December 2003 - cypherpunks-legacy

YOUR LISTING ON YAHOO!
by brian＠firstgear.com 17 Dec '03

17 Dec '03

engines, it is becoming more and more difficult to be found among the MILLIONS of listings. If you"re like the rest of us you have found it extremely frustrating. You spend lots of time and money developing your site and then you're listed number 30, or 80, or even 200th. You're NEVER FOUND. *************************** GOOD NEWS The good news is we have found a SOLUTION. After months of fighting the search engine battle we got LUCKY. A programmer recently became associated with our firm who had done some CONSULTING WORK for six months with one of the major search engines. With his help we developed a REPORT on the major search engines and how they really work. ***************************** REPORT His report is excellent. We have been using the material in the report for over five months. IT WORKS! With it, our sites are in the top TEN listings on all major search engines and we have experienced a virtual stampede of people to the web sites. HITS ARE UP, SALES ARE UP, and most importantly, everyone is HAPPY. *************************** YOUR COPY Now, YOU CAN HAVE A COPY of his report. In it you will find: How to vault in the TOP TEN on any search engine using any keyword. Strategies that put you ahead of 95% of the other sites online. How to STAY in that TOP TEN. How to improve your chances of being found in about 10 MINUTES. How the search engines calculate CONFIDENCE ratings (and what that means to you). Killer META TAGS that totally blow away your competitors. Which search engines are the very BEST FOR YOU. How to get your site REGISTERED for FREE at over 200 locations, in one easy step (it takes 10 minutes). How to BLOCK out part of your site from the search engines (and why you should do it). The effect of REPEATING KEY WORDS. (good or bad?) What happens when you repeat them too many times? LATEST FORMS for developing the best meta tags. Meta Tag strategies that can broaden your audience and build high volume web traffic for you. We tell you exactly what to do and show you SPECIFIC EXAMPLES. And it's SIMPLE and EASY to understand. So you can put the principles to immediate use. The benefits of site UPDATING. How often? What NOT to do! Avoid making those errors which can cost you. and even How to legally "steal" your competitor's web traffic and send it to your site. Type in your competitor's name and YOUR NAME will appear FIRST! *************************** WHAT DOES IT COST? The material is only $15, and is unconditionally guaranteed to work for you. Just follow the instructions and you will find your site in the top ten too. Ordering is SAFE and EASY. For more information, or to RECEIVE this 18 page report by email just go to our INSTANT-DELIVERY SECURE order form at: http://www.lr-publishing.com/SES2/ (Order on line and you will receive your report in JUST 60 SECONDS.) Now that your site is up shouldn't you take this MOST IMPORTANT LAST STEP so people can find it. ****************************** UNCONDITIONAL GUARANTEE Remember, we UNCONDITIONALLY GUARANTEE IT WORKS. You can't lose. ******************************** SPECIAL FREE BONUS Order within 48 hours, we and will include, AS A FREE BONUS, information on over 500 SEARCH ENGINES and directories where you can list your site for free. (Some are very specialized and targeted). SPECIAL NOTE: If you are busy and don't have time to go to our web site INSTANT-DELIVERY SECURE ORDER FORM, you can order by FAX. (The unconditional guarantee still applies!) Just fill in the FAX FORM AT THE BOTTOM OF THIS PAGE. Then FAX it to us at: 1-305-289-1884 If you order by FAX your copy of the report will be sent to you by email within 24 hrs. Or, if you prefer, you can send your order with a CHECK by snail mail to the address below. (Be sure to include your email address for delivery.) Whichever method you choose to order, YOU'LL BE GLAD YOU DID! Best of luck with your web site! Leeds Publishing 5800 Overseas Hwy., St. 35-154 Marathon Key, Fl. 33050 Fax 305-289-1884 http://www.lr-publishing.com/SES2/ ________________________________________________________________________ ________________________________________________________________________ FAX ORDER FORM (Please print clearly) FAX TO: Leeds Publishing FAX NUMBER: 1-305-289-1884 Hi: Here is my order for Search Engine Secrets at $15 only. I understand it is unconditionally guaranteed. Include my FREE BONUS of 500 search engines. Send by email ASAP. Date:__________________ NAME:_______________________________________________ E-MAIL ADDRESS:______________________________________________________________ (PLEASE be accurate. One small error and we can't send your order). CARD TYPE:_________________ CARD NUMBER:_________________________________________________ EXPIRATION DATE:______________ NAME ON CARD:________________________________________________ Thanks for ordering. Your copy of the report will be sent to you by email ASAP. ____________________________________________________________ ____________________________________________________________ Copyright 1997 Leeds and Rousseau Publishing. All rights reserved. Form 10-16 GD-Yahoo

1 0

Cypherpunks Related (?) or merely about DC in general?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Q. How did Sir Alexander Fleming change Spain's bullfighting? A. Before he invented penicillin, countless toreros died of infected wounds. After, even the smallest arenas were equipped with penicillin syringes. And the performances became much more exhilarating. Said one cape artist: "Now I can stand closer to the bull." http://www.LMBoyd.com/postscript.htm

1 0

I am a homosexual!@#$!@#@!!
by Bronc Buster 17 Dec '03

17 Dec '03

Hi, my name is Bronc Buster and you all know me. but what you donot know is that I AM A HOMOFAGGOT who likes lil' boys cocks and stuff. you all have to email me here cuz some body email bombed my other adress and then my new one. i also want to see pics of your cocks but please wtrie my name on your dick before you mail them to me so i know You love me. off to spank my small monkey, Bronc Buster ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

French GAK
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Wall Street Journal, October 20, 1997: French Proposal For Encryption Is Worrying EC By Jennifer L. Schenker A proposed French law ensuring government access to corporate electronic communications is setting off alarm bells in the business community and on the European Commission. France, presenting the law as a liberalization of its current policy, is the only Western country that bans any domestic use of cryptography - technology that encodes data for protection against prying eyes. France also places strict controls on the export of encryption tools, a restriction imposed by certain other countries, including the U.S. The new rules, submitted to the European Commission on Thursday, allow businesses operating in France to encode their corporate secrets but require that keys to unlock the code be given to a French government-approved entity in which the majority of the capital or votes is retained by French nationals. Microsoft Corp., Netscape Communications Corp. and the Business Software Association have raised objections to the French proposal. The BSA represents major international software publishers and high-tech companies, including Novell Inc., Compaq Computer Corp., Apple Computer Inc. and Lotus, a unit of International Business Machines Corp. The proposal also requires companies selling products with embedded encryption software in France to reveal "source code" - the rough equivalent of asking Coke to reveal its secret formula. Some believe that such a key-recovery system would make it easier for competitors to gain access to a company's secrets. The BSA's European chapter is expected to release a public statement this week supporting the European Commission's decision earlier this month to reject the key-recovery approach to encryption, which is championed by both the U.S. and France. The commission, which will formally comment on the French proposal by month's end, is concerned partly because the French ownership requirements may violate internal market rules. "I do not say this is the best system. It is the least bad in trying to find a balance between national-security interests, economic interests and the protection of personal privacy," said Gen. Jean-Louis Desvegnes, chief of France's Central Service for the Security of Information Systems, a civilian agency that reports directly to the French prime minister's office. He indicated that France might be flexible on the ownership requirements. -----

1 0

everybody wants a piece of Microsoft's monopoly
by Zooko Journeyman 17 Dec '03

17 Dec '03

If you thought Microsoft and Bill Gates were bad for the evolution of our precious technology, you'll _love_ the new "Guvsoft", lead by everyone's favorite businesswoman Janet Reno. The race to see who can play "Little Mister Gates" best and earn a cut of the action is accelerating. Pundits are already taking bets on Scott "Now Selling Licenses For 100% Pure Anything-Non-Microsoft" McNealy, Steve "Competition Is Great As Long It Doesn't Actually Affect Us" Jobs, and Janet "I've Already Demonstrated My Grasp Of Tactics And Tact" Reno. I mean, _sure_ Microsoft is an oppressive monopoly, but then what the hell is the USG? Zooko

3 2

Re: EC refutes GAK
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

[I originally posted this to the c2.net crypto list but apparently it never appeared, I've reposted it here in case anyone finds it useful] >The report also notes a new (to me, anyway) method of bypassing GAK while >maintaining full compliance with the law: > >"Users could encrypt a relatively large number of session keys in a way that >the previous key encrypts the next one, always using one or several official >escrow/recovery systems. Only the last key would be used to encrypt the >message. There's another way to foil GAK which I don't think has been mentioned before, using what is often referred to as "malicious obedience" in the military (or "you asked for it, you got it" elsewhere): Since I don't trust any cryptosystem based on mathematical principles, I encrypt all my communications using a one-time pad communicated on CDROM (700+MB if you push it). To limit the exposure of each pad, I change it once a month at a cost of ~$1 per CDR blank. If I communicate with around 100 people that's 100 x 12 x 700+MB or (rounding things up a bit) a terabyte of keying material a year. Since they use their own pads to communicate back to me, anyone wanting to intercept a years worth of traffic to/from me would need to archive 100 terabytes of keying material (I'd make sure I spread out the bits of pad I used so they couldn't just keep the useful bits and discard the rest). In any case since this will only be used for court-authorised intercepts (just keep repeating that until you believe it), everything would have to be archived without any changes so it could be used as evidence. At a cost of $100/month in CDR's this should comply with any GAK law (instant access to keys, etc), but will also do a reasonable job of overwhelming any centralised repository charged with storing the data. Of course since I don't trust the government any more than I trust those nasty cryptosystems based on mathematical principles, I'd use triple DES underneath the OTP just to be sure. Peter.

