December 2003 - cypherpunks-legacy

FTC Online Privacy Report
by John Young 17 Dec '03

17 Dec '03

The Federal Trade Commission released yesterday: "Consumer Privacy on the Global Information Infrastructure" http://www.ftc.gov/bcp/conline/pubs/privacy/privacy1.htm Reuters 1-6-97: The Federal Trade Commission, which last year held a conference on privacy issues, said participants at the gathering agreed that businesses have four ways to protect consumer privacy: -- Notify consumers about how personal information collected online is used. -- Give consumers a choice about whether and how their personal information is used. -- Ensure the security of personal information is protected. -- Give consumers access to their own personal information to ensure its accuracy.

3 2

Internet Draft : keyserver protocol
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: coderpunks(a)toad.com Date: Tue Jan 07 08:15:10 1997 My proposal for a realtime keyserver protocol/system has been made available. I would welcome any comments/discussion regarding it. It may be found at: ds.internic.net/internet-drafts/draft-merriman-realtime-key-00.txt Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMtGxtMVrTvyYOzAZAQFsVQP+LpTOyQjdNH3dMpUBG0DMHQ8jIM+cENs+ nK+r/9uKYAWKHkTwENNHwIn9mwxKi2GhgnXdJf7zUMdkNgK2w6Im7yOHzMhsZFfm KQJlY+qzQbNOdf+LjOnbhy16u0h/0zgP6+NzITFqeXOToGC9KkImWmdaROe+enIX 3v1LYz4jHEM= =tIT+ -----END PGP SIGNATURE-----

1 0

Re: Double crypt strength
by Rick Osborne 17 Dec '03

17 Dec '03

At 04:33 PM 1/6/97 -0800, Toto wrote: > Pardon my ignorance, but I seem to be missing something here. > If you use an encryption as your password, do you not need to 'store' >it somewhere in order to use it in the future (to 'pass' it to the >decryption program)? I was thinking something as simple as running crypt and then the next thing you do is run passwd. That way, the encrypted string will probably still be right there on the screen (assuming your passwd util doesn't clear the screen first). Granted, it still means that you have to remember a pseudo-random string, but the string is always one step away if you used a logical password/phrase to generate it. Sorry, I guess I wasn't too clear on that (fingers can't keep up with the mind and all that...) -Rick Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- "And when exactly did all this happen?" 'When we rewrote the dictionary.'

1 0

Polymorph engine (was:RE: PWL's how ?)
by Mullen Patrick 17 Dec '03

17 Dec '03

Where did you get the following text on polymorph engines? Is it available somewhere? Where can I get other information on similar topics (Please resist the urge to mention web search engines; I'm looking for specific recommendations :-) Thanks! - Patrick _______________________________________________________________________________ From: Neil Tunnicliffe on Tue, Jan 7, 1997 6:08 Read this for an understanding of a polymorhphic virus: E#234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234#>> #188# A GENERAL DESCRIPTION OF THE METHODS BEHIND A POLYMORPH ENGINE #188# E#234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234##234#* A small glossary of terms: AAAAAAAAAAAAAAAAAAAAAAAAAA ENCRYPT = Transform from it's original form to an altered form. DECRYPT = Transform from it's altered form to it's original form. KEY = The register or value used to encrypt/decrypt with. SLIDING KEY = A KEY value that is INCREASED or DECREASED on each loop. COUNT = The number of bytes in the encrypted code or data. INDEX = A pointer to the encrypted code or data. SIGNATURE = A unique group of bytes that can be used to check against a programs content in the hope of detecting a particular program. HEURISTIC = A set of well defined rules to apply to a problem in the hope of achieving a known result. Question: What is a Polymorph? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Answer: Well, the Longman English Dictionary defines it as: "POLYMORPHOUS also POLYMORPHIC adj fml or tech. EXISTING IN VARIOUS DIFFERENT FORMS." In other words, something that has the ability to change it's shape. Other ways to describe such a thing might be; Mutable, Metamorphic, Etc... Question: What is a Polymorph Engine? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Answer: A program with the abilities to encrypt (or jumble up) another program or data and provide a unique decryptor for it, it must do this in such a way that no two encryptions of the same program or data will look alike. Example: Take the following ultra-simple decryptor: MOV SI,jumbled_data ;Point to the jumbled data MOV CX,10 ;Ten bytes to decrypt main_loop: XOR BYTE PTR [SI],55 ;XOR (un_scramble!) a byte INC SI ;Next byte LOOP main_loop ;Loop for the 9 remaining bytes This small program will XOR the ten bytes at the location pointed to by SI with the value 55. Providing the ten bytes were XORed with 55 prior to running this decryptor the ten bytes will be restored to their original state. If you are unsure as to why this is, brush up on your XOR logic!! Ok, so you might say that if you change the KEY value on each generation it will become Polymorphic? Well, yes and no! If you did that, the encrypted portion would be Polymorphic, but the decryptor would still remain mostly the same, the only change begin the KEY value! So, a signature scanner that allows WILDCARDS (and most do!) would still be able to find your decryptor! One way you could fool some signature scanners is to swap around some of the instructions. So, with this in mind, the above decryptor might look like: MOV CX,10 MOV SI,jumbled_data main_loop: XOR BYTE PTR [SI],55 INC SI LOOP main_loop As you can see, still not much of a change, not really enough to fool some of the better signature scanners. "GET TO THE POINT! WHAT IS A TRUE POLYMORPH?", I hear you cry! AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Well, a "true" Polymorph would be a decryptor that looks completely different on each generation! Take the following decryptor: MOV CX,10 NOP NOP MOV SI,jumbled_data NOP main_loop: NOP NOP XOR BYTE PTR [SI],55 NOP INC SI NOP NOP NOP NOP LOOP main_loop This decryptor is the same as the one before it, but it has has a few random NOP instructions peppered throughout itself. On each generation you would vary the amount of NOPs after each instruction. This is a Polymorph in it's simplest form. Still, most of the good signature scanners would have no problem with such a simple Polymorph. They would simply skip the NOPs, thus having a clear view of the decryptor, to which they could apply a signature! No, a "true" Polymorph has to be far far more complex then this! Instead of peppering NOPs throughout the decryptor it would pepper totally random amounts of totally random 8086 instructions, including JUMPS and CALLS. It would also use a different main decryptor (possibly from a selection of pre-coded ones) and would alter all the registers that the decryptor uses on each generation, making sure that the JUNK code that it generates doesn't destroy any of the registers used by the real decryptor! So, with these rules in mind, here is our simple decryptor again: MOV DX,10 ;Real part of the decryptor! MOV SI,1234 ;junk AND AX,[SI+1234] ;junk CLD ;junk MOV DI,jumbled_data ;Real part of the decryptor! TEST [SI+1234],BL ;junk OR AL,CL ;junk main_loop: ADD SI,SI ;junk instruction, real loop! XOR AX,1234 ;junk XOR BYTE PTR [DI],55 ;Real part of the decryptor! SUB SI,123 ;junk INC DI ;Real part of the decryptor! TEST DX,1234 ;junk AND AL,[BP+1234] ;junk DEC DX ;Real part of the decryptor! NOP ;junk XOR AX,DX ;junk SBB AX,[SI+1234] ;junk AND DX,DX ;Real part of the decryptor! JNZ main_loop ;Real part of the decryptor! As you should be able to see, quite a mess!! But, still executable code. It is essential that any junk code generated by the Polymorph Engine is executable, as it is going to be peppered throughout the decryptor. Note, in this example, that some of the junk instructions use registers that we are using in the decryptor! This is fine, providing the values in these registers aren't destroyed. Also note, that now we have random registers and random instructions on each generation it makes signature scanning (even for the clever signature scanners) impossible! Instead, an HEURISTIC method must be used, which can lead to false alarms. So, a Polymorph Engine can be summed up into three major parts: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 1 .. The random number generator. 2 .. The junk code generator. 3 .. The decryptor generator. There are other discrete parts but these three are the ones where most of the work goes on! How does it all work? Well, SMEG goes about generating random decryptors in the following way: 1 .. Chooses a random selection of registers to use for the decryptor. Leaving the remaining registers as "junk" registers for the junk code generator. 2 .. Chooses one of the compressed pre-coded decryptors. 3 .. Goes into a loop generating the real decryptor, peppered with junk code. To understand how the selected registers are slotted into the decryptors and the junk code you must look at the 8086 instructions from a binary level: XOR AX,AX = 00110001 11000000 XOR AX,CX = 00110001 11001000 XOR AX,DX = 00110001 11010000 XOR AX,BX = 00110001 11011000 You should be able to see a pattern in the binary code for these four 8086 instructions? Well, all 8086 instructions follow logical patterns, and it is these patterns that tell the 8086 processor which registers/addressing mode to use for a particular instruction. The total amount of instruction formats and the precise logic regarding the patterns is too complex to go into here. However, all good 8086 tutorials/reference guides will explain in full. SMEG exploits this pattern logic to generate junk code and decryptors with random registers, as the patterns directly relate to the registers Etc. SMEG generates junk code in the following way: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Inside SMEG there is a table of the basic binary patterns for all of the 8086 instruction set, but with one important difference, all the register/address mode bits are zero. This is called the SKELETON INSTRUCTION TABLE. The table also contains various other bytes used by SMEG to determine the relevant bit positions to "plug in" the register bit patterns. These patterns are plugged in via the logic processes OR and AND. Using this method, SMEG can generate endless amounts of random 8086 instructions without destroying any of the registers used by the decryptor proper. SMEG also contains some discrete logic for producing false CALLS to dummy subroutines and also false conditional JMPS around the junk code. SMEG generates the decryptor proper in the following way: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Inside SMEG there is a table containing a selection of common 8086 instructions used in decryptors, such as XOR [index],reg Etc. These are, again, stored in SKELETON FORM with some control bytes used by the decryptor generator. Also, inside SMEG, there are several pre-coded decryptors stored in a compressed form. On average, a complete decryptor can be described to the decryptor generator in as few as 11 bytes and adding to the list of pre-coded decryptors is both painless and economical with space! SMEG generates the Polymorphed decryptor in the following way: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA First it chooses, at random, one of the pre-coded compressed decryptors. Next it goes into a loop uncompressing each decryptor instruction, plugging in the required registers, storing it and then generating (for each real instruction) a random amount of random instructions. This loop repeats until the complete decryptor has been constructed. The final result is a random size, random register, random patterned decryptor! It should also be noted that whenever SMEG generates an INDEXed instruction it uses either SI, DI or BX at random, also it sometimes uses a random offset. For example, say the encrypted code started at address 10h, the following could be used to index this address: MOV SI,10h ;Start address MOV AL,[SI] ;Index from initial address But sometimes SMEG will generate something like the following, again based on the encrypted code starting at address 10h: MOV DI,0BFAAh ;Indirect start address MOV AL,[DI+4066h) ;4066h + 0BFAAh = 10010h (and FFFF = 10h)!! These indexed and initial values are picked at complete random, and the examples of 0BFAAh and 4066h are valid, but next time they will be completely different! The following are two decryptors that were generated with my SMEG Polymorph Engine. It should be noted that I generated 4000 examples with no two alike! Unfortunately I ran out of hard drive space! But it is fairly safe to say that the total number of decryptor combinations would run into the BILLIONS! All the lines marked with ";junk" in the following listings indicate random junk instructions that were inserted throughout the actual decryptor, note that SMEG has the ability to generate junk CALLS to false SUBROUTINES, as well as general junk conditional jumps! All lines marked with a * indicate an actual part of the decryptor proper. I chose the two generations shown because their sizes were similar, 386 and 480 bytes. SMEG produces decryptors ranging in size from as little as 288 to as much as 1536 bytes. Even if two decryptors are generated that are the same size the chances of them being the same are, literally, billions to one!

