December 2003 - cypherpunks-legacy

congressman wants review of online banking system
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)pop.tiac.net Date: Tue, 08 Apr 1997 17:58:51 -0400 To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: The Old Bear <oldbear(a)arctos.com> Subject: congressman wants review of online banking system Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> CONGRESSMAN CALLS FOR REVIEW OF ONLINE BANKING House Banking Committee Chairman James Leach (R-Iowa) has asked the General Accounting Office to review whether the Federal Reserve has sufficiently protected its Fedwire funds transfer and security transfer system from electronic trespassing. Fedwire processes around 380,000 securities and funds transfers totaling $1.6 trillion each day. source: BNA Daily Report for Executives April 7, 1997 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

2 1

Re: AP Revisited
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr. Roberts suggestively wrote: >>The War on Drugs was first declared by President Nixon. It has been a >>failure ever since. >No, the "War on Drugs" was in Vietnam. > >Dr. Roberts Lost that one too. AP is OK if it's a bounty on drug dealers. More hypocrisy. Ms. Dr. Roberts

1 0

Re: IRS raids a cypherpunk
by rlpowell＠calum.csclub.uwaterloo.ca 17 Dec '03

17 Dec '03

The followiing is an article that didn't even brng a hiccup to cypherpunks. WHERE IS EVERYBODY?? -Robin, sniff :-( In article <v03007807af6a270a11d5(a)[168.161.105.191]> Declan McCullagh <declan(a)well.com> writes: Path: news.csclub.uwaterloo.ca!not-for-mail From: Declan McCullagh <declan(a)well.com> Newsgroups: csc.lists.coderpunks Date: 3 Apr 1997 23:41:04 -0500 Organization: University of Waterloo Computer Science Club Lines: 79 Sender: daemon(a)calum.csclub.uwaterloo.ca Approved: mail2news(a)csclub.uwaterloo.ca Distribution: csc NNTP-Posting-Host: calum.csclub.uwaterloo.ca Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Sender: declan(a)mail.pathfinder.com Precedence: bulk Xref: news.csclub.uwaterloo.ca csc.lists.coderpunks:1207 [I've attached some excerpts from the article. Check out the URL below for the whole thing. --Declan] ******** http://cgi.pathfinder.com/netly/editorial/0,1012,800,00.html The Netly News Network April 3, 1997 IRS raids a cypherpunk by Declan McCullagh (declan(a)well.com) Jim Bell's first mistake was publishing an essay describing how disgruntled citizens could kill off Federal government agents by using anonymous betting pools and digital cash. His second mistake was informing the IRS that the agency had no legal authority to tax him. About twenty armed IRS agents and other Federal police swarmed into Bell's home in Washington state on Tuesday morning, hunting for evidence that Bell's "Assassination Politics" essay had come to fruition. They expropriated Bell's three computer systems, two guns and even a solitary mouse cable. The Feds were taking no chances: Since Bell's voluminous Net postings mentioned tax collectors, agents from the BATF, FBI, DEA, and local police forces joined the raid. [...] The raid stemmed from a six-month tussle between Bell and the IRS, which began in November 1996 when the 38-year old computer engineer demanded a hefty tax refund and threatened to convene his own "common-law court" if it was refused. That grabbed the Feds' attention. (So did the actions of the "Multnomah County Common Law Court," which apparently met in January to convict IRS agents and Attorney General Janet Reno of "theft by deception.") In February, IRS agents seized Bell's 1986 Honda as payment for back taxes -- and found inside it a printout of his "Assassination Politics" essay. " [...] And it was, ultimately, a Federal magistrate who signed the search warrant on 9:02 am on March 28 at the request of the IRS. Jeffrey Gordon, an inspector in the IRS' Internal Security Division, details in an 10-page affidavit how he traced Bell's use of allegedly fraudulent Social Security Numbers, how he learned that Bell had been arrested in 1989 for "manufacturing a controlled substance," how he found out that Bell possessed the home addresses of a handful of IRS agents. Gordon's conclusion: Bell planned "to overthrow the government." The IRS investigator says in his affidavit that Bell's "essay details an illegal scheme by Bell which involves plans to assassinate IRS and other government officals... I believe that Bell has begun taking steps to carry out his Assassination Politics plan." [...] ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

2 1

Re: Black box attacks (was Re: Crypto-Dongel)
by Dave Emery 17 Dec '03

17 Dec '03

Lucky Green wrote : > It is true that methods exist to recover data from RAM even after it has > been "erased". First and foremost, there are physical processes taking > place in the substrate that cause permanent changes in the cells containing > the data. In general, if there is a chip left to analyze, the data that > used to be stored within can be obtained. [The particular opponent may of > course choose not to spend the funds required to perform the analysis.] > > The only way to reliably remove data from RAM is to destroy the substrate. > I recently investigated various methods of doing so for a certain high > security application. My research showed that the only portable (and truly > reliable) solution for this task are micro explosives. Perhaps > unsurprisingly, the US uses explosives to protect the electronics in > nuclear weapons. The local ATF office informed me that any device using > explosives to destroy its contents would be considered a booby trap, even > if the explosion would be contained to the inside of device and therefore > not pose a danger to the operator. > I have heard about thermite devices being used for this in the sort of applications that might warrent it. Granted that this is a royal fire hazard unless very carefully engineered, but at least it is not an explosive per se.... One can reduce this effect somewhat by implementing software or hardware methods that complement the key or whatever you are protecting every few seconds. But I can testify, as someone who has done hardware design, that the memory effect is real and very pronounced... not a myth. Dave Emery die(a)die.com

2 1

Re: Anti-Spambot: what algorithm should be used?
by Ross Wright 17 Dec '03

17 Dec '03

On or About 8 Apr 97 at 21:05, Dr.Dimitri Vulis KOTM wrote: On or About 8 Apr 97 at 21:05, I think it was Igor who wrote: > > will pay nothing and let Bob sue the forger for the lost income. > > (This may become moot as more and more ISPs ignore forged > > cancels.) This gives Bob the insentive to spam intelligently - not > > to trigger any cancelbots and not to have his plug pulled by his > > ISP. Right, but this is where a tool comes in that lets you post a seemingly "on topic" post to hundreds of newsgroups with the "Drink Kaka Kola, Elect John, etc." in the sig file. This also makes it harder for an article to be canceled, I imagine. Or you can do it by hand. I am sure that in a 40 hour week I could post seemingly "On-Topic" to many newsgroups. Hell, I'm doing this on a minor scale right now. Bob just needs to be *really* smart. And if he has a good relaitionship with his small, local ISP, then he can proceed as normal. Hell, I never get complaints anymore. Yet, every time I post I advertise my company. Then: On or About 8 Apr 97 at 21:05, Dr.Dimitri Vulis KOTM wrote: > After Alice's bot finds an eligible Usenet article, it should wait a > week or so to see if it was cancelled or superseded before issuing a > payment. If it's cancelled, then instead of payment it should send a > notice saying: > "Your article with message-id blah posted to blah contains > a message that I'm paying to promote. I would have paid > you $n e-cash, but unfortunately a cancel has been issued > for your article: <quote cancel>" > That should get Bob pretty mad at the 3rd party canceller. :-) Boy, I would be pissed off if I was Bob. This is definitely the scary end of the internet. Most people will never even know about this rash of first amendment violations, that you are calling "forged cancels" and "plug pulling". I am so glad I fell into these groups when I joined the net just about 20 months ago. Funny thing is, it's right where I belong. I always speak my mind and have been known as a trouble maker in the workplace. > Alice needs to maintain a map of (poster,newsgroup,regexp) to # > posts; when it reaches 100, stop paying this poster. I think 100 > mentions by the same poster is way past saturation. > > Ross: yes, unfortunately the spambot is on the back burner right > now, but I definitely will finish it eventually. Well, it seems to me that this is where this conversation is leading. The technology you are talking about here, without talking about it, is quite exciting to me. I'll be reading. Still looking for HP Vectra RS input, Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: Another Article on Jim Bell from the Oregano
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:18 AM 4/5/97 -0800, you wrote: >As for the "drug conviction", he was nailed for possession of phenyl acetic >acid in 1989. The government tried to prove that he was trying to manufacture >meth, but was unable and Jim pleaded guilty to a lesser charge. >(Of course, >what are prohibited molecules and non-prohibited molecules is an ever >changing maze. It is pretty hard to keep track of what is "legal" and >"illegal" in that area. Seems to be "whatever we say it is". It's actually quite straightforward - it all depends on the intent of the molecules being arrested. If they're just loitering around, it's not illegal, but if they're loitering with intent to commit public intoxication, or conspiring to form an illegal syndicate, you may be in big trouble.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

new ,CRIPT password
by Sebastia Lancho 17 Dec '03

17 Dec '03

Hi ! I'm Sebastian from Barcelona. I'm new on internet. I'm a developer.In my first project I did a homebanking but I don't know how cript the password of the users. If somebody has a little C function that can do this please send me! and report me information! many thanks Sebastian tan(a)mss.es

1 0

Re: Sweden Netscape Intra
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:tcmay@got.net to Harka <=- In> The Swedish plan is something to be avoided. Consider just a few In> quotes: Actually, I was just flying over the text before forwarding it. But after reading it in depth, I agree with you. In> The government gives out the mailboxes. Wanna bet they give out the In> keys, too? Not only that but it would create the e-mail monopoly, that would be the destruction of the de-centralized nature of the Internet (e-mail being part of it). Just imagine, how easy it would be to have a few well publicized cases of remailer-abuse and the Swedish Postal Office therefore decides to automatically block all mail coming from (and maybe even to) remailers. With the majority of people having no clue about remailers in the first place (except what the press will feed them) the protest will be small enough to be ignored. That could even be extended to crypto, as you indicate. If Sweden ever outlaws cryptography, the monopoly would provide a perfect setting of enforcing such (with the few exceptions of where stego is used). The same applies to content and traceability of e-mails. In> (Yes, I understand that the system is being presented as "voluntary." In> For how long? And what happens to non-PTT ISPs when the PTT is a state In> monopoly? (Imagine what would happen if the U.S. Postal Service made a In> deal wherein AOL became the favored provider.) Market-driven "voluntary" measurements tend to be rather forced upon people than anything else. If something is standard then you'll have to use it because most other people do too. That is the danger with monopolies of any kind. This, I am afraid, will happen with crypto-issues in the US itself. I am almost certain, that Windows 97 will adress cryptography in one way or the other. If they put in means to encrypt e-mails for example right from the operating system and independent of the provider, then this would be the death-blow to PGP. And considering the talk about "key-management-infrastructure", then this will be probably the best means to achieve it. In fact, it might not even be a GAK-enabled system, but one that's easy to crack (propriatory algorithm or whatever). The civil-liberty groups have no GAK-issue to talk about anymore and few will understand, why "security through obscurity" is not good. The majority however, who doesn't care anyway much about crypto, will use that slick Windows interface and not worry any further. That would be cause for celebration at the TLA's and the end to wide-spread strong crypto. Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM0oCzzltEBIEF0MBAQEf4gf/ZINVtWwqyIzYXbi7uDxmTKCdfMS1Xujj /AlYGsmjUeh7UduN2q8YmRqzfuUhA6SNOaT0La+QuqzIOImmY3MfbH9tWc+xWqNQ 4cUC/aPFAl/7SxbXA4lsL4QD8Vnf3Tf2bxt5XUC7TO6lfEW91hblnz1WV2OVimgt pBGhv8b0td+CIAPnGd8WoscbH1NtgZMz+bLaF9zTl22KZerd8tfUbDhPQjWHOzgv Ck0mXTuOPpRXYTO+U9tua1U/Nz2dJN/+VXJO3nUfJOJ8C5eAHimji+IbsoWt1jur O27KvFuIhPtDaQIenv62G8ClmVxvd+XzIJ+43XnEU4r3PmFHgDJLjg== =wREG -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Cipher newsletter
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- == Forwarded Message Follows ========================================= Vance Bell wrote: From: vbell(a)dept.english.upenn.edu (Vance Bell) Subject: Cipher Date: Sun, 6 Apr 1997 16:46:08 -0400 (EDT) Cipher http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/ Cipher is the electronic newsletter of the Technical Committee on Security and Privacy, IEEE featuring Security and Privacy News Briefs, Conference Reports, Commentary and Opinion on computer security and privacy issues. Recent articles: Security and Privacy News Briefs * LISTWATCH: Items from security-related mailing lists by Mary * UK Policy on Licensing TTPs Proposed, Criticised * Two New Sources of Random Numbers * Attack Reports and Responses * U.S. Computer Security Breach During Desert Shield? * New IETF Working Group Formed to Standardize SSH * News items from past Cipher issues Conference Reports * Report on 1st Annual Workshop on Education in Computer Security (WECS '97) * Report on ISOC Symposium on Network and Distributed System Security '97 Commentary and Opinion * Practical Experimentation in Information Security Education (A brief report from a survey) *Summary of Comments on "A Serious Problem for Key Escrow Systems?" Contact: Carl Landwehr, landwehr(a)itd.nrl.navy.mil - ------------------------------ == End Forwarded Message ============================================== Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM0oDDjltEBIEF0MBAQGisAf+LYkc1Pn7UGdkW5TyjR+Lz1gZ2/Qn1izJ m8aIydx1bHkkRTarV432i69l+SPV8BeWjHIELBNSDfTQ+rci2AFRvxBHdBquyl0A KLjdvhek2fJNn9vC8eifDpE0wM4VR+Fn7RfHFwMMr4CxocZlMxkXseebQ4hsviVk eJb8dbz4oFYtE4AXhNCzCsAx9LQNojJgxq+xGzMnBreTGNDZtRdKhi7MMhiWCmFp u2FQ9lpNs2I8wdlAuHIYAUg11gylkKk7iwUJ1fVLgaeCBww7da2TFcl7ybLvMx0Z m9GYeo9bsWpRFJuJcZxa2mLo0DksDPfHytqcxyGNyb7ebPkZJ4lLww== =6Ly2 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

