CERT or anyone else that I know of. if anyone does know of this kind of "security spectrum", I think our cause of trying to improve software security would be furthered immensely if whenever reporters call about bugs, the scale factor could be consistently and uniformly used in association with trying to describe the severity of the bug. I am willing to work on a beta version of this "security spectrum" if there is sufficient interest. it certainly seems like a far better and worthwhile investment of time than, say, "the geek code", the latter of which is already highly developed!! I don't really consider myself the best qualified in terms of experience but sometimes if you want something done, you have to do it yourself. however, if we do this, I hope that a good scale that is pretty general and doesn't need extensions can be done from the start, before its widespread usage, so that later changes do not confuse users. there is already confusion in the media about two slightly different richter scales, this is a pity. another neat perq: if the cypherpunks come up with a good scale, it could be a tremendous positive publicity tool. "today experts discovered a bug in -x- that rated a -y- on the CSSS (Cypherpunk Security Spectrum Scale)" generally, regarding cypherpunk priorities, I think the "media can be made our friend", but we just have to learn how to be more meticulous and careful in our interactions with them. in general I don't really think a lot of the misreporting going on is the fault of the reporters involved. it's not surprising they get their stories mixed up, when, IMHO, even the "experts" they quote aren't particularly polished and don't really have their act fully together (or at least, tend to misrepresent the problems from the beginning). (most of the last Markoff article imho can just be chalked up to, "two prestigious graduate students who discovered something significant recently wrote a message warning about another significant security problem." it shows how absolutely critical it is to be careful what you say once you have built up a bit of a reputation. these two grad students are now being watched as the Chicken Little's of Cyberspace by the media, unfairly or not. be careful about wishing about fame, or anything else!! you might get it!! makes me a bit nervous about causes *I* have promoted in the distant past.) --Vlad Nuri

2 1

CYPHERPUNKS EXPOSED
by L.Detweiler 17 Dec '03

17 Dec '03

Attn Reporters and Writers!! who are the CYPHERPUNKS? what are they talking about? what have they done in the past? who are the "leaders"? what do they believe in? what are their *real* goals? My name is L.Detweiler, and I've made a serious study of the more ulterior aspects of the CYPHERPUNKS for several years, and I invite you to peruse my findings at the web site below. I've been quoted in various articles and I'm available for serious interviews with anyone who wants the REAL STORY BEHIND THE CYPHERPUNKS. note: be forewarned that key cypherpunks consider me a heretical blasphemer because of the tenacious, unforgiving honesty and zealous antisychophancy by which I have pursued this herculean study. | /\ |\| /~ L~ ``I have to spew this stuff, or I'd be on the L_ /~~\ | | \_ L_ roof with a high power weapon.'' -Jim Carrey http://www.csn.net/~ldetweil

2 1

Netscape question transformed
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

I would like to rephrase the question I had yesterday was completely misunderstood. The point I was meaning to make was soppuse to be as follows: Why would a compony like Netscape jeapordise themselves by even letting out a beta version so hackers have time to find bugs before the full version is released. Don't take me wrong I have only been on the net fer a little over a year and Love Netscape. And If I knew what I was Doing I would love to help them..... Anyway I don't mean to waste your time, but arent these kinda things for stating your opinion? And to clarify any questions on my age I am 13 and was born in 1982.ok? thanks.....And I would again like to thank perry for understanding what level Im on. I will try my best not to annoy you or cause you any inconvenience. And to sameer I am sorry for what I said but you have to understyand Why I said it...... Sincerely, CyberPunc X

5 4

Same ol' massive MITM exposure in Netscape 2.01b
by Simon Spero 17 Dec '03

17 Dec '03

Just to repeat old news: Netscape 2 has similar exposure to MITM attacks to 1.1. Netscape 2 does make one variant of the MITM attack less useful: The new document info page allows information to be obtained about inlined images as well as the base page; this breaks the old attack of only intercepting inline image requests (which can be used to steal information in request headers without there being any chance of your certificate showing up). 1) The client does not do any verification that the certificate used for the transaction is one associated with the server, allowing MITM substitutions as long as the server has a properly signed certificate 2) The client does not issue warnings for redirections from one https page to another https page, even if the url to which it is redirected has a different hostname to the url originally dereferenced. 3) In the case of redirection, the document info screen does not provide information about the originaly referenced page, just the final page. This allows the MITM to intercept the first request, steal the request data, then issue a redirect to hide the certificate used in the intercept. 4) In the beta version, the document info page does not display the security info (I did check with MITM disabled). Simon ----- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

