December 2003 - cypherpunks-legacy

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Info about FUCK@YOURSELF.UP
by sorry＠lame.guys 17 Dec '03

17 Dec '03

Ok, you better sleep nicely cause i would never again Post nothing to this list. Sorry again. Sincerely *RareTrip*

1 0

Password Keystroke Snarfer Programs
by Bill Stewart 17 Dec '03

17 Dec '03

Several articles on the PGP-users mailing list have discussed keystroke snarfers that unexpectedly grab and save keystrokes, including passwords, severely weakening any benefits from encryption. taoboy <taoboy(a)sprynet.com> mentioned Mac programs FileGuard and HiddenOasis and the SpellCatcher spell-check program's Ghostwriter feature, which he'd noticed had stuck his password into a disk file; he suggests that Windows machines probably have similar surprises. From: patm(a)connix.com (Pat McCotter) > Which is why, every once in a while, I do a search of my entire disk for my > PGP pass phrase and various other passwords I use. [....] I do this with > Norton DiskEditor. I have to upgrade to do this on my Win95 machine which I > understand is much worse than Win3.x in this area. Be careful - PGP goes to a lot of effort to overwrite your passphrase when it's done using it; Norton or grep or other disk-crawlers are unlikely to do so, because that sort of paranoia's not part of their job, and simply typing in a command in a command window will often get it saved in a command history file. So your search for the passphrase on disk makes it _more_ likely that some program will stash it on your disk... You could work around this by using a complex passphrase and adding a distinctive word to the end, e.g. "mumblefrotz foobaroid zarquon FINDTHIS", which doesn't become much less secure if the FINDTHIS gets left on the disk from your "grepemall FINDTHIS c:" command. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

5 4

Encryption ?
by SHARK 17 Dec '03

17 Dec '03

I am a Mathematic student at Bosphorus University in Turkey. I am interested in both computer applications and mathematical base of encryption.Where can I find this kind of staff on internet. Is it necessary to have high level of mathematical background in order to deal with encryption?? By the way Is there any member of this list from Turkey?

4 3

Mr. throw@yourself.up
by jamie＠comet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- He's some little turd at telnor.net. Probably rex(a)telnor.net Throw ftp://ftp.telnor.net/pub/firewall/downloaders.HTM into your favorite browser. The ftp server is world writable too. Fuckin' IRC scum. Oh yeah. Merry Christmas. jamie - ------------------------------------------------------------------------------ jamie(a)comet.net | Comet.Net | Send empty message | Charlottesville, Va. | to pgpkey(a)comet.net | (804)295-2407 | for pgp public key. | http://www.comet.net | "When buying and selling are controlled by legislation, the first things to be bought and sold are legislators" -P.J. O'Rourke. - ------------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMrkpX/MDfTuunU79AQEeogf+Lq4bmq3klEUXHyMAozReqBJgX55AshYs SKh+dZUSEd4kXGM2zDbApLyO8htzxVlpMfcql8ra//9S55OqIOrI3EaVlm3MJ1jt q0oBLM93SNPUmExVAiR38LEybPi7m8qWpfPj6xQUrt20Jlh3FG1aZJJW0JxW1vHP QwsZCbp2QKifCYA+ej404HdsVjfPoC/IyTcZ/QTi5BOcXMLRbjkfLb3XuVjPfuiE 5wrqqVnXmQpGOp9Pd1yUHvGUYcxKIRBqx23IwaxcIpfONtWsDfTlZixLGZNVOjc8 SJmbOukE+KeOSJRElwrJFuWVTB+qtTyif9qksopmuj6vsCQpbrQ94g== =aDfS -----END PGP SIGNATURE-----

1 0

Proof that "cypher punks" have complete degenerated...
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

No one even commented on the latest Dr. Dobbs issue. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 5

BUY_spy
by John Young 17 Dec '03

17 Dec '03

12-18-96. "Special Chips Off-Load and Speed Encryption Transactions" Buy-spy GAK chips from IRE, Rainbow, Atalla, IBM. "Clinton administration opposed to encryption bills" "Goodlatte to resubmit encryption bill" Commerce Department has said it expects to issue rules implementing the new Clinton export policy by January 1, 1997. [NYT reports final rules are due out December 22.] "Method and apparatus for the secure communication of data" Patent: An auto-dialer suitable for use as a smart card capable of being acoustically coupled to a telephone and being reprogrammed in response to acoustic signals. A device for generating a set of tones encoded with data. "Enciphered file sharing method (Fujitsu)" Patent: An enciphered file sharing method adapted to an area distributed type data processing system. "EMD Encryptor; First 32-Bit desktop utility to provide multiple encryption capabilities for home and corporate computer users Largest encryption key size: 256-bit. ----- BUY_spy

1 0

RE: The virus I got...
by Mullen Patrick 17 Dec '03

17 Dec '03

You already had the Monkey (or whatever) virus. It was not included in the file distributed to the list. The file was a pure Trojan, not infector. PM _______________________________________________________________________________ From: Internaut on Thu, Dec 19, 1996 3:30 Subject: RE: The virus I got... From: Mark Rosen[SMTP:mrosen@peganet.com] Sent: Wednesday, December 18, 1996 04.37 PM >Oh, and as far as I know, no virus was installed, >though you should check for one just for good measure. There was one, though I don't remember what it's name was. Maby it was Monkey. I already deleted it. --Internaut

2 1

RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !!
by Peter Trei 17 Dec '03

17 Dec '03

> From: Walt Armour <walt(a)blarg.net> > Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > Security through obscurity is no security at all. > > As for PnC (actually, the scCryptoEngine beneath it), we get the 40 bits > from the 56 bits by nulling out the high nybble of every other byte. > > walt > > ---------- > From: Peter Trei[SMTP:trei@process.com] > Would you mind telling us just how you expand the 40 key to the 56 > bits needed for DES? (Security through obscurity has a bad rep on > this list). For many methods of doing so, 40bit DES is NOT > secure against a motivated individual's attack. > > Peter Trei > trei(a)process.com Thanks for being so forthcoming! There are methods for using 40 bit keys that are a lot better than this. My contention stands: 50 200MHz Pentiums *WILL* crack this overnight. A single 100 MHz Pentium will do it in a month. (This assumes a known plaintext attack in EBC or CBC mode). Not utterly trivial, but well within the means of a motivated individual. Peter Trei trei(a)process.com