EPIC Alert 4.05
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

== Forwarded Message Follows ========================================= * Originally By: In:epic-news@epic.org * Originally Re: EPIC Alert 4.05 * Original Date: 04-08-97 18:08 ============================================================== @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 4.05 April 8, 1997 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org/ ======================================================================= Table of Contents ======================================================================= [1] OECD Releases Crypto Guidelines [2] White House Floats Draft Crypto Bill [3] FAA Calls for Collecting SSNs of all Air Travelers [4] Groups Urge IETF to Fix Cookies [5] National Research Council Reports on Privacy of Medical Systems [6] FTC To Conduct Hearings on Privacy, Investigate Databases [7] NTIA Files Comments on Privacy of Telephone Calling Information [8] Upcoming Conferences and Events ======================================================================= [1] OECD Releases Crypto Guidelines ======================================================================= The Organization for Economic Cooperation and Development (OECD), a 29 country international organization, released on March 27 its long anticipated Guidelines for Cryptography Policy. The Guidelines are intended to promote the use of cryptography, to develop electronic commerce through a variety of commercial applications, to bolster user confidence in networks, and to provide for data security and privacy protection. The Cryptography Policy Guidelines are a non-binding agreement that identifies the basic issues that countries should consider in drawing up cryptography policies at the national and international level. The Recommendation culminates one year of intensive talks to draft the Guidelines. They are designed to assist decision-makers in the public and private sectors in developing and implementing coherent national and international policies for the effective use of cryptography. Member countries are encouraged to establish new, or amend existing, policies to reflect them. The Guidelines set out eight basic Principles for cryptography policy in the areas of trust, user choice, market development, technical standards, privacy, lawful access, liability and international cooperation. The key recommendations of the OECD include: -- Recognition of commercial importance of cryptography. The Guidelines recognize that cryptography is an effective tool for the secure use of information technology by ensuring confidentiality, integrity and availability of data and providing authentication and non-repudiation mechanisms. -- Rejection of key escrow encryption. The U.S. sought endorsement for government access to private keys. Initial drafts of the guidelines included this recommendation. The final draft does not. OECD countries rejected this approach. -- Endorsement of voluntary, market-driven development of crypto products. The OECD emphasized open, competitive markets to promote trade and commerce in new cryptographic methods. -- Need for critical assessment of key escrow. The OECD Guidelines recommend that countries which are considering key escrow techniques to consider also "the risks of misuse, the additional expense of any supporting infrastructure, the prospects of technical failure, and other costs." -- Endorsement of strong privacy safeguards. The OECD adopted one of strongest privacy principles found in any international agreement, including the obligation to apply the OECD privacy principles to crypto products and services. The OECD also noted favorably the development of anonymous payment schemes which would minimize the collection of personal data. -- Removal of Restrictions on Cryptography. The OECD urged member countries to remove, and avoid creating, obstacles to trade based on cryptography policy. This guideline should lead to further liberalization of export control policies among the OECD member countries. Drafting of the Guidelines for Cryptography Policy began in early 1996. More than 100 representatives from OECD Member countries participated, including government officials from commerce, industry, telecommunications and foreign ministries, law enforcement and security agencies, privacy and data protection commissions, as well as representatives of private sector and privacy advocates. The Global Internet Liberty Campaign (http://www.gilc.org/) an international coalition of civil liberties and human rights organizations, organized a conference for the OECD delegates in Paris in September 1996. The conference contributed significantly to the OECD's final recommendations. The Guidelines, the OECD press announcement and additional commentary are available at: http://www.epic.org/crypto/oecd/ ======================================================================= [2] White House Floats Draft Crypto Bill ======================================================================= The White House has released a new draft proposal on key escrow encryption to the Congress. The draft (dated March 12) is entitled the "Electronic Data Security Act of 1997." The legislation is the latest attempt to push forward the result the Administration sought to achieve with the failed Clipper Chip initiative -- ensuring government access to all encrypted communications through government-escrowed keys. To achieve this goal, the bill would create incentives for all persons and organizations to use a government-certified Certificate Authority (CA) to establish their identities for any electronic transactions. The CA would ensure that there was an escrow system in place before it would issue an identification certificate to the user. Government agencies would likely refuse to communicate with persons and entities not using a government certified CA. Agencies would also likely pressure others over whom they have substantial regulatory or economic power, such as banks, state agencies, and government contractors, to require that government-certified CA's are used to communicate with them. Another provision would require any person who "manufactures, imports, packages, distributes or labels" encryption products to state whether they use a key recovery agent. The draft bill also provides that if non-escrowed cryptography is used during the commission of a crime, an additional five year prison sentence could be imposed. Another provision, apparently intended to gain industry support, would limit the potential civil liability of any "Certification Authority" or "Key Recovery Agent" who obtains a government certification. More information on cryptography policy is available at: http://www.epic.org/crypto/ ================================================================== [3] FAA Calls for Collecting SSNs of all Air Travelers ================================================================== On March 13, the FAA issued a call for comments on a FAA proposal to require airlines to collect substantial personal information on each passenger, including full name, address, next of kin, Social Security Number and date of birth. The purpose of this collection would be to facilitate identification of victims of airplane crashes. The proposal anticipates that passengers would have to provide this information in order to board an aircraft. The proposal raises a number of substantive threats to personal privacy. One major problem is that it appears to violate the Privacy Act of 1974, which limits the ability of government agencies to collect the SSN. There also appear to be no limitations on the use of the collected information, creating a risk that the data could be put to a wide variety of unrelated uses by both the airlines and government agencies. One potential use of this information would be in connection with the controversial "profiling" proposals recently recommended by the Gore Commission. The use of the Social Security Number would simplify the comparison of passenger records with other databases. It appears likely that the FAA is using this proposal as a less controversial rationale to demand the collection of personal information rather than specifically including it in the profiling proposal, which has already generated considerable public and editorial opposition. More information on the proposal and other FAA activities is available at the EPIC Airline Security Page: http://www.epic.org/privacy/faa/ ======================================================================= [4] Groups Urge IETF to Fix Cookies ======================================================================= Several leading consumer, civil liberties, and children's advocacy organizations have urged an Internet standards organization to fix a problem with web browser software that allows companies and government agencies operating web sites to track the activities of Internet users. The groups say that there is a problem with the so-called "cookies" technology. Cookies make it possible to read information on users' computers and find out where they go on the Internet. Some companies in the on-line advertising industry use cookies data to collect personal information for advertising and marketing. The Internet Engineering Task Force, a loose coalition of technical experts responsible for the development of standards for the Internet is meeting this week in Memphis to consider a wide range of technical issues concerning the Internet, including a proposal to limit the ability of companies to use cookies. The proposed safeguard has come under attack by several companies engaged in interactive advertising and marketing. According to a March 31, 1997 article in Ad Age, these groups are now drafting a "counter-proposal" to head-off the IETF recommendation. In the letter, the groups express support for RFC 2109, the proposal for an HTTP State Management Mechanism. The letter further says that "transparency" -- the ability of users to see and exercise control over the disclosure of personally identifiable information -- is a critical guideline for the development of sensible privacy practices on the Internet" The letter was signed by the Center for Media Education, Computer Professionals for Social Responsibility, the Consumer Federation of American, the Consumer Project on Technology, the Electronic Frontier Foundation, the Electronic Privacy Information Center, National Association of Elementary School Principals, NetAction, Privacy International, the United States Privacy Council, and more than one hundred Internet users. The coalition letter, and more information about cookies, is available at: http://www.epic.org/privacy/internet/cookies/ ======================================================================= [5] National Research Council Reports on Privacy of Medical Systems ======================================================================= The National Research Council has released a report on the privacy of medical systems. The report, entitled "For the Record: Protecting Electronic Health Information," calls for measures by government, companies and consumers to better protect the privacy of medical records. The NRC recommended a two-prong approach to dealing with medical privacy, involving the revision of organizational practices to deter unauthorized access to and/or misuse of electronic medical records, and implemention of more stringent technical measures as a safeguard in case the first prong proves ineffective. The NRC also proposes that health-related organizations adopt fair information practices similar to those contained in the federal Privacy Act of 1974. Consumers should have access to a privacy ombudsman that not only provides such information, but could also address patient grievances over violations of privacy. The NRC waffled on fundamental issues such as the desirability of national databases of medical information and the creation of a unique national patient identifier, but expressed concerns over the ramifications for privacy entailed in such a system. Also proposed by the NRC, although admittedly difficult to implement, is the identification of parties which may inappropriately link patient information. Using the Social Security Number, the NRC states, is in its current form insufficient to protect the privacy of individuals. More information on medical privacy is available at: http://www.epic.org/privacy/medical/ ======================================================================= [6] FTC To Conduct Hearings on Privacy, Investigate Databases ======================================================================= The Federal Trade Commission has announced that it will convene a public workshop devoted to consumer information privacy on June 10-13, 1997. This is a follow-up to FTC workshops held last summer. The workshop is intended to gather information on the collection, compilation, sale and use of computerized data bases that contain sensitive identifying information, as well as self-regulatory efforts, technological innovations and unsolicited e-mail. The workshop will also address these developments as they pertain to children's personal information. The workshop will gather information for a new computer data base study that the FTC has also announced. However, this study will be limited to "look up services" which contain personal identifying information, such as the Lexis-Nexis P-TRAK service. Importantly, the FTC will not address computer databases used primarily for direct marketing purposes, medical and student records or the use of computer credit reports for employment purposes. Interested participants must submit written comments by April 15, 1997. More information is available at the FCC web page: http://www.ftc.gov/ ======================================================================= [7] NTIA Files Comments on Privacy of Telephone Calling Information ======================================================================= The Commerce Department's National Telecommunications and Information Administration (NTIA) recommended on March 27 that the Federal Communications Commission (FCC) establish more specific policies to protect <<< Continued to next message >>> ====================================================================== If encryption is outlawed, only outlaws will have encryption...