2 1

Re: Exporting Mental States
by Brad Shantz 17 Dec '03

17 Dec '03

I just arrived in Ottawa, Canada from Seattle, USA. I had sort of thought through exactly what Tim just described. I had a little notebook with me and was doing some calculations and design of a fractal compression algorithm. I started to think about El-Gamal and decided to look at elliptical curve algorithms. So, I pulled out my copy of Applied Crypto to look up some things and started writing things down. (BTW: I had Applied Crypto with me for recreational reading on the plane, I don't normally carry it everywhere I go.) Anyway, i got to customs in Ottawa, and they asked me if I had anything to declare. I immediately thought, "Should I tell them about the notebook?" I decided against it. How does export of intellectual property work? The other question they asked me was "Do you have any eggs?" I started giggling. **SARCASM ON** I always carry an egg around in my inside coat pocket. Who knows when you might need one, especially when in a foreign country. **SARCASM OFF** I don't know, I guess the question just struck me as funny. Brad Shantz TRISource (formerly TriLogic) Windows Development Services

2 1

Re: what are these people selling????
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510130722.AA03096(a)anon.penet.fi>, an116512(a)anon.penet.fi wrote: > why is the cp meeting sponsored by sun? > so we can hear a sales pitch on java? Where are clueless idiots that post messages such as the one quoted above comming from? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH7UnyoZzwIn1bdtAQGPDAF+IRhbPNJK0fo6PXTrKliTU7ITwkzPOD5L agjzNaBIDukCFmtfz1ZZNyHCC8OTeq5r =B+J8 -----END PGP SIGNATURE-----

1 0

CAT_sho
by John Young 17 Dec '03

17 Dec '03

The Econom of Oct 14 ogles the catfight between Wintel and JavaNet to outclaw whineflesh. "Will your next computer be a tin can and a wire?" This week's fall in technology stocks was bad enough. But what if the Internet destroyed the personal-computer industry ...? Sun, Oracle and Netscape are spending tens of millions of dollars on a bet that the Internet can do a lot more than pass around e-mail and transmit data. They think it can also do much of the work of today's computers, holding not just information but software, from word processors and spreadsheets to games and entertainment programs. Most radically, they go on to argue that this could end the reign of the personal computer. Forget Windows 95; some people are starting to wonder if they need Microsoft at all. But those who predict that such machines will kill the PC are ignoring computing history, and glitch-prone real life. The PC beat the mainframe because users wanted the whole computer on their desktop, not in the basement. That makes Java terminals look like a step backwards: by putting program storage far away down a shared network, it makes it vulnerable to delays, congestion, and all the unpredictability of anything out of a user's control. CAT_sho (10 kb)

1 0

thanx
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

Thanks to everyone especially Bill Sommerfeild and Derek Atkins fer helping me out.......

1 0

Guess what I found...
by Donald M. Kitchen 17 Dec '03

17 Dec '03

From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,alt.fan.bill-gates,alt.privacy Subject: Re: Microsoft Network: Hard Drive Raid Date: 11 Oct 1995 23:59:58 -0700 Message-ID: <45iede$dp2(a)Networking.Stanford.EDU> References: <45h0v7$579(a)news.corpcomm.net> rryan(a)blackhills.com (Richard Ryan) writes: >Had my first hard core, proveable case of MSN reading someones drive. Store >Client had entered fantasy company name upon installing a program. Forgot about >it, didn't tell anyone. 2 days after downloading a simple text file from MSN a >junk mail offering from Pitney-Bowes showed up in his snail mailbox addressed >to him c/o the fantasy company. Somebody is playing somewhere they shouldn't >be. Any comments, Microsoft? I registered as Richard E. Graves (changing middle initials and adding an unnecessary suite number to your address are good ways to track who has been selling whom your address). Richard E. Graves also received mail from Pitney-Bowes. Microsoft says they don't sell their mailing lists. Clearly, someone has taken advantage of security holes in the NT servers that make up MSN and *stole* the mailing lists. Maybe unauthorized external access accounts for the abysmal performance of MSN, in part. -rich moderator of the win95netbugs list http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html