2 1

everybody wants a piece of Microsoft's monopoly
by Brandon Crosby 17 Dec '03

17 Dec '03

> > If you thought Microsoft and Bill Gates were bad for the > evolution of our precious technology, you'll _love_ the > new "Guvsoft", lead by everyone's favorite businesswoman > Janet Reno. > > > The race to see who can play "Little Mister Gates" best > and earn a cut of the action is accelerating. Pundits > are already taking bets on Scott "Now Selling Licenses > For 100% Pure Anything-Non-Microsoft" McNealy, Steve > "Competition Is Great As Long It Doesn't Actually Affect Us" > Jobs, and Janet "I've Already Demonstrated My Grasp Of Tactics > And Tact" Reno. > > > > I mean, _sure_ Microsoft is an oppressive monopoly, but then > what the hell is the USG? > > The Dept of Justice pulled an Antitrust on Microsoft (sourced, the morning news)... $1 mil/day fine. Based on Internet Explorer. -Brandon Crosby

1 0

tell me more...
by adri 17 Dec '03

17 Dec '03

Hi! I just loved +The Plot, Thickening;, it4s great! I4m from Portugal and I4m very concerned about these kind of problems nowadays. I think we4re coming to state of apocalyptic brainstorm, I think it4s also simtomatic. Please send news because I became curious about cyberstuff. Email me to adrimacedo(a)rocketmail.com Thank you.

1 0

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule U.S. SAID VULNERABLE TO COMPUTER ATTACK cyberwarfare October 21, 1997 Web posted at: 5:02 a.m. EDT (0902 GMT) WASHINGTON (AP) -- A report concluding the nation is vulnerable to electronic warfare was delivered to the White House Monday by a presidential commission. The classified findings and recommendations of the Commission on Critical Infrastructure Protection say the danger of computer attacks that could shut down communications and power grids is real and requires early action. "Today, the right command sent over the Internet to a power generating station's control computer could be just as effective as a backpack full of explosives and the perpetrator would be harder to identify and apprehend," the panel wrote in its executive summary to the report. The report recommends stepping up research and establishing a nationwide program to educate people on the scope of the problem. It also recommends revising existing laws to ensure protection against electronic attacks through the Internet. "Law has failed to keep pace with technology. Some laws capable of promoting assurance are not as clear or effective as they could be," the panel wrote. Because revamping laws would be a "lengthy and massive undertaking," the commission offered several suggestions to jump-start the process. "We identified existing laws that could help the government take the lead and serve as a model of standards and practices for the private sector," it wrote. "We identified other areas of law that can enable infrastructure owners and operators to take precautions proportionate to the threat." P.J. Crowley, a White House spokesman, said a task force composed of representatives from several government agencies will review the report and come up with recommendations, which is likely to take the rest of the year. In addition, an advisory committee headed by former Sen. Sam Nunn, D-Ga., and former Deputy Attorney General Jamie Gorelick will work with the private sector on ways to protect against cyber attacks. At a conference on computer security two weeks ago, commission Chairman Robert T. Marsh said the ability to do serious harm over the Internet is real. "While a catastrophic cyber attack has not occurred, we have enough isolated incidents to know that the potential for disaster is real and the time to act is now," he said. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related stories: * Threat of 'techno' terrorism being explored - March 18, 1997 * Military sees high-tech future - March 8, 1997 Related sites: Note: Pages will open in a new browser window * Argonne National Laboratory Decision and Information Sciences - Presidential Commission on Critical Infrastructure Protection Survey Form * Naval Research Laboratory Information Technology Division - Clinton creates Commission on Critical Infrastructure Protection * U.S. Business Advisor - Survey -- Presidential Commission on Critical Infrastructure Protection * The Whitehouse - Executive order on Critical Infrastructure Protection External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Dark is faster than Light
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Bell Labs Proves Existence of Dark Suckers For years it has been believed that electric bulbs emitted light. However, recent information from Bell Labs has proven otherwise. Electric bulbs don't emit light, they suck dark. Thus they now call these bulbs dark suckers. The dark sucker theory, according to a Bell Labs spokesperson, proves the existence of dark, that dark has mass heavier than that of light, and that dark is faster than light. The basis of the dark sucker theory is that electric bulbs suck dark. Take for example, the dark suckers in the room where you are. There is less dark right next to them than there is elsewhere. The larger the dark sucker, the greater its capacity to suck dark. Dark suckers in a parking lot have a much greater capacity than the ones in this room. As with all things, dark suckers don't last forever. Once they are full of dark, they can no longer suck. This is proven by the black spot on a full dark sucker. A candle is a primitive dark sucker. A new candle has a white wick. You will notice that after the first use, the wick turns black, representing all the dark which has been sucked into it. If you hold a pencil next to the wick of an operating candle, the tip will turn black because it got in the path of the dark flowing into the candle. Unfortunately, these primitive dark suckers have a very limited range. There are also portable dark suckers. The bulbs in these can't handle all of the dark by themselves, and must be aided by a dark storage unit. When the dark storage unit is full, it must be either emptied or replaced before the portable dark sucker can operate again. Dark has mass. When dark goes into a dark sucker, friction from this mass generates heat. Thus it is not wise to touch an operating dark sucker. Candles present a special problem, as the dark must travel in the solid wick instead of through glass. This generates a great amount of heat. Thus it can be very dangerous to touch an operating candle. Dark is also heavier than light. If you swim deeper and deeper, you notice it gets slowly darker and darker. When you reach a depth of approximately fifty feet, you are in total darkness. This is because the heavier dark sinks to the bottom of the lake and the lighter light floats to the top. The immense power of dark can be utilized to mans advantage. We can collect the dark that has settled to the bottom of lakes and push it through turbines, which generate electricity and help push it to the ocean where it may be safely stored. Prior to turbines, it was much more difficult to get dark from the rivers and lakes to the ocean. The Indians recognized this problem, and tried to solve it. When on a river in a canoe travelling in the same direction as the flow of the dark, they paddled slowly, so as not to stop the flow of dark, but when they traveled against the flow of dark, they paddled quickly so as to help push the dark along its way. Finally, we must prove that dark is faster than light. If you were to stand in an illuminated room in front of a closed, dark closet, then slowly open the closet door, you would see the light slowly enter the closet, but since the dark is so fast, you would not be able to see the dark leave the closet. In conclusion, Bell Labs stated that dark suckers make all our lives much easier. So the next time you look at an electric bulb remember that it is indeed a dark sucker.

1 0

PGP, CMR, and OpenPGP
by Fisher Mark 17 Dec '03

17 Dec '03

As a Corporate Security Officer, I personally would prefer a solution like Adam Back's CDR that leaves the copy of the corporate data on the user's hard drive to the current PGP CMR. As long as the email data didn't need to be encrypted during local storage (i.e. encrypted against the possibility of industrial espionage), I wouldn't care whether the copy of the corporate data was encrypted -- actually it would be a lot easier to leave it in plain text (as I think Tim May suggested). (A single file in Unix mail(1) file format would make a nice auditing/reporting tool, so you could remember what you had sent to whom all in one place.) Corporate keys as in PGP CMR just means another key to manage that provides a single point of weakness in the company's security architecture. Without forcing everyone to run on a secure OS on hardware they can't directly access (i.e. no desktop computers), any additional security provided by a CMR system (as in providing unalterable records of encrypted email that was sent) can be easily bypassed. OpenPGP, meanwhile, should work on non-GAK/CAK solutions, while PGP Inc. should come up with a new product name (like 'BizSecure' only less whimsical) for its line of corporate encryption programs. (It might even be better business for PGP to set up a wholly-owned subsidiary, whose name does not even incorporate the term 'PGP' or its derivatives, for marketing such products, as those products would not be tainted by personal privacy reputation of the name 'PGP'.) 'BizSecure' and its kindred would then interoperate with OpenPGP standards only to the extent of the common non-GAK/CAK functionality of the two systems. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

2 1

Re: Remailers and ecash (fwd)
by Fisher Mark 17 Dec '03

17 Dec '03

Picking up a thread of a few weeks ago (sometimes life intervenes)... What I propose is: employee -> encryptor -> email -> remailer -> delivermail -> recipient -> decrypt which forces the opponent to both monitor traffic much more closely (to get around the traffic analysis-resistance of remailers) and to decrypt the actual messages. The point being to force the opponent to employ other, less safe (more chance of discovery) techniques, like bribing your employees or sending in agents as employees of the cleaning company, etc., etc. This use of remailers I think could be worth money to corporations. Unless you are a truly huge corporation, you are not going to be in a position to set up private email links with everyone you need a private email link to. Using the Internet, while deploying security measures appropriate to the application, is just too cost-effective. My proposal is just that using encryption and remailers together gives you more security than either technique will alone, perhaps enough that commercial remailers could flourish. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Re: GAK "service" charges (Re: EC refutes GAK)
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> writes: >Peter Gutmann <pgut001(a)cs.auckland.ac.nz> writes: >>[multiple terabyte CDrom based keying material] >Reckon they'll twig, and charge you per megabyte to offer you the "service" >of allowing them to "recover" your communications in real time. Yes, but how will they phrase the requirements? A CD is a single key (in fact 1,000 CD's are all part of a single key)... this leads to the same problem I heard of here a few years ago w.r.t. outlawing gangs: "It would be impossible to word any comprehensive anti-gang legislation in a manner which didn't also outlaw the police". The same goes for certain aspects of escrowing, any escrow rules which are in any way practical and useable will also be open to all sorts of creative interpretation ("You must deposit a copy of your encryption key with the government" -> "Here's the key. Where can I park the forklift that moves the container of CD's?"). Peter.