1 0

EFF: Bernstein court declares crypto restrictions unconstitutional
by Rich Burroughs 17 Dec '03

17 Dec '03

> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > Free Speech Trumps Clinton Wiretap Plan > >December 18, 1996 [snip] This is the best news that I have heard in some time :) Congrats to John, EFF, Cindy Cohn, and the other counsel for Professor Bernstein. I am very much looking forward to seeing that decision... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb U.S. State Censorship Page at - http://www.teleport.com/~richieb/state dec96 issue "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

passphrase protection (was: Re: [PGP-USERS] Security LeakPrograms)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >I have just in the last few minutes realized how I need to bring attention >to the security level of my own computer or PGP means NOTHING in terms of >protection. Indeed, Floyd: the dirty little secret is that passphrase protection is a more serious weakness than almost any other factor. I don't just mean dictionary attacks: those are way too expensive if you can just grab a text stream saved to an invisible file on an unsuspecting user's net-accessible machine. The new generation of PGP software (3.x) includes several new prompts/enhancements to the passphrase entry process: perhaps subsequent releases could take those even further into the realm of system-level monitoring. >PZ writes in the manual about the inability to fully wipe, etc. >when using virtual memory but this problem I just encountered in security >goes beyond that, I believe. >I have been installing a Macintosh program, FileGuard, which adds several >levels of security. I knew about and had used the invisible extension >HiddenOasis that saves EVERY keystroke made on the machine. I started doing an informal survey of all key capture utilities (on all platforms) a couple of years back, but there were so few utilities publicly available back then, very few respondents came back at me with items to list. It occurred to me then that if there _were_ persons trying to grab passphrases from an individual's machine, it would be a significant advantage to have "invisible" keystroke monitors and for all knowledge of the existence of such utilities to remain a closely-guarded secret (from, say, the laptop of an FBI counter-intelligence instructor suspected of selling secrets to foreign agents for a few hundred thousand dollars, or something improbable like that). However, it's not the "good guys" we mainly need to be concerned with: there is a great deal of industrial espionage that needs some sunshine. The viability of personal privacy software in the marketplace is threatened if such utilities spread: as a responsible company protecting both the public's interest and our own company's survival, we need to plan for very sophisticated passphrase attacks and constantly educate users about this danger. That having been said, this invisible "HiddenOasis" item you mention is a new one to me: I'd like a copy to test in our lab and my interest in hearing about everyone's favorite keycapture utility is rekindled. Maybe my boss will let me devote, oh, about 0.73% of my time to this. ;) PGP's engineers have already spec'ed out some good defenses against subtle attacks like ion migration (memory burn-in), and with everyone's help (we can't watch every security leak, that's why we need you guys!), we can continue to work up defenses against such wee beasties. Any whistleblowers are also invited to drop a dime: my public key is widely available (even clickable) through the header URL above and we still have anonymous remailers in this country. Nudge-nudge, say no more, etc. [elided] >To my surprise as I set user priveledges with FileGuard, I saw a previously >unnoticed folder far from my root directory called, "Ghostwriter." This gives new meaning to the term "spook"... >I rummaged through it and many, most of the files therein (900k of files) >showed various passwords I had consdered absolutely uncompromised in >plaintext. It's quite a shocking feeling to realize what defaults are built into some popular commercial apps, isn't it? :/ You don't often see "insignificant" items like this get mentioned in any popular reviews either. It could be that even more users out there are ignorant of this issue than there are sysadmins who haven't read up on the SYN attack. >It turns out that the spell-check program, SpellCatcher [elided] created >these files which (from the manual), "For the Ghostwriter feature, Spell >Catcher saves a continuous stream of keystrokes to a text file inside the >SPEL CATCHER FOLDER." The manual does mention disabling Ghostwriter before >typing a "sensitive password." But offers no way to PERMANENTLY shut this >feature OFF. [elided] If confirmed, this is an absolutely unconscionable design flaw, IMHO. Anyone who has a specific comment (include URLs if possible), please mail me and put "passphrase protection" somewhere in the subject line. <"mailto:ddt@pgp.com?subject=passphrase protection"> I'll collect them, filter to our engineers where appropriate and eventually, when we have enough for a decent matrix, I'll either post a summary on our website or write up an informational RFC. dave ________________________________________________________________________ Dave Del Torto +1.415.524.6231 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

thread?
by danalogi＠videotron.net 17 Dec '03

17 Dec '03

can we read this thread as a newsgroup somehwre? or it's avaible only as remail? fred.

1 0

Re: Pretty Lousy Privacy
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 06:19 AM 12/19/96 -0800, you wrote: :John H West wrote: :> Are Dr DVT & Ray Arachelian the same pair who relentlessly :> spammed the Net about three years ago. [snip] How soon can we expect Turkish and Armenian language modules for this beta? What is status vis-a-vis export? Thanks for the effort. Cordially, Alec PGP Fingerprint: Type bits/keyID Date User ID pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31

5 10

RE: permanent invasion of privacy
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn Maybe if you got off your ass and did something worthwhile for society, things would really change for the better. But I won't hold my breath. ............................................................. Don't be so presumptious, Dale. I could be a secret cpunk NSA tentacleH^H^H^H^agent on the list trying to discourage people from pursuing certain ideas - like yours, for example. .. Blanc (LOL) > >