1 0

Free Software - Link to 500 Engines & Directories!!
by David Rand 17 Dec '03

17 Dec '03

This is what everyone with a Web Page has been waiting for! AN AUTOMATIC Submission program which will link your Web Pages to over 500 Search Engines & Directories!! Find out more about the Exploit Submission Wizard, and why it recently received a 5 star 'best buy' award from Internet Magazine and was recently reviewed as the 'greatest advance to web designers since the invention of hot dog'. You Can Download the Program and have a FREE TRIAL at: http://www.freegoodies.com/wizard/submit.htm

1 0

RSA and Cylink settle
by Bruce Schneier 17 Dec '03

17 Dec '03

Subj: Cylink and RSA Data Security Reach Legal Settlement; Public Key Encryption Compa Date: Tue, Jan 7, 1997 7:52 AM EST From: AOLNewsProfiles(a)aol.net REDWOOD CITY, Calif.--(BUSINESS WIRE)--Jan. 7, 1997--RSA Data Security, Inc., a wholly-owned subsidiary of Security Dynamics Technologies, Inc. (NASDAQ:SDTI), and Cylink Corporation (NASDAQ:CYLK), today announced a comprehensive global settlement of their long-standing legal disputes. The settlement ends all outstanding litigation between Cylink and RSA. The two companies reached an amicable resolution of their disputes. As part of the settlement, Cylink granted to RSA all necessary rights to Cylink's Stanford patents, and RSA granted to Cylink a license to RSA's cryptographic software toolkits. For both parties, the settlement ends further prolongation of a legal dispute that has been costly and distracting. RSA is fulfilling the promise made to its customers to resolve the disputes with Cylink. Cylink, under its new president and chief executive, is refocusing all of its energies on providing end-to-end data security products and solutions, and has the ability to incorporate RSA or other technologies to meet customer requirements. "We are very pleased that what had so long seemed to be an intractable problem has, within the space of 10 days, now been resolved by the new management at Cylink," said James Bidzos, president of RSA. "I worked well with Fernand Sarrat while he was at IBM, and that working relationship helped us reach this agreement so swiftly. This agreement turns long-time antagonists into companies that are already exploring ways of working together constructively, to the benefit of the industry as a whole." Fernand Sarrat, president and chief executive officer of Cylink, said, "We are setting out on an aggressive new course at Cylink in which old disputes are an unnecessary distraction. RSA will be one of our strategic suppliers and we anticipate focusing totally on the needs of our customers and the enormous market opportunity before us." RSA Data Security, Inc. RSA Data Security, Inc., a wholly-owned subsidiary of Security Dynamics Technologies, Inc. (NASDAQ: SDTI), is the world's brand name for cryptography, with more than 75 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, IT4, ISO, ANSI, IEEE, business, financial and electronic commerce networks around the globe. The company develops and markets platform-independent developer's kits and end-user products and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, Calif. Cylink Corporation Cylink Corporation (NASDAQ: CYLK) is a leading worldwide supplier of information security solutions, providing the most comprehensive portfolio of public key cryptographic hardware and software products available today. Cylink's products enable secure transmissions over local area networks (LANs), wide area networks (WANs), public packet switched networks such as the Internet, asynchronous transfer mode (ATM) and frame relay networks. Cylink, headquartered in Sunnyvale, Calif., is also the leader in outdoor spread spectrum microwave radio communications. Cylink's customers include national and multinational corporations, financial institutions and government organizations. For more information about Cylink and its products, call the fax-on-demand number 800/735-6614, or visit the company's Web site at http://www.cylink.com. --30--mg/sf* eh CONTACT: Cylink Paula Contos Dunne, 408/523-5993 pdunne(a)cylink.com or Edelman Worldwide Ina McGuinness, 415/433-5381 x 213 imcguinn(a)edelman.com or Patrick Corman Patrick Corman, 415/326-9648 Corman(a)cerfnet.com ************************************************************************ * Bruce Schneier 2,000,000,000,000,000,000,000,000,002,000, * Counterpane Systems 000,000,000,000,000,000,002,000,000,002,293 * schneier(a)counterpane.com The last prime number...alphabetically! * (612) 823-1098 Two vigintillion, two undecillion, two * 101 E Minnehaha Pkwy trillion, two thousand, two hundred and * Minneapolis, MN 55419 ninety three. * http://www.counterpane.com ************************************************************************

2 1

Re: An observation on the moderation thread.
by Dale Thorn 17 Dec '03

17 Dec '03

Roy M. Silvernail wrote: > In your mail, you write: > > So this jerk (number ???) admits the problem is already solved, > > then goes on to say "yeah, Sandy, block some more, just in case > > my killfile misses one". > Not at all. I'm simply noting that the people who are crying the > loudest about losing their forum are the ones I already ignore. As has > been amply pointed out, so long as the list is available in an > unmoderated form, nothing is being lost. > > You would have loved Hitler. > Godwin's Law has been invoked. > > You're nothing new, Roy. Just another fascistic voice calling for > > the Final Solution. > I'll resist the temptation to return the insult. If it matters, you've > been in my killfile for some weeks. > Consider this official notice: do not send me any more email of any > kind. Any such mail received will be considered harrassment, and will be > dealt with accordingly. Since Roy has chosen to argue with me, then shut me off by threatening reprisal if I mail him directly, I'll have to post this to the list. Sorry, Roy. I try never to do a thing like this, but next time, don't argue and then say I can't argue back. Just say "don't reply" and drop the argument.