2 1

Re: SMTP Encryption Exten
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:ericm@lne.com to Harka <=- In> If your mail goes to an intermediate MX site, it'll sit in the In> clear on the disk there until its sent to its final In> destination. Even if all mailers supported ssmtp, the mail In> would not be secure. True, but an encrypted tunnel to fetch your e-mail will at least render wiretaps on your phone-line useless. While that doesn't really matter if all your e-mail is PGP-encrypted, the truth is that a lot of e-mail is still in the clear. That at least would be protected to a degree... Btw., does anybody know if there's an crypto-enhanced direct-dial-up program such as minicom out there? Ciao Harka ... "Use a Cipher - Be Free!" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBNE0TyjltEBIEF0MBAQEsawf/SyzCJ5vHC9gvn9aX4Efuxt9rNe6UqXoh 78ZpKba5X0QvkvPyG+4TAopLZUXL5Qjs5TKQmEhBcCnw4+bHv36T4nzaDPNKsD39 RFtCddWgpF1pIUQ7GIdY/mMTh5UGMibXgqU9Z1kZKP0j8pJJPn4aK1uSas+Yne69 /OdDX3PBBgbw66DxOqjdE6+pC0v5LS1janXUuEMXo8nV1MfpBnStI9ORAcyNeCtu H8KlnQcLwUhuEnTn/VeEwRZJIFPf3hUFcuxVdcooHgqDbY9d+zbSsFiqVE3EyMji bSiBTMK9N/jQ7VFllhkqLihJbA/Q27KP4M6hV4NMqDdh3Sfv6Bd7iw== =jbpL -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Bill Gates, the Bully Savior, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

***************** http://cgi.pathfinder.com/netly/opinion/0,1042,1517,00.html The Netly News Network (http://netlynews.com/) October 21, 1997 Bill Gates, the Bully Savior by Declan McCullagh (declan(a)well.com) When the Justice Department yesterday accused Microsoft of using its operating system near-monopoly to violate the law, the government did more than attack the world's largest software company. It also handed Microsoft's chief competitor, Netscape, a major business -- and political -- victory. Netscape has long been urging the Clinton administration to rein in Bill Gates. For years its lobbyists have bent the ears of powerful Washington policymakers. And, unlike many other Silicon Valley chiefs, Netscape's Jim Barksdale -- a veteran of such highly regulated companies as Federal Express and McCaw Cellular -- appears to truly understand how Washington works. So was Janet Reno motivated by politics, or law? "Fundamentally, I think it's a legal issue," says Ed Black, president of the Computer and Communications Industry Association. "But to say whenever the wealthiest man in America and one of the most powerful companies in America is challenged by a cabinet official, you can't say there's no political impact. You're in a political world at that level." When asked to name the most pressing issues Netscape faces in Washington, company lobbyists rattle off a long list of topics from encryption to copyright and education. But antitrust has always topped the list. This, after all, is the company's primary policy goal: to stop what it considers to be Microsoft's predatory practices. "This is not a Netscape-Microsoft issue," says Netscape's public policy counsel Peter Harter. "This is not a browser war. This is about obeying the law." Perhaps. But clearly Netscape has been complaining to the government about Internet Explorer since the Microsoft browser first hit the Net. Naturally, the company cheered Janet Reno's suggestion that Microsoft be punished with a fine of up to $1 million a day. "We're very supportive of the actions the Department of Justice has taken," Roberta Katz, Netscape's chief counsel, told the Netly News last night. "This lawsuit is about preserving competition as we move to the era of digital commerce." It is, of course, also an efficient way for Netscape to protect its commanding share of the browser market. "Bill Gates is a successful rival who makes it difficult for others to do business. Rather than compete against him head to head in the market, competitors turn to antitrust laws," says Don Boudreaux, a professor of law and economics at Clemson University. "What people at Netscape probably don't like is the fact that Internet Explorer is a good product." Netscape has slowly been emerging as the grand marshal in the Everyone But Microsoft parade. Last year Netscape hired the heavyweight Silicon Valley law firm of Wilson, Sonsini, Goodrich & Rosati, whose partner Gary Reback is a veteran anti-Microsoft campaigner. In November 1994 Reback prepared -- after a request from the Department of Justice, which was investigating Microsoft -- a 100-page white paper on behalf of three anonymous high tech clients. The theme: Microsoft's apparent anticompetitive behavior. [...] ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