1 0

EPIC Alert 4.05
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

== Forwarded Message Follows ========================================= * Originally By: In:epic-news@epic.org * Originally Re: EPIC Alert 4.05 * Original Date: 04-08-97 18:08 <<< This message is part 2 of a previous message >>> the privacy of information gathered about consumers by telephone companies. The recommendations cover Customer Proprietary Network Information (CPNI). CPNI is the information that is gathered by phone companies in the process of delivering services, such as numbers called, length of calls, and times calls were made. The FCC is currently conducting a rulemaking on CPNI under the Telecommunications Act of 1996. The law limits the use and disclosure of CPNI information: a telecommunications carrier that receives or obtains customer proprietary network information by virtue of its provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable customer proprietary network information in its provision of (A) the telecommunications service from which such information is derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publishing of directories. NTIA recommended that phone companies provide a list of uses for the information and provide consumers with an opportunity to opt-out of those disclosures. However, this appears to contradict the text of Section 702 of the Act, which requires that phone companies obtain prior written consent before they can share the information and use the information for marketing purposes. Telephone companies have been pressing the FCC to relax that requirement and to require customers to contact them before the telcos stop selling the information. Public interest groups such as Computer Professionals for Social Responsibility and NetAction are arguing for more consumer protection. The NTIA comments are available at: http://www.ntia.doc.gov/ntiahome/fccfilings/cc96-115.htm ======================================================================= [8] Upcoming Conferences and Events ======================================================================= Culture and Democracy revisited in the Global Information Society. May 8 - 10, 1997. Corfu, Greece. Sponsored by IFIP-WG9.2/9.5. Contact: http://www.math.aegean.gr/english/events/econf/ecnew/ewc97.htm Can Trusted Third Parties Be Trusted?: A Public Debate on The UK DTI Crypto Proposal. May 19, 1997. London, UK. Sponsored by Privacy International and the London School of Economics. Contact: pi(a)privacy.org CYBER://CON.97: Rules for Cyberspace?:Governance, Standards and Control. June 4 - 7, 1997. Chicago, Illinois. Sponsored by the John Marshall Law School. Contact: cyber97(a)jmls.edu. Ethics in the Computer Society: The Second Annual Ethics and Technology Conference. June 6 - 7, 1997. Chicago, Ill. Sponsored by Loyola University Chicago. http://www.math.luc.edu/ethics97 Public Workshop on Consumer Privacy. June 10-13, 1997. Washington, DC. Sponsored by the Federal Trade Commission. Contact: http://www.ftc.gov/os/9703/privacy.htm INET 97 -- The Internet: The Global Frontiers. June 24-27, 1997. Kuala Lumpur, Malaysia. Sponsored by the Internet Society. Contact: inet97(a)isoc.org or http://www.isoc.org/inet97 Privacy Laws & Business 10th Anniversary Conference. July 1-3, 1997. St. John's College, Cambridge, England. Contact: info(a)privacylaws.co.uk. Communities, Culture, Communication, and Computers (C**5): On the Role of Professionals in the Information Age. August 20-22, 1997, Paderborn, Germany. Sponsored by FIFF. Contact: c5(a)uni-paderborn.de AST3: Cryptography and Internet Privacy. Sept. 15, 1997. Brussels, Belgium. Sponsored by Privacy International. Contact: pi(a)privacy.org. http://www.privacy.org/pi/conference/brussels/ 19th Annual International Privacy and Data Protection Conference. Sept. 17-18, 1997. Brussels, Belgium. Sponsored by Belgium Data Protection and Privacy Commission. International Conference on Privacy. September 23-26, 1997. Montreal, Canada. Sponsored by the Commission d'Acces a l'information du Quebec. http://www.confpriv.qc.ca/ Managing the Privacy Revolution '97. October 21-23, 1997. Washington, DC. Sponsored by Privacy and American Business. Contact: http://shell.idt.net/~pab/conf97.html (Send calendar submissions to alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send email to epic-news(a)epic.org with the subject: "subscribe" (no quotes) or use the subscription form at: http://www.epic.org/alert/subscribe.html Back issues are available at: http://www.epic.org/alert/ ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC is sponsored by the Fund for Constitutional Government, a non-profit organization established in 1974 to protect civil liberties and constitutional rights. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, email info(a)epic.org, HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Individuals with First Virtual accounts can donate at http://www.epic.org/epic/support.html Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan. Thank you for your support. == End Forwarded Message ============================================== If encryption is outlawed, only outlaws will have encryption...

2 1

Cryptoanalyze to make $$$ fast! [was Re: congressman wants review of online banking system]
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

On Tue, Apr 8 1997, Robert Hettinga wrote- > >--- begin forwarded text > > >X-Sender: oldbear(a)pop.tiac.net >Date: Tue, 08 Apr 1997 17:58:51 -0400 >To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> >From: The Old Bear <oldbear(a)arctos.com> >Subject: congressman wants review of online banking system >Mime-Version: 1.0 >Sender: bounce-dcsb(a)ai.mit.edu >Precedence: bulk >Reply-To: The Old Bear <oldbear(a)arctos.com> > >CONGRESSMAN CALLS FOR REVIEW OF ONLINE BANKING > >House Banking Committee Chairman James Leach (R-Iowa) has >asked the General Accounting Office to review whether the >Federal Reserve has sufficiently protected its Fedwire >funds transfer and security transfer system from electronic >trespassing. > >Fedwire processes around 380,000 securities and funds >transfers totaling $1.6 trillion each day. ********************** > >source: BNA Daily Report for Executives > April 7, 1997 I bet a crack team of encryption experts from the cypherpunks list could make a pretty penny by exploiting holes in Fedwire or related systems.

1 0

Re: Another Article on Jim Bell from the Oregano
by Toto 17 Dec '03

17 Dec '03

Bill Stewart wrote: > > The government tried to prove that he was trying to manufacture > meth, but was unable and Jim pleaded guilty to a lesser charge. Misleading. He pled guilty to a 'different' charge, which had nothing to do with 'drugs', but was some EPA type of thing, as I recall. > >(Of course, > >what are prohibited molecules and non-prohibited molecules is an ever > >changing maze. It is pretty hard to keep track of what is "legal" and > >"illegal" in that area. Seems to be "whatever we say it is". > > It's actually quite straightforward - it all depends on the > intent of the molecules being arrested. If they're just loitering around, > it's not illegal, but if they're loitering with intent to commit public > intoxication, or conspiring to form an illegal syndicate, you may be > in big trouble.... I bought some drugs once, intending to try them. Then I changed my mind... -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Reporters, Declan, Columns, Articles, and Angles
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > At 1:00 AM -0400 4/9/97, Declan McCullagh wrote: > >I'll be going to both events, of course. I'll try to drag an article or > >column out of the "regulation in the digital age" conference, so check out > >netlynews.com around that time. Maybe in the Afterword section. > > Just when I was beginning to think Declan was not just a typical journalist.. > (long flame skipped) I guess Timmy May is still miffed at Declan for exposing Timmy and Cocksucker John Gilmore as plug-pulling censors? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: which remailers are safe?
by Alec 17 Dec '03

17 Dec '03

At 11:01 AM 4/9/97 -0500, 00043.an(a)edtec.com wrote: |For some reason my anonymized posts here are never arriving? |So I try this service - does anyone know about edtec.com? |The problem is, does anyone really know who their remailer is? |Which ones are known absolutely to be run by safe operators, |and which ones are thought or known to be trolls by Unsavory Characters? |I am very interested to see if this post makes it to the list! Dear 00043.an, I have a sense of being here before! 'Twas a post such as this that called forth TruthMngler. Spare us! Alec

1 0

Re: Black box attacks (was Re: Crypto-Dongel)
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Wed, 9 Apr 1997, Jeremiah A Blatz wrote: > Dave Emery <die(a)pig.die.com> writes: > > I have heard about thermite devices being used for this in > > the sort of applications that might warrent it. Granted that this > > is a royal fire hazard unless very carefully engineered, but at least > > it is not an explosive per se.... > > Thermite is probably overkill unless you're trying to dust something > big like a hard drive. Just a bit of magnesium (which is often used as > primer for thermite) should do the trick on a chip. I wonder if it's > really essential to be so drastic, though? Would just getting the chip > really hot be enough to wipe it? What about exposing it to a big arc? > One might imagine a PCMCIA with a voltage doubling diode ladder and a > small capacitor... would this be sufficient? If you're trying to destroy a standard IC, why don't you just hook up the power and ground pins to a 120V AC outlet? No special equipment or substances required, just a couple of wires. Done it myself, and some chips make a really neat popping sound as the top blows off :-) Warning for the electronically challenged: don't use this method if you care about the rest of the board. Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

2 2

Re: which remailers are safe?
by Toto 17 Dec '03

17 Dec '03

00043.an(a)edtec.com wrote: > > does anyone know about edtec.com? > The problem is, does anyone really know who their remailer is? > Which ones are known absolutely to be run by safe operators, > and which ones are thought or known to be trolls by Unsavory Characters? The edtec.com remailer is run by communist agents within the CIA who share their informations with capitalist agents in Red China. I will phone you at your unlisted number later tonight, in order to discuss this matter further. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Reporters, Declan, Columns, Articles, and Angles
by Toto 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > I've been on cypherpunks long before I got my press credentials. The > topics genuinely interest me, and this is one of the few jobs where I can > follow them full-time. If I wanted to make a decent living, I would have > taken that job as a management consultant instead. (Some of us aren't > independently wealthy, Tim.) Mercenary? Not quite. Journalists don't get > paid a whole hell of a lot. And Declan's articles genuinely interest 'me'. Having done a variety of 'reports' ranging from business reports to press reports, I recognize that they have to be written so as to be readable to those with no deep-rooted background in the events or issues being reported. While those who faithfully follow the CypherPunks list and the issued discussed here may find his reports somewhat shallow, I try to read them from the perspective of those who have an interest in the issues but only limited knowledge concerning them. From this perspective, Declan's reports do a good deal to enlighten the masses in regard to whatever issue he addresses. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: on micro-explosions was Re: Black box attacks (was Re: Crypto-Dongel)
by Lucky Green 17 Dec '03

17 Dec '03

At 11:46 PM 4/8/97 -0700, shadow(a)count04.mry.scruznet.com wrote: >instead of minute quantities of explosives one could use extremely fine wires >suspended a small distance from the substrate to be destroyed. >Feed a short(below 3 ms) high current pulse(figure a 400w/s photoflash supply) >the wavefront from the exploding wire will be in the supersonic region. >this method may be used in lieu of explosives to achieve the effect of >a high order detonation. gee wonder if the >atf will forbid us capacitors and wires now :) Wavefronts are a possibility. The disadvantage of any capacitor based system is that capacitors discharge over time. If the system gets disconnected from the power supply, before long the device has to be activated or lose its effectiveness. "Use it or lose it". This may not be ideal for the particular application. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

WebWorld 29
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: Black box attacks (was Re: Crypto-Dongel)
by Lucky Green 17 Dec '03

17 Dec '03

At 12:35 PM 4/9/97 -0400, Cynthia H. Brown wrote: >If you're trying to destroy a standard IC, why don't you just hook up the >power and ground pins to a 120V AC outlet? You are unlikely to have AC in a system by the time the tamper detector senses an intrusion. Similar problems apply to arcs and anything based on discharging a large capacitor. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

3 2

Re: KC post per Alec
by Toto 17 Dec '03

17 Dec '03

Kent Crispin, whose sense of humor indicates he may not, after all, be a government Bot, wrote: > On Thu, Apr 10, 1997 at 12:27:29PM -0800, Timothy C. May wrote: > [...] > > By the way, I'm staying out of this latest tamper-responding device > > argument. I worked on this at Intel, actually. But I wrote a bunch of > > fairly long articles on this the 5th, or maybe it was the 7th?, time this > > came up, circa 1993. Those who refuse to learn from the threads of the past > > are condemned to repeat them. > > Let's see, to which would I rather be condemned: participating in a > lively, current discussion; or digging through musty outdated archives? I regularly cruise back through my archives of the CypherPunks list from as far back as the early 90's and I rarely find them outdated. And rather than being pretentious, I usually find them 'portentious'. > Yes, we could continually mine the archives for words of wisdom from > past participants, and thus pay them homage -- especially since it is > so painfully obvious that is what they crave. But we should forgive > them this weakness, for at some lonely age we all start wondering > about our legacy. There is, however, a far cry of difference between those to whom homage is due, and those to whom it is not. As much as I may have railed against the fascist censorship of the 'moderation experiment' badly instituted by John Gilmore, I am not ungrateful for the years of time and effort that he spent in hosting the CypherPunks list, and stated so in a post to the list before it moved on to new homes. Not knowing Tim May personally, I cannot comment on the description of him in the press as 'crusty' (not knowing if it refers to his personality or his sexual hygene), but I can see how a review of some of his recent posts might suggest that he would not be out of place in a remake of 'Grumpy Old Men'. However, his propensity for taking an attitude of 'been there, done that' (and spanking young pups on the list) in no way negates the fact that he 'has', in fact, been there and done that, and that his (somewhat vague) pointers to sources of information in regard to various list issues might prove valuable to those who have enough interest in the issue to want to indulge in a little research on the matter. While the discussions of those currently active on the list may be enlightening, there are certainly other CypherPunks (some active, some inactive) who have dealt with current issues in the past, and done so from a perspective and knowledge base that are equal or superior to those who are participating in current discussions. While Tim is certainly an icon on the list, I haven't seen any signs of senility seeping in, just yet. {From: "Timothy C. May" <tcmay(a)got.net> Subject: Has anybody seen my shoes? I lost my shoes! } (OK, maybe a couple of signs..:) While I sometimes feel that the list would be better served by more of the long-time members being a little more specific in their aide to more inexperienced members seeking information, there is no doubt that much of the input they do provide is useful enough to point those seeking a better knowledge of crypto and crypto issues in directions which can bear much fruit if the individual is sincere enough to follow their pointers. Tim's legacy is already written in CypherStone, regardless of what he may or may not do in the future, as is that of Gilmore and Hughes. Despite whatever battles you or I may engage them in, in the future, we will be telling our grandchilren, "Hey, I <spit on>/<farted at>/ <kissed> him." when the movie 'Grouchy Old CypherPunks' hits the big screen. -- Toto "One TruthMonger down, four to go"