1 0

The Last Great Opportunity of the 20th Century!
by kent＠axxis.com 17 Dec '03

17 Dec '03

I'm_a_SPAMMING_moron, Just thought I would drop you a note letting you know of an opportunity that I came across lately. I have been amazed at the success everyone in the company is having. As you know timing is everything. JDS, a debt-free multimillion dollar telecommunication company, is launching for expansion its networking division called FastTrack January 6, 1997. Just as the Oklahoma land rush was the last great opportunity of the 19th century - so is FastTrack the last great opportunity of the 20th. This is our chance to get in on the ground floor of an incredible opportunity. Best of all - the program incorporates "Spillover". Spillover is one of the best ideas ever developed for network marketing. Here's why: Anyone I sponsor after you, will be placed under you. You then earn commissions on these new people as if you had signed them up! I just signed up a few days ago and I already have 53 members in my team just from SPILLOVER! I hardly did anything! The program just started, in fact it has less than 3,000 members. This IS the ground floor! If you are serious about making money, then call our hotline at 800-399-5052. If you know what it's like to lose sleep because your so excited, then give me a call at 801-955-7975 or email me at kent(a)axxis.com.

1 0

Dale on a tear (again)
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

At 06:04 PM 1/5/97 -0800, Dale obviously wrote: :I'll bet Hitler was disenchanted by the declaration against him by the World Jewish Congress. : :I'll bet Andrew Jackson was disenchanted with the decisions of the :Seminole Indian leaders to not just lay down and die. : :And now Sandy is disenchanted. What a hypocritical asshole. What can one make of this fellow Dale? Either he is Dr. V's mouthpiece or he has gone off the deep end. A pity in either case -- a mind is a terrible thing to waste.

1 0

Re: Relative Strength of 40-bit Crypto Implementations
by Rick Smith 17 Dec '03

17 Dec '03

: A client asked me today about where he could find evidence of the : relative strength of different encryption algorithms, when all are : restricted to 40-bit keys. He assumed dot-Gov was going to restrict his : export product to the 40-bit limit, but he wanted to provide the strongest : security he could within that limitation. There is a tiny technical wrinkle here -- the simpleminded approach is to use a 40 bit secret key appended to a constant, the smarter approach is to use some disclosed random data that, combined with 40 secret bits, produces a much longer key. It's like the salt in Unix passwords. The simple approach can allow an attacker to use a dictionary attack. The smarter approach means that the algorithm's full key length gets used. So, for example, you have 128 bit RC4 in which 88 bits are random but disclosed while the remaining 40 bits are still secret. The only practical problem is disclosure of the extra random bits, which the government expects the software to do. This is one of the uses of the big chunks of random data that host exchange in SSL V3. In earler SSLs they built the disclosed bits right into the protocol, an explicit field for disclosing part of the key. Rick. smith(a)sctc.com secure computing corporation

1 0

infowar - defense - DOD
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

DoD Information Warfare (IW) Department of Defense Topic(s): Government BPR Project Reports [Home] Document Listing by: [Title] [Author] [Topic] [Coverage] [Source] Abstract: Lead Agency: OASD (C31) Functional Area: Command and Control Project Title: DoD Information Warfare (IW) Functional Area: Command & Control Lead Agency: OASD(C3I) Summary: To achieve information superiority in support of national military strategy, a joint DoD team reengineered DoD Information Warfare processes. A high-level model was developed to provide a consensus view of key processes and data. This evaluation will lead to the development of a national IW policy, an assessment of IW vulnerability, and a standard risk management process. Description: The mission of this project was to develop a baseline activity model for current IW processes, identify improvement opportunities, and recommend a plan for the application of Business Process Reengineering to IW. Representatives from the Joint Chiefs of Staff (JCS), Army, Navy, Air Force, Marines, Defense Intelligence Agency, National Security Agency, and the Defense Information Systems Agency participated in the project. Improvements: Nine specific improvements were identified including: Development of a joint, coordinated effort to identify and assess the vulnerabilities of military operations and systems and the defense information infrastructure. Development of a standardized process for risk management. Development of a national policy for the conduct of IW. Benefit: The improvements will provide an improved ability to achieve information superiority in support of national military strategy by affecting adversary information, information systems, and information processes while leveraging and defending U.S. information, information systems, and information processes. Predicted Savings: Not reported Investment: Not reported Point of Contact: LCOL Liz Anderson OASD (C3I) IW 6000 Defense Pentagon Washington, D.C. 20301-6000 (703)614-0624 DSN: 224-0624 INFOWAR.WPD 3252D.html

1 0

[CRYPTO] Quadratic residues
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timothy May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. /\ o-/\ Timothy May ///\|/\\\ / /|\ \

1 0

Great Opportunity!
by AllTheCash＠aol.com 17 Dec '03

17 Dec '03

I thought this may be of interst to you! I recently researched a company who has all the traits of becoming a key player in the Health & Nutrition industry. The companies name is I.D.E.A. Concepts and They are Steamrolling the competition! ...FREE Multi-Page Custom Website Does All The Work For You! ...No Sign Up Fees! ...Incredible Pay Structure..You recieve your checks every 2 weeks! ...Top Notch support from Doctors and Biotech News letters! It's hard to really sum up all the benefits of this outfit in one short letter so please take a look for yourself at what they have to offer... .....What Do You Have To Lose! http://www.multi-level.com/millennium/quickmoney.html Best Of Luck, D.M.C.

1 0

Re: Modified Token Posting Scheme
by ed.falk＠Eng.Sun.COM 17 Dec '03

17 Dec '03

> > > How about this simple policy scheme: > > > > > > 1) posts from known list members forwarded to list automatically > > > 2) posts with "approval cookie" also forwarded automatically > > > 3) otherwise, forwarded only after approval by moderator, > > > > I.e., libel from Timmy May, Ray Arachelian, and the rest of the gang > > is approved automatically, and when a victim tries to defend himself > > and to point out that Timmy May is a liar, the response is delayed > > and probably rejected by the moderator. > > > > It's been said that the best response to speech one doesn't like > > is more speech. "Cypher punks" want to take away the victim's > > ability to respond to the lies being posted on their mailing list. > > You are far from being the victim of anything. If anything you're a big > huge thug who spams the list, posts racist flames, posts homophobic > flames, uses social engineering to find out info on his "enemies" and > then posts that info online with requests that others send flames to that > person's employers. Besides, in my scheme, the first two options are explicitly there to avoid moderation. Just post under your real name or generate an authentication cookie.

1 0

Re: FW: Modified Token Posting Scheme
by ed.falk＠Eng.Sun.COM 17 Dec '03

17 Dec '03

> >> How about this simple policy scheme: > >> > >> 1) posts from known list members forwarded to list automatically > >> 2) posts with "approval cookie" also forwarded automatically > >> 3) otherwise, forwarded only after approval by moderator, > > > So does this mean that any personal attacks or useless and annoying > drivel from the likes of Timmy May, Ray Arachelian and Sandy Sandford > would be automatically forwarded to the mailing list even though they > are frequently more annoying than the spam posted by the people who > would be censored by Gilmore ? No, just the opposite. My scheme allows people to route around moderation by authenticating their posts. The goal here is to keep *random* stuff, such as spam, off the list.