CDR design document
by Adam Back 17 Dec '03

17 Dec '03

Here is a proposal for consideration for inclusion in the OpenPGP standard: http://www.dcs.ex.ac.uk/~aba/cdr/ (Also attached text version below [1]) It describes a mechanism for commercial data recovery which attempts to minimise the security risks inherent in allowing disaster recovery of stored encrypted documents. The CDR design also avoids the security risks in building systems which send recovery information over open communications networks, as the CMR proposal currently does. The CDR design offers the option of more ergonomic recovery from forgotten passphrase. CDR allows for more secure use to be made of the existing pgp5.0 key expiry functionality when applied to communications-only keys because they can be deleted with out loss of data-availability, providing a form of PFS which is backwards compatible with pgp5.0 and pgp5.5 clients. Comments? The only change addition to the standard required is to create a distinction between a storage only key and a communications only key. This distinction could be made via the use of an extra flag, ideally so that keyrings can remain standardised and interchangeable between different implementations. The document can also be viewed as a recommendation to implementors of how to avoid security risks (and related government abuse risks) in implementing data recovery systems. I would like to see the OpenPGP standard accomodate both the CMR and CDR design so that each can fly on it's technical merits. (And political merits, cryptography being a highly political field, a politically unpopular design may suffer for other than technical reasons). Adam [1] http://www.dcs.ex.ac.uk/~aba/cdr/ ==============================8<============================== Commercial Data Recovery This document describes a mechanism, Commercial Data Recovery (CDR), to allow companies to recover stored encrypted information as part of a disaster recovery plan. Introduction This document is centered around the OpenPGP standard, and therefore explores first what is possible within the existing standard. Several of the CDR variants presented can be achieved entirely within the pgp5.0 standard without adding any new functionality. Commercial disaster recovery requirement PGP is commonly used for two purposes: file encryption, and encryption of email communications. The situation arises in a commercial setting that individuals are protecting information which the company would like to be able to recover in the event of disaster: in the event of the user forgetting his passphrase, or in the event of the unexpected death of the employee. Stored files which the company may require the ability to recover include encrypted files stored in the files system, on backup tapes, or on floppy disks; and encrypted sent and recieved emails stored in mail client folders. Security vs Availability There is a security risk in adding data recovery mechanisms: the additional risk that recovery procedure is used by other than the owners of the data to recover plaintext. A central goal of the CDR design described in this document is to minimise this security risk. Keys used to encrypt email which is transmitted over the Internet are more valuable to an attacker than keys used to encrypt stored files because of the relative ease with which an attacker can obtain copies of emailed ciphertext. Stored encrypted files in contrast are protected by all the physical security systems the company is relying on to protect it's paper files, plaintext data stored on disks, and backup tapes. For this reason the CDR approach treats communications keys as more sensitive than keys used to encrypt locally stored information. Separate Signature and Encryption Keys added in pgp5.0 This section describes a feature added to PGP with the pgp5.0 release: separate signature and encryption keys. Readers familiar with pgp5.0 functionality may like to skip this section. pgp2.x RSA keys pgp2.x (and pgp1.x) only had direct support for one type of public key: the RSA public key. RSA public keys were used both as signature keys, and as encryption keys to transfer session keys. The ability to generate RSA keys, and to interoperate with pgp2.x is retained in pgp5.x. pgp5.x El Gamal (DH) encryption and DSA signature keys One reason for the introduction of separate key functionalities is the addition, starting with pgp5.0, of the DSA digital signature algorithm which can only function as a signature system. In addition the El Gamal (EG) public key system which was also added with pgp5.0 is used only as a public key encryption system. (There are some El Gamal variants which can be used to produce digital signatures, but these are not used in pgp5.0). (El Gamal is a Diffie-Hellman (DH) variant which is sometimes also referred to confusingly as DH.) The DSA is itself a DH signature variant. Patent issues Another significant reason for the adoption of EG and DSA in particular is the freedom from patent encumbrances these algorithms now enjoy. RSA by contrast is patented, and unpatented algorithms are generally preferred for internet standards. Key expiry feature added in pgp5.0 One general security principle is that keys used to protect communications should be replaced periodically to reduce the value to an attacker of an individual key. Migration path The pgp5.0 standard provides support for this functionality in terms of the ability to attach expiry dates to signature and encryption keys. (In the pgp5.0 and pgp5.5 clients the signature and encryption keys are treated as a pair, and are given the same expiry information, but both the pgp5.0 and pgp5.5 clients can already cope with signature-only keys and encryption-only keys with different expiry information.) Web of Trust In pgp5.0 with the EG public keys, the Web of Trust (WoT) is based on the signature keys only. The users signature key is authenticated in the web of trust. The user signs his own encryption key thereby transferring trust to it. This ensures that encryption keys can be expired and replaced without affecting the web of trust. Limited Perfect Forward Secrecy Perfect Forward Secrecy (PFS) refers the technique of destroying old communications keys to ensure that past traffic can not be compromised after the point of re-keying. One way to use the pgp5.0 key expiry facilities is to have signature and encryption keys with very different expiry periods. For example a signature key could be given no expiry period (the pgp5.0 standard supports expiry periods of `forever'), and encryption keys could be given an expiry period of 6 months. To obtain PFS, a more secure way of dealing with expired encryption keys is to actually irretrievably delete them. This then simulates PFS: an attacker is unable to decrypt traffic encrypted with old communications keys even if he is able to coerce co-operation from the recipient. No one can be coerced because the key has been deleted. It seems reasonable that some users may want to use key expiry for this purpose, and this does not require any modifications to the existing pgp5.0 standard. Key expiry problems for stored encrypted data One problem introduced by key expiry is that any stored data encrypted to the expired key becomes less available. For security reasons the expired key should ideally be deleted, and in this case access to the data is lost. Alternatives are to attempt to store the old keys more securely, this then presents the problem that some stored data is harder to access than other data, and presents additional key management problems for old keys which will be confusing for users. Re-encrypting after key expiry One method to solve this problem is to re-encrypt all of the encrypted files at the point of re-keying. However this method has disadvantages in that not all of the encrypted data may be easily available. Some of the encrypted data may be on backup tapes, on floppy disks, or stored inside `zip' or `tar' archives on the disk and hence may be missed. Separate storage keys The simplest solution to this problem seems to be to encrypt to a separate storage key. Within the pgp5.0 standard this storage key would be a separate El Gamal key with a long expiry date. With this system we then have three types of keys: signature-only keys, communications-only keys and storage-only keys. This could require minimal or even no modifications to the pgp5.0 standard, storage and encryption keys could be differentiated between by: * location storage-only key is stored in (for example a separate keyring) * application being configured to use a chosen encryption key as the storage-only key by giving a keyID * convention on expiry dates (expiry date `forever' could be storage key, other values could be communications keys) * extra flag to indicate a storage-only key Once the separation of key types is made, the security benefits of re-keying can be more fully obtained. Sent and recieved email folders To maintain availability after re-keying of encrypted sent and received emails archived in mail folders, the email plaintext would be encrypted with the storage-only key. This then means that data availability for encrypted files on disk, floppy disk, and backup tape is maintained; and that availability for archived sent and received emails is maintained. Storage Recovery If the system is being used in a commercial setting, disaster recovery can be provided by storing recovery information to allow recovery of the storage-only key. There is still some additional danger over the case where there is no recovery procedure: the risk that an attacker may be able to compromise the recovery information. However because the encrypted data is all protected by the companies existing physical security mechanisms the security risk is minimised. Another form of storage recovery would be to include recovery information with each file, and this would be a valid combination achieved by placing CMR-style requests for additional crypto-recipients on the CDR storage-only key. However this practice makes recovery from forgotten passphrase more problematic: to restore user access to the data after forgotten passphrase, the recovery agent would have to decrypt all stored files (be they on hard disk, backup tape, floppy disk, or stored inside `zip' or other archives), then the user would have to generate a new storage-only key, and re-encrypt all of the files. Given the frequency with which users are prone to forgetting passphrases implementors may decide to avoid this option for ergonomics reasons. CDR vs CMR PGP Inc has an alternative data recovery proposal called Commercial Message Recovery (CMR). The CMR proposal involves sending recovery information with the message in the form of a second crypto recipient. In addition mechanisms are provided in the form of a proposed CMR public key extension to the IETF OpenPGP standard which indicates a request to the sender to include this recovery information. In addition facilities are provided in the form of PGP Inc's SMTP policy enforcer to partially enforce the inclusion of this recovery information by bouncing mail which does not include it. Security comparison PGP Inc's CMR proposal makes re-keying problematic because data is archived in email folders still encrypted to the encryption key. This tends to encourage the practice of having very long term communication encryption keys. Indeed the beta pgp5.0 implementation the author tried makes the recommendation that most users would give keys an expiry period of `forever'. In addition a security risk with the CMR proposal is that an attacker is able to obtain via coercion, bribery or burglary the CMR key used to encrypt the traffic for this key. With a purloined CMR recovery key, and given the long life time encouraged for such keys the previously passive attacker may be able to recover years worth of old traffic. Another risk is that companies may for simplicity have only one CMR key, thereby putting at risk the entire companies secured communications over periods of years. This is naturally a bad practice, and one which is discouraged by PGP Inc also, but the author remains cynically confident that some corporate users will ignore such advice. Privacy Comparison PGP Inc proposese the CMR communications recovery mechanism as a privacy respecting method of achieving data recovery. The privacy features of the CMR proposal are that there are proposed flags which are attached to a public key to indicate statement of intent about plaintext handling to the sender who is about to use the public key. Three statements of intent are possible with the current CMR proposal: * personal key (no flags set) * company use key, company may read message, please encrypt to listed company CMR recovery key(s) (recovery flag set) * company may read message, encrypt to listed CMR recovery key(s) or the message will be bounced (strict recovery flag set) PGP Inc's statement of intent in plaintext handling is a useful concept, in that it explains explicitly to the sender who will be able to read the message, and how the plaintext will be handled. Statement of intents are always advisory, in that they are impossible to enforce; however they are useful in encouraging ethical behaviour in this regard. Statement of intent messages are independent of recovery mechanism, and apply equally to the CDR mechanism described in this document. In fact the author would like to encourage a fuller set of statement of intent flags for both sender and recipient, allowing keys to be marked with intents: * personal key, messages not archived * personal key, messages archived * key used for company business, messages not archived * key used for company business, messages archived * key used for company business, messages archived and recoverable And, in addition a similar privacy argument could be made to allow the sender to express his preferences with regard to plaintext handling on a per message basis. This could generalise the -m function of pgp2.x which instructs the recipient not to save to a file. (The -m flag is the sort of electronic version of `please burn this document after reading', this flag is mildly enforced by the pgp2.x command line application). These set of flags would allow a sender to send a `normal communication message', or a `official statement, please archive with recovery if available', or `sensitive do not archive' and so on. A privacy respecting implementation could provide support for these functionalities. Whilst obviously easy to over-ride, this is felt to be a useful exercise in encouraging respect for privacy. In addition the recipient should have ability where company policy allows to choose which messages to archive, and which to archive with company recovery information. >From a privacy perspective the CDR and CMR proposals are approximately equivalent; the statement of intent flags, and the social value of encouraging companies to respect privacy are useful in both. Government access to communication key politics Another aspect of the whole data recovery area is that the US government, French government, and UK government (as well as other governments) have expressed an unhealthy interest in obtaining private individuals, and companies communications keys. Many privacy advocates view this development with fear, as it seems to many a particularly Orwellian development. Usually the Government Access to Communication Key (GACK) attempts try to deflect criticism by focussing on unrelated issues as a vehicle to introducing GACK: * Terrorist attacks and requirement for emergency government access to communications traffic * Government assistance for companies to recover stored plaintext via key escrow infrastructure. * Assisting electronic commerce by helping put in place Certification Authorities and digital signature laws However readers who have followed GACK politics will recognise the above for what they are: attempts to put in place GACK via indirect routes (respectively: the four horsemen of the infocalypse argument (the fallacy that terrorists will obey laws and use encryption systems which have government backdoors), the Clipper I, II and III attemps (various attempts by the US government to bribe and bully companies into building a GACK architecture), and the UK TTP (Trusted Third Party) proposal where `TTPs' are a euphamism for a Certification Authority (CA) which has been coerced by law to keep individuals private keys). Scenarios governments might shortly try this to request master keys for communications might be France, where the government is changing from a position of no encryption software without license, to a position of unlicensed encryption software being allowed provided that the governments has a back door into the communications. Other examples being perhaps the UK (with it's highly controversial TTP licensing proposals), or the US with the administration and law enforcement community pushing hard for access to communications keys. It is likely, particularly in the UK, and US in the authors opinion, that government backdoors would be demanded in carefully orchestrated stages, designed to minimise public opposition. There might be trials where the traditionally more regulated financial organisations were required to comply, next perhaps government funded research labs, and business organisations accustomed to large amounts of government regulation Only towards the end would people using government funded networks (academics), Internet services providers (ISPs) and individuals be regulated. The final phases may use a terrorist activity, or national emergency, or other scandal as justification for increasing the requirements. It is likely also that the justification will be in terms of wholesome sounding public safety safeguards. Political Comparison PGP Inc's CMR proposal loses heavily in the political argument in the author's opinion because the protocol design supports the practice of allowing third and fourth party access to communications traffic. Particularly with the multiple CMR key requests per key which are rumored to be coming in the next version of PGP, it will be easy technically for a government to request that one of the recovery keys belong to the government. Governments already have the political will to have access to communications; the barriers are technical, and individual's resistance to the notion. The danger with the CMR proposal is that it could become the enabling technology for push button suveillance, the enabling technology for wide scale secret service signals intelligence keyword scanning. This probably not what it's proposers intend, however the danger is there in building the technology. The CDR proposal on the other hand focusses on recovery information of stored information only, and as a design principle avoids sending recovery information over open networks. Whislt governments may be interested to obtain storage keys, they have much less value, because the ciphertext is much harder to obtain. Also non-compliance is much harder to detect: a government law enforcement agency would not know if an individual was actually using storage software with government backdoor key access without physically obtaining the storage media. For most individuals the point at which governments executes a dawn raid is a point at which the individual is already in trouble. The CDR proposal is much closer to the status quo in political terms.