1 0

Re: NSA Intercepts Sent to Democratic National Committee
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > Reports that the White House fed NSA phone intercepts to the Democratic > National Committee (DNC), for political purposes. > > The calls were between a New York businessman and a Latvian national. This reminds me how some stupid cunt on Usenet thought I was latvian and posted hundreds of kilobytes of flames about how stupid latvians were using me as an example. Of course, I am NOT latvian in any way. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: "...markets are fundamentally chaotic, not efficient"? Really?
by Bill Stewart 17 Dec '03

17 Dec '03

Kent and Bob have been huffing and puffing and blowing each others's straw men down for a few stochastically-determined rounds.... >Sorry. It's Edgar Peters, "Chaos and Order in the Capital Markets", >John Wiley, 1991. I'm sure you will rush out and buy a copy :-) > >> > Chaotic is not the same as stochastic. ... >Clearly, you don't know what you are talking about. Strictly >speaking, chaotic behavior (as mathematically defined in chaos theory) >is completely *deterministic*, not random. By that definition, markets, whether for capital or assassins, are distinctly _not_ chaotic*, since most people's decisions [* Unless Life, The Universe, and Everything are really deterministic, but fate has decreed that I don't believe that...] about what stocks to buy/sell, and particularly the timing, are influenced by lots of random events - when they hear what information, whether they were busy doing something else when they heard, whether they'd just blown their disposable income on a new car because that freak windstorm dropped a tree on their car the same week the Post Office ate their car insurance payment, whether Alan Greenspan had a bad pizza the night before the quarterly interest rates came out or too much caffeine before his latest speech.... Much of the market is driven by the large institutional trading houses, and increasingly by their computer models, but a lot of it's random, and those functions that are chaotic are driven by random inputs. To the extent that the interactions are chaotic rather than linear, it is hard to develop good models of what the market might do and squeeze a few more bits of predictive information out of the vast quantity of observable random data; even with good computer models and Nuclear Physics PhDs on Wall Street there'll probably always be enough inefficiency left in the market for people to squeeze a few more megabucks worth of arbitrage out of it. [Of course, one of the most effective ways to make money in the market has always been to provide high-priced (or low-priced high-volume) investment advice to investors - and chaos theory has contributed not only to the profitability of some investors but to the buzzword-supply of hucksters in many fields, and selling buzzwords can make a lot of short-term money...] >> Most of the physicists hired by Wall Street were people who >> discovered market analogs to physical processes. The one physicist I knew well who went to Wall Street did it during the stock market boom of 1987. (Oops...) He was fortunate to avoid getting caught in one of the major fallouts of the '87 stock crash, which was the '87-'88 stock market job crash, though. >> > Obviously I can't "prove" markets are not efficient -- >> > that's an empirical matter, not a mathematical matter. The standard way to prove that a market is inefficient is to go tap some money out of it. Doing so does eliminate that particular inefficiency after a while, but there keep being enough people employed on Wall Street to suggest that there's always inefficiency. >> > "Whip me! Beat me! Savage me in Cypherpunks!" I didn't come here for an argument.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

[Key Markets] Re: "...markets are fundamentally chaotic, not efficient"?
by Bill Stewart 17 Dec '03

17 Dec '03

Crispin and Hettinga discussing efficient markets for key bailment: >> In a geodesic network, a single node can not possibly process all >> the information in the network. It chokes, and the network routes >> around it. >> You can bet that any key escrow agent would be innundated with >> surveillance requests We're not talking about a lot of bits, here. If you take care of the hard problem, which is getting people to hand their keys over to easily located key baliffs for no good business reason, the amount of retrieval work is really a lot smaller than the work of wiretapping all the communications and selecting targets. If the government expects to get the key owners to pay for bailment, and get retrievals for free in return for paper copies of warrants blue-ink-signed by judges, in triplicate, with hand-pressed notary seals, yes, that'd be a bottleneck. On the other hand, if the key bailiffs accept electronic requests, digitally signed by the judge's key, with electronic payment attached (whether DigiCash or EscrowBucks), the costs of the key bailment service are quite low and the profit on each request makes it worthwhile to expand the business to meet rapidly-increasing demand - cheap enough to the government to make it worth wiretapping more encrypted transactions. Since the Secretary gets to approve Key Recovery Agent Parties, he can disavow all knowledge of agents who insist on a real signature and want to be sure the request was signed by a real judge rather than by some clerk or cop using the Escrowed copy of the judge's key. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

New York court hears challenge to state Net-censorship law
by Declan McCullagh 17 Dec '03

17 Dec '03

********** Date: Wed, 9 Apr 1997 17:50:08 -0400 To: fight-censorship-announce(a)vorlon.mit.edu From: Declan McCullagh <declan(a)well.com> Subject: FC: New York court hears challenge to state Net-censorship law Sender: owner-fight-censorship-announce(a)vorlon.mit.edu Reply-To: declan(a)well.com X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ ************** http://cgi.pathfinder.com/netly/editorial/0,1012,811,00.html The Netly News Network April 8, 1997 The Bad Apple by Declan McCullagh (declan(a)well.com) To those of us who follow such events, it's a common enough scene: a squad of civil liberties attorneys troops into a federal courtroom to do righteous battle with an unconstitutional law. It happened this week in New York City, before a judge who finished hearing testimony yesterday in a case the ACLU brought against yet another state Net-censorship statute. The outcome in this lawsuit, however, will reverberate not just in the Empire State but also along the marble corridors of the U.S. Capitol. If the Supreme Court rules that the Communications Decency Act indeed violates the First Amendment, Congress hopes the New York case will guide it in revising the law so it passes constitutional muster. And given how the New York case is shaping up for the forces of unbridled free speech, that could be ugly. A group of 15 plaintiffs challenging the New York statute filed suit in January, arguing that that the law unconstitutionally stifles online speech and unduly interferes with interstate commerce on the Net. The measure, which took effect last November, amends the penal code by making it a crime to distribute online pictures or text "which is harmful to minors." Attorneys for the New York attorney general's office, who are defending the law, say that the "harmful to minors" legal standard isn't as heinous as the CDA's "indecency" ban -- it covers only sexually explicit pictures, not textual conversations. They also argue that filtering software could be used to help online purveyors of adult-only stuff comply with the state statute. Of course, as always, academics, librarians and artists point out that these attempts to limit online communications are overly broad and ill-defined. What I consider harmful to a kid might not be what you consider harmful, after all. Yesterday four witnesses testified for the plaintiffs, uniformly saying they felt threatened by the law. "I walk around with a healthy fear that every book in our collection would give someone the idea that we're giving harmful materials to minors," said Maurice Friedman, executive director of the Westchester Library System. Rudolf Kinsky, an artist from Poland, weighed in next: "I feel a chilling effect on my creativity. Someone could consider my art harmful to minors and could prosecute me. I came to this country [from Poland] looking for freedom of speech, not this." But yesterday's testimony seemed like the capper to an overwhelmingly poor showing the government made in its opening arguments last week. The government's case lasted a mere hour and was hardly persuasive. Among other gaffes, the state failed to slide a new legal standard -- "level of maturity" -- into the discussion; Judge Loretta Preska quickly rebuffed that attempt: "I don't read 'level of maturity' anywhere in the statute," she said, nettled. That wasn't the only time Preska pounced on the government. By the end of the three-day hearing, I was ready to bet good money on the ACLU winning yet another victory for the Net. But I have a confession to make. In January I claimed that "knocking down New York's law should be a virtual slam dunk," saying it suffers from all of the same problems as the CDA. But now, after reading a recent law review article by UCLA law professor Eugene Volokh, I'm not as sure. Volokh points out that the government could rely on the ready existence of ratings schemes, such as RSACi and PICS, which give publishers the ability to keep their material out of the hands of minors. He writes: "Under the existing doctrine, it would be constitutional to criminalize the display of any harmful-to-minors material which does not carry a correct rating." In other words, rate your web pages with RSACi or go to jail. (I can't see Microsoft, the Software Publishers Association and other RSACi boosters probably opposing this. I can smell another Microsoft world-domination plot brewing already...) Indeed, Volokh told me yesterday that he thinks the New York attorney general may have a workable case. "I think the state has a decent defense. They could say look, this rating imposes a burden but not a very high burden. It's like that imposed on a bookseller. All you're required to do is put on this label." Certainly, Net rating systems played a big part in the New York trial. Last Friday a government attorney asked: "In general, what would be more burdensome as a whole: requiring millions of web sites to rate their contents or just requiring a percentage of web sites that contain graphical objectionable material to rate their web sites?" What the government was trying to point out was that rating systems like RSACi -- that let you assign values to web pages based on nudity or violence -- are increasingly commonplace. If they're commonplace, then netizens may be able to comply with the New York law. And if netizens can comply with the law, then it may be constitutional. [...] "Harmful to minors is something people will talk about again and it's an option, but I don't want to say we'll be out there trumpeting it," says Connie Correll, spokeswoman for Rep. Rick White, a Republican congressman from Washington State -- whose district includes Microsoft. (Coincidence, or another Microsoft attempt at world domination? While you're pondering the question, keep in mind that White championed "harmful to minors" language in December 1995, but Congress rejected it in favor of the CDA's broader "indecency" ban.) Correll adds: "People are watching the New York case. I think it's going to be a real good indication." So do I. ### -------------------------------------------------------------------------- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/ ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Reactionaries
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Toto is another loser who pays for sick.sympatico.ca-ca because he lacks the mental capacity to gain net access as a perk of either employment or academic achievment. ,,, ($ $) -ooO-(_)-Ooo- To[homo]to

2 1

Assassination Politics
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Toto's abysmal grammar, atrocious spelling and feeble responses clearly identify him as a product of the American education system. >\\\|/< |_ ; (O) (o) -OOO--(_)--OOOo- T[h]o[mo]to

4 3

Premium Webhosting Services
by caseym＠genesisnetwork.net 17 Dec '03

17 Dec '03

Thanks for requesting the GENESIS Network website hosting information guide, to make this short so we do not take up your valuable time, please stop in and visit us at ... http://www.genesisnetwork.net " look for the red chili pepers " The rest is easy.

1 0

Reactionaries
by nobody＠hidden.net 17 Dec '03

17 Dec '03

Toto is another loser who pays for sick.sympatico.ca-ca because he lacks the mental capacity to gain net access as a perk of either employment or academic achievment. ,,, ($ $) -ooO-(_)-Ooo- To[homo]to

2 1

APRIL BAY AREA CYPHERPUNKS MEETING AND BEACH PARTY, BONNY DOON
by Bill Stewart 17 Dec '03

17 Dec '03

The April Bay Area Cypherpunks Meeting will be held jointly with the Clan MacDude Back To The Beach party, April 12 at Bonny Doon Beach. ( www.macdude.org , http://www.macdude.org/aprbeach.htm for event description.) Among other things, John Randolph was planning to do a Great Wall of Fire with his leftover moving boxes, and various other cypherpunks are part of the Glorious Clan, which is a generally silly organization. Cypherpunkish agenda: It's been a quiet month, except for Jim Bell. CFP was just after the March meeting. The UK is hyping Key Escrow. Bring some discussion topics that benefit from handwaving but don't need a blackboard :-) Ron Rivest and Carl Ellison have been doing some good work on key distribution. PGP Inc. is up to something. China is announcing plans for Hong Kong. It's also time to celebrate "Diffie-Hellman Would Have Been Patent-Free!" day, though of course they changed the patent laws to make it September. MacDude planned events Fizzball: A game involving cheap evil smelling beer and large stick Caber toss: Except that we use a surf board Haggis toss: Using an old Bean Bag Chair Siege engines: How far can you launch a can of fizzbeer? Bonny knees contest: Best legs in (or out) of a kilt, blindfolded judging. Dry Ice bombs: Dry Ice in plastic soda bottles, big boom. Fire: Fire pit as executed by the army corpse of engineers Music: Bardic and Filk around the burning pit of doom and cheer Food and drink: bring stuff for potlucking. Silly clothes: Plaid and hawaiian print. "During the day there will be many special events including a Caber toss (with a longboard), a contest for best legs in a kilt (judging with and without blindfolds), ritual sacrificing of consumer goods, sand fortress building and, of course, fizzball. There will be a potluck dinner on the beach featuring a whole roast pig. Time: All day, especially afternoon and dinner time. What to bring: Food, Toys, Silly People, Sand-tolerant musical instruments. Catapults are good, too... Directions to Bonny Doon: Bonny Doon Beach is about 8-9 miles north of Santa Cruz on Hwy 1 (still south of Davenport (but only just...)). Bonny Doon Road is inland. The beach is between the highway and the ocean. Park and walk over the hill to the ocean. (This hill is a steep begger, with an abandoned rail line across the top.) Map: http://www.vicinity.com/yt.hm?FAM=mapblast&CMD=GEO&SEC=find&IC=0%3A0%3A5&IC% 3A=Beach+Party&AD2=Highway+1+%26+Bonny+Doon+Rd.&AD3=Santa+Cruz%2C+CA ASCII MAP 1 | | Beach |------ Bonny Doon Road | | ~ ~ Santa Cruz # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Information Systems Security Board
by John Young 17 Dec '03

17 Dec '03

On December 13, 1996, representatives from The National Information Infrastructure (NII) Task Force of The President's National Security Telecommunications Advisory Committee (NSTAC) held a meeting at Steptoe & Johnson in Washington, D.C. to discuss industry interest in developing an industry-run Information Systems Security Board (ISSB). Stewart Baker of Steptoe & Johnson discussed the antitrust laws and their application to the meeting, with particular emphasis on the need to avoid discussion of competitive conditions and to show openness to all interested participants. Guy Copeland, a representative from the Task Force, briefly discussed the ISSB model and the purposes of the meeting. Will Ozier, Chairman of the GSSP Committee, next discussed the efforts of the Generally Accepted System Security Principles (GSSP) project. Several representatives from the Administration expressed support for the concept of the ISSB. These representatives also indicated that the Administration would like private industry to take the lead in this area and is more than willing to take "a back seat" to such an effort. These representatives did request for periodic updates on any industry driven initiative in this area. ----- For full report and links to background documents: http://jya.com/issb.htm Thanks to RH.