1 0

NEW
by express＠capella.net 17 Dec '03

17 Dec '03

THE FOX FIRES HAVE STARTED BURNING! http://www.mlmers-ad-net.com/FoxTeam/Fox FREE WEB PAGE AND CHECKS SENT OUT DAILY! Let it begin, John

1 0

American Cyber Mall
by rgwjr 17 Dec '03

17 Dec '03

AMERICAN CYBER MALL http://www.usacm.com FREE WEB PAGE CONTEST, WEEKLY DRAWING !!! Visit the American Cyber Mall http://www.usacm.com and you can register to win a FREE web page with FREE 12 months hosting !!! Just our way of say thanks for visiting our new award winning cyber mall. American Cyber Mall http://www.usacm.com TO BE REMOVED FROM LIST REPLY WITH SUBJECT = REMOVE

1 0

Sandy is God...Listen to Him!
by nobody＠replay.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Don't understand all this issue about Sandy and John filtering the list. Don't we want order and control? We need Sandy to decide whether our articles should be read by others. Sandy is our spokesman, our leader, our navigator. When he founded the Cypherpunks group, he wanted ``order and control, ``and now he has been forced to re-assume control of the group to put controls in place. Hey, if Sandy and John say we have to stick to certain topics, well, dammit, they are in control and we have to do what they want. Sandy and John are our leaders. Forget this stuff about the Cypherpunks list being a group seperate from toad.com. Forget this idea that John is just the host of the list...he is actually the co-controlled. And we'd better pay attention. Why didn't Sandy and John just announce a new filtered list, like Blossom has? Why make their control the default for the whole list, with the the unfiltered list harder to subscribe to and eventually to go away completely? Good questions! Ask not the reasons for God's decissions. This is Sandy's list, and John's machine, and if they say they know best what is a flame and what is not, I say we should just take our medicine and learn to love their wise decisions. If they say we can only write flames if they approve, OK. If they say we must only write about libertarian topics, OK. If they reject our messages without explanation, OK. Sandy is our Leader. And anyone who doesn't respect our Leader should just leave. Bye -----BEGIN PGP SIGNATURE----- Version: 2.6.2 07dTgUBMs4Q8hvikii9febJAQEbrAQAmgwAeqSsi2qIkqakNRPCpwCwNnYudNop zyxE2LueC+WuhugtLeyDDet+WgefE9X84F4qxn/QVB+tJAGbZzfCPO24shelX21k mk80oevKqzcfAAzbB4tMtXe5gl6+zykExXjsx4J/KjMNPL0QAE490uvnKqus/a2H 0l2AU9k/Kp8= =ix2B -----END PGP SIGNATURE-----

1 0

Re: The Upcoming DES Challenge
by Liz Taylor 17 Dec '03

17 Dec '03

There is nothing unglamorous about a known plaintext attack, if the plaintext is choosen carefully. I don't know anything about bank ATMs and the protocols they use, but I presume the PIN is stored on the card single DES encrypted. If this is so, anyone can take an ATM card, attack it to recover the key and then use that key to recover the PIN for any stolen ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext pair that RSA announces will be a real target like this, with the actual key disabled. Once the key is recovered, the press can then claim that ATM cards are not safe any longer. On a related note, do you think the key will first be recovered by a hardware device or by the Great Internet DES Key Search? Hardware is much faster, but no such device exists in the private/amateur sector now. Estimates are that it will take 10 months to actually build such a device. Opinions?

1 0

Re: Thoughts on moderation
by Douglas Barnes 17 Dec '03

17 Dec '03

Goodness knows most people who are fully engaged in a mailing list get involved in an unproductive discussion or argument from time to time. My main assertion about Sandy is that although he has his likes and dislikes (and is not shy about sharing them) I can't see him bouncing messages just because someone was disagreeing with him. There might be someone who is less opinionated, but I think that you need to find someone who cares enough about a subject to be interested in moderating it (one antonym of "opinionated" is "dispassionate" -- think about it.) The only way to tell if Sandy will be fair _as a moderator_ is to give him a chance. Years of knowing him as a friend, and four months of sharing an office indicate that while he's stubborn and opinionated, he's also extremely fairminded, and will not bounce for content he disagrees with. He also has a broad concept (some might argue too broad) of acceptable list topics, but since we're looking primarily to screen out the worst dreck & outright spam, he seems like a logical choice as moderator. I don't see this move as censorship of any sort -- cleaning the Augean stables is more like it. I am profoundly tired of wading through completely worthless and vapid trash accusing Tim and John of various sexual perversions. (Note that if the writers actually knew these folks, they'd at least be able to write better or more interesting libel.) At 10:35 PM 1/6/97 -0800, you wrote: >Douglas Barnes wrote: >> 1) I've known Sandy for a couple of years, and I trust him to >> use good judgement as a moderator. It will be important to >> develop guidelines so that the job can be rotated, but it's also >> important that the moderator be someone who doesn't have any >> major axe to grind. Sandy has his personal likes and dislikes, >> but I don't think he'll ever stoop to tossing out opinions that >> he disagrees with. > >Wishful thinking, Doug. Sandy will take an emotional (non-objective) >position on an issue, and argue it beyond any reasonable limit. I wish >I had all his replies to things I've said - you'd see what I mean. > >Not to promote anyone who I might not be a friend of, but, there are >people on this list who are "well respected" who are light-years ahead >of Sandy in areas that are important for a list moderator. > >Maybe Gilmore should have publicly announced for a moderator, and then >let the subscribers pick.... > >

2 1

$2500 for a class c.
by faried nawaz 17 Dec '03

17 Dec '03

------- Blind-Carbon-Copy To: hungry(a)hungry.com Cc: chris(a)uidaho.edu, people(a)kuoi.sub.uidaho.edu Subject: $2500 for a class c. Date: Tue, 07 Jan 1997 15:19:25 PST Message-ID: <7130.852679165(a)bear.cs.uidaho.edu> From: faried nawaz <nawaz921(a)bear.cs.uidaho.edu> (two messages follow) From: gjohnson(a)dream.season.com (Reality is a point of view) Subject: IP allocation goes fee based soon?! Newsgroups: ba.internet Date: 6 Jan 1997 16:08:04 GMT Organization: season.com [205.179.33.0] Path: news.uidaho.edu!newsfeed.orst.edu!newshub.tc.umn.edu!spool.mu.edu!newspump.sol.net!howland.erols.net!agate!news.ucsc.edu!news.scruz.net!gjohnson Lines: 18 Message-ID: <slrn5d28r9.34.gjohnson(a)dream.season.com> NNTP-Posting-Host: 205.179.33.42 Xref: news.uidaho.edu ba.internet:12066 Take a look at http://rs.internic.net/arin for a quiet bombshell, especially Section 2.3. A Class C block for $2,500? If you think that isn't funny there are a few people that agree with you in threads elsewhere. Try a dejanews search on $2500 Class C. You might also want to take a peek at http://www.iahc.org for news about a commentary period that ends in the next few days. - -- Gary Johnson "Wahoo." gjohnson(a)season.com Remember why... later in the thread -- From: davidm(a)them.com (David Mandala) Subject: Re: IP allocation goes fee based soon?! Newsgroups: ba.internet Date: Tue, 07 Jan 97 19:10:07 GMT Organization: Them Productions Path: news.uidaho.edu!newsfeed.orst.edu!news.uoregon.edu!marlin.ucsf.edu!overload.lbl.gov!agate!spool.mu.edu!newspump.sol.net!howland.erols.net!news.bbnplanet.com!cam-news-hub1.bbnplanet.com!news-xfer.netaxs.com!news.texas.net!news1.best.com!nntp1.best.com!davidm Lines: 32 Message-ID: <5au72j$rnn(a)nntp1.best.com> References: <slrn5d28r9.34.gjohnson(a)dream.season.com> <e3mca8.3mx(a)oriole.sbay.org> <southernE3MJxJ.FKq(a)netcom.com> NNTP-Posting-Host: davidm.vip.best.com X-Newsreader: News Xpress 2.0 Beta #2 Xref: news.uidaho.edu ba.internet:12120 I've since heard that their contract run out in 1998, now since they have gone from a small nothing company to a widly known disaster, if follows that they are making money hand over fist. So before the contract opens we need to make enough noise with the goverment that the contract is NOT relet to them but rather to open bid, or to a true non profit alliance of Internet professionals to provide the service at cost (which in reality is quite small). Only we can make the difference. In article <southernE3MJxJ.FKq(a)netcom.com>, southern(a)netcom.com (Shawn) wrote: >In article <e3mca8.3mx(a)oriole.sbay.org>, George Bonser wrote: >: Billions and Billions of IP addresses are right around the corner >: and they are going to use the current shortage to set a precedent >: (sp?) of charging $2500 per block of 256? That would put them in a >: position to make an absolute KILLING when IPv6 comes out. > ^^^^^^^^^^^^^^^^^^^^^^^^^^^ > >Give that man a ceegar. > >That is, I believe, the point. > >All, of course, at $50/year per domain name. > >With that kind of income, they might give Microsoft a run for their >money as being one of the most profitable computer companies in the >world. <tounge FIRMLY in cheek> :-) > >Shawn /************************************************************* David Mandala Them Productions San Francisco, CA Internet: davidm(a)them.com CIS: 74156,221 AOL: dism *************************************************************/ faried - -- i don't hate people. | my other car is a cdr why, some of my closest | linux, the ms-dos of the nineties friends are people. | <zorgo> cable and internet.. who needs a life? -- stevi(a)aa.net | http://www.hungry.com/~fn/ ------- End of Blind-Carbon-Copy