2 1

Re: Cypherpunks "Exposed"
by Damaged Justice 17 Dec '03

17 Dec '03

>X-Authentication-Warning: teal.csn.net: Host localhost didn't use HELO protocol ?que? >Attn Reporters and Writers!! > >who are the CYPHERPUNKS? First, most of those on this list, rather easily discernible since most of them make no attempt to conceal their views. Second, anyone who agrees substantially that the universal deployment of strong cryptology tools will increase individual freedom, and that this is desirable. >what are they talking about? Since you're subscribed to this list, you can easily find out. >what have they done in the past? See a few web pages or FTP archives. "L. Detweiler's" page has plenty of links to other places, although there are a few things I'd like him to clarify (see below). >who are the "leaders"? Tim May says there are none. LD repeatedly contends that May, and anyone else who agrees with his statement, are either ignorant or deliberately lying. (By virtue of this post, I'm sure I'm now on this list.) Neal Stephenson's *The Diamond Age* description of "CryptNet" is remarkably similar to this whole situation. I wonder if Neal used any aspects of the LD "phenomenon" as a template. (Aside: If you haven't yet read Diamond Age, do so immediately. My highest possible rating.) >what do they believe in? See above. But individuals always differ. >what are their *real* goals? Why don't you join the guild, get your barcode tattoo and find out? >My name is L.Detweiler, and I've made a serious study of the more ulterior >aspects of the CYPHERPUNKS for several years, Ulterior? I'd say it's right out in the open. The statists want the state to have power over the individual. Most people on this list believe this would be bad. Both are pretty well "represented" by a number of outspoken, public individuals. It's reassuring to see the number of computer industry pros and average folks alike who don't buy into the claim that freedom can be preserved by outlawing it... or the equally likely claim that freedom itself is bad, and people who advocate it are evil, right up there with violent criminals (but see how many people who make these statements also advocate "might makes right" rule of force by the creation and enforcement of coercive laws, and the mass robbery of as many people as possible?). Best that these people be as open and outspoken as those they disagree with, the better to know their methods and goals. >and I invite you to peruse my findings at the web site below. I have, and I quote therefrom further below. >I've been quoted in various articles and I'm available for serious interviews >with anyone who wants the REAL STORY BEHIND THE CYPHERPUNKS. Now that's blatant advertising. Where were you when all these so-called "journalists" descended on the net, desperately searching for people who would tell them the Internet was a festering pool of child molesting, money laundering slime? Will we soon see you defending organizations like FinCEN? >note: be forewarned that key cypherpunks consider me a heretical >blasphemer because of the tenacious, unforgiving honesty and >zealous antisychophancy by which I have pursued this herculean study. Perhaps if you were less pompous and self-aggrandizing in your presentation, people would be more willing to seriously entertain your ideas. Anyway, for those who wish to browse http://www.csn.net/~ldetweil go ahead, and make up your own mind. Your page doesn't have a mailto: button, Lance. But I figured this was perfectly appropriate for public consumption anyway: >Other Sites > Psychopunkery [...] > + Raph Levien's remailer page - amazing how long it took to get > this simple and basic utility from the cypherpunk crowd -- > and surprise! written by an outsider The rest I'll let pass, but why is Raph an "outsider"? And what is "inside"? Does agreeing with the above statements I've generalized make one "inside"? -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information To be a skeptic is to refuse to be a victim. "This is my .sig. There are many like it, but this one is mine." Freedom...yeah, right.

1 0

applications
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

I know this isnt what you guys generally talk about but I was curious. Off the top of your head do you know of any sites where I can get kracking apps for macs? Any information would be greatly appreciated.