1 0

Bernstein case in the White House press conference
by John Gilmore 17 Dec '03

17 Dec '03

"What do you mean? Of course the Emperor is wearing clothes!" John http://library.whitehouse.gov/Briefings.cgi?date=0&briefing=0 December 19, 1996 PRESS BRIEFING BY MIKE MCCURRY 1:37 P.M. EST THE WHITE HOUSE Office of the Press Secretary ______________________________________________________________ For Immediate Release December 19, 1996 PRESS BRIEFING BY MIKE MCCURRY The Briefing Room 1:37 P.M. EST MR. MCCURRY: I sit up here with no information to give, empty. Throw this thing away, this is useless. (Laughter.) I spent the whole morning running around, just like you guys do, running around trying to find somebody who knows something. And I found a whole lot of people who knew nothing. ...several pages deleted... Q Mike, the Post story on the encryption -- federal court decision on encryption software -- can you say what that does to the government's rule-making effort and its plans to -- MR. MCCURRY: I am told that folks at Justice are trying to figure that out. They're analyzing the opinion now and seeing what impact it has. The preliminary read that I've got from them is that it should not have any impact on it because of the way the case is structured and the opinion was drawn. But they're looking at it more carefully now. Q Mike, any comment on The New York Times report that the United States is cracking on war criminals in Bosnia? ....a page deleted... Q Thank you. MR. MCCURRY: Thank you, Helen. See you all tomorrow. Maybe we'll have some real news tomorrow for a change. (Laughter.) THE PRESS: Thank you. END 2:05 P.M. EST #289-12/19

1 0

Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At the last meeting references were made to processors which only execute encrypted code. Decryption occurs on chip. If each chip has a unique public/secret key pair, and executes authenticated code only, there are some interesting implications. Software piracy becomes difficult, if not impossible. Code is sold on a processor by processor basis. Code for a different physical processor cannot be decrypted or executed. Even if it is feasible to determine the secret key stored on the chip, software piracy is still hard because it is not possible to execute the code on another chip without authenticating it. One could execute the code on another architecture entirely using an emulator, but there would be a performance price paid. It wouldn't be worth the trouble for most software. The manufacturer of the encrypted-code processor would protect its instruction set using intellectual property law. Given the high price of a fab, it is entirely feasible to stop anybody from building a new architecture which can execute the code about as fast as the encrypting-code processor. Viruses are not feasible if the authentication is strong. Retrieval of the secret key is quite difficult. Since the results of the decryption never leave the chip, the recent attacks against smart cards do not work. (In the case of an error, the authentication fails and the code does not execute. No information has to leave the chip.) I would be interested to hear comments and corrections. Peter Hendrickson ph(a)netcom.com

5 4

Code+Data separation
by ph＠netcom.com 17 Dec '03

17 Dec '03

Allowing code and data to reside in the same areas of memory is a nice convenience, but it makes security harder to implement because it means code is modifiable and data can be created which just happens to do bad things if it is executed. Are there any modern processors which keep the code and data separated? Peter Hendrickson ph(a)netcom.com

3 2

Re: "Cypher punks'" sexual preferences
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

> Bruce Schneier <schneier(a)counterpane.com> writes: > > > John Gilmore just called me. > > Is Bruce gay? Bruce has a very strange look in his eyes. Perhaps he never has sex with anyone. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 5

Re: We won the Bernstein case.
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu> writes: > On Wed, 18 Dec 1996, Bruce Schneier wrote: > > > John Gilmore just called me. There should be info on it on the EFF website > > real soon now. > > shehechianu vekiyemanu hevigianu lazman hazeh... No wonder Jewhater Timmy May (fart) is rapidly approaching apoplexy! Omeyn. There probably will be an orgy at the NYC punks meeting tonight, which I'm not going to attend, not being a queer "cypher punk". > So does this mean that anything can be exported as long as it's in source > code, or is object code covered as well? Try to find Judge Patel's district on the map. Hint: North California is covered, North Carolina (and North Dakota) ain't. > Simon > > --- > Queen's Own Cypherpunk Regiment / 82nd Chairborne - Gilmour's Irregulars Pathetic queens indeed. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: controlling web "cookies"
by Andrew Loewenstern 17 Dec '03

17 Dec '03

[note, I have rerouted this thread from coderpunks to cypherpunks where it is more appropriate...] Adam Shostack writes: > Posting hacks like this, while fun, tells the bad guys > (in Washington) how we're going to bypass their next > bits of nonsense. > A number of cute hacks posted to cypherpunks after > Clipper II were defended against in Clipper III. So > don't post your cute hacks against systems until they're ok'd > by the government or deployed. Part of the reason past Clipper schemes haven't been deployed is because they had been shown not to work! I say if there are weak spots, keep punching holes in them. While Washington is spinning around trying to come up with a new-and-improved version, keep deploying good strong crypto and working the free-speech/civil-liberties angle in the courts. By the GAKers come up with a workable solution (which is probably impossible given the politics involved in global-GAK) it will be too late. andrew

1 0

"Cryptography Policy and the Information Economy" draft available
by Matt Blaze 17 Dec '03

17 Dec '03

I've got a new draft available of my critique of US cryptography policy and its impact on the future of the "information economy". It summarizes comments I made to a recent meeting of the Computer and Communications Industry Association, and is an updated version of testimony I gave to the Senate commerce committee earlier this year. Postscript is at ftp://ftp.research.att.com/dist/mab/policy.ps ASCII text is at ftp://ftp.research.att.com/dist/mab/policy.txt -matt

1 0

Bernstein (export laws unconstitutional) decision update
by John Gilmore 17 Dec '03

17 Dec '03

The full text of the decision is available at: http:/www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/Legal/961206.decision It's still full of scannos, but we wanted to get it out to you-all ASAP. After further consultations with the attorneys, we are not sure whether the decision has nationwide impact or whether it is limited to the Northern District of California (which includes SF and Silicon Valley). Your Mileage May Vary -- check with your lawyer. I hear from reporters that the Administration plans to announce its reaction to the case this evening. John