2 2

re: index.html
by Anonymous 17 Dec '03

17 Dec '03

> U.S. SAID VULNERABLE TO COMPUTER ATTACK > > "Today, the right command sent over the Internet to a power > generating station's control computer could be just as effective as > a backpack full of explosives and the perpetrator would be harder to > identify and apprehend," the panel wrote in its executive summary to > the report. "Today, we decided to hook up the computer that controls the power supply of several states to the most hostile WAN in history. OMIGOD, THERE'S AN INSECURE POWER GENERATION CONTROL COMPUTER HOOKED UP TO THE INTERNET! Everyone in the US, $2 please, so we can fix it." > > The report recommends stepping up research and establishing a > nationwide program to educate people on the scope of the problem. It > also recommends revising existing laws to ensure protection against > electronic attacks through the Internet. > This sounds like a bad cyberpunk novel. Two crackers in some hotel room in a hyper-crowded city in Japan, hacking the "power control network". Suddenly, one of them stops and says, "Shit." The other looks up, startled. The first says, "I forgot. This is against the law." A pause. Then they both start rolling around a floor covered with anti- static bags, polystyrene, and fast-food cartons laughing until they turn blue. > > "Law has failed to keep pace with technology. Some laws capable of > promoting assurance are not as clear or effective as they could be," > the panel wrote. > When I hear the "Law has failed to keep pace with technology" mantra, I get the feeling that lawmakers want license to pretend that Moore's Law applies to them, as well. Double the amount of criminal laws and regs every 18-24 months. > "We identified existing laws that could help the government take the > lead and serve as a model of standards and practices for the private > sector," it wrote. "We identified other areas of law that can enable > infrastructure owners and operators to take precautions > proportionate to the threat." "We think we can do what we want with what we already have. Give us the money anyway." Nuke them from orbit. It's the only way to be sure. Golem

1 0

Re: Your "RIGHT" to Speak to Big Brother
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/20/97 11:13 PM, Eric Cordian (emc(a)wire.insync.net) passed this wisdom: >And there you have it. The people's right to provide their >neighbor's proprietary information their government shall not be >infringed. How Constitutional-Sounding. can you say INSLAW ????? they are sooooo trustworthy! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE08NcdZgC62U/gIEQJ2/wCaAwcjQLogUeAp7eBQk8n73OhmCjYAoON9 Z3FYtXeYgUYXlChaGYXu1IBk =Rho8 -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "Civilization is the progress toward a society of privacy. The savage's whole existence is public, ruled by the laws of his tribe. Civilization is the process of setting man free from men." -- Ayn Rand - The Fountainhead (1943)

1 0

wanted dead or alive: pgp5.5 key pair
by Adam Back 17 Dec '03

17 Dec '03

Could some kind soul who has downloaded pgp5.5 for business (I think it is available in the US from www.pgp.com) create a key with a CMR key extension. I guess this means generating two keys: XYZ Corp recovery key <snoopy(a)xyz.com> and then: XYZ Corp Sales <sales(a)xyz.com> with the sales person's key set up to have a strict requirement to encrypt to the XYZ "message recovery" key. Could this kind soul then mail me, (or post here I guess would be even more useful) both the private and public keys of both of them. Enciphering minds want to find out how pgp5.0 reacts to this key :-) (The question is really does pgp5.0 encrypt to the CMR key). (btw for the curious as to why my previous message was had a date of 22nd Feb ... I had to set my clock back to get pgp5.0 beta to function as the one I have had expired, and I forgot to set the clock forward again). Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

3 2

None
by Anonymous 17 Dec '03

17 Dec '03

Everyone has a "right" to speak to the government on any subject whatsoever, which cannot be abrogated by contracts, agreements or willful desire. A populace that holds no secrets is a safe populace. This is why we are officially announcing the formation of a federal agency, the Government Agency of Knowledge. Its role will be to obtain - by whatever means necessary - any and all knowledge of all actions, desires, means and ways of everything transpiring on US soil. Duties will include holding cryptographic keys in escrow, monitoring and assuring the wholesomeness of private and encrypted data traffic, and analyzing all available "knowledge patterns" of US citizens. Since honest, good citizens have nothing to hide, GAK will be a major advance toward protecting American citizenry from crime, terrorism and other human-meditated harm. After all, your government has a right and duty to protect you.

1 0

No Subject
by rka2＠hotmail.com 17 Dec '03

17 Dec '03

To: rka2(a)hotmail.com From: rka2(a)hotmail.com Subject: Simple Reply-to:rka2@hotmail.com Comments: Authenticated sender is <rka2(a)hotmail.com> Received: from hotmail.com (hotmail.com [000.000.000.000]) by hotmail.com (0.0.0./0.0.0.) with SMTP id AAA000000 for <rka2(a)hotmail.com>; Tue, 30 Sep 1997 23:37:27 -0500 (EST) Message-Id: 0000000000.AAA000(a)hotmail.com X-UIDL: 54956195511931597781388792848969 This may be the most important message of your life! You're not going to believe what you hear when you call this Toll Free number: 1-800-811-2141 (CODE 45434). We realize that almost everyone hates selling so we decided to solve that problem! Let our team of over 250 professional telemarketers work the phones, mail out brochures on your behalf, and most importantly "Close The Sale For You." This is a truly simple business that anyone can do which is why it works so well. You just give out the 800 number and your code and that's it. Everything else is done for you. No meetings, no presentations, no selling! Many are making over $8000/month! Call Today! You'll Be Glad You Did!! Toll Free: 1-800-811-2141 (CODE 45434) ============================================================== For name removal information please visit http://www.iemmc.org/remove.htm or send an email to globalremove(a)iemmc.org and you will be permanently removed from our mailing list as well as many others at the same time. Thank you very much.

1 0

PGP 5.5 CMR key examples, mini-review
by Greg Broiles 17 Dec '03

17 Dec '03

An acqaintance of mine received an evaluation copy of the new PGP For Business Security 5.5 suite, and I was able to generate some test keys to play with the message recovery features. I've uploaded them to the cert servers so folks with the 5.0 client software can experiment with them for interoperability, etc. The recovery key is "Little Brother <snoop@localhost>", fingerprint 26A5 667A 97D4 7018 1B18 2B15 D631 4776 B670 E1D0; a test user whose incoming and outgoing mail is forced to include the recovery key is "CMR User <snooped@localhost>, fingerprint EC79 A170 8BAE 60A1 3CAC C517 34A4 6056 EE42 30E3. Both keys are 768-bit DH keys, as I don't expect that anyone will use them for anything other than testing. Installation of the package involves multiple steps - there's an "administrator install package" (my term, not theirs), which installs a version 5.5 of PGP, including the PGPTools, PGPKeys and PGPTray apps, as well as a PGPAdmin program. To implement CMR, the ordinary PGPKeys app is used to create an otherwise ordinary PGP key pair; the administrator then runs the PGPAdmin app, which asks questions about security/recovery policy. The admin can force incoming messages to use a recovery key, can force outgoing messages to use a recovery key, can enable/disable conventional encryption, can enable/disable key generation (and RSA key generation), can force a key to be trusted and to act as a trusted meta-introducer. The admin can also force the user to use a strong passphrase. (PGP 5.5 includes a neat passphrase-strength-meter which changes depending on the length and apparent alphabet-space used in the passphrase for user keys.) Finally, the admin can force the user to sign/trust a designated Corporate Signing Key. After the administrator sets those policy choices, the PGPAdmin tool can be used to generate a customized installer application for distribution to users. That installer creates a local copy of PGP, which will enforce the policy choices made by the administrator. The user is warned upon key generation that a message recovery key will be used (if the app is thus configured) and that the behavior isn't optional. The recovery key ID is displayed but not modifiable. The user interface for 5.5 is much improved over that in 5.0, which was a big improvement over the command line. There's an indicator (initially preferenced to OFF, along with other information) in the PGPKeys application which marks CMR'd keys with a red button; the interface between PGPKeys and the key server is much improved. It's now possible to mark & retrieve many unknown keys, then approve adding them to the local keyring in one step, instead of approving the addition of each additional key. The icons & screen design have been updated and are now more colorful and easier to decipher. When a user with CMR-only client software encrypts data, the ID of the recovery key appears in the "encrypt to" box, and cannot be dragged out. A CMR-client will (apparently) still do conventional encryption with no recovery key if the admin allows this. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

1 0

Searching_for_representatives
by casinomarket＠correy.com 17 Dec '03

17 Dec '03

Dear Friend! We are offering an exclusive, unprecedented opportunity to earn money, and even start your own marketing business in the field of online gambling. We are a legitimate highly regarded firm, which has now developed a technologically advanced web product that is a completely unique and new introduction to the Internet - the first 3D multi-player on line casino. We are searching for representatives, who are well connected and have proven marketing abilities, to cooperate with us in marketing our unique product. Get more information at : http://www.casino-on.net/market Best Regards, Casino On Net Marketing Department CASSAVA ENTERPRISES LTD. ----------------------------------------------------- This email is for adults only! It concerns you only if the Internet qambling is legal in your country. -----------------------------------------------------