1 0

Re: what are these people selling????
by cman＠communities.com 17 Dec '03

17 Dec '03

>why is the cp meeting sponsored by sun? >so we can hear a sales pitch on java? Actually, the idea for the meeting came out of a discussion at a party that Marianne and I attended last summer. Chip Morningstar (one of the co-founders of Electric Communities) and I were getting heavily into Java; also, my wife and I were starting to write a crypto package for Java (JCrypt). Subsequently, at a focus group meeting at Sun, we discovered that practically all of us were on cypherpunks. It's just a happy accident that discussion about Java has hit a crescendo here on the list. I suggested to mrm that we have it at Sun, since the warehouse loft space in SF where we've been meeting, charming as it is, isn't a great spot for doing presentations and would likely have capacity problems for this topic. So no, this is not some great conspiracy on Sun's part to co-opt the list. You can return to your regularly scheduled paranoid fantasies. Thank you....

1 0

early anonymous remailer
by Carl Ellison 17 Dec '03

17 Dec '03

I was talking with someone at NSA's NISSC today and he was talking about Hamilton's support of the gov't in the Whiskey Rebellion. To voice his support (an unpopular position at the time) he wrote an article under a pseudonym, had it published in a French paper and then re-published over here, citing the French paper. This is the earliest example of an anonymous remailer I've found yet. :-) +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