4 3

Phil Zimmermann interviewed by Brock Meeks on ISP-TV
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: MEEKS UNFILTERED WITH PHIL ZIMMERMANN DECEMBER 25, 1996 Few men have influenced the face of public cryptography in this decade as much as Phil Zimmermann, creator of the PGP encryption software program and Chairman of the Board and Chief Technical Officer of the Pretty Good Privacy corporation. Public cryptography, however, is more than just clever software. It has become a battleground for individual privacy and the role of the government in having access to private communications. For three years, Zimmermann was the target of a criminal investigation by the US Customs Service, who assumed that United States munitions export laws were broken when PGP spread outside the US. The investigation was finally closed in January 1996, without any charges being filed. Far from being silenced, Zimmermann is now a respected voice for Netziens and privacy advocates, frequently called upon by the media and Congress for his views. Please join ISP-TV and "Meeks Unfiltered" on December 25, 1996, at 8 PM ET for a 30 minute interview between Brock N. Meeks, publisher of CyberWire Dispatch, and Phil Zimmermann. We'd like to call it our Christmas gift to the Net. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network. To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Re: Code+Data separation
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Allowing code and data to reside in the same areas of memory is >a nice convenience, but it makes security harder to implement >because it means code is modifiable and data can be created which >just happens to do bad things if it is executed. > >Are there any modern processors which keep the code and data separated? > >Peter Hendrickson >ph(a)netcom.com I believe those that follow a Harvard architecture do this. -- Steve

1 0

Re: EFF: Bernstein court declares crypto restrictions unconstitutiona
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

jai(a)mantra.com (Dr. Jai Maharaj) writes: > On Thu, 19 Dec 96 11:37:58 EST, > in message <Z2Z7yD10w165w(a)bwalk.dm.com>, > dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: > > I find it highly amusing how John "asshole censor" > > Gilmore claims credit for himself and his discredited > > EFF, as if they had anything to do with Patel's > > ruling. > > What a maroon. > > John Gilmore <gnu(a)toad.com> writes: > > > >> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > >> Free Speech Trumps Clinton Wiretap Plan > >> [...] > > Trying to steal glory from freedom martyr Zimmerman, I > see. The EFF were kicked out of, or their operation > severely reduced on CompuServe, was it not a few years > ago? The EFF lost whatever little credibility is had left when John "asshole censor" Gilmore (spit) admitted to content-based plug-pulling. What a jerk. P.S. I wonder if Bon Giovanni is an EFF supporter. He sounds like one - clueless and untruthful jerk, seeking to silence his mental superiors... --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Mr. throw@yourself.up
by Psionic Damage 17 Dec '03

17 Dec '03

Try Pingin' his ass! Teach him a lesson. At 06:39 AM 12/19/96 -0500, you wrote: > > ><HTML> ><BODY> ><CENTER> ><A HREF="http://www.geocities.com">Postage paid by: <IMG SRC="http://www.geocities.com/pictures/newgeobt.gif"></A></CENTER> ></BODY> ></HTML> > > >-----BEGIN PGP SIGNED MESSAGE----- > >He's some little turd at telnor.net. Probably >rex(a)telnor.net > Throw ftp://ftp.telnor.net/pub/firewall/downloaders.HTM >into your favorite browser. The ftp server is world writable too. > Fuckin' IRC scum. > Oh yeah. > Merry Christmas. > > >jamie >- ------------------------------------------------------------------------------ >jamie(a)comet.net | Comet.Net | Send empty message > | Charlottesville, Va. | to pgpkey(a)comet.net > | (804)295-2407 | for pgp public key. > | http://www.comet.net | >"When buying and selling are controlled by legislation, the first things >to be bought and sold are legislators" -P.J. O'Rourke. >- ------------------------------------------------------------------------------ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQEVAwUBMrkpX/MDfTuunU79AQEeogf+Lq4bmq3klEUXHyMAozReqBJgX55AshYs >SKh+dZUSEd4kXGM2zDbApLyO8htzxVlpMfcql8ra//9S55OqIOrI3EaVlm3MJ1jt >q0oBLM93SNPUmExVAiR38LEybPi7m8qWpfPj6xQUrt20Jlh3FG1aZJJW0JxW1vHP >QwsZCbp2QKifCYA+ej404HdsVjfPoC/IyTcZ/QTi5BOcXMLRbjkfLb3XuVjPfuiE >5wrqqVnXmQpGOp9Pd1yUHvGUYcxKIRBqx23IwaxcIpfONtWsDfTlZixLGZNVOjc8 >SJmbOukE+KeOSJRElwrJFuWVTB+qtTyif9qksopmuj6vsCQpbrQ94g== >=aDfS >-----END PGP SIGNATURE----- > > pSIONIC dAMAGE Zer0 Faith Inc. www.geocities.com/SiliconValley/Heights/2608 H/P/A/V/C ANTIVIRUS/COUNTERSECURITY "ONLY THE ELITE SURVIVE!"

1 0

Ban spam outright?
by Roderick Simpson 17 Dec '03

17 Dec '03

There is an interesting debate going on between Jamie Love and Scott Hazen Mueller over how to deal with the problem of email spam (does this constitute as one?) in Brain Tennis right now. Mueller would like to get rid of spam outright, while Love's organization is on the verge of recommending spam labeling legislation to the US Congress. Go to www.braintennis.com to take a look. Also, drop in to the open discussion area: http://www.braintennis.com/cgi-bin/interact/replies_all?msg.33709 Best, Rod R o d e r i c k S i m p s o n rod(a)wired.com A s s o c i a t e P r o d u c e r T h e H o t W i r e d N e t w o r k www.braintennis.com www.wiredsource.com