1 0

EVENT REMINDER! Rep. Rick White on democracy.net tonight! (4/10/1997)
by Shabbir Safdar 17 Dec '03

17 Dec '03

========================================================================= _ _ __| | ___ _ __ ___ ___ ___ _ __ __ _ ___ _ _ _ __ ___| |_ / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __| | (_| | __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | | __/ |_ \__,_|\___|_| |_| |_|\___/ \___|_| \__,_|\___|\__, (_)_| |_|\___|\__| |___/ Government Without Walls _________________________________________________________________________ Update No.4 http:/www.democracy.net/ April 9 1997 _________________________________________________________________________ Table of Contents - REMINDER - Town Hall Meeting with Rep. Rick White (R-WA) THURS April 10. - Upcoming Events - About democracy.net _________________________________________________________________________ REPRESENTATIVE RICK WHITE BRINGS TOWN HALL MEETING TO CYBERSPACE Just a reminder that Rep. Rick White (R-WA) will be live online at democracy.net on Thursday April 10. We hope you will stop by, ask a few questions, and join Rep. White and Wired Magazine's Todd Lappin as we kick off the democracy.net Virtual Town Hall meeting project. Date: Thursday April 10, 1997 Time: 8:30 pm ET (5:30 pm Pacific) Event will last approx. 45 min Location: http://www.democracy.net You will need RealAudio and a telnet application (available free at http://www.democracy.net/software) Rep. White is the co-founder of the Congressional Internet Caucus, an opponent of the CDA, and a leading voice in Congress on Internet policy issues. White will discuss current Internet issues and respond to your questions. You can submit questions for Rep. White in advance by visiting http://www.democracy.net ___________________________________________________________________________ UPCOMING EVENTS Wednesday April 16 - 8:30 pm ET (5:30 pm Pacific) Representative Anna Eshoo (D-CA) Eshoo, who represents California's Silicon Valley, is co-sponsor of the SAFE bill to ease government controls on encryption technologies and has recently set up the first interactive "Virtual District Office" in the Congress. Join Representative Eshoo and democracy.net live online. Details are available at http://www.democracy.net/ ___________________________________________________________________________ ABOUT DEMOCRACY.NET democracy.net is a joint project of the Center for Democracy and Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore ways of enhancing citizen participation in the democratic process via the Internet. To this end, democracy.net will host live, interactive cybercasts of Congressional Hearings and online town hall meetings with key policy makers. democracy.net is made possible through the generous support of WebActive, Public Access Networks, the Democracy Network, and DIGEX Internet. More information about the project and its sponsors can be found at http://www.democracy.net/about/ To receive democracy.net announcements automatically, please visit our signup form at http://www.democracy.net/ __________________________________________________________________________ end update no.4 04/09/97 ===========================================================================

1 0

Internet security code said vulnerable to hackers
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: "Joseph M. Reagle Jr." <reagle(a)rpcp.mit.edu> Mime-Version: 1.0 Precedence: Bulk Date: Thu, 10 Apr 1997 09:47:06 -0400 From: "Joseph M. Reagle Jr." <reagle(a)rpcp.mit.edu> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Internet security code said vulnerable to hackers This is one screwed up story. I don't know what they are actually trying to say, but the guy from MasterCard isn't helping. (I stick my two derisive comments into the story. <smile>) Forwarded Text ---- ATLANTA, April 9 (Reuter) - The new security protocol for safeguarding credit-card transactions on the Internet may have to change because the underlying cryptography is too easy to hack through and too difficult to upgrade, an expert said Wednesday. Steve Mott, senior vice president of electronic commerce and new ventures for MasterCard International, said it could take hackers as little as a year to break the industry's standard encryption code, which is supposed to render credit-card numbers unreadable to outsiders on the Internet's World Wide Web. For that reason, the consortium of technology companies and creditors that has spent two years years developing the Secure Electronic Transaction (SET) protocol may switch to a faster encryption system called Elliptic Curve, which is produced by Certicom Corp. The first complete version of SET, known as SET 1.0, will be available to software makers June 1 with core cryptography provided by RSA Data Security, a unit of Security Dynamics Technologies Inc. ``RSA is a very good starting point. But we suspect that in a year or two, the Kevin Mitnicks of the world will start to figure out ways to hack it,'' Mott said. Mitnick is one of the most notorious computer hackers. [This is stupid mixing "hackers" with key lengths. Kevin Mitnick doesn't have didley to do with encryption. He just grabbed a huge CC plain text file off of netcom file system. Should have said Ian Goldberg, or the folks at Ecole Polytechnique in Paris or MIT.] ``The only way you scale an RSA is to add a lot more bits. You add a lot more bits and it becomes more complex software in terms of the interaction of the transaction messages. That's part of what's taken SET so long to start with.'' [This is a hoot! Adding a longer key length makes the software more complex! And THIS is what has held up SET!!!?? <grin>] MasterCard has been helping put together merchants with its own member banks for SET pilot projects in Denmark, Japan, Taiwan, South Africa and the United States. Mott told a news conference at the Internet Commerce Expo that the Elliptic Curve encryption system would make a better encryption core. In fact, he said it would have been chosen in the first place if developers had been known about it. ``It will fit on a chip card. I think its 160 bits equals security to 1,024 bits of RSA,'' the credit industry executive said. ``We anticipate putting it into some SET 1.0 pilots in the very near future this year in the U.S.'' Far from being disturbed by the possibility of hackers getting through the current SET cryptography, Mott said SET's developers would ``give them an award and a ribbon and then embody whatever they did as part of the improvements'' in the next version of security standards. ``The current version for SET is as safe as anybody can make it,'' he said. End Forwarded Text ---- _______________________ Regards, A man's dreams are an index to his greatness. -Zadok Rabinwitz Joseph Reagle http://web.mit.edu/reagle/www/ reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

3 2

Cato/Brookings conference on "Regulation in the Digital Age"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 10 Apr 1997 10:59:53 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Cato/Brookings conference on "Regulation in the Digital Age" [Robert Bork weighs in on the CDA -- who can pass that up? This promises to be a fabulous conference. --Declan] ---------- Forwarded message ---------- Date: Thu, 10 Apr 1997 05:35:01 -0400 (EDT) From: Solveig Bernstein <sberns(a)cato.org> To: Declan McCullagh <declan(a)well.com> Subject: Digital Regulation Conference Declan, would you please post this to fight-censorship with an invitation to repost freely. Cato and Brookings have a really interesting conference lined up for April 17/18 in DC. I'm particularly looking forward to seeing Bob Corn-Revere debating former Judge Bork on content controls. We've decided to waive the registration fee for students, professors, teachers, policymakers, and those in the public interest community. Feel free to join us--email Julie to rsvp at jbriggs(a)cato.org or call (202) 789-5296. REGISTRATION FEE HAS BEEN WAIVED FOR NONPROFITS, EDUCATORS, STUDENTS, AND POLICYMAKERS!!! **************************************************************** C A T O . B R O O K I N G S @ C A P I T A L_H I L T O N . A P R I L 1 7 / 1 8 / 1 9 9 7 Regulation in the Digital Age Schedule of Speakers THURSDAY, APRIL 17, 1997 8:00 - 8:30 a.m. Registration 8:30 - 8:45 a.m. Welcoming Remarks: Robert Litan, Director, Economic Studies Program, Brookings Institution, and William Niskanen, Cato Institute 8:45 - 10:15 a.m. Does the Digital Age Require a New Approach to Regulation (If So, What Is It)? Michael Katz, University of California, Berkeley Lawrence J. White, New York University Peter Pitsch, Pitsch Communications Richard E. Wiley, Wiley, Rein & Fielding 10:15 - 10:30 a.m. Break 10:30 - 12:00 a.m. Does the Digital Age Require a New Approach to Antitrust? Donald I. Baker, Baker & Miller Robert E. Hall, Stanford University Timothy F. Bresnahan, Stanford University Thomas Hazlett, University of California, Davis 11:30 - 1:00 p.m. Luncheon and Luncheon Address: "Implications of the Digital Age for Democratic Government: A Dialogue," Thomas E. Mann, The Brookings Institution, and William Niskanen, Cato Institute 2:00 a.m. - 3:45 p.m. Making Global Commerce Happen (including Intellectual Property, Encryption, Privacy, UCC Contracts, Anti-fraud, and Tax Issues) Anne Branscomb, Harvard University Dorthy E. Denning, Georgetown Computer Science David Post, Georgetown University Law School Kenneth W. Dam, University of Chicago Law School Whitfield Diffie, Sun Microsystems 3:45 - 4:00 p.m. Break 4:00 - 5:15 p.m. Professional Licensing Joel Hyatt, Hyatt Legal Services Robert Waters, Arent Fox Jay Sanders, American Telemedicine Association 5:45 - 6:15 Reception 6:15 - 8:00 p.m. Dinner and Dinner Address: "Regulation the Telecosm," George Gilder, The Discovery Institute FRIDAY, APRIL 18, 1997 8:30 - 9:30 a.m. Regulating Content (Culture, Pornography, and Libel) Robert Bork, American Enterprise Institute Patrick Vittet-Phillip, European Union Bob Corn-Revere, Hogan & Hartson Nadine Strossen, ACLU (invited) 9:30 - 10:30 a.m. Standards and Interoperability Cynthia Beltz, American Enterprise Institute Jeff Rohlfs, Strategic Policy Institute Daniel L. Brenner, National Cable Television Association 10:30-10:45 a.m. Break 10:45 - 11:45 a.m. Ensuring Access Robert W. Crandall, The Brookings Institution Jonathan Sallett, MCI Lawrence Gasman, Cato Institute Lawrence Strickling, Ameritech 11:45 - 1:15 p.m. Luncheon and Luncheon Address: "Birth of the Digital Nation," Louis Rossetto, Editor & Publisher of Wired. News media please email or call Robin Hulsey at (202) 789-5293. THE CAPITAL HILTON 16th & K STREETS, NW WASHINGTON, DC Click above for pricing and registration information Return to the Cato Home Page Solveig Bernstein, Esq. (202) 789-5274 (202) 842-3490 (fax) Assistant Director of Telecommunications & Technology Studies Cato Institute 1000 Mass. Ave. NW Washington, DC 20001

1 0

Re: [NTSEC] GOOD GRIEF! re:Hack' punches hole in Microsoft NT s (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die. ---------- Forwarded message ---------- Date: Thu, 10 Apr 1997 18:10:04 +0000 From: Alan C. Ramsbottom <acr(a)als.co.uk> To: Jos Visser <josv(a)osp.nl> Cc: ntsecurity(a)iss.net Subject: Re: [NTSEC] GOOD GRIEF! re:Hack' punches hole in Microsoft NT s > I am currently reviewing the write-up to include the newest > relevant information.I had considered the possibility that you could > brute-force attack the password space. However, the possible number > of passwords is quite bi. Let us assume that the average password > contains about 40 bits of information, the entie plausible passowrd > space then is 2^40 = 1099511627776 possible passwords. Suppose you > could hash and store 1,000,000 passwords each secondthe brute-force > approach takes more then 12 days to calculate and requires about > 16 GB diskspace to store the results (uncompressed). > > Could you please point me the errors in my calculations so I can fix > the article asap? Certainly.. Theoretically, for a "complete" brute-force attack on the DES hashes we need to consider a 56 bit ( 7 chars x 8 bits) password space. This space is the maximum we have to worry about because of the 14 char password to two independent 7 char DES keys split. The timing overheads of checking both the 8 char hashes during a brute-force attack are relatively trivial. Now the crunch. Theory is fine, but in the real world there are constraints on the password space - in reality it gets much smaller e.g. 1) chars below 0x20 can't be entered in the password dialogue box 2) alphas are uppercased prior to being used as DES keys so you can also ignore 0x61 to 0x7A. Correcting the case of any alphas after finding a LanMan password is a quick and relatively trivial task using MD4. That much is guaranteed even if you (reasonably in 99.99% of cases) start throwing away characters that are difficult to quickly enter on a keyboard e.g. anything that needs an ALT-0-nnn sequence to enter (more or less everything above 0x80 subject to country). Finally 3-4Gb disks are now relatively inexpensive so the amount of diskspace required for a precomputed attack is not much of an obstacle. It has been also been suggested that if you are short of diskspace you could always keep sequentially sorted sections of the precomputed file on a backup tape. Then, as you mention above there is compression. My main point is that you don't need an exceptionally fast machine or impossible amount of disk space. If I can write code to do this then you can guarantee that other people have, and that theirs is both cleverer and runs faster ;-) "Greater password complexity" is a good idea for many reasons but not much help in this specific case. The LanMan hashes are simply far too easy to attack and you should concentrate your defences in preventing access to them. Finally, we need to put this in proper perspective - this attack and the associated IE 3.0 SMB and NTLM problems can EASILY BE AVOIDED with a few simple network administration policies. --Alan-- acr(a)als.co.uk PS. Haven't seen my original message turn up on NTSecurity yet so I don't suppose this will.