1 0

See the Seasons's Hottest Video Games on VideoGameSpot!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- ZDNET ANNOUNCEMENT 10/22/97 ----------------------------------------------------------------- Video games are going to be on everyone's Christmas list this year, and there are so many hot titles coming out, it'll make your head spin. If you need help finding something for yourself or the right gift for someone special, there is one site that will be your guide to the best games of the season - VideoGameSpot: http://www.zdnet.com/chkpt/zdna971022001/www.videogamespot.com/ VideoGameSpot is the leading video game information site on the Web. With the largest editorial staff in the business, you'll find everything you need to be in the know this holiday season. VideoGameSpot gives you: * Hard-hitting, critical reviews of the latest games played on the Sony PlayStation, Nintendo 64 and Sega Saturn console systems * Previews of games you've been waiting for and other new releases * Hints and strategy guides to help you play better and win * Custom Quick Time trailers so you can see games before you buy them * Monthly contests and promotions with thousands of dollars in prizes given out each month If you like video games (or know someone that does) and want to buy smarter and play better, then click on the URL listed below (or enter it into your browser): http://www.zdnet.com/chkpt/zdna971022002/www.videogamespot.com/ You'll also find us on the Games Channel at ZD Net: http://www.zdnet.com/chkpt/zdna971022003/www.zdnet.com/games _________________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _________________________________________________________________ Powered by InfoBeat: http://www.infobeat.com

1 0

Re: the migration path (was Re: Your "RIGHT" to Speak to Big Brother)
by Blanc 17 Dec '03

17 Dec '03

Adam Back wrote: >Perhaps this is what they are busy building at their top-sikrit crypto >software development/research center at Cambridge, UK under the >guidance of new head of research cryptographer Roger Needham. >Looks like an export embargo end-run by Bill Gates. > >Maybe Bill Gates is a cypherpunk after all, well we can live in hope, >anyway. ................................................................. He's no anarcho-cypherpunk: he and his father just contributed a great amount of money to support a gun-law initiative which would place all sorts of requirements on gun-owners (mandatory licensing, mandatory training, mandatory gun-locks, and many privacy-intrusive reductions of personal authority, etc.) in Washington state. I don't precisely know where he stands regarding crypto, but I know that he puts business requirements and customer acceptance above the arguments of GAK advocates, as do the VIPs who work in encryption and who totally reject the idea of Big Brother. .. Blanc

1 0

Re: everybody wants a piece of Microsoft's monopoly
by Blanc 17 Dec '03

17 Dec '03

It is intruiging to observe how alarmed certain companies get about Microsoft's methods (as though sellers of bundled MS software couldn't themselves just say "no" to such business proposals, without the government's assistance), and how Billg (and his legal advisors) deal with the govmt as they get further and more precisely investigated. It should be instructive and inspiring for everyone else, when MS wins, to see how (if) they do it. I would sympathize, but Billg is a great believer in "lawful" ways of doing things, often cooperating in regard of hiring practices and monopoly watch-dogs, among other things, so it is of great interest to me to see how he deals with these "lawful" types who believe they have cause to stick it to him. 'Tis a fine line he walks, between supporting the methods of The Law, using its services, and also being highly successful in beyond the limits set forth in the Official U.S. Rules for Success, Section 0.123, p. 26.930. Anyway, it's all "for the customer", you know. .. Blanc

1 0

30� a click, paid weekly!
by brian＠firstgear.com 17 Dec '03

17 Dec '03

Send More, Convert More & Earn More! Want to get paid what your traffic is really worth? Sign up and we'll show you how! http://www.More4Clicks.com This message is intended for Webmasters, we want to help you make your site profitable. We apologise for any intrusion. mailto:emissary@lostvegas.com?subject:remove

1 0

PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

[Posted to cypherpunks, cc:-ed to Jon Callas] You know, in the last few days I've read a lot of messages on both sides of this debate, and I've umm-ed and ahh-ed and slowly gone from thinking that what PGP are doing is evil to thinking that it's just bad. While I believe that Adam Back's suggestions for alternate systems are good and neccesary ideas for the long-term, I'm coming to the conclusion that PGP are heading in the right direction for the short-term, but have things backwards. The current system sends out a user's personal key, with a tag to say that if I don't encrypt to the company as well, my mail will bounce. But think about this: how often do I want to send email to a particular person in a company, and ensure that only they see it? And how often do I want to send mail to a particular group inside a company? All I want is to ensure that I get a response from the company, I usually don't care who I talk to in the process. So PGP's "everything private unless you choose to make it public" system seems backwards. Surely what we really need to meet these customer demands is an "everything public (within the company) unless you choose to make it private" system? That is, all mail to my department inside the company should be encrypted to a department key, shared by all members, *unless* it is confidential, in which case it should *only* be encrypted to me. Here's how I see this working: when Joe Blow joins Foo-Bah Cryptosystems, he creates his own personal PGP key. He also gets a copy of the department key, which he can use to decrypt any mail which is encrypted to his department; or this decryption could be handled automatically by a department email server to ensure that individuals never have access to the department's private key. PGP then creates a public key for 'Joe Blow <joe.blow(a)foo-bah.com>', which would be the department key with a signed tag linking it to his personal public key. This is the tagged corporate public key which he would give out to any customers. When a customer wishes to send email to Joe, he would use this public key. When encrypting, PGP would detect the tag and put up a dialog box pointing out that this is a corporate key and if they click on the 'confidential' button it will be encrypted to the user's personal key prior to encrypting to the corporate key (by which I mean superencryption, to avoid traffic analysis). The default would be not to superencrypt; and as a side effect this system would be compatible with any version of PGP for non-confidential mail (assuming that version understands the encryption algorithms in use). The effect of this is that if someone wants to send email about an urgent bug and I'm out at lunch, any of my co-workers can read that mail. But if they want to send *me* mail about confidential inter-company negotiations, the co-workers could decrypt the outer layer of the message, but would be blocked by the inner layer encryption to my personal key. As I see it, this system is simple, solves the problems which PGP claim they need to solve without creating the snooping problems Tim and others have discussed, cannot easily be adapted to GAK ('This message is to be encrypted to the FBI public key. If it is confidential, click here to superencrypt to the recipient's personal key'), and won't require a massive change to the PGP source code. There are some obvious security issues with having the department key shared amongst the members of the department, but I don't see that they are any worse than PGP's current CMR implementation, which has already discussed the use of department keys; it's certainly better than using plaintext. There are also problems with encrypting confidential mail to multiple recipients, but they're surmountable; an easy solution, if you don't care about traffic analysis, is to only encrypt confidential mail to the personal key rather than superencrypt with the corporate key. In most cases such mail wouldn't be sent to multiple recipients anyway. So here's how I'd see the simple system working: A PGP CMR key would consist of 1. A corporate key; this might be company-wide, department-wide, or an individual escrowed key; this choice is a seperate key-management issue for the corporation. 2. Optionally a personal key, which could only be decrypted by the individual. 3. A signature from the corporate key linking the personal key to it and the specified User Id. 4. Optional flag to indicate which key to encrypt to by default. 5. User Id, signatures, etc When PGP was asked to encrypt to such a key, it would check for the optional personal key. If it wasn't there, it would put up a warning box to tell the user that the message can be read by people other than the recipient. If it is, then it would put up a dialog box allowing the user to choose whether to encrypt to the corporate key or the individual key, normally defaulting to the corporate key. This system could not easily become GAK because it will only encrypt to one of the keys and not both; the FBI could create FBI CMR keys from all our public keys, but then PGP would either encrypt to the FBI and I wouldn't be able to read it, or encrypt to me and the FBI wouldn't be able to read it. Anyone care to pick any holes? Mark |-----------------------------------------------------------------------| |Mark Grant M.A., U.L.C. EMAIL: mark(a)unicorn.com | |WWW: http://www.unicorn.com/ MAILBOT: bot(a)unicorn.com | |-----------------------------------------------------------------------|

7 10

Digital signatures
by Anonymous 17 Dec '03

17 Dec '03

Tim Maytag carries a turd in his wallet for identification purposes. _______c___c / /_ _\ | ((6)(6)) Tim Maytag ( )_ __\\ //__ o___n) (nn)\o/(nn)