New PA law (????)
by Tom Edwards 17 Dec '03

17 Dec '03

[Can anyone provide more information on this? I am still looking for the original source to confirm/deny this. Please pay special attention to anti-anon-mailer deals] ---------- Forwarded message ---------- This law was just passed and signed by the governor in PA. If you look at it, you'll notice that it makes it illegal to post instructions for making certain things (like phreaking boxes) and it also makes it illegal to use an anonymous remailer (conceal or assist another to conceal from any service provider). Amending Title 18 (Crimes and Offenses) of the Pennsylvania Consolidated Statutes, further providing for manufacture, distribution or possession of devices for theft of telecommunications services. The General Assembly of the Commonwealth of Pennsylvania hereby enacts as follows: Section 1. Sections 910 and 3926 of Title 18 of the Pennsylvania Consolidated Statutes are amended to read: § 910. Manufacture, distribution or possession of devices for theft of telecommunications services. (a) Offense defined.Any person commits an offense if he: (1) [makes or possesses any instrument, apparatus, equipment or] makes, distributes, possesses, uses or assembles an unlawful telecommunication device or modifies, alters, programs or reprograms a telecommunication device designed, adapted or which can be used: (i) for commission of a theft of [telecommunications]telecommunication service or to acquire or facilitate the acquisition of telecommunication service without the consent of the telecommunication service provider; or (ii) to conceal or to assist another to conceal from any [supplier of telecommunications] telecommunicationservice provider or from any lawful authority the existence or place of origin or of destination of any telecommunication; or (2) sells, possesses, distributes, gives or otherwise transfers to another[,] or offers, promotes or advertises for sale [any instrument, apparatus, equipment or device described in paragraph (1) of this subsection,] any: (i) unlawful telecommunication device, or plans or instructions for making or assembling the same, under circumstances evidencing an intent to use or employ such [instrument, apparatus, equipment or] unlawful telecommunication device, or to allow the same to be used or employed for a purpose described in paragraph (1) [of this subsection], or knowing or having reason to believe that the same is intended to be so used, or that the aforesaid plans or instructions are intended to be used for making or assembling such [instrument, apparatus, equipment or device.] unlawful telecommunication device; or (ii) material, including hardware, cables, tools, data, computer software or other information or equipment, knowing that the purchaser or a third person intends to use the material in the manufacture of an unlawful telecommunication device. (b) Grading.An offense under this section is a [misdemeanor of the first] felony of the third degree if the person convicted of such offense has been previously convicted of any similar crime in this or any other state or Federal jurisdiction. Otherwise it is a misdemeanor of the [second] first degree. (c) Restitution.The court may, in addition to any other sentence authorized by law, sentence a person convicted of violating this section to make restitution under section 1106 (relating to restitution for injuries to person or property) or 42 Pa.C.S. § 9721(c) (relating to sentencing generally). (d) Civil action.A telecommunication service provider aggrieved by a violation of this section may, in a civil action in any court of competent jurisdiction, obtain appropriate relief, including preliminary and other equitable or declaratory relief, compensatory and punitive damages, reasonable investigation expenses, costs of suit and attorney fees. (e) Definitions.As used in this section, the following words and phrases shall have the meanings given to them in this subsection: "Manufacture of an unlawful telecommunication device." To produce or assemble an unlawful telecommunication device or to modify, alter, program or reprogram a telecommunication device to be capable of acquiring or facilitating the acquisition of telecommunication service without the consent of the telecommunication service provider. "Telecommunication device." Any type of instrument, device, machine or equipment which is capable of transmitting or receiving telephonic, electronic or radio communications, or any part of such instrument, device, machine or equipment, or any computer circuit, computer chip, electronic mechanism or other component which is capable of facilitating the transmission or reception of telephonic, electronic or radio communications. "Telecommunication service." The meaning given to it in section 3926 (relating to theft of services). "Telecommunication service provider." The meanings given to it in section 3926 (relating to theft of service). "Unlawful telecommunication device." The meaning given to it in section 3926 (relating to theft of service). § 3926. Theft of services. (a) Acquisition of services. (1) A person is guilty of theft if he intentionally obtains services for himself or for another which he knows are available only for compensation, by deception or threat, by altering or tampering with the public utility meter or measuring device by which such services are delivered or by causing or permitting such altering or tampering, by making or maintaining any unauthorized connection, whether physically, electrically or inductively, to a distribution or transmission line, by attaching or maintaining the attachment of any unauthorized device to any cable, wire or other component of an electric, telephone or cable television system or to a television receiving set connected to a cable television system, by making or maintaining any unauthorized modification or alteration to any device installed by a cable television system, or by false token or other trick or artifice to avoid payment for the service. (1.1) A person is guilty of theft if he intentionally obtains or attempts to obtain telecommunication service by the use of an unlawful telecommunication device or without the consent of the telecommunication service provider. [(2) As used in this section, the word "service" includes, but is not limited to, labor, professional service, transportation service, the supplying of hotel accommodations, restaurant services, entertainment, cable television service, the supplying of equipment for use, and the supplying of commodities of a public utility nature such as gas, electricity, steam and water, and telephone service. The term "unauthorized" means that payment of full compensation for service has been avoided, or has been sought to be avoided, without the consent of the supplier of the service.] (3) A person is not guilty of theft of cable television service under this section who subscribes to and receives service through an authorized connection of a From