1 0

Ahem... 'virus'?
by Dagmar the Surreal 17 Dec '03

17 Dec '03

Let's get a few things straight here before we go any further... I field enough calls from the clooless at work trying to warn me about getting the 'Good Times Virus' in my email without having to worry about yet another meme floating around about email virii. 1. Can anyone show that the .com file replicates? It MUST reproduce itself to be called a virus last time I checked. It looks like a trojan horse to me. 2. How many of you people are using Microsloth Internet Mail? It was mentioned a LONG time ago (I think here, in fact) that there was a major mental lapse on the part of the programmers when designing it because single-clicking a piece of mail will view it, while DOUBLE-CLICKING the mail will execute it (and any attached files!). Most people double-click EVERYTHING in Windoze, and this is why it nailed so many people. I'm surprised I hadn't seen this done sooner. If you think it only got a few of the M$IM users, think again. I'll bet there's a LOT of them out there who are 'suffering in silence' because their computer is completely kaput, or sitting in a shop waiting for someone like me to wipe the hard drive and reinstall everything. Please, if there's going to be another damn meme about email virii, let it NOT be from a list I consider to be at least a LITTLE more enlightened than the hordes of AOL (l)users out there. ---------- Dagmar the Surreal (not actual size) "The Internet is Full. Go Away." -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzK50XQAAAEEAMoJsT9Rwbd28VUGhag2fOl+QrTnltqHrN2/7CBMy6kcnaba 8j3HIsNY6NzE/62iV67n6uCTlt6r3/ZosZL4RXYerH06bDOAfWZ6AYn6d0OO+vgi sghnFXiUfknU0h7A88R7z4uRRpZNkU0NXL/svZjrL+cOiMRnQUAqcwqI8ynFAAUR tCREYWdtYXIgdGhlIFN1cnJlYWwgPGRhZ21hckBlZGdlLm5ldD4= =34r7 -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: EFF: Bernstein court declares crypto restrictions unconstitutiona
by root＠ace.cnl.com.au 17 Dec '03

17 Dec '03

1 0

Re: "I've Always Wondered..."
by Jason Durbin 17 Dec '03

17 Dec '03

Dimitri Vulis KOTM (dlv(a)bwalk.dm.com) Thu, 19 Dec 96 09:50:27 EST wrote: Rabid Wombat <wombat(a)mcfeely.bsfs.org> writes: > On 10 Dec 1996, Secret Squirrel wrote: > > > Still, this brings up an interesting point: Considering the special > > > abilities of many of the principals here, is there something especially > > > tasty in store for those net predators who spam this list? > > > I've always imagined something _very_ special happens to their accounts, > > > but I may just be a hopeless romantic, I dunno... > > > If not, why not? > > Even c'punks are busy at times. > He he he. Clearly, "cypher punks" like Paul Bradley, Ray Arachalian, and > Timmy May suffer from too having too much free time. Idle minds are the > root of sexual perversion or some such. Regulars of the Cypherpunk mailing list would be well advised to pay no attention to Dimitri Vulis who is in the latter stages of dementia caused by the syphillus he contracted from his wife Marina. How sad. Of course, in his rare lucid moment, he lies just for fun. So, enjoy. :) jd

1 0

Re: "Cryptography Policy and the Information Economy" draft available
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:11 PM 12/19/96 -0500, Matt Blaze wrote: >I've got a new draft available of my critique of US cryptography >policy and its impact on the future of the "information economy". >It summarizes comments I made to a recent meeting of the Computer >and Communications Industry Association, and is an updated version >of testimony I gave to the Senate commerce committee earlier this >year. > >Postscript is at ftp://ftp.research.att.com/dist/mab/policy.ps >ASCII text is at ftp://ftp.research.att.com/dist/mab/policy.txt Matt, I liked your draft except for one thing. You never mentioned that the government has never established a legal right to access the cleartext of an encrypted communication or file. Perhaps the most severe flaw in the GAK proposals is that I as a citizen wish to attempt to keep secrets from the government and to force them to take me to court to get a judge to demand that I release those secrets -=- while their proposals are trying to prevent me from even attempting such. - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrn+WlQXJENzYr45AQFrFgQAp2jfB3EOLJoOKHIpTne7D4cwL1KzPcRg VoELRWDGS1RkgK5cSgLl9ASWZ7TdcMRiQUbDPMoffMi3UWlfIpomdsHq+E4HE/U+ 6CS+cpUfw/eSwBYkotCfETMAHymknu/o06QYfBX0TQsN/2XOC52xXEd9Nb/8xjUW c4RETw8Os8A= =nkcy -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:18 PM 12/19/1996, Ben Byer wrote: >> At the last meeting references were made to processors which only >> execute encrypted code. Decryption occurs on chip. >> >> If each chip has a unique public/secret key pair, and executes >> authenticated code only, there are some interesting implications. > Let's see... What about this scenario: > Alice gets a contraband copy of PGP 4.0 off the Internet. Since the > public-key algorithm is publicized so that people can encrypt software > to a chip, PGP 4.0 has the ability to encode/decode/generate keys for > the chip. Alice generates a public key/private key pair 0x12345678, > in software. Alice goes to www.microsoft.com and orders Office '99 > online, and tells Microsoft "Hi, my name is Alice, my credit card > number is 31426436136778 and my PGPentium's public key is 0x12345678." > Microsoft unwittingly sends Alice a copy encrypted to 0x12345678, for > which she has the private key to. Alice decrypts Office '99, and > reencrypts it with public key of her PGPentium, as well as the keys f > all her friends. The software vendor would be wise to check that the public key was legal. It would be a simple matter for the manufacturer to publicize all public keys that had been installed on chips. > Does the authentication defeat this? I'm sort of waving my hands around when I say "authentication". One approach is for the manufacturer to authenticate software submitted by approved vendors. The vendors are then tasked with encrypting it for the correct processor. > Our computers would only run software from Microsoft? Scary. There are all sorts of nifty deals that could be made. Microsoft could commission a special run of the processors which only run Microsoft approved software. Machines using these processors could be given away or sold at a steep discount. You could also timestamp the software so that it only runs for a given length of time. This will encourage people to upgrade regularly. ;-) The processors could also support metering. The processor could support some sort of API for the software to tell it how many computrons had been used and stop it from running after they run out. This means that light users or evaluators of software pay relatively low prices while heavy users pay high prices. This is a great deal for all concerned. Right now software vendors try to do this with clever deals, but it's crude at best. Peter Hendrickson ph(a)netcom.com