1 0

Free Cash Grants...
by 71073979＠cyberbundle.net 17 Dec '03

17 Dec '03

To be removed from this mailing list e-mail remove(a)cyberbundle.net $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ We Have Over 150 Private Foundations In Our Program All Over the United States... WE ARE A FINANCIAL FINDER & MATCHING SERVICE .."INTEREST - FREE CASH GRANTS!! - NEVER PAY BACK!!!"... FOUNDATIONS CAN BE A BETTER SOURCE FOR FINANCE, THAN BANKS! ___________________________________________________________ Foundations give away billions of dollars every year to individuals. Most are non-profit organizations dedicated to the betterment of society. A foundation is excempt from income tax because its non-profit status. Private foundations have been giving out cash-grants to people for over 100 years. You can check with your attorney or local chamber of commerce. ARE YOU BEING REJECTED FOR THE MONEY YOU NEED SO BADLY? _________________________________________________________ Then Why Not Try A Private Foundation? Interest Free Cash Grants From $500.00 & Up to $50,000.00. No Collateral. No Cosigners, No Security Deposit, No Mortgages. No Credit Check. No Pay Back. ANYONE CAN GET AN INTEREST FREE CASH GRANT! ____________________________________________ As long as they have a genuine reason for needing money, & as long as the foundation guidelines are met. Dear Applicant, This letter tells you HOW YOU CAN GET AN INTEREST-FREE CASH GRANT. Take a few minutes to read it. Youll be suprised to see how easy it is to get a Cash-Grant, by mail. From time to time, everyone needs to borrow. The problem is that for most people making a loan is a big hassle. Going to banks or finance companies in person takes a lot of time. In most cases, thereis endless paperwork. And Unfortunately, in many cases all that you end up with is a rejection notice. ABSOLUTELY NO CREDIT CHECK ________________________ People are getting CASH GRANTS BY MAIL, that are Interest -Free & do not have to be paid back, in any way. Getting a Grant by mail is probably a lot easier than you think. In your area, there are usually only a small number of places that will provide you with the money, that you need. On the other hand, there are literally hundreds of private foundations who are anxious to donate money by mail, to people who have genuine reasons for needing the money. While it is not possible for anyone to guarantee that you will receive a CASH GRANT BY MAIL, the fact is that right now, someone just like you is getting your grant. Chances are that most banks in your area have very stringent loan requirements. On the other hand, most foundations who give GRANTS BY MAIL are much more lenient. Persons who have poor credit, no credit or even those who have gone through bankruptcy are able to get the money that they need BY MAIL sent to them by check payable to them, because foundations are NOT interested in CREDIT RATINGS. GETTING A GRANT BY MAIL IS CONFIDENTIAL ____________________________________ There are no embarrassing interviews. Neither collateral nor cosigners are required. The main requirement is that you have a legitimate need for the money and are willing to use it for whatever reason that the foundation agrees to. Everything is handled by mail. We are not associated with any of the foundations in our program, therefore all money will go directly to you, payable to you. As a Financial Finder & Matching Service, we know where the money is and which private foundations may be most likely to approver your grant. There are actually hundreds of foundations with money that they are anxious to donate. It is our job to put you in touch with them. PLEASE REMEMBER: CASH-GRANTS are FREE of any interest, & they DO NOT NEED TO BE PAID BACK! ________________________________________________ Foundations give out money for a wide variety of needs as long as it is something LEGAL & this means that you obtain the money to pay off old bills, go on vacation, meet emergency needs or to buy anything that you might need, as long as the foundation agrees to it. Everything is handled by mail. YOU DECIDE HOW MUCH MONEY YOU WANT TO OBTAIN. ________________________________________________ The amount can be as little as $500.00 and up to $50,000.00, possible. And remember, there is NO CREDIT CHECK. Interest-Free Cash Grants are ideal for people who have bad credit or bankruptcy. If you had trouble in the past dealing with banks, then these private foundations, are a better source for finances, because they dont care about bad credit or bankruptcies. (Foundations do not do a credit check on a client..) As a Financial Finder & Matching Service, well review your service application form and determine which foundations may be most likely to provide you with the money that you need. Keep in mind that we have only reputable foundations in our program. You are protected by the fact that these foundations are regulated by the laws of the United States. No matter how much you want to obtain, no matter what you want to use the money for-we feel confident that we can help you to get it! With the service we are offering you. WE GUARANTEE THAT UNLESS WE HELP YOU WITH OUR SERVICE, TO GET THE MONEY THAT YOU NEED, OUR APPLICATION FEE OF $19.95 WILL BE REFUNDED! ____________________________________________________________________ Our Application fee is $19.95 for personal & Business Grants. There are absolutely no other fees to pay. All that you will have to do is complete the service application form, below, and mail it with payment with as indicated on the form. We will process your service application within 10-12 days. We will match your FINANCIAL NEEDS & REQUIREMENTS with the most suitable Private Foundations, in our program. 100% FULL MONEY BACK GUARANTEE, OF APPLICATION FEE, AT ANY TIME. ______________________________________________________________________ Remember-unless your grant is approved, your application fee of $19.95 will be refunded in full, promptly. The sooner you apply the sooner youre likely to have the money you need! Mail the APPLICATION TODAY! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ APLLY WITHIN 5 Days & GET 70 FREE MONEY MAKING REPORTS WITH RESELL AND RE-PRINT RIGHTS. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Service Application Form Please Find: (circle one) Money Order Check Credit Card (Circle One: VISA, M/C, AMEX, Discover) Credit card # ________________________________________ Expiration Date____________________ Signature_________________________________________ Guaranteed Fee $19.95. I need you to RUSH processing. Please add $10.00 Total $________ ______ I have applied within 5 Days. Please Include the 70 MONEY MAKING REPORTS W/ RE-PRINT RIGHTS. TO EXPEDITE, FAX TO 540-723-8699 We also accept checks by fax! Simply tape your checks on the bottom and fax!! It's that easy!! (For check payments, tape check to the bottom and fax) PLEASE MAKE CHECKS PAYABLE TO: McConville Enterprises, LLC or MAIL TO: McConville Enterprises, LLC Creators of... "Internet Business In A Bundle" (tm) 117 W. Boscawen Street Suite # 203 Winchester, Virginia 22601 (540) 723-8699 Fax Checks Take 5 Days to clear at the bank. Please Print Clearly For Our Office Staff ** Please write very clearly** Grant Purpose:____________________________________________________ Amount Needed $___________.00 Yearly Income $___________.00 Name_____________________________ Occupation __________________ Address___________________ City ___________ State _____Zip __________ Signature______________________________ Phone #(___)____ -________ E-Mail Address (very important)____________________________ Please match my financial needs & requirements with the most suitable private foundations in your program. I understand that the fee I enclosed will be refunded if I don't receive my grant. The Entirety of this Material and all Packages are Protected by Copyright Law. Copyright October 1996-97 By McConville Enterprises, LLC . All Rights Reserved.

1 0

Re: PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

amp(a)pobox.com wrote: > One thing that I think PGP needs more than anything else, is to make it easy > to build lists of keys to encrypt to. I'm not sure that it's quite what you're suggesting, but I was thinking that this idea could be extended to an arbitrary hierachy; for example, company key, department key, individual escrowed key, individual-only key. The sender could then choose which of these keys to encrypt to based on the sensitivity of the message. Again, this couldn't be extended to GAK because if the FBI were to put themselves at the top of the hierachy we wouldn't be able to read any mail which was encrypted to their key! Mark

2 1

Re: SMTP Encryption Extension (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 22 Oct 1997 07:38:07 +0200 > From: Mike <Michael.Johnson(a)mejl.com> > Subject: Re: SMTP Encryption Extension > Sure, but the idea here was hiding email to defeat traffic analysis. Ssmtp > would raise alarms in any snopper but https would seem like business as > usual, probably just another gif. And https is available through a lot of > firewalls where you can't run ssmtp. Your base assumption is that Mallet is stupid. Bad assumption. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

PGP Inc isn't using CMR (Re: wanted dead or alive: pgp5.5 key pair)Tue, 21 Oct 1997 18:06:04 -0700)
by Adam Back 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> writes: > At 4:34 PM -0700 10/21/97, Adam Back wrote: > >Enciphering minds want to find out how pgp5.0 reacts to this key :-) > > > >(The question is really does pgp5.0 encrypt to the CMR key). > > Why not just try to send a message to "phil(a)pgp.com"? > > Surely PGP, Inc. is itself using its own product? Strangely not. Tom Zerucha asked this question over on open-pgp, and Jon Callas replied: Jon Callas <jon(a)pgp.com> wrote: : Tom Zerucha <@spam-resistant-email-address> wrote: : : But let me ask a question about PGP, Inc. - Do they use the PGP 5.5 : version with corporate key recovery internally? : : No, we don't. We have no need to. It would be inappropriate for our : environment. Guess that answers that one then. > (I know if I were Jon Seybold and I had a radical"No nukes" nut like Phil > on my staff, :-), I'd want to monitor what he was saying to people and what > they were saying to him.) Some fairly hot things by all accounts: all about resistance fighters, and terrorists. Really ought to watch that guy :-) He has a laptop which he carries everywhere too -- probably with his non-CMR old prz(a)acm.org key on it -- reckon he'll be fiercely hanging on to that one :-) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Great new GAY Phone Services...can be Absolutely FREE
by 82GuyWire＠live.net 17 Dec '03

17 Dec '03

THE MALEBOX THE MALEBOX is an awesome new GAY live voice phone system..{currently absolutely FREE with Sprint's Free Monday} ! Otherwise, only REGULAR U.S. phone charges apply (NY free)...the computer is in New York with a normal phone number. There are no setup costs and NO FEES...call from anywhere anytime (use your own best rate...Dime Deal...MCI 5ct Sunday,etc). Why be shy? Call THE MALEBOX at # 315-233-1693 and press 7 for the LOBBY, then press... #1...LIVE ROOMS > chat for up to 8 people per room; a great way to meet and (press 7 to skip to next room) Gay Guys seem to prefer the virtual chat aspect found on One-on-One #2...BULLETIN BOARD > post messages or ads, or listen #3...ONE-ON-ONE > private talk; good place to meet and chat without giving your home phone number...check out NEW INSTANT VIRTUAL CHAT !! #4...PERSONALS > super place to meet your dream mate #5...VOICEMAIL > get your own private mailbox or leave a message. #9....DIRECTORY > other special numbers and services #0...to return to the LOBBY The system is very simple, just follow the easy directions or use the menu above...try it you'll like it! Please SAVE THIS MESSAGE for the future. Call THE MALEBOX at # 315-233-1693...if busy just try again press 7 to slip in to the LOBBY ...... ( for straight folk try a similar system at THE HOTEL CALIFORNIA at 315-233-1690 ) ( from the U.K. try 268-404-7489 ) for FREE TAROT READINGS try # 1-268-404-4772

1 0

Singapore TOILET ALERT
by Declan McCullagh 17 Dec '03

17 Dec '03

[Apologies to my friends in Singapore, but I am NOT making this up. --Declan] And the top five toilets are... SINGAPORE (Reuters) - A drive to keep public toilets clean and dry is meeting with overwhelming success, the Ministry of Environment said in a "toilet alert" Tuesday. The statement said that in the first week "5,000 Singaporans have called the Clean Public Toilets hotline to identify Singapore's model toilets and to vote for their top five favorite toilets." The ministry launched a poster competition earlier in the month featuring three model toilets and inviting the public to identify their locations, as well as to nominate their favorite public toilets in five categories of locations. Various prizes are involved, including a return trip to Hong Kong to be won in a draw. Singapore is known for public campaigns promoting causes ranging from discouraging littering to encouraging people to have more children. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