1 0

RE: New York court hears challenge to state
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

Remember that the Internet is an international playground and while the U.S. Government may say "Rate your site or go to jail" or worse yet filter traffic that is not rated (blind censorship), the rest of the world may go on its merry way and not even flinch (crypto is a good example). Sounds like a state-run New York Times. The phrase "harmful to children" also means different things in different countries. Maybe the idea is that countries and/or sites that do not rate their content will be blocked from accessing U.S. sites (immigration law on the net). Other countries could do the same in retaliation. That would mean the loss of access to a lot of information for all sides. "Excuse me sir, I can't let your packet pass unless I've seen your Net passport and visa". And what happens to all those international sites hosted on U.S. territory? If they were to move out it would mean a loss of $$ for U.S. companies (again). Also, don't forget that state laws would impede interstate commerce (loss of revenue for the state). I see the word "boycott" in my future. Somebody please slap the person who said the Cold War was over. I'm glad that somebody has finally discovered time travel. Unforunately its in back in time not forward! Art Grapa agrapa(a)banamex.com ---------- From: Declan McCullagh To: ARTURO GRAPA YSUNZA; cypherpunks(a)toad.com Subject: New York court hears challenge to state Date: Wednesday, April 09, 1997 7:33PM Microsoft Mail v3.0 IPM.Microsoft Mail.Note De: Declan McCullagh Para: ARTURO GRAPA YSUNZA cypherpunks(a)toad.com Asunto: New York court hears challenge to state Fecha: 1997-04-09 19:33 Prioridad: 3 Ident. del mensaje: 9E367DA622B0D011AF8D006097838CEB ----------------------------------------------------------------------- ----- -- ********** Date: Wed, 9 Apr 1997 17:50:08 -0400 To: fight-censorship-announce(a)vorlon.mit.edu From: Declan McCullagh <declan(a)well.com> Subject: FC: New York court hears challenge to state Net-censorship law Sender: owner-fight-censorship-announce(a)vorlon.mit.edu Reply-To: declan(a)well.com X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ ************** http://cgi.pathfinder.com/netly/editorial/0,1012,811,00.html The Netly News Network April 8, 1997 The Bad Apple by Declan McCullagh (declan(a)well.com) To those of us who follow such events, it's a common enough scene: a squad of civil liberties attorneys troops into a federal courtroom to do righteous battle with an unconstitutional law. It happened this week in New York City, before a judge who finished hearing testimony yesterday in a case the ACLU brought against yet another state Net-censorship statute. The outcome in this lawsuit, however, will reverberate not just in the Empire State but also along the marble corridors of the U.S. Capitol. If the Supreme Court rules that the Communications Decency Act indeed violates the First Amendment, Congress hopes the New York case will guide it in revising the law so it passes constitutional muster. And given how the New York case is shaping up for the forces of unbridled free speech, that could be ugly. A group of 15 plaintiffs challenging the New York statute filed suit in January, arguing that that the law unconstitutionally stifles online speech and unduly interferes with interstate commerce on the Net. The measure, which took effect last November, amends the penal code by making it a crime to distribute online pictures or text "which is harmful to minors." Attorneys for the New York attorney general's office, who are defending the law, say that the "harmful to minors" legal standard isn't as heinous as the CDA's "indecency" ban -- it covers only sexually explicit pictures, not textual conversations. They also argue that filtering software could be used to help online purveyors of adult-only stuff comply with the state statute. Of course, as always, academics, librarians and artists point out that these attempts to limit online communications are overly broad and ill-defined. What I consider harmful to a kid might not be what you consider harmful, after all. Yesterday four witnesses testified for the plaintiffs, uniformly saying they felt threatened by the law. "I walk around with a healthy fear that every book in our collection would give someone the idea that we're giving harmful materials to minors," said Maurice Friedman, executive director of the Westchester Library System. Rudolf Kinsky, an artist from Poland, weighed in next: "I feel a chilling effect on my creativity. Someone could consider my art harmful to minors and could prosecute me. I came to this country [from Poland] looking for freedom of speech, not this." But yesterday's testimony seemed like the capper to an overwhelmingly poor showing the government made in its opening arguments last week. The government's case lasted a mere hour and was hardly persuasive. Among other gaffes, the state failed to slide a new legal standard -- "level of maturity" -- into the discussion; Judge Loretta Preska quickly rebuffed that attempt: "I don't read 'level of maturity' anywhere in the statute," she said, nettled. That wasn't the only time Preska pounced on the government. By the end of the three-day hearing, I was ready to bet good money on the ACLU winning yet another victory for the Net. But I have a confession to make. In January I claimed that "knocking down New York's law should be a virtual slam dunk," saying it suffers from all of the same problems as the CDA. But now, after reading a recent law review article by UCLA law professor Eugene Volokh, I'm not as sure. Volokh points out that the government could rely on the ready existence of ratings schemes, such as RSACi and PICS, which give publishers the ability to keep their material out of the hands of minors. He writes: "Under the existing doctrine, it would be constitutional to criminalize the display of any harmful-to-minors material which does not carry a correct rating." In other words, rate your web pages with RSACi or go to jail. (I can't see Microsoft, the Software Publishers Association and other RSACi boosters probably opposing this. I can smell another Microsoft world-domination plot brewing already...) Indeed, Volokh told me yesterday that he thinks the New York attorney general may have a workable case. "I think the state has a decent defense. They could say look, this rating imposes a burden but not a very high burden. It's like that imposed on a bookseller. All you're required to do is put on this label." Certainly, Net rating systems played a big part in the New York trial. Last Friday a government attorney asked: "In general, what would be more burdensome as a whole: requiring millions of web sites to rate their contents or just requiring a percentage of web sites that contain graphical objectionable material to rate their web sites?" What the government was trying to point out was that rating systems like RSACi -- that let you assign values to web pages based on nudity or violence -- are increasingly commonplace. If they're commonplace, then netizens may be able to comply with the New York law. And if netizens can comply with the law, then it may be constitutional. [...] "Harmful to minors is something people will talk about again and it's an option, but I don't want to say we'll be out there trumpeting it," says Connie Correll, spokeswoman for Rep. Rick White, a Republican congressman from Washington State -- whose district includes Microsoft. (Coincidence, or another Microsoft attempt at world domination? While you're pondering the question, keep in mind that White championed "harmful to minors" language in December 1995, but Congress rejected it in favor of the CDA's broader "indecency" ban.) Correll adds: "People are watching the New York case. I think it's going to be a real good indication." So do I. ### ----------------------------------------------------------------------- --- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/ ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Checkout the crypto in IE 4.0
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Maybe people have already noticed but the pre-release IE 4.0 has S/MIME encryption and signatures built in. I'm trying to set it up as we speak. Unfortunately Outlook Express does not seem to pick up the Outlook '97 address book so I haven't been able to add the sig to this message :-) Phillip M. Hallam-Baker Visitng Scientist MIT Laboratory for Artificial Intelligence. hallam(a)ai.mit.edu http://www.ai.mit.edu/people/hallam/hallam.html

1 0

Re: Information Systems Security Board
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

"John Young" <jya(a)pipeline.com> wrote in article <5iil75$n93(a)life.ai.mit.edu>... > On December 13, 1996, representatives from The National > Information Infrastructure (NII) Task Force of The President's > National Security Telecommunications Advisory Committee > (NSTAC) held a meeting at Steptoe & Johnson in Washington, D.C. > to discuss industry interest in developing an industry-run > Information Systems Security Board (ISSB). > > Stewart Baker of Steptoe & Johnson discussed the antitrust laws > and their application to the meeting, with particular emphasis on > the need to avoid discussion of competitive conditions and to show > openness to all interested participants. I would consider such a proposal from Suart Baker to involve an unfortunate conflict of interest. As one of the people who makes his living as a fixer enabling people to comply with the export control laws he does not have an interest in pressing for reform of the anti-crypto regulations that stop computer security sdystems being used. He is like the owner of a NYC taxi medallion. His 'property' has no legitimate value but he has an interest to continue the legal distortions that keep it in place. Phill

1 0

Re: Reporters, Declan, Columns, Articles, and Angles
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

> >Nothing personal. I just get tired of hearing about "story angles" and > >"columns." Frankly, the only people I want to communicate with are those > >who take the time to read this and related lists....the sheeple who read > >about the Net in Time and Newsweek and their ilk are not worth > >communicating with. They will be spaded under. > > But what if Declan were writing for the Economist... I have a lot more respect for Duncan's style than certain Economist articles. A case in point was a little hatchet job some journo-hack did on Sorros' piece on the open society in the Atlantic monthly. I consider that Sorros has demopnstrated empirically a knowledge of markets that few economists and no journalists can claim to match yet the economist decided to have a go at him. In any case since the piece was principally about political philosophy the Economist interpretation was plain wrong. Phill

2 1

Re: [PGP-USERS] BestCryp NP
by Alec 17 Dec '03

17 Dec '03

>From: GWNapier(a)aol.com >Date: Thu, 10 Apr 1997 16:11:41 -0400 (EDT) >To: pgp-users(a)rivertown.net >Resent-Message-ID: <"h3W-hD.A.rVC.jmUTz"@rivertown> >Reply-To: pgp-users(a)rivertown.net > >To Fred and His Question About BestCrypt NP. I received this today and >thought it might be of interest. > >>Someone asked on the list about the possibility to transparently access >>encrypted data on a CD. SFS doesn't allow this, but I yesterday found >>a software for Windows 95 that does. > >>BestCrypt NP costs $115, the home page is www.jetico.sci.fi. >>They even have our Mr Peter Gutmann on their credits list. BestCrypt >>supports BlowFish, DES (boo) and GOST, a russian standard with >>256bit key. It supports all fixed, removable or networked media, >>allowing upto 6 "containers" be open simultaneously. > >>Although the company seems like Finnish, they don't speak Finnish and >>I don't get even a discount for telling you this :) Just thought some >>of you might be interested. > >>Jyrki Petsalo

2 1

Pilots saw missile over NY
by Alec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- April 10, 1997 Web posted at: 9:22 a.m. EDT (1322 GMT) ST. PAUL, Minnesota (Reuters) -- Northwest Airlines pilots reported that they saw what appeared to be a missile or a rocket over the New York area the evening of March 17, the Saint Paul Pioneer Press reported Thursday. In a copyrighted story, the Pioneer Press reported that investigators are piecing together tapes of air traffic control radar recorded the night of the sightings.... http://cnn.com/US/9704/10/missile.reut/index.html -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBM01ZgiKJGkNBIH7lAQFH2QP+LolytyAkNpiKHD5bQgnOdDjnX7U2tV9f bKuCrbUQyppV58YslT7c0o72NmcSwB7TFll+F9gCsPKmpPjHkPc7ZTaWo/nIxrs1 YwRxqta1EKIlM4KtccMAh2XJezw9wNTtPUcStp8fH9EJYG/0kCyhjjE5J4xS5/KD BR1C0pLjZ1Y= =nd+d -----END PGP SIGNATURE-----