4 3

Re: Credentials without Identity--Race Bits
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:38 PM 12/11/96 -0800, "Timothy C. May" <tcmay(a)got.net> wrote: >Consider a "race credential" offered by some entity. .. >(Why some groups might want this is left as an exercise for the reader. >Perhaps a less-inflammatory example (to some of the sensitive amongst you) >might be that some women want to interact in "women only" forums--a clear >case of discrimination, no?--and may want a "gender bit" avaiable to >display as a credential.) I've already tried to subscribe to a forum (at the liberal Utne reader!) where I was rejected because they currently had more subscribers who identified themselves as "male" than as "female", and they wanted to maintain a balance. And certainly "US Citizens Only" sites are common - nationalism is just as ugly and stupid as racism, and far more likely to be enforced with ID requirements; I've heard that in less civilized parts of the world you're actually required to carry government-issued ID cards to walk down the street or fly on airplanes. Another problem is that "nationalist credentials" made hide other data, such as a race bit, a Jewish bit, a don't-ask-out-loud-don't-tell bit, a suspected-Commie bit, a check-FBI-files-first bit, etc. The subliminal channels in DSS are the best known method for doing this, but it's probably possible to do something similar even using blind signatures, especially if there are multiple keys or timestamp fields. For example, they could use different signature keys that are supposedly just "signed at the New York/LA/Langley/Holtsville/SF/DC office" or "signed 4/1/97 4:20pm". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

11 12

Re: Executing Encrypted Code
by Jazzmin Belle Sommers 17 Dec '03

17 Dec '03

>>>> You could also timestamp the software so that it only runs for a given >>>> length of time. This will encourage people to upgrade regularly. ;-) >>> Or to reset their clocks. Which is what many of us do when software is >>> about to "expire." >>However, why not use "beacons"? chop chop chop I have been using some shareware that simply has a built-in counter. Once the counter runs out, you have to register. I would suppose that one could hack the code to find the counter, assuming you could decompile it (or wanted to). Personally I think this is a decent solution to the problem -- the counter on this particular software let you use it 50 times. That's adequate to determine whether you want to keep it or not. Of course, if you saved the .zip file to disk before you installed it, you could delete the copy and reinstall the .zip. But everyone knows this. Jazzmin Sommers

1 0

RE: Securing ActiveX.
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Armenians are murderous cowards. They killed over 2 million Moslems in > this century alone - mostly women and children. I note that along with this racist generalisation you decided to post the following rant: >As usual, Timmy May spouts racist, anti-Semitic shit. As usual, he has >no idea what he's talking about. So what else is new... As well as a number of other rants along those lines. There is little difference between over generalisations of the kind you made above and, for example, discriminating against someone on the basis of race, colour, religion etc. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 8:31 PM 12/19/1996, Timothy C. May wrote: >At 7:34 PM -0800 12/19/96, Peter Hendrickson wrote: >> You could also timestamp the software so that it only runs for a given >> length of time. This will encourage people to upgrade regularly. ;-) > Or to reset their clocks. Which is what many of us do when software is > about to "expire." You are right that this only works in instances where the customer just needs a little prodding to get the upgrade and not in instances where the customer might put up with significant inconvenience to avoid it. However, why not use "beacons"? The clock could have a built-in timer that needs to be reset once a month from an authenticated source. This assumes the presence of net connectivity, but that's not a terrible assumption. Peter Hendrickson ph(a)netcom.com

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:16 PM 12/19/1996, Ben Byer wrote: > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Let's say each key is 2048 bits and there are 10 million processors. That's only 2.38 gigabytes, or under $1000. Easy enough to put on the Web or on a set of CD-ROMs. > Also... with a few million possible keys like this, all you need to do > is to either guess or factor just one of them. Yes, my working assumption is that factoring is very hard. >>> Does the authentication defeat this? >> I'm sort of waving my hands around when I say "authentication". >> One approach is for the manufacturer to authenticate software submitted >> by approved vendors. The vendors are then tasked with encrypting it >> for the correct processor. > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. You have to have the "approved" message so that you don't get viruses and to thwart piracy in case anybody did manage to get the secret key out of the chip. How well it goes over depends entirely on how much you pay for the software. >>> Our computers would only run software from Microsoft? Scary. >> There are all sorts of nifty deals that could be made. Microsoft >> could commission a special run of the processors which only run >> Microsoft approved software. Machines using these processors could >> be given away or sold at a steep discount. > Right; the only reason I could see people using this would be for > economical reasons. And one would expect piracy-proof software to be very inexpensive. Most people who pay for software have little sympathy for those who don't. >> You could also timestamp the software so that it only runs for a given >> length of time. This will encourage people to upgrade regularly. ;-) >> The processors could also support metering. > Right; once the user loses control of what he's running, then you can > pretty much do anything you want as far as metering goes. Right you are - see below. > ObGAK question: Would this be exportable? I mean, you could be > encrypting god knows WHAT into those .exe's... Key escrow? How would > they get the key?!? I can see the headlines, "Key Escrow Database > Leaked to Pirate Firm"... :) While I am certainly not a lawyer, and even the lawyers can't tell you what is legal to export, I would guess that Big Brother would be delighted with the manufacturers of this processor. It can't be used to encrypt communications, only to decrypt software. What is more, you could control the physical processors so that exportable processors accept a different authentication key. Then, the manufacturer of the processor can take care not to authenticate any privacy enhancing programs for the export version of the processor. Free speech and constitutional issues evaporate because the processors are physical devices and not expressions of ideas. Even "better", not very many organizations in the world can afford the fab lines to manufacture a state of the art processor. So, if the G-7 countries are brought onto the reservation, it would be feasible to forbid all free processors. Peter Hendrickson ph(a)netcom.com P.S. Did you hear? For Christmas Big Brother is raising the chocolate ration from 30g to 20g!!!