owner-cypherpunks Fri Oct 13 15:22:25 1995 Return-Path: <owner-cypherpunks> Received: by toad.com id AA13987; Fri, 13 Oct 95 15:22:25 PDT Received: from ix9.ix.netcom.com by toad.com id AA13971; Fri, 13 Oct 95 15:22:11 PDT Received: from ix-pl4-18.ix.netcom.com by ix9.ix.netcom.com (8.6.12/SMI-4.1/Netcom) id PAA06683; Fri, 13 Oct 1995 15:21:53 -0700 Message-Id: <199510132221.PAA06683(a)ix9.ix.netcom.com> X-Sender: stewarts(a)popd.ix.netcom.com X-Mailer: Windows Eudora Light Version 1.5.2 Mime-Version: 1.0 Content-Type: text/plain; charset.s-ascii" Date: Fri, 13 Oct 1995 15:21:00 -0700 To: zoetrope(a)infinet.com (cYberpUnc) From: Bill Stewart <stewarts(a)ix.netcom.com> Subject: Re: applications Cc: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk At 05:50 PM 10/13/95 -0400, you wrote: > I know this isnt what you guys generally talk about but I was curious. >Off the top of your head do you know of any sites where I can get kracking >apps for macs? Any information would be greatly appreciated. There are several fine tool companies on the Web who can sell you large hammers. Check with Yahoo for locations. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- the same person or several persons, may be aggregated in determining the grade of the offense. (d) Inferences. (1) Any person having possession of or access to the location of a public utility meter or service measuring device which has been avoided or tampered with so as to inhibit or prevent the accurate measurement of utility service and who enjoys the use of or receives the benefit from the public utility service intended to be metered or measured by the public utility meter or measuring device so avoided or tampered with may be reasonably inferred to have acted to avoid or tamper with the public utility meter or measuring device with the intent to obtain the public utility service without making full compensation therefor. (2) Any person having possession of or access to the location of the distribution or transmission lines or other facilities of a cable television system which have been tapped, altered or tampered with or to which any unauthorized connection has been made or to which any unauthorized device has been attached or any person having possession of or access to any device installed by a cable television system to which an unauthorized modification or alteration has been made, the result of which tapping, altering, tampering, connection, attachment or modification is to avoid payment for all or any part of the cable television service for which payment is normally required, and who enjoys the use of or receives the benefit from the cable television service, may be reasonably inferred to have acted to have tapped, altered, tampered with, connected or attached to or modified cable television facilities with the intent to obtain cable television service without making full compensation therefor. This inference shall not apply to the act of a subscriber to cable television service, who receives service through an authorized connection of a television receiving set at his dwelling, in making, within his dwelling, an unauthorized connection of an additional television receiving set or sets or audio system which receives only basic cable television service obtained through such authorized connection. (e) Sale or transfer of device or plan intended for acquisition or diversion.A person is guilty of a misdemeanor of the third degree if he sells, gives or otherwise transfers to others or offers, advertises or exposes for sale to others, any device, kit, plan or other instructional procedure for the making of such device or a printed circuit, under circumstances indicating his having knowledge or reason to believe that such device, kit, plan or instructional procedure is intended for use by such others for the acquisition or diversion of services as set forth in subsections (a) and (b). (f) Restitution.The court may, in addition to any other sentence authorized by law, sentence a person convicted of violating this section to make restitution under section 1106 (relating to restitution for injuries to person or property) or 42 Pa.C.S. § 9721(c) (relating to sentencing generally). (g) Civil action.A telecommunication service provider aggrieved by a violation of this section may, in a civil action in any court of competent jurisdiction, obtain appropriate relief, including preliminary and other equitable or declaratory relief, compensatory and punitive damages, reasonable investigation expenses, costs of suit and attorney fees. (h) Definitions.As used in this section, the following words and phrases shall have the meanings given to them in this subsection: "Service." Includes, but is not limited to, labor, professional service, transportation service, the supplying of hotel accommodations, restaurant services, entertainment, cable television service, the supplying of equipment for use, and the supplying of commodities of a public utility nature such as gas, electricity, steam and water, and telephone or telecommunication service. The term "unauthorized" means that payment of full compensation for service has been avoided, or has been sought to be avoided, without the consent of the supplier of the service. "Telephone service" or "telecommunication service." Includes, but is not limited to, any service provided for a charge or compensation to facilitate the origination, transmission, emission or reception of signs, signals, data, writings, images and sounds or intelligence of any nature by telephone, including cellular telephones, wire, radio, electromagnetic, photoelectronic or photooptical system. "Telecommunication service provider." A person or entity providing telecommunication service, including, but not limited to, a cellular, paging or other wireless communications company or other person or entity which, for a fee, supplies the facility, cell site, mobile telephone switching office or other equipment or telecommunication service. "Unlawful telecommunication device." Any electronic serial number, mobile identification number, personal identification number or any telecommunication device that is capable, or has been altered, modified, programmed or reprogrammed alone or in conjunction with another access device or other equipment so as to be capable, of acquiring or facilitating the acquisition of a telecommunication service without the consent of the telecommunication service provider. The term includes, but is not limited to, phones altered to obtain service without the consent of the telecommunication service provider, tumbler phones, counterfeit or clone phones, tumbler microchips, counterfeit or clone microchips, scanning receivers of wireless telecommunication service of a telecommunication service provider and other instruments capable of disguising their identity or location or of gaining access to a communications system operated by a telecommunication service provider. Section 2. This act shall take effect in 60 days.