1 0

Cato Institute report on Clinton's sad constitutional record
by Declan McCullagh 17 Dec '03

17 Dec '03

>Date: Thu, 10 Apr 1997 16:57:56 -0400 >To: fight-censorship-announce(a)vorlon.mit.edu >From: Declan McCullagh <declan(a)well.com> >Subject: Cato Institute report on Clinton's sad constitutional record >Cc: >Bcc: >X-Attachments: > >In yesterday's mail I found a copy of a Cato Institute policy analysis by >Tim Lynch called "Dereliction of Duty: The Constitutional Record of >President Clinton." It's damming. Lynch lays bare Clinton's two-faced, >arrogant, downright hostile attitude towards civil liberties and, in a >word, freedom. > >Lynch concludes: "If constitutional report cards were handed out to >presidents, Bill Clinton would certainly receive an F--an appalling grade >for any president--let alone a former professor of constitutional law." >I've attached a few excerpts below. > >Also, in today's mail came a new book put out by Cato, "The Future of >Money in the Information Age," edited by James Dorn. I haven't read it >yet, but it looks promising. > >-Declan > >----------------------------- > >http://www.cato.org/pubs/pas/pa-271es.html > >DERELICTION OF DUTY >The Constitutional Record of President Clinton > >by Timothy Lynch > >Timothy Lynch is assistant director of the Cato >Institute's Center for Constitutional Studies. > >********* > >Executive Summary > >President Clinton recently put his hand on the Bible >and swore an oath to "preserve, protect and defend the >Constitution of the United States." He took the same >oath in January 1993. As the president embarks on his >second term in office, it is an appropriate time to >review his record thus far to see how well he has >defended our Constitution. > >Although President Clinton has expressed support for >an "expansive" view of the Constitution and the Bill >of Rights, he has actually weakened a number of >fundamental guarantees, including those of free speech >and the right to trial by jury and that against double >jeopardy. He has also supported retroactive taxes, gun >control, and warrantless searches and seizures. The >president's legal team is constantly pushing for >judicial rulings that will sanction expansions of >federal power. The Clinton White House has, for >example, supported the federalization of health care, >crime fighting, environmental protection, and >education. Clinton also claims constitutional >authority to order military attacks against other >countries whenever he deems it appropriate. President >Clinton's record is, in a word, deplorable. If >constitutional report cards were handed out to >presidents, he would receive an F. > >It is to be hoped that President Clinton will resolve >to be more conscientious about his constitutional >responsibilities in his second term. But should his >dereliction of duty continue, Congress and the Supreme >Court should stand fast against any constitutional >transgression. In the present climate, it is vitally >important for all Americans to understand that the >Constitution is incapable of enforcing itself. That >task ultimately rests with the citizenry. If the >American people demand adherence to the Constitution, >government officials, including President Clinton, >will respect the limitations that were wisely placed >on their power. > >********* > > >The Free Speech Clause > >The free speech clause of the First Amendment is, >without a doubt, the most famous provision of the >American Constitution. Its simple, yet profound, >command provides: "Congress shall pass no law . . . >abridging the freedom of speech." The underlying >principle of the free speech clause is that "each >person should decide for him or herself the ideas and >beliefs deserving of expression, consideration, and >adherence." [9] That principle has been recognized as >"one of the preeminent rights of Western democratic >theory, the touchstone of individual liberty." [10] >The invocation of the free speech guarantee, however, >is often controversial because it requires the >government and the citizenry to tolerate the speech >and writings of unpopular, crude, ignorant, and >malicious people. Civil libertarians must often remind >government officials (and others) that if the First >Amendment only protected the expression of popular and >agreeable ideas, it would be totally unnecessary since >those ideas would never be threatened by our >democratic form of government. Our society's >commitment to free speech is tested when we encounter >the expression of ideas that are disagreeable--or even >offensive. > >One would think that President Clinton, a former >professor of constitutional law, would have a deep >appreciation for the principle of freedom of speech, >but his official actions in office show just the >opposite. The Clinton Justice Department has attempted >to censor (a) the rights of peaceful protesters; (b) >the views of priests and doctors; (c) radio, >television, and the Internet; and (d) truthful >advertisements for lawful products. > >[...] > >The Ex Post Facto Clause > >The Framers of the Constitution detested the idea of >retroactive legislation. The Constitution contains two >specific prohibitions against ex post facto laws: >Article I, section 9, addresses Congress: "No . . . ex >post facto Law shall be passed." Article I, section >10, addresses state officials: "No State shall pass >any ex post facto Law." The Constitution contains no >exception to either prohibition. As Professor William >Winslow Crosskey of the University of Chicago once >observed, it is evident that ex post facto laws "were >thoroughly disapproved by the framers of the >Constitution and intended by them to be completely >impossible under our system." [44] > >Not only has President Clinton failed to defend the >prohibition of ex post facto laws; he encouraged the >103rd Congress to violate the prohibition. In the >summer of 1993 he urged Congress to levy a retroactive >tax on the American people. Under the president's >initial budget plan, income, corporate, gift, and >estate taxes were to be increased retroactively to >January 1, 1993--20 days before the president assumed >office. Never before in American history had a tax >been made retroactive to the time of a prior >administration. > >[...] > >The Warrant Clause > >The warrant clause of the Fourth Amendment, specifying >the conditions that must be met before officials may >search a person's home or seize papers and effects, >provides: "no [search] Warrants shall issue, but upon >probable cause, supported by Oath or affirmation, and >particularly describing the place to be searched, and >the person or things to be seized." The warrant clause >protects the citizenry from arbitrary searches by >requiring law enforcement personnel to obtain judicial >authorization before they demand entrance to any >person's home. The Supreme Court described the >constitutional importance of the warrant application >process in McDonald v. United States (1948). > >The presence of a search warrant serves a high >function. Absent some grave emergency, the Fourth >Amendment has interposed a magistrate between the >citizen and the police. This was done not to shield >criminals nor to make the home a safe haven for >illegal activities. It was done so that an objective >mind might weigh the need to invade that privacy in >order to enforce the law. The right of privacy was >deemed too precious to entrust to the discretion of >those whose job is the detection and the arrest of >criminals. Power is a heady thing; and history shows >that the police acting on their own cannot be trusted. >And so the Constitution requires a magistrate to pass >on the desires of the police before they violate the >privacy of the home. [50] > >The Clinton administration has repeatedly attempted to >play down the significance of the warrant clause. In >fact, President Clinton has asserted the power to >conduct warrantless searches, warrantless drug testing >of public school students, and warrantless >wiretapping. > >Warrantless "National Security" Searches > >The Clinton administration claims that it can bypass >the warrant clause for "national security" purposes. >In July 1994 Deputy Attorney General Jamie S. Gorelick >told the House Select Committee on Intelligence that >the president "has inherent authority to conduct >warrantless searches for foreign intelligence >purposes." [51] According to Gorelick, the president >(or his attorney general) need only satisfy himself >that an American is working in conjunction with a >foreign power before a search can take place. > >[...] > >Constitutional Federalism > >President Clinton is the first president in American >history to deny that the Constitution limits the >powers of the federal government. The Clinton White >House has sought to federalize health care, crime >fighting, environmental protection, and education. It >has also tried to thwart any effort to downsize >federal agencies and programs. Although the Washington >press corps has dutifully scrutinized the fledgling >efforts of the 104th Congress to breathe life into the >Tenth Amendment of the Constitution, which affirms >that the federal government has only limited powers, >the president's efforts to expand federal power have >received scant attention from a Tenth Amendment >perspective. By his official conduct as president, >Clinton has made it clear that he believes there is no >area of human activity that is beyond the >redistributive or regulatory reach of the federal >government and that the state governments essentially >operate at the sufferance of the national government. >Such a view contravenes the text, history, and >structure of our Constitution. > >[...] > >Conclusion > >As his first term of office drew to a close, Bill >Clinton proclaimed, "One of my highest goals as >President has been . . . to protect and uphold the >Constitution." [161] In light of the evidence set >forth in this study, it seems obvious that that >statement was simply a platitudinous throwaway line >that was completely devoid of substance. > >Supporters of the Clinton White House can point with >pride to a handful of presidential actions in defense >of constitutional rights--such as the signing of the >Religious Freedom Restoration Act and the Justice >Department's lawsuit against the Virginia Military >Institute on behalf of gender equality [162]--but >those acts were exceptions to the rule. Indeed, some >constitutionalists and civil liberties attorneys might >very well claim that this study does not go far enough >in its criticisms of the Clinton record. [163] >Although this study is not an exhaustive account of >every presidential action over the last four years, it >does present overwhelming evidence that Clinton has >been derelict in his duty to "protect and preserve" >our Constitution. If constitutional report cards were >handed out to presidents, Bill Clinton would certainly >receive an F--an appalling grade for any >president--let alone a former professor of >constitutional law. > >Perhaps Clinton will resolve to be more conscientious >about his constitutional responsibilities in his >second term. One can only hope that he will. But >should his dereliction of duty continue, Congress and >the Supreme Court should stand fast against any >constitutional transgression. > >All three branches of government--executive, >legislative, and judicial--should strive to be more >conscientious about meeting the responsibilities that >have been assigned to them under the Constitution. >Constitutional violations are frequently temporary, >isolated events. The most serious constitutional >violations occur when all three branches conspire to >expand the bounds of government power. When that >happens, it becomes very difficult to right the wrong. >Precedents are extremely important. That is why any >constitutional transgression by any branch is >alarming. > >The American people should jealously guard their >liberty and hold all government officials accountable >when they neglect or disregard the Constitution. Its >Framers were keenly aware that the ultimate source of >the Constitution's authority is the consent of the >people. If the American electorate demands adherence >to the Bill of Rights and the other provisions of our >Constitution, government officials will respect the >constitutional limitations on their power. But, as >Judge Learned Hand warned many years ago, "Liberty >lies in the hearts of men and women; [if] it dies >there, no constitution, no law, no court can save it." >[164] > >### > >

1 0

Wassenaar Arrangement and public domain software
by Declan McCullagh 17 Dec '03

17 Dec '03

The courier showed up, and I'm now at home changing in preparation for a soccer game (I'm part of a libertarian soccer team), but thought I'd post a brief note about the W.A. It says: "The Lists do not control 'software' which is either generally available to the public... or in the public domain." So what's the fuss about? Hmm.... -Declan

1 0

Re: Reactionaries
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Wed, 9 Apr 1997, Timothy C. May wrote: > At 5:55 PM -0400 4/9/97, Alec wrote: > > >At 01:32 PM 4/9/97 -0600, you wrote: > >|Timothy C. May wrote: > >| > >|> Let's not make the Cypherpunks firing squad a circle. > >| > >| Although Tim has been on the rag lately, perhaps this bit > >|of humor is a sign that his period (pardon the pun) of male > >|menopause is over. > > > >This sort of snide sexist humor has no place here. > > Agreed. Any neutral observer of the Cypherpunks list would have to conclude > there's a lot of _something_ going on here. Certain posters, whose names > are well known, seem infatuated with sexual innuendo. Assuming the source doesn't appear to *believe* that a particular group is inferior / superior by virtue of genitalia, race, etc.: if ($humour eq "distasteful") { cat $humour | in_one_ear | out_the_other; } get_on_with_life; > (And their innuendo is more often than not centered around homosexual themes.) > > Draw your own conclusions. "TruthMonger," for example, seems hung up on--no > pun intended--frequent repetitions of "bum buddies." Vulis is similarly > focussed on cocksuckers. Toto, who may or may not be Bubba Rom Dos, > TruthMonger, etc., based on style, is centered on many of these homosexual > themes. Just like pre-schoolers are hung up on bathroom jokes <grin>. Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