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:20 PM 12/19/1996, Timothy C. May wrote: >> However, why not use "beacons"? The clock could have a built-in timer >> that needs to be reset once a month from an authenticated source. This >> assumes the presence of net connectivity, but that's not a terrible >> assumption. > I mentioned "beacons" in the portion of my message you did not quote here. Gack! > As for why they are not being used, they don't exist. Here's how I would do it. When the processor wants to update its clock, it generates a random number and encrypts it for the trusted time source. The trusted time source decrypts its message to get the random number. It timestamps it, encrypts it, and sends it back. This means you can't replay old time messages to keep using your old software. Is it possible to have a little clock and rechargeable battery on a chip? If so, then this technique should be easy to use. If not, then the processor can count the number of cycles it runs and use that as an approximate means of deciding when to check the time. Or, it could demand a time update every time it is power cycled. Peter Hendrickson ph(a)netcom.com

1 0

Expedia New Member Information
by accthelp＠expedia.com 17 Dec '03

17 Dec '03

Welcome to Microsoft Expedia Travel Services! Below is your new membership information. Please keep this confirmation mail as a record of your Member ID and Password. Your Member ID is: cypherpunks Your Password is: cypherpunks The Expedia Internet address is: http://expedia.msn.com/ Expedia is a free service. To use the Expedia Travel Agent, you will have to type your Member ID and Password on the Sign In page. Whether for business or pleasure, Microsoft Expedia makes it easy for you to plan and purchase travel arrangements that best meet your budget and personal preferences. Expedia is on the job 24 hours a day, 7 days a week. With a click of your mouse, you can: * Reserve and purchase airline tickets * Reserve hotel rooms * Reserve rental cars * Subscribe to Fare Tracker for the lowest airfares to your favorite destinations * Research over 300 destinations in the Expedia World Guide * Chart your course with over 200 city maps * Check out the world of adventure in the Mungo Park online magazine * Catch up on the latest travel news, weather and more We look forward to fulfilling all of your travel needs. Expedia Member Services Start your travel here. http://expedia.msn.com/

1 0

Re: Proof that "cypher punks" have complete degenerated...
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 19 Dec 1996 04:24:14 +0000, geeman(a)best.com wrote: >It wasn't worth commenting on. >Appending data after the ctrl-Z as stego? >Not even worth a letter to the ed! >> No one even commented on the latest Dr. Dobbs issue. I know - I was amazed that made it into the issue. It's almost amazing that someone would go to such effort to do this and miss all the [IMHO] easier ways. Simply astounding... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:52 PM 12/19/1996, Bill Frantz wrote: >At 12:08 PM -0800 12/19/96, Peter Hendrickson wrote: >> If each chip has a unique public/secret key pair, and executes >> authenticated code only, there are some interesting implications. >> Software piracy becomes difficult, if not impossible. Code is sold >> on a processor by processor basis. Code for a different physical >> processor cannot be decrypted or executed. > This makes backup hard. That is the rock the routine copy protection hit > up against. There were many, me included, who simply said, "If your > product is copy protected then I will buy from your competitor." No, you can backup just as much as many times as you like. The code isn't stored on the chip permanently, it is only decrypted there. There is a similar problem, though. If your processor dies you could lose your software library. There are ways to mitigate this. One is for the vendors to just trust people and reissue the code to a new processor. Of course, you track how often you have to do this. Or, you could turn in the broken processor and have the manufacturer certify that it was turned in to the software vendors and that a new version of the software should be generated. This might not be so important if you generally pay for metered software. >> Viruses are not feasible if the authentication is strong. > So is user written code, public domain code etc. If there is an > un-encrypted mode for that kind of code, then viruses again become > possible. User written code is harder to arrange, it is true. You might have a way to execute non-authenticated code but at a speed comparable to an emulator. Or, you might just have another computer for running your own code. Right now it is not uncommon for a software library to exceed the value of the machine. It might actually be economical to have two machines if one of them can support a rich software library which doesn't cost as much money because it can't be pirated. Free software is still possible to run at full speed, but it has to be authenticated. The free software writer just has to do whatever the software vendor had to do to get it okayed. This makes it harder to release free software, but the effort is still a small fraction of the work required to build a significant application. Getting it to execute for particular processors is easy. You could release a piece of software which takes code and encrypts it for your particular hunk of silicon. If you could offer otherwise free software for, say, $20 and know that everybody using it will pay, many people might consider that to be a great deal. Right now the mechanisms of moving the software are too expensive to really make it feasible for something under $20. Development might be a bit tricky, but there are workable solutions. The manufacturer could release special processors which have an additional authentication mechanism for software developers which is specific to each developer. They could authenticate code to run on their own machine, but not on anybody else's. This does make it possible for software developers to pirate software (if the can get a secret key), but if the number of development processors is low, this could be manageable. If the environment was well defined, you could conceivably develop in a high level language on one platform, but deploy for sale on the decrypting-processor platform. Peter Hendrickson ph(a)netcom.com

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:41 AM 12/20/1996, Scott V. McGuire wrote: >On Thu, 19 Dec 1996, Peter Hendrickson Wrote: >> The manufacturer of the encrypted-code processor would protect its >> instruction set using intellectual property law. Given the high >> price of a fab, it is entirely feasible to stop anybody from building >> a new architecture which can execute the code about as fast as >> the encrypting-code processor. > It seems to me that this is where this scheme would be broken. Have > intellectual property laws been (successfully) used in this way? I don't know, but I bet it would be possible to arrange if there was support for it. Or, maybe the instruction set itself remains a trade secret. Sure, it could leak out, but aren't there laws against industrial espionage? (If the instruction set was secret, the manufacturer might have to provide a compilation service.) > And even if so, would they be enforced in all the countries where the > chips might be fabricated? Yes, if the laws exist they would be easy to enforce. What does a state-of-the-art fab cost now? $5 billion? $10 billion? I was generous when I said "G-7". Which countries can really compete in this market? The U.S. and Japan, I believe. There is no reason to rule out extra-legal pressure, either. The USG appears to have played the policeman in supporting the DRAM market in an informal way. It would be very easy to have a chat with the Japanese government about the importance of stopping software piracy. Peter Hendrickson ph(a)netcom.com