1 0

Re: The Upcoming DES Challenge
by sameer 17 Dec '03

17 Dec '03

> There is nothing unglamorous about a known plaintext attack, if the > plaintext is choosen carefully. I don't know anything about bank ATMs > and the protocols they use, but I presume the PIN is stored on the card > single DES encrypted. If this is so, anyone can take an ATM card, attack it > to recover the key and then use that key to recover the PIN for any stolen > ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext > pair that RSA announces will be a real target like this, with the actual key > disabled. Once the key is recovered, the press can then claim that ATM > cards are not safe any longer. Stolen ATM cards are actually not that valuable. They have fixed limits and require physical presence to exploit. Try swift/forex/etc. secret des keys.. those are valuable. -- Sameer Parekh Voice: 510-986-8770 President FAX: 510-986-8777 C2Net C2Net is having a party: http://www.c2.net/party/ http://www.c2.net/ sameer(a)c2.net

1 0

Re: [CRYPTO] Quadratic residues
by miner 17 Dec '03

17 Dec '03

At 02:37 PM 1/7/97 -0500, Anonymous wrote: >Timothy May's family tree goes straight up. All of his >ancestors were siblings, to dumb to recognize each other in the >dark. > > /\ o-/\ Timothy May > ///\|/\\\ > / /|\ \ Counting the days till I don't have to see anymore of these, certainly a product of one of the 3 people already in my killfile. Thank you John and Sandy in advance

1 0

RE: Thoughts on moderation
by Blanc Weber 17 Dec '03

17 Dec '03

From: Douglas Barnes I don't see this move as censorship of any sort -- cleaning the Augean stables is more like it. I am profoundly tired of wading through completely worthless and vapid trash accusing Tim and John of various sexual perversions. .................................................. So what about determining the lowest parameter of tolerance for style & content - how low you can go before your messages are transferred to the "flames" division? Then, for instance, Uni could say to Dale: "you will find my detailed retort to your deluded accusations on the other list" (which Dale would, of course, go over there and read <g>). In any case, everyone would know what that sensitive, low point of intolerance is such that if they descend to it they will be sifted out and recategorized. .. Blanc

1 0

About ICF(International Cryptography Framework)
by Starr 17 Dec '03

17 Dec '03

Has anyone heard anything or been paying attention to the development of the ICF(International Cryptography Framework) standard. This seems to be an attempt of the US Gov and a FEW of our favorite corps to completely control cryptography standards as well as to have the keys to all cryptographical content. The only information I've found so far is on HP's website http://www.dmo.hp.com/gsy/security/icf/main.html I've also managed to get a hold of Ray Bamford (ray_bamford(a)hp.com)at HP who seems to have some PR role in this wool over the eyes attempt. It seems to be just another (souped-up, in disguise attempt at the clipper chip except on an International basis). When I spoke to him he told me that the only information that has been issued is what you seen in the technical paper, and that the info they have is extremely exclusive, even if you are a legitimate company working on cryptography issues, etc. Check it out...I would definitely like to hear your opinions as well as if any of you have more information on this subject(newsgroups, mail lists, etc). -spanky

2 2

How To Repair "YOUR OWN " Credit !
by native＠media.com 17 Dec '03

17 Dec '03

CREDIT REBUILDING OF AMERICA * REBUILD YOUR OWN CREDIT* PLEASE FORGIVE THIS E-MAIL INTRUSION BUT IF YOU CAN USE THIS SERVICE? PLEASE KEEP READING! *** Have you ever been turned down after you applied for a credit card, department store card, or a gas credit card, or that new car you have wanted? The reason was probably because of something the creditor found on your credit report. Thousands of people are DENIED CREDIT because of something that appears on their credit report that is not correct OR they would like REMOVED from their credit report FOR GOOD!! There are many companies out there that can remove tems on your credit report but want to charge you any where from $300.00 to $1,000.00 . "BE CAREFUL", most of these companies cant do anything to repair your credit that you cant do yourself with my CREDIT REPAIR PACKET. Once I found out just how the " BIG " companies were doing this, I put all the information down on a simple twelve step process. ** DO IT YOURSELF ** why pay their high prices to repair your credit, when you can do it yourself for only $19.95 plus 2.95 for S&H. I spent over two years to perfect this process, and if followed to the letter, it will work!!! HAVE the NEW CAR you want, the CREDIT CARDS you want. You dont have to wait SEVEN to TEN YEARS for these items to be taken off your credit reprot. DO IT YOUR SELF!! and feel GOOD AGAIN!! Just send your check or money order to: Robert C. Roy, Jr. P.O. Box 1052 Delray Beach, Fl. 33447-1052 I will send you by return mail the complete twelve step packet so you can get started RIGHT NOW!! SEND NOW!! due to the unbelievable responce for this packet the introductory price of $19.95 (+) $2.95 S&H, will not last long! HAVE A GREAT DAY! & THANK YOU FOR YOUR TIME AND ORDER!!

1 0

Re: Sandy and I will run a cypherpunks "moderation" experiment in Jan
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:37 AM 1/7/97 -0800, Pierre Uszynski wrote: >Rich Graves <rcgraves(a)disposable.com> very correctly mentions: > >> 1) Moderator liability and anonymous posting. > >I agree that this is actually a critical problem with a filtering >moderation scheme. Such a scheme appears to provide the capability to >filter out possible "copyright violations" posts. From what I remember >of the Netcom/CoS case (without going back to the sources), that may >mean more liability for the reviewers (and the operator of the >machine). That's a major point against simple filtering moderation. I agree that this raises the spectre of liability for messages passed on, but I'm not sure it's a big problem. I see three broad categories of information which the moderation liability scheme may suppress: 1. Copyrighted items such as newspaper/magazine articles 2. Secrets which are being revealed (e.g., the alleged RC4 source, the Mykotronix trash stuff) 3. Defamation As to the loss of (1), I'm not heartbroken - much of this information is already placed online by its owners, and can be referred to with a hypertext link or a reference instead of being posted in its entirety. Also, some people (who I don't feel like singling out) currently provide access to third-party copyrighted information, but in a discreet manner. The "copyright violations" poster(s) could provide access in this way, unless they're committed to making John Gilmore and the remailer operators take the heat for someone else's actions. The loss of (2) is regrettable; but Usenet (and other unmoderated forums) are still available for hit-and-run disclosure of secrets. Also, it's unclear to what extent (2) will be lost. Given the recent California and Federal statutory changes strengthening trade secret protection, I think it's useful to be careful - but it's arguable that neither the alleged RC4 code nor the Mykotronix trash stuff would have been a trade secret violation. Also, let's weigh the value of what'd be lost (how many of these messages do we really get?) against the negative value of the crap we're currently subjected to, and the (speculative) value of posts we don't get because their authors have left the list because of disgust and annoyance. I'm not going to lose much sleep over (3). I can't call to mind a single instance of interesting or useful defamation that I've seen on the Net. >ichudov(a)algebra.com (Igor Chudov @ home) responded: > >> [in another forum] >> After long thinking, moderator board has come with the following >> solution: >> >> 1) We do not know for sure if a certain post violates >> some copyrights or not >> [and more in the same line 2,3,4,5] > >Would any of this have mattered in Netcom/CoS? My hunch is that liability for infringement will focus on defendants' actions after they knew or had reason to know that a particular act of copying or distribution was a violation of the copyright owners' rights. Copying data from one place to another is the essence of the net; holding owners of machines (or moderators) responsible for violations they couldn't have stopped is nonsensical. I predict (but cannot cite cases so holding) that moderators/listowners will be held liable for copyright violations they could have detected and stopped with the exercise of some level of care; but that they will not be held liable where no reasonable amount of effort on their part could have prevented the copyright violation. And I think "reasonable" will depend on the facts at hand. (All of the contributory infringement cases I'm familiar with have involved a defendant who was aware of, if not actively assisting with, the underlying infringement.) >Instead, a system that would forward reviewers' opinions *after the >fact* does not have any of this problem. And we have already mentioned, >it is also more powerful (real time initial feed, easy multiple >feedback feeds, fully compatible with anything else...) although it >does not reduce bandwidth requirements. Can you name a software package which runs under Windows or the Mac OS which automatically processes reviewers' opinions against a mailbox of incoming mail? Better yet, can you name a Eudora plug-in which does so? Abandoning an imperfect but workable solution because it's possible to imagine that someone will create something better someday strikes me as silly. Comparing theoretical software/strategies with currently implemented software/strategies is comparing apples and oranges. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