2 1

Japan E-Commerce Promotion Council on CAs
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Thu, 10 Apr 1997 11:44:59 -0700 From: jmuller(a)brobeck.com (John D. Muller) Subject: Japan E-Commerce Promotion Council on CAs To: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: jmuller(a)brobeck.com (John D. Muller) Press release Announcement of Certification Authority Guidelines in Japan ---------------------------------------------------------------------- -- Full Document 7th, April, 1997 Electronic Commerce Promotion Council of Japan ---------------------------------------------------------------------- -- 1. Background The Electronic Commerce Promotion Project partially funded by the Japanese government was started In late 1995 . The project consists of 19 test-bed projects which experimentally provide various kinds of electronic commerce between consumers and businesses. Currently over 350 companies participate in the projects and more than 500,000 consumers are presumed to have join. To foster Electronic Commerce(EC) in Japan, and also to support and coordinate these projects, the Electronic Commerce Promotion Council of Japan (ECOM) was established in early 1996. ECOM has set up 14 Working Groups to study a wide range of EC related issues. One of these Working Groups is the Certification Authority(CA) Working Group which focuses on the technology, practice, and legal environment of CA. One of objectives of this CA Working Group is to develop the CA Guidelines. The primary draft of the Guidelines was made public in the December 1996. 2. Objectives of the CA Guidelines CA Guidelines provide the foundation for the operation of CAs which issue digital certificates. A digital certificate, which electronically verifies the identity of business parties during network transactions, will play an important role in electronic commerce conducted via open networks. Digital certification guarantees the security of transaction information transmitted through networks, and information transmitted between organizations, within organizations and between individuals, by eliminating problems such as wiretapping, tampering or repudiation. This fosters the reliance and trust required to conduct business. 3. Structure of the CA Guidelines(Alpha Version) (1) Introduction This section first defines the basic terminology related to CAs, such as public keys, certificates, and revocation of certificates, etc. The section then deals with the following subjects concerning public key infrastructure, which can be regarded as the technological foundation of the guidelines: (1) certificate management service for issuance, publication, and storage of certificates, services relating to the registration and management of personal information, and electronic notary, etc. (2) hierarchical structure of CAs; (3) purpose of use and format of certificates. (2) Management requirements As management requirements are important for increasing the reliability of CAs, establishment and publication of policies relating to certification, requirements needed by organizations, operational security requirements, and information disclosure requirements are stipulated. Within the policy arena the establishment and presentation of provisions concerning the requirements for secure operation of equipment and facilities, and of provisions concerning standards for issuance of certificates are discussed. This section also stipulates that organizational requirements must specify independence, third party character and specialization. (3) Service requirements This section specifies requirements for guaranteeing security relating to five services that constitute the certificate management service, which is the basic service of CAs: management of the keys of CAs, issuance of certificates, registration and publicizing of certificates, storage and management of certificates, and revocation of certificates. For example, in view of the serious consequences of leakage or theft, private keys of CAs must be stored in an independent special module with high storage capacity, and in an environment that does not allow illegal removal of the storage module. Auditing of certificate issuance are also discussed. The personal verification of the applicant must be divided into three levels and that personal verifications should be conducted according to these levels. (4) Facilities and system requirements This section specifies that requirements conform to measures classified under group A of the "Information Systems Security Measures Standards," which were announced by MITI in August 1995 and the instruction manual was published by the Information Service Industry Association in October 1996. Group A requirements relate to information systems that affect people's lives, the property of others, privacy and other social elements. 4. Forthcoming Schedule ECOM is requesting that member companies and other relevant parties offer their comments regarding this guidelines draft. At the same time, the guidelines will be applied to the electronic commerce test-bed projects sponsored by MITI ( Ministry of International Trade & Industry), with the results of these test operations to be incorporated in the guidelines. The final version, based on opinions obtained from various sectors, is scheduled to be prepared and announced by March 1998. More information E-mail: tawara(a)ecom.or.jp FAX : +81-3-5531-0068 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

Re: Checkout the crypto in IE 4.0
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>Maybe people have already noticed but the pre-release IE 4.0 has >S/MIME encryption and signatures built in. I'm trying to set it up >as we speak. Just found an even more important cypherpunk feature. It has a kill file feature for both news and mail. Now if we could just get them to put Dimitri in as the default it would be fine. Phill

1 0

security_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Digital TV Sets Off High-Definition Race Next Story: NTT Data, MCI To Start Internet Roaming Service _________________________________________________________________ Thursday April 10 10:03 AM EDT Internet Security Code Said Vulnerable To Hackers By David Morgan ATLANTA - The new security protocol for safeguarding credit-card transactions on the Internet may have to change because the underlying cryptography is too easy to hack through and too difficult to upgrade, an expert says. Steve Mott, senior vice president of electronic commerce and new ventures for MasterCard International, said it could take hackers as little as a year to break the industry's standard encryption code, which is supposed to render credit-card numbers unreadable to outsiders on the Internet's World Wide Web. For that reason, the consortium of technology companies and creditors that has spent two years developing the Secure Electronic Transaction (SET) protocol may switch to a faster encryption system called Elliptic Curve, which is produced by Certicom Corp. The first complete version of SET, known as SET 1.0, will be available to software makers June 1 with core cryptography provided by RSA Data Security, a unit of Security Dynamics Technologies. "RSA is a very good starting point. But we suspect that in a year or two, the Kevin Mitnicks of the world will start to figure out ways to hack it," Mott said. Mitnick is one of the most notorious computer hackers. "The only way you scale an RSA is to add a lot more bits. You add a lot more bits and it becomes more complex software in terms of the interaction of the transaction messages. That's part of what's taken SET so long to start with." MasterCard has been helping put together merchants with its own member banks for SET pilot projects in Denmark, Japan, Taiwan, South Africa and the United States. Mott told a news conference at the Internet Commerce Expo that the Elliptic Curve encryption system would make a better encryption core. In fact, he said it would have been chosen in the first place if developers had been known about it. "It will fit on a chip card. I think its 160 bits equals security to 1,024 bits of RSA," the credit industry executive said. "We anticipate putting it into some SET 1.0 pilots in the very near future this year in the U.S." Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Digital TV Sets Off High-Definition Race Next Story: NTT Data, MCI To Start Internet Roaming Service _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

EVENT! Rep. Anna Eshoo (D-CA) holds online town hall meeting April 16!
by Shabbir Safdar 17 Dec '03

17 Dec '03

========================================================================= _ _ __| | ___ _ __ ___ ___ ___ _ __ __ _ ___ _ _ _ __ ___| |_ / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __| | (_| | __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | | __/ |_ \__,_|\___|_| |_| |_|\___/ \___|_| \__,_|\___|\__, (_)_| |_|\___|\__| |___/ "Government Without Walls" _________________________________________________________________________ Update No.5 http://www.democracy.net/ April 10 1997 _________________________________________________________________________ Table of Contents - Join Silicon Valley Internet Policy Leader Anna Eshoo (D-CA) Live April 16. - Background on Rep. Eshoo - democracy.net statistics - About democracy.net ___________________________________________________________________________ JOIN SILICON VALLEY INTERNET POLICY LEADER ANNA ESHOO (D-CA) Live ONLINE! Representative Anna Eshoo (D-CA), walks point for Silicon Valley on Internet policy issues. Her career has been marked by outspoken positive positions on Internet policy, but also for her groundbreaking work of making the Internet a tool for servicing her constituents better. Rep. Eshoo will hold a live online interactive 'town hall meeting' at democracy.net on Wednesday April 16 at 8:30 pm Eastern (5:30 pm Pacific). The town hall meeting, moderated by Wired Magazine's Todd Lappin, will be completely virtual. The discussion will be cybercast live via RealAudio, and listeners can join a simultaneous interactive chat discussion and pose questions to Rep. Eshoo. This is a unique opportunity for Internet users to discuss current Internet issues, including how Congress can better communicate with the public using the Internet, the chances for online speech legislation in the 105th Congress, Congress' agenda for encryption policy reform, and others. Details on the event, including instructions on how you can submit questions in advance, are attached below. ____________________________________________________________________________ INSTRUCTIONS ON HOW TO PARTICIPATE * Interactive Town Hall Meeting with Rep. Anna Eshoo (D-CA) * DATE: Wednesday, April 16, 1997 TIME: 5:30 pm Pacific / 8:30 pm Eastern LOCATION: http://www.democracy.net In advance of the town hall meeting, please visit http://www.democracy.net and fill out the form to ask Rep. Eshoo a question. We will collect the questions and forward them to the moderator on the day of the event, and will make every effort to ensure that questions from constituents are asked first. 1. Attend and ask Rep. Eshoo a question! Please mark this date in your calendar: Thursday April 16, 5:30PM Pacific at http://democracy.net/ 2. Get your friends and co-workers to join the discussion Members of Congress love to hear from their constituents. If you have friends that live in the district, please forward this invitation and encourage them to attend. 3. Make sure you have the right software To participate in the chat, you will need two pieces of software besides a Web browser. To listen to the _____________________________________________________________________________ BACKGROUND "We need to send a clear, unscrambled message to Washington that our nation's encryption policy needs to be reformed, and reformed now." -- Rep. Anna Eshoo (D-CA), SAFE Forum, July 1, 1996 Given the 14th District's concentration of high-tech industries, it is not surprising that Rep. Eshoo serves on the House Committee on Commerce. Her subcommittee assignments on this committee include the Subcommittee on Telecommunications, Trade, and Consumer Protection, as well as the Subcommittee on Health and the Environment. The Commerce Committee has policy making power over high technology, biotechnology, public health, and the environment. Through her seat on the Commerce Committee, Rep. Eshoo is well positioned to assist high technology interests in her district. She fought hard to ensure that securities litigation reform and telecommunications reform were signed into law. Rep. Eshoo has introduced the Online Parental Control Act to fight government censorship and encourage parents to use technology to control their children's access to online materials. She has led the fight to improve the Food and Drug Administration's product review process and played an instrumental role in securing the $238 million B Factory for the Stanford Linear Accelerator Center. In addition, Rep. Eshoo has pushed to loosen costly export controls on high technology products, make NASA contractors more liable for the costs of failing to comply with their contract requirements, and prevent government laboratories from competing with private industry. She also played a key role in stopping the Financial Accounting Standards Board from adopting a rule requiring businesses to charge stock options against earnings, a move which could have seriously curtailed the growth of small firms and start-up businesses, particularly in the high technology industry. Additional Information can be found at the following locations: * Rep. Anna Eshoo's Home Page -- http://www-eshoo.house.gov/ * democracy.net Page -- http://www.democracy.net/ _______________________________________________________________________________ DEMOCRACY.NET STATISTICS In the two weeks following the original Pro-CODE cybercast hearing, over eight times as many people (804) listened to the RealAudio archive than could have fit into the room at the hearing itself! The hearing transcript continues to be extremely popular, with the testimony of Jim Barksdale (CEO, Netscape) and Louis Freeh (Director, FBI) counting as the two most popular hearing witnesses to listen to. Over a quarter of our visitors to the hearing archives stop to listen to Barksdale and Freeh's takes on the encryption debate. Whether you're a concerned citizen who can't get to Washington, a student researching the topic of privacy, or a reporter just following the debate, these archives are here for you. You can experience Government Without Walls at the March 19th hearing cybercast archive at http://www.democracy.net/. _______________________________________________________________________________ ABOUT DEMOCRACY.NET The democracy.net is a joint project of the Center for Democracy and Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore ways of enhancing citizen participation in the democratic process via the Internet. To this end, democracy.net will host live, interactive cybercasts of Congressional Hearings and online town hall meetings with key policy makers. democracy.net is made possible through the generous support of WebActive, Public Access Networks, the Democracy Network, and DIGEX Internet. More information about the project and its sponsors can be found at http://www.democracy.net/about/ To receive democracy.net announcements automatically, please visit our signup form at http://www.democracy.net/ _____________________________________________________________________________ End update no.5 04/10/1997 =============================================================================

1 0

Re: store your private ke
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:bryce@digicash.com to Harka <=- In> The non-cpunks that I talk to frequently say that "no bad guys In> would bother to read my e-mail". This is a pretty good assumption, In> because it takes into account (as the cpunks themselves frequently In> fail to do) that there is a _cost_ to illicitly reading e-mail, and In> that as long as the value of reading your private e-mail is less than In> the cost of reading it, you can consider yourself safe. Another point, that most PGP-"uninitiated" (challenged? :)) people fail to realize is the non-individual-based approach to e-mail snooping. Commonly people think, that first they have to be specifically targeted by a "bad guy". But in the times of Echelon and generic key-word-based filtering of _all_ e-mails, that go through certain points (Satellite-Links etc.), nobody has to be specifically targeted anymore, because _everybody's_ e-mail is potentially read. All other things you mentioned are of course valid too besides that. Ciao Harka ... Microsoft - "Where do you want to crash today?" ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM02gpjltEBIEF0MBAQFy4wf/QIx7s1iRBDIW7VXYFWN6T5xlO2stm7QI +Cl8dz7ZL24nMazVUA+I0GqJjpjEOY7bK5oZwbELTaaD6g6unjoZLb6n5/fiXeaN Dd7LdJ989oqmUxO2fm6F/81OqPIGHQl5UwqOj0hII4AndaIwMJB/kSENXXJXXupI 7G/HWWddSnCzeuTfAzYBUeo1cpAgsBP7zTqyQsVUtoGVhgwbRsdUBX1kqcR7cEsv SX+TZZJZAs9AxTlIoQBuP4hb5/aEZnahb8myomKVY9XbMLBRdFzw6YlF2u/hHyit OqMzn12QVKkflxbMQWj3qCLARuT2wKEg6TeHUFAReSgIV1YSNV2Xsw== =Au+6 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0