1 0

Ebonics
by Timothy C. May 17 Dec '03

17 Dec '03

In order to remain compliant with the new California law requiring increased use of "Ebonics," the new academic name for "Black English" (and known by honkey mofos as "ghetto jive"). Apparently the coloreds have had enough of "standard English" and its repression of their culture. To meet the requirements of this new law, 10% of my posts from now on will be written as best I can manage in the Ebonic language. Switching to Ebonics: De honks be chimin.' Code be fly! I's huffa be gots to be sizing, bitch. PGP 3 be dope, nuffin but bad! I be axing you if it be outa honkeyland or outa Afrika? Dat bitch Reno be sayin' it be 'legal be usin' dope 'warez. Day be hos. --a melanin-challenged honkey mofo Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Test files for encryption
by Steve O 17 Dec '03

17 Dec '03

Can someone point me to any standard files that are used when testing encryption strength. Iie i'm looking for a gourp of files that may have been used by an agency or Internet group in the past that when encrypted were tested for byte frequency etc. as well as cryptoanalytic atacks. thanks in advance. steveo privsoft(a)ix.netcom.com

1 0

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 03:30:46 EST, you write: << > >You could also timestamp the software so that it only runs for a given > >length of time. This will encourage people to upgrade regularly. ;-) > >> If anyone thinks it is anything but trivial to track down a call for time/date and a comparison of the two.. and then overwrite the area with some nop's to make sure the address jumps come out the same.. your sadly mistaken =-}

1 0

C2Net Party: January 24th
by sameer 17 Dec '03

17 Dec '03

http://www.c2.net/party/ C2NET is having a party January 24th at 654 Mission St. San Francisco assorted snacks, a cash bar and live music by WEIRD BLINKING LIGHTS with dj accompaniment by DJ FLINT and DJ PINNIPED will be present for your enjoyment Festivities begin at 8PM We hope to see you there --- Directions: >From the West or North: Take Oak Street East. Turn left on Laguna. Turn right on Fell. Fell crosses Market and becomes 10th Street. Merge left within one block of Market. Turn left on Mission. >From the East: Take Hwy 80 West across the Bay Bridge. Take the first exit on the left (Harrison Street exit) Turn left on Harrison. Turn right on 3rd Street. Turn right on Mission. >From the South: Take Hwy 280 North. Follow 280 to its end at 4th & King Streets. Follow King Street to its end at 3rd Street. Turn left on 3rd. Turn right on Mission. >From BART: Take BART to the Montgomery station Walk south on New Montgomery Street Turn right on Mission. Parking: There is a commercial parking lot across the street on Mission and another one on the corner of 3rd and Mission.

1 0

Re: Executing Encrypted Code
by Hal Finney 17 Dec '03

17 Dec '03

From: Ben Byer <root(a)bushing.plastic.crosslink.net> > [Quoting Peter Hendrickson:] > > The software vendor would be wise to check that the public key was > > legal. It would be a simple matter for the manufacturer to publicize > > all public keys that had been installed on chips. > > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Probably an easier way would be for the chip manufacturer to issue a key certificate (signature) on the chip keys. Then it is a trivial matter for any software manufacturer to verify that a proferred chip key is legit; just check the cert. > > One approach is for the manufacturer to authenticate software submitted > > by approved vendors. The vendors are then tasked with encrypting it > > for the correct processor. > > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. Hey, it's a free world, right? Some people only run authenticated code from big companies; other people turn off the authentication bit in the CPU and can run any old thing they stumble across on the net. Everybody's happy. The first group doesn't have to worry about viruses, or at least they have somebody to sue if they see one, and the second group gets to run all the freeware and PD code they can today. > Right; the only reason I could see people using this would be for > economical reasons. Yes, I think this is a point often missed in these discussions. People say, why would I want a CPU which will limit the software I can run, something which will let a software maker give me a version of his program which will only run on my CPU and which I have no ability to share with others? What's in it for me? The answer presumably is that the software manufacturer will sell software with such limits for much less than he will sell unlimited software. That's because software piracy is such a major problem, and this way he can be protected against piracy from this copy of his program. So people with these CPU's can buy their software a lot cheaper. Now if you only use pirated software anyway, which you get for free, then obviously this is not much of an incentive. It is only for people who pay for their software. But that is a significant market. Of course the big downside is that the track record of tamper resistant hardware has not been too strong lately! If a system like this gets into widespread use and somebody finds out that shooting X-rays at the chip exposes its secret key, you've got a big problem. Hal

2 1

Key Escrow Rule
by John Young 17 Dec '03

17 Dec '03

The Federal Register of December 13, 1996 has published "Licensing of Key Escrow Encryption Equipment and Software" This parallels the draft regulations for encryption export provided by Steptoe & Johnson on December 11 but sets provisions specifically for key escrow products. We've put it at: http://jya.com/ke121396.htm (39 kb) Here are excerpts from the opening: ----------------------------------------------------------------------- This interim final rule amends the Export Administration Regulations (EAR) by imposing national security controls on Key escrow information security (encryption) equipment and software transferred from the U.S. Munitions List to the Commerce Control List following a commodity jurisdiction determination by the Department of State. This interim final rule also amends the EAR to exclude key escrow items from the de minimis provisions for items exported from abroad and to exclude key escrow encryption software from mass market eligibility. Further, key escrow encryption software is subject to the EAR even when made publicly available. ... Once transferred, key escrow encryption items will be controlled for national security reasons. A license will be required from the Department of Commerce to all destinations, except Canada. This is an initial step in liberalizing the treatment of encryption exports. The Bureau of Export Administration is preparing regulations to further implement the Administration's encryption policies, which will be published in the Federal Register in the near future. ...

1 0