7 6

Moderation and the Polymorphic Virus
by Toto 17 Dec '03

17 Dec '03

Perhaps with proper moderation, having access to a cloistered environment without all of the 'noise', cypherpunks will be able to come up with a true polymorphic virus that will make the Atom Bomb look like a child's toy. The rabble who rant on endlessly about 'social issues' can surely not be trusted to contribute anything of value on what are, in fact, merely a question of 'numbers'. It is up the the elite, the code writers, to lead the cypher- punks into a New World Order, in which the results of cryptography are only used for proper, approved purposes. Toto

1 0

Get Quick Results!
by owner-cypherpunks 17 Dec '03

17 Dec '03

***** The BEST Way for YOU to Market Successfully ***** ********5 Million E-mail Addresses Available ******** Nothing works better than mass e-mail to get quick results. Nothing! There are plenty of programs you could buy such as Floodgate to pull your own addresses however, these programs (even when used properly) can take up to 6 months just to pull as many as 750,000 addresses! And after THAT time has elapsed you're database will have plenty of addresses that are undeliverable. Why wait? Get started by using our SUPER responsive list that was generated just last month! We purchase current lists only. Imagine 5 Million deliverable addresses that can bring you more orders than you have ever seen!!! Imagine, the potential profits from your offer(s)! If you only get 1/2 of a percent that's 25,000 orders!!! These addresses can be mailed using Pegasus or other mailing programs. Everything has been saved in a text (.txt) format. Each group of names comes in lots of 100,000. You can mail any quantity you wish! Just drop the quantity you want to send and that's it! This list originally cost over $3000. I'm offering the complete list for only $159. That's right OVER 5 MILLION addresses for only $159. Think about it. If you get just 1/2 of a percent that's 25,000 orders!!! Do you think you could turn a profit? This list will be sold to ONLY the first 25 people who respond. PLUS, I'll include FREE... a special report that will show you how to mass e-mail without losing your dial-up account. Also, this report will show you where to get a bullet proof space and e-mail account for mass mailing. This report alone is worth the purchase price. Let's face it, if you can't mail successfully then what good are the addresses? If you ever wanted to see a ton of orders come pouring in this is the ONLY WAY it can happen for so little money. This incredible offer will expire after 25 sales. Don't delay act now! Have questions? Call 714-288-6227 FAX your order to: 714-288-6233 ********************* ORDER FORM ******************* Yes, RUSH me the entire 5 million e-mail addresses right away for just $159! (Print this out and Fax it to 714-288-6233) Name:______________________________________ Address:____________________________________ City:_______________________________________ State:_______________________________________ Country:____________________________________ E-mail Address:_______________________________ Phone Number:_______________________________ I wish to pay by: ( Check One ) Master Card:_____ VISA:_____ American Express:_____ Check:_____ Money Order:_____ Card Number:__________________________________ Exp. Date:_______________ Signature:_____________________________________ Once we have recieved your order you will be notified by e-mail immediately where to download this offer. ======================================== ***I also do bulk mailing if you want to have me send your ad out. The price is $199.95 per 100,000 e-mail addresses and I'll place your Home page on a server for 1 month. This way you never have to worry about losing your space account. If you want to be removed from our mailing list just hit "reply" and put "remove". You will be remove pronto!

1 0

Zero-knowledge commit
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy C[retin] May the self-admitted child molester possesses a rudimentary dick less than one inch long, half the size of his mother's clitoris, that barely makes a fistful. Thereby hangs the root of this Jew-hating sissy's sick fixation on little boys and Usenet forgeries. . |___ (}o o{) -ooO-(_)-Ooo- Timmy C[retin] May

1 0

Re: Polymorph engine (was:RE: PWL's how ?)
by Neil Tunnicliffe 17 Dec '03

17 Dec '03

At 09:50 7/01/97 -0400, you wrote: >Where did you get the following text on polymorph engines? Is it available >somewhere? Where can I get other information on similar topics (Please resist >the urge to mention web search engines; I'm looking for specific >recommendations :-) > >Thanks! > >- Patrick >_______________________________________________________________________________ Well try some sitez like Vrack: http://206.117.82.30/vrack/ Neil

1 0

Fed Study on Identity Theft
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 7 Jan 1997 18:59:00 -0500 (EST) To: Multiple Recipients of e$pam <e$pam(a)intertrader.com> From: e$pam(a)intertrader.com (e$pam) Reply-To: e$(a)thumper.vmeng.com X-Comment: To unsubscribe, send any email to e$pam-off(a)intertrader.com Precedence: Bulk Subject: Fed Study on Identity Theft X-orig-from: jmuller(a)brobeck.com (John D. Muller) X-e$pam-source: Various Forwarded by Robert Hettinga ----------------------------------------------------------------------- Mime-Version: 1.0 Date: Tue, 7 Jan 1997 12:00:09 -0800 From: jmuller(a)brobeck.com (John D. Muller) Subject: Fed Study on Identity Theft To: rah(a)shipwright.com I unsubscribed from e$pam over the holidays, so this item may already have been on, but if not it might be of interest: As required by legislation passed last year (partly in response to the P-TRAK fiasco), the Fed is required to study whether institutions that are not subject to the Fair Credit Reporting Act are making sensitive personal identifying information available to the public, whether such information creates undue potential for fraud and for risk of loss to banks, and whether legislation is needed to address the risk of fraud and loss. The Fed has recently published a request for comments on these issues. Comments are due by January 31. The Fed release is at http://www.bog.frb.fed.us/boarddocs/press/BoardActs/1996/19961223 Have a happy, prosperous and reputation-enhancing 1997. -------------------------------------------------- The e$ lists are brought to you by: Intertrader Ltd - SMART '96 Winners for a Java e$ product Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$pam? Help pay for it! See <http://www.atanda.com/rah.html> Or, for e$pam sponsorship, see <http://thumper.vmeng.com/pub/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> HTMLurgist: Cynthia Zwerling <mailto:czrider@@webstuff.apple.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/ FC97: Anguilla, anyone? http://offshore.com.ai/fc97/