1 0

mental cryptography
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As we know, security is always relative to a threat model. For example, most cryptographic protocols today will not protect their users against the cloning attack I described earlier, nor more mundanely, against video surveilence of your computing space. What can you do if you ARE worried about such attacks? The answer is doing cryptography in your head. Well not quite, since many cryptographic operations are very computing intensive, and not everyone can do 1000 bit mental modular exponention in a reasonable amount of time. But if you have a piece of secure hardware that you can trust to do some of these operations for you, then all you need is a secure communications channel to this piece of hardware. There may be other ways, but I suggest that you establish a common key with your crypto server ahead of time, and then simply encrypt all your communications using a symmetric algorithm. RC4 may be a reasonable choice, since the operations are simple and easy to remember, but you need to keep track of a 255-byte state. WAKE is probably better. Although it uses a large key table, you only have to memorize it once, after which the only state that is changing is four 32-bit registers. I am sure better algorithms can be found for this purpose if mental cryptography is made explicit as a design goal. Perhaps it should be? - the Mad Scientist in the Middle -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMH7l+9IjPOsOWLIJAQEwDwP7BB6ZlEoYVoOFYtzNDcF4XpCKs71GyASC TiwCf+donWycN9SiJHApyXXbnuppGiEyAQYMBGkSLMyIwPMcE4v6CSt2DkpbPjkF XauZy4rqDNljV2pk7PldbPOHDow9wOeoSF2S/luKAoHx5aJWVQrE5SKIgwY2xWfx DYhjte2v9Jc= =88be -----END PGP SIGNATURE-----

5 8

Re: what are these people selling????
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >So no, this is not some great conspiracy on Sun's part to >co-opt the list. You can return to your regularly scheduled >paranoid fantasies. Thank you.... DAMN!.....I thought someone was on to something here. I mean maybe we could get Microhard to do a meeting. Or the dreaded RSA or somebody. Love Always, Carol Anne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMH75T4rpjEWs1wBlAQFM2QP9Eeh1wcbdUMRk+Z8MXX8rix2VeZt1rqnb d735C9bt0B2x0FtYjOTi6r8FPUYWV6AVYjn2z/m+RjZ71H7MoOSoyHOk+XA+biGM TAzSCPcJNvTTjAyAGs7/wC8WC0z6QudMXkitPuXW4s5ZeqX3yuEbPjlyBYwRbt3h LNTVc/BfrsI= =NgMw -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: what are these people selling????
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:43 PM 10/13/95, Censored Girls Anonymous wrote: >I mean maybe we could get Microhard to do a meeting. >Or the dreaded RSA or somebody. Jim Bidzos, President of RSADSI, attended our special "Clipper" meeting the weekend after Clipper was announced, in April 1993. I'm not saying this in defense of RSADSI and their patent situation, just to note that they are not "dreaded." No doubt Carol meant this tongue-in-cheek, but I think it important to remind folks that things are not so black and white as to allow demonization of such companies, at least not based on what has come out so far. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Certificate proposal
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510120147.LAA13833(a)sweeney.cs.monash.edu.au>, Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: > What you are missing is that you should not say > "I want to send my credit card number to Egghead Software" > you should say > "I want to send my credit card number to 12 34 56 78 9A BC DE F0" Why does this sound so much like defining the problem away? Maybe I just don't get it... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH8QCSoZzwIn1bdtAQFm1QGApigaZIVNZTghR9YrzwL/1dMCdu5zGMK5 QPCEJPY2W1hTrL/znVMkcOCg/Tw5ampO =+2Co -----END PGP SIGNATURE-----

1 0

Re: Netscape beta 2.0 [NOISE]
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510130224.TAA04729(a)infinity.c2.org>, sameer <sameer(a)c2.org> wrote: > Hey those shirts aren't measly! Very comfy, in my opinion :-) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH8RzCoZzwIn1bdtAQGRTwGAzGuG7xyQyNmF7MZZpdU+1Wtx7tjmC1an rnhYqyrNV/9XS3qLe789f8epr1/OsUE8 =cnDM -----END PGP SIGNATURE-----

1 0

Re: responce to graphic encryption replies
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

> ... The graphic file is going to have a highly correlated > structure, long runs of white space etc. This is not the case for digital imagery. For any given band, if you sample a significant portion of the image it would not be surprising to see a more or less random distribution over the range. > The statistics for such a file > would be different than the random distribution you'd get from using the > wrong key. If you decrypt with the wrong key, do you get a random distribution? Would this be the case for all wrong keys? Would the statistics change in any discernible pattern as the keys got "closer"? > Even if the graphics format is compressed, leading to a more > even distribution, ... This may give a better result. Most compressions involve a shift to the frequency domain with a quantization of the samples. You might be able to write a detector based on this discontinuity. You could also try throwing an edge detector or some other morphological recognizer at the output. It would still be cheaper than having to a man in the loop, but you're going to spend a lot of cpu time. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