1 0

Free Money!
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

1 0

If guilty of a lesser crime, you can be sentenced for a greater
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 7 Jan 1997 18:44:07 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: If guilty of a lesser crime, you can be sentenced for a greater The Supreme Court ruled on this sentencing case yesterday. Kennedy and Stevens -- hardly known as civil libertarians -- dissented. The Court reversed the 9th Circuit, ruling the lower court was wrong to say that such a practice "would make the jury's findings of fact pointless." The court declared: "Sentencing enhancements do not punish a defendant for crimes of which he was not convicted, but rather increase his sentence because of the manner in which he committed the crime of conviction." Double jeopardy? What's that? Of course it was a drug crime. The defendant, Vernon Watts, was convicted of cocaine possession with intent to distribute. To paraphrase another saying: "'Drug Trafficking Offense' is the root passphrase to the Constitution." -Declan ---------- Forwarded message ---------- Date: Tue, 7 Jan 1997 17:41:35 -0800 From: Jim Warren <jwarren(a)well.com> Sender: owner-fight-censorship(a)vorlon.mit.edu Did you read about the U.S. Supreme Court's recent decision? Seems they decided it was acceptable for a judge to use crimes for which a jury has found a defendent *NOT guilty*, to justify imposing greater penalties than the judge could otherwise, for a lesser crime for which the jury found the defendent guilty. (It's quite common to prosecute someone for multiple crimes, and have the jury find them innocent of some charges, but guilty of others.) Now, all a judge has to do is opine that, in his or her unilateral opinion, there is a "preponderance of evidence" of guilt of the more serious crime -- in spite of the unanimous finding by every member of the jury, that the defendent is NOT guilty of that crime, beyond a reasonable doubt. The Supreme's *unsigned* 7-2 opinion says than a finding of NOT guilty, "does not prove that the defendent is innocent; it *merely* proves the esistence of a reasonable doubt as to his guilt." [I.e., all U.S. citizens now risk being penalized as theough they are guilty, unless they can PROVE they're innocent!] Much worse, the basis for *criminal* guilt and associated penalties -- charged, prosecuted and imposed using the massive powers and resources of the State -- has now functionally changed from proof "beyond a reasonable doubt," to the much lesser standard of, "preponderance of evidence," which used to be limited only to civil litigation prosecuted between private attorneys for feuding plaintiffs. Who says the practices of the Third Reich didn't survive!? --jim, Amerikan citizen Jim Warren (jwarren(a)well.com) GovAccess list-owner/editor, advocate & columnist (Govt.Technology, MicroTimes) 345 Swett Rd., Woodside CA 94062; voice/415-851-7075; fax-for-the-quaint/<ask> [Also blind-cc'ed to others.]

5 5

Germany Passes Sweeping Cyberspace Legislation 01/06/97 (fwd)
by wb8foz＠netcom.com 17 Dec '03

17 Dec '03

BONN, GERMANY, 1997 JAN 6 (NB) -- By Sylvia Dennis. The German government passed a major round of legislation in the runup to Christmas that aims at regulating the Internet and protecting user privacy. No surprise there.... {} The law also prohibits the use of "cookies," software applets that trace a user's path across the Internet and recording the data they view. This is, to me! -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

RE: The FAGGOT list
by Brett Carswell 17 Dec '03

17 Dec '03

Aga Wrote: > >That is another FAGGOT coming out of the woodwork! >> > Just how many KNOWN faggots are on this list? [snippo] > >Most of the above men are apparently FAGGOTS, since they >conspire to censor Freedom Of Speech on the InterNet, under >the guise of "spam elimination." Actually, is all a front >for censorship by homosexuals on the InterNet. >[more snippo] >> > All of these who are faggots must be labeled >> > and watched, as we know that faggots are the worst censors. Could someone please forward me the URL of the FAGGOT (are the caps manditory?) detecting software for mailing lists. I feel pretty left out as almost everyone else know who the FAGGOTS are. Is this the same software that detects Cocksuckers or does Dr Dimitri have something of his own. Maybe we could all band together and come up with something that detects Nazi moderators as well. Brett

2 1

Re: Moderation
by Bovine Remailer 17 Dec '03

17 Dec '03

Tim C. May's sexual life is not the business of the cypherpunks mailing list. o)__ (_ _`\ Tim C. May z/z\__)

1 0

re: Free Money!
by anonymous＠miron.vip.best.com 17 Dec '03

17 Dec '03

Thanks for the dough! I just love cyber technology. Will spend it wisely.

1 0

[STATS] Cypherpunks subscriptions on and off
by Dale Thorn 17 Dec '03

17 Dec '03

The following table shows cypherpunks subscription activity for the period 12 Oct 1996 thru 07 January 1996. Date ~Days #Subs Gain Loss Gain / day Loss / day ----- ----- ----- ---- ---- ---------- ---------- 10/12 n/a 1361 n/a n/a n/a n/a 11/04 23 1353 211 219 9.2 9.5 11/30 26 1299 173 227 6.7 8.7 12/18 18 1262 120 157 6.7 8.7 01/07 20 1291 151 122 7.6 6.1 ----- ----- ---- ---- ---------- ---------- Totals: 87 655 725 7.5 8.3 Interpretation: Unless the reversal of gain/loss in the 5th data row is permanent, c-punks are losing 0.8 bodies per day, or 294 subscribers per year. Actually, the constant high turnover suggests something else: Many people join the list and get back off again due to the high volume and their own personal time constraints. Unless Sandy can cut *way* back on the number of posts to the list, i.e. excise a *lot* more postings than just the blatant Spam and "Timmy is a....." posts, it won't make any difference to those people who come and go. In effect, Sandy is going to have to cut the number of daily posts (to the moderated list) from, say, 100 per day down to, say, 20 or 25 per day. This would certainly be a goal of his, since most of the subscriber comments I've heard indicate that even 50 posts per day of "relevant political/social commentary" is way too high for them. As to the net loss in subscribers, the moderation of the list could have a substantial effect on the number of subscribers short-term, but whatever trend we have here will continue regardless, since the real value and character of the list is not determined by the posts which are removed (unless it were that some of the character and value is going to be removed), but by long-term factors which are to be expected when the principals get older, less involved, and less contentious (like Sandy, wanting to avoid conflict).

4 6

Copyright loophole?
by azur＠netcom.com 17 Dec '03

17 Dec '03

While doing research at a law library, I came across what appears to be a legal loop-hole in the copyright law. It seems a famous author's publisher had a substantial number of unbound and unsold copies of his works sitting around. Another publisher purchased them from his publisher, without the author's knowledge, and printed an anthology which included an index which was not part of the purchased (copyrighted) items. In Kipling vs. G.P. Putnam & Sons (1903, CA2 NY) 120 F 631, the 2nd circuit found that (from 17 USCS § 501) "Publication of an index to accompany copyrighted volume of author's work although containing words and phrases found in text, does not constitute infringement." From the original opinion: "They were also at liberty to make and publish an index contained in their volumes even though the index, as necessary must, contain words and phrases found in the text." Q1: Could this decision (which has stood since 1903) support the creation, storage and distribution of "standalone" on-line indicies to copyrighted works without infringement? (I could not find a direct reference to "fair-use" in the portion of the opinion referencing the index nor a related ruling, using the 1976 Copyright Act, which overturned the "index' provision.) Q2: How much content can an index contain and still not infringe? Q3: What would be the legal standing of these indicies, or several unrelated "indexes", if they can jointly (but not separately) be used to reconstitute the original copyright work by a private citizen? (Anonymous index posting, especially via a Ross Anderson style Eternity Service, might "practically" circumvent government enforcement.) -- Steve

1 0

What about postscript?
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

What if somebody wanted to publish the source code of an encryption program in book form, but make the book dowloadable freely from an ftp site using postscript or PDF format. Surely, the government will be hard pressed to argue the difference between paper media and electronic media here, since the files downloaded cannot be used to encrypt or decrypt data, without somebody first typing in the source. Maybe MIT or PGP should convert at least part of the PGP book into postscript and then request Commerce Department clearance to make it publically available. That should make for a nice court battle. If somebody argues that sophisticated programs can extract the text out of postscript files, what about providing JPEG images of pages of the book?

1 0

Lane Stipes
by Toto 17 Dec '03

17 Dec '03

Bob Hawbaker wrote: > ____________________________________ > Remember, the people who paint lane stripes on the road > of life probably have different objectives than you do.

1 0

Re: The Upcoming DES Challenge
by jim bell 17 Dec '03

17 Dec '03

At 10:49 PM 1/7/97, pgut001(a)cs.auckland.ac.nz wrote: >Orbital mind control lasers made mpd(a)netcom.com (Mike Duvos) write: > >>Peter Trei (trei(a)process.com) writes: >>>1. I'm astonished at the low level of reaction RSA's announcement that they >>>will be sponsoring a DES Challenge, with a $10,000 cash prize. >>I'm certainly jumping up and down and cheering. I said a while back that the >>life expectancy of DES would be about two weeks if anyone forked over serious >>cash. > >I'm still a bit nervous about what the reaction will be though - won't the >US government (and anyone else pushing DES) be able to say "It took 10,000 >Pentiums several weeks, noone would bother doing that, so it's safe" (with a >possible side order of "Safer-SK64 is 256 times as secure, anyone we really >like can use that provided they hand over the keys in advance"). This was exactly my concern months ago. PC's are remarkably _inefficient_ systems for attempting to crack codes. I recall estimating, quite approximately, that it might take somewhere about $500,000 of electricity cost alone to check all 2**56 possible decrypts, most of which is going to power unnecessary components. (monitors, hard drives, sound cards, modem cards, etc, etc, etc.) By doing the decrypts on PCs (term used generically; it applies just as well to Mac's, PowerPC's, DEC Alpha's, etc) we make it look like DES is better than it really is. But I'm under no illusion. As the saying went, "When the only tool you have is a hammer, you treat every problem as if it were a nail.) People have PC's, and will use them. Let me suggest, however, that somebody familiar with the details of DES and FPGA's (or other kinds of high-density programmable logic) figure out a ballpark estimate of how much it would cost to implement a minimalist DES-cracker in hardware. Don't do it, just estimate it. Then, when somebody has finally cracked that DES message and someone the news media is trying to suggest that this was an expensive effort, a more economical figure will be quotable. Jim Bell jimbell(a)pacifier.com

1 0

Commercial Encryption Packages
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

How much word has there been on any commercial encryption packages (such as point n crypt..etc) of any types of backdoors installed in them? Any comments or knowledge about this would be good edition to the list :) Adam

2 1

Why are 1024 bit keys the limit right now?
by AaronH4321＠aol.com 17 Dec '03

17 Dec '03

I am just starting at this. I know that part of RSA/PGP's strength comes from the size key you choose. What prevents someone from writting a 2048 bit key? Is it because computers can't handle it? Is 1024 top of the prime number size right now? Am I way off track?

1 0

RE: [STATS] Cypherpunks subscriptions on and off
by Juriaan Massenza 17 Dec '03

17 Dec '03

Hi Dale, I am usually lurking cypherpunks, I decided to reply to your message just to give you an idea of why _I_ subscribed to cypherpunks. (English is not my first language, not even the second, please forgive me my grammar monstruosities) I am very intested in crypto, _application_ of crypto, remailers and security, I usually trash flames, political/social implication of crypto and of course commercial emails. Looks like the last 3 categories are the main topic. I don't have problem in bandwith but I think that if I was forced to use a phone connection instead of a digital one like I have now I will unsubscribe to the list since it will not be worth for me to spend hours in downloading a lot of emails knowing that I will trash the 90% of them. I don't want to criticize people who talk all the time about the above mentioned 3 categories because it is in my understanding that someone is interested in those and I will remain subscribed to the list just to pick up the real juice. Best wishes to all, Juriaan >-----Original Message----- >From: Dale Thorn [SMTP:dthorn@gte.net] >Sent: Wednesday, January 08, 1997 4:06 AM >To: cypherpunks(a)toad.com >Cc: freedom-knights(a)jetcafe.org >Subject: [STATS] Cypherpunks subscriptions on and off > >The following table shows cypherpunks subscription activity >for the period 12 Oct 1996 thru 07 January 1996. > >Date ~Days #Subs Gain Loss Gain / day Loss / day >----- ----- ----- ---- ---- ---------- ---------- >10/12 n/a 1361 n/a n/a n/a n/a >11/04 23 1353 211 219 9.2 9.5 >11/30 26 1299 173 227 6.7 8.7 >12/18 18 1262 120 157 6.7 8.7 >01/07 20 1291 151 122 7.6 6.1 > ----- ----- ---- ---- ---------- ---------- >Totals: 87 655 725 7.5 8.3 > >Interpretation: > >Unless the reversal of gain/loss in the 5th data row is permanent, >c-punks are losing 0.8 bodies per day, or 294 subscribers per year. > >Actually, the constant high turnover suggests something else: >Many people join the list and get back off again due to the high >volume and their own personal time constraints. Unless Sandy can >cut *way* back on the number of posts to the list, i.e. excise a *lot* >more postings than just the blatant Spam and "Timmy is a....." posts, >it won't make any difference to those people who come and go. > >In effect, Sandy is going to have to cut the number of daily posts >(to the moderated list) from, say, 100 per day down to, say, 20 or >25 per day. This would certainly be a goal of his, since most of the >subscriber comments I've heard indicate that even 50 posts per day of >"relevant political/social commentary" is way too high for them. > >As to the net loss in subscribers, the moderation of the list could >have a substantial effect on the number of subscribers short-term, >but whatever trend we have here will continue regardless, since the >real value and character of the list is not determined by the posts >which are removed (unless it were that some of the character and value >is going to be removed), but by long-term factors which are to be >expected when the principals get older, less involved, and less >contentious (like Sandy, wanting to avoid conflict). > >

2 1

[ADMINISTRATIVIUM] Forgery detection
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Tim Maya grew a beard to look like his mother. /\_/\ ( x x ) -oo0-(o o)-0oo- Tim Maya

1 0

IBM Key Recovery Propaganda on United Airlines
by Bill Stewart 17 Dec '03

17 Dec '03

The commercials between the movie and news show on the airline include an IBM spot on their new Key Recovery software. Sigh. The explanations they gave were mixed; one person was talking about making sure that if you lose the key that people with a legitimate need to access the material can do it. The other example they gave, with pictures, was along the lines of "Suppose you're going on vacation and you want to leave a key with a neighbor to feed the dog. A safe way to do it would be to put your house key in a lockbox that needs several keys to open it, and give those keys to people you trust." Yeah, right - cops can get in, but Dog's gonna get pretty hungry.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

5 5

Re: The Upcoming DES Challenge
by Ulrich Kuehn 17 Dec '03

17 Dec '03

Liz Taylor writes: > There is nothing unglamorous about a known plaintext attack, if the > plaintext is choosen carefully. I don't know anything about bank ATMs > and the protocols they use, but I presume the PIN is stored on the card > single DES encrypted. If this is so, anyone can take an ATM card, attack it > to recover the key and then use that key to recover the PIN for any stolen > ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext > pair that RSA announces will be a real target like this, with the actual key > disabled. Once the key is recovered, the press can then claim that ATM > cards are not safe any longer. > As far as I know, here in Germany (maybe also somewhere else) there is not the pin stored on the card. Instead, it is regenerated by the ATM every time using a secret key of the bank. In order to be able to use the ATM card even with ATMs of different banks, there are offsets stored on the card that relate to some commonly used pool keys. Ciao, Ulrich -- Ulrich Kuehn ------ kuehn(a)math.uni-muenster.de http://wwwmath.uni-muenster.de/~kuehn/

2 1

sig. files with PGP
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I have a question reg. PGP: If certain parts of an encrypted message are known, does that compromise the security of the rest of the message? Example: If I always use a signature file, in plaintext messages as well as in encrypted messages, could an attacker knowing that signature file to be part of my encrypted message crack the rest too? Please copy replies to my private e-mail, for I am currently not subscribed to the CP list... Thanks in advance for your help, Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE * */ /* and PRIVATE ONLINE COMMUNICATIONS! * * */ /* * * */ /* E-mail: harka(a)nycmetro.com * * */ /* * */ /* Finger or E-Mail for PGP public key. * * */ /* Key Size: 2047 / KeyID: 04174301 * * */ /* Fingerprint: FD E4 F8 6D C1 6A 44 F5 http://www.eff.org */ /* 28 9C 40 6E B8 94 78 E8 */ /* Note: My old key (KeyID: B2728495) has been revoked. */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMtN8SjltEBIEF0MBAQEEoQf/TVZO2Z9gr8Jik0SnbfE7VbrORETlD7q3 nqIsU5FY6iCJKmXy9Us/VW6LOyuRr0qAMbM8IAdMaX96P1FFFGoZ+6QAH1txV+xs i6+w6TKtHmLZDyMaa40hH5F3/sUUECT5MyW59McO2+seX3gYDwi+jLp6XVZq8BFs uLymgoDmh+NsDXBcOUs9ULCQy8rsu/nYmbwQxlWqhUnPw1o1nnuUGuBZaEfU6xJj gthebIpjCPh9YAthdI/XxE4bmYmS1AVhL4Fz6cwR9yMQ4JC3eEoZnhIUvFd16w6i eOo1Og9sD241ksJTjH7lT0qaRAQFh0ccEQoFoCP/7dAesVjwXKjRhg== =3u9n -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0