2 1

Re: applications
by Steve Bryan 17 Dec '03

17 Dec '03

At 5:50 pm 10/13/95, cYberpUnc wrote: > I know this isnt what you guys generally talk about but I was curious. >Off the top of your head do you know of any sites where I can get kracking >apps for macs? Any information would be greatly appreciated. Before looking at the address information I was going to send a one line: "Go away" reply to the question. I thought you promised to try to be less obnoxious. If you'd calm down and read the list for a while you might realize why this might not be the place to pose such questions. Why not take a look at the newsgroup alt.2600? You might find it a rather rude place to frequent and I'd certainly never send my 13 year old there (my oldest is currently 8) but I get the impression the topics you'd find there might prove more interesting than the political and/or technical discussions you'll find here. By all means enjoy yourself here but spend more time listening. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)gofast.net |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

Re: Anguilla Cypherpunks Meeting
by cman＠communities.com 17 Dec '03

17 Dec '03

[various comments about extraterritorial reach] Laws that affect the behavior of citizen-units, no matter where they go, rest on the theory of "personal jurisdiction". Note that in addition to ITAR, the various laws on money laundering, as well as the RICO statues, apply to US citizens wherever they may be. Ditto for tax laws -- one of the little gems that I learned last week was that penalties to failure to report worldwide income are going to be substantially increased. I guess they're not getting very good compliance for some reason...

1 0

Re: Netscape question transformed
by carolann＠censored.org 17 Dec '03

17 Dec '03

And some of us wish 2.0 would show images (the windoze 16 version) And I'm not even clever, and have downloaded three copies. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. > > --Jeff > >-- >Jeff Weinstein - Electronic Munitions Specialist >Netscape Communication Corporation >jsw(a)netscape.com - http://home.netscape.com/people/jsw >Any opinions expressed above are mine. > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

AP on trashing/computer fraud ring
by cman＠communities.com 17 Dec '03

17 Dec '03

Although I generally agree that capturing information online has certain advantages to the criminal over going through the trash, that certainly didn't stop this bunch. Doug [wondering if this will affect the market for home shredders] ======================= ATLANTA (AP) -- Thirty people have been charged in a $10 million fraud scheme that involved counterfeiting checks, bank statements and credit card receipts pulled out of the trash. ``What we're finding is people are getting more and more clever with what they pull out of the trash,'' U.S. Attorney Kent Alexander said. ``This is the most clever scam I've ever seen.'' The defendants, who defrauded people in 17 states, used checks, bank statements, credit card receipts and other documents from garbage bins to create counterfeit checks, false driver's licenses and false credit reports, Alexander said. Investigators said software was used to rub out information on the discarded paper. Counterfeit blank checks, printed on high-quality color printers, were allegedly used to defraud banks of $2 million. A core group of about eight people moved the operation to Atlanta from New Jersey five years ago because they thought it would be easy to take advantage of Southerners, the prosecutor said. Of the 30 people charged, 24 have pleaded guilty, Alexander said. Twelve of the 24 have been sentenced to jail terms of up to eight years and restitution of up to $218,070.

1 0

airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Roy M. Silvernail wriote: >Have you flown recently? They now ask you this scripted question about >whether you have been approached by anyone you don't know since arriving >at the airport, and warn you not to accept anything from a stranger or >leave your carry-on baggage unattended until you board the plane. The >ticket agent told me it was a "new FAA regulation". I hadn't flown >anywhere for a few years. Anyone know how long this has been happening? > Goodbye freedom, hello police state. >I wonder how long before I need a passport to cross a state line... The US is merely trying to catch up to what the Europeans have been doing for over a decade. In fact, the US still has a way to go. You ought to pass through Heathrow in London some time to see what real airport security looks like. The US security changes are a recent response, starting after the World Trade Center bombing and being stepped up on a continuing basis. Today you need a picture ID to board with your ticket. Tomorrow...? We have lived in relative safety compared to the rest of the world, but I think those days are over. Usual disclaimer. Bob Bruen.

5 4