8 19

Re: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a possible solution)
by Adam Back 17 Dec '03

17 Dec '03

Forwarded with permission, Mark's response: ------- Start of forwarded message ------- Date: Wed, 22 Oct 1997 06:41:49 -0700 (PDT) From: mark(a)unicorn.com To: aba(a)dcs.exeter.ac.uk Cc: mab(a)research.att.com Subject: Re: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a possible solution) aba(a)dcs.ex.ac.uk wrote: [Did you intend to send this to the list, or Bcc it? If so, please forward a copy of this reply as well] > What you're describing is an alternate use for CMR: to allow > sales(a)acme.com to have attached to it the request that messages to > that address be encrypted for all the sales people. > > Well that seems reasonable in a way. Still potentially dangerous in > that the NSA will soon enough be asking to be on every one's CMR list. But that's *precisely* what I set out to avoid. The intention is to eliminate the multiple-recipient encryption which is the real problem with PGP 5.5's CMR. The NSA can easily put themselves at the top of the encryption hierachy, but then all mail will *only* be encrypted to the NSA, and the recipient will not be able to read it. Rather than encrypting to multiple recipients, you would encrypt to a single key which is available to all those recipients. > The other alternative is as you say: to have group keys which are > shared amongst the sales people. There are problems with this in > managing the secure distribution of the shared key: sales manager > creates it, and emails securely to all sales team members? > Plausible I suppose. Exactly. Or the individual sales-people create personal 'corporate use keys' and escrow them, or the key is retained in a secure 'black box' which takes incoming email encrypted to the sales department and outputs plaintext. The point is that mail sent to that key can be recovered somehow, but confidential mail sent to their private, personal key cannot. > Problem for both approaches is re-keying: what happens when Fred > leaves the sales team to work for a competitor. I agree. But that can be solved in some fashion; the 'black box' approach, for example. > Really it seems to me that actually having half a dozen sales droids > sharing a key, or being able to decrypt a message because they are all > CMR enforced multiple crypto recipients is a security nightmare either > way :-) Sure, but better than a security nightmare *and* GAK. > Reckon it would be arguably more secure to have the SMTP policy > enforcer decrypt it for them, even. Yep, that was one of the options I listed; the 'black box' above. > I think what PGP are arguing for is ability to recover stored messages > even if they are intended for one recipient only. But this is the one thing they don't seem to have a business case for. In my system, if the mail was encrypted to that recipient's personal key rather than a group key or an individual escrowed key, then the sender had a good reason to do so. In that case, the only reason a company could want to read the mail is for snooping on their employees. I don't believe that PGP or anyone else should be encouraging that. The proxy key stuff seemed interesting, but not something that can be implemented in the next few months. I'm thinking of this as a short-term solution, not long-term. Mark ------- End of forwarded message -------

1 0

We have to keep our keys for HOW long???
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

* The Wall Street Journal reported in July that the Environmental Protection Agency has ordered 71 mining companies in Idaho to submit copies of all of the paperwork they have produced in the last 117 years. EPA says it needs the information to help determine who is responsible for lead pollution in Idaho's Silver Valley. According to the president of one firm, the order was so crazy that the EPA investigators "must not live on this planet." Another pointed out that there are not enough copy machines in the region to handle the work. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.)

1 0

ADMIN: lost messages (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Jeff Barber <jeffb(a)issl.atl.hp.com> > Subject: ADMIN: lost messages > Date: Thu, 23 Oct 1997 08:22:06 -0400 (EDT) > CPunks list administrators, > > There appears to be an occasional breakdown in the list > distribution/reflection. I am sometimes seeing responses to articles > that I haven't received. For example, a message from > spencer_ante(a)webmagazine.com has been the subject of several > follow-ups (according to their In-reply-to fields, it is message > ID <88256538.00787D24.00(a)pcwhub.pcworld.com>). Yes, there are occassional breakdowns in the communications between the list remailers. The reason that there are several of them is if one goes down for more than a few minutes the whole lists doesn't go down which would occur if we were still on a single remailer. In cases such as this I would suggest checking the archives provided by a couple of sites (I thought since I don't check the archives). > Any clues? Things get lost on occassion? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: PGP 5.5 CMR/GAK: a possible solution
by Anonymous 17 Dec '03

17 Dec '03

mark(a)unicorn.com writes: > When a customer wishes to send email to Joe, he would use this public key. > When encrypting, PGP would detect the tag and put up a dialog box pointing > out that this is a corporate key and if they click on the 'confidential' > button it will be encrypted to the user's personal key prior to encrypting > to the corporate key (by which I mean superencryption, to avoid traffic > analysis). The default would be not to superencrypt; and as a side effect > this system would be compatible with any version of PGP for > non-confidential mail (assuming that version understands the encryption > algorithms in use). Neat, automatic superencryption. Could the same idea work with the Pgp method with the CMR key? You would encrypt to the user first, then reencrypt to the combination of user and CMR key. Would this prevent GAK?

2 1

Re: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Adam Back wrote: > No offense Declan, but what has this got to do with cypherpunks, > cryptography, crypto politics etc? (This is not a perrygram, this is > a message saying I found that particular article uninteresting). Adam, I believe that Declan may be trying to keep things in perspective, by reminding us who the actual users of "widespread crypto" will be, GAK or no GAK. As a matter of fact, Declan and I are counting on you to explain the issues involved to our good friend and neighbor, Debbie (details below), and get back to us with her thoughts on the crypto issues which are relevant, from her perspective. * At a celebrity auction in May, Debbie Dacoba of Paw Paw, Mich., bid $8,625 for a pair of Mr. Ed's horseshoes and was so overcome with joy when she won that she had to retreat to the ladies' room for 20 minutes until she stopped crying. Later she told a reporter that she would keep the horseshoes in plastic because specks of brown residue in the nail holes "could be manure, which I hope it is because then I have a piece of him." ManureMonger ~~~~~~~~~~~~ To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.)

1 0

We Do All The Work And You Collect All The Cash
by mktg＠inet.com 17 Dec '03

17 Dec '03

If you're NOT currently looking for an income opportunity, then just delete this message. If you ARE looking for an income opportunity, then... WELCOME TO THE HOTTEST CASH GENERATING PROGRAM ON THE INTERNET! I'm sure that this is not the first opportunity that you have ever run across that claims that you can make a lot of cash, very quickly. But, this just might be the only program you'll ever run across, that can actually make that happen. Every other cash generating program that you've ever run across was probably doomed from the start, for 3 simple reasons. 1) You needed to dedicate a lot more time and effort into the marketing of your program, than you originally planned. 2) You needed to invest a lot more money into the marketing of your program, than you originally expected. 3) Your success depended solely on you. And, unless you're a marketing expert, your expected level of success just wasn't going to be achieved. Well, that's where our expertise comes in. We here at Internet Marketing Services, have been asked to develop an effective marketing system that would require virtually no effort and very little capital. We are proud to tell you, that our experience in this industry has enabled us to create a very low cost, high response, marketing program, that blows away traditional methods of network marketing and advertising. The secret to becoming successful in any business is to get your message to as many people as possible, in a cost effective manner. Through our creative advertising program were able to greatly reduce our costs and we are simply passing the savings on to you. IT'S REALLY AMAZING HOW EASY THIS IS AND HOW BEAUTIFULLY IT WORKS! By compounding our efforts and combining your advertising along with other income opportunity seekers wanting to participate in this highly profitable program, Internet Marketing Services is now able to offer you the best Internet marketing rates available anywhere. HERE'S HOW IT WORKS. Multi-level marketing is still used by some of the largest companies in the world today; Amway, Excel and Avon, just to name a few. This highly effective, multi-level business provides you the same type of opportunity. A business that offers a proven cash generating program, complete with a low cost internet marketing service. THIS IS THE SECRET TO YOUR SUCCESS! If a new customer decides to participate in your program, they simply send you a $5.00 commission. And the best part is, we do all the hard work for you, you just collect your cash. As with all multi-level businesses, your income is generated by recruiting new customers that have the same interest as you. The desire to create a large cash income. And, every state in the USA allows us to legally recruit for you, via the Internet. For an extremely low fee of only $35.00, we will market this highly profitable opportunity to 750,000 people with your name and address inserted into the mailing. Then you just go to your mailbox and collect your cash. That's all there is to it. HERE'S HOW YOUR ADVERTISING DOLLARS COMPOUND. In each mailing your name will be included with 2 other distributors. We will then advertise your opportunity to 250,000 people, in 3 seperate mailings. So your opportunity will be offered to 750,000 different people. EXAMPLE: Mailing #1: 250,000 People Mailing #2: 250,000 People Mailing #3: 250,000 People FOR A TOTAL OF: 750,000 People NOW, LET'S COMPARE COSTS. If you were to send your offer through the postal service, it would cost you $240,000.00, in postage alone. The typical e-mail company charges 1-2 dollars per 1000 addresses mailed to. That would be a minimum of $750.00. Other methods could be even more expensive than using the postal service. As you now can see, by compounding your advertising dollars with other income opportunity seekers, it allows us to offer you a cost effective way to cash in on a proven income generating program. And remember, we do all the work for you. You just go to the mailbox and collect your cash. THIS IS A LEGITIMATE MONEY MAKING OPPORTUNITY. It does not require you to come into contact with people, do any hard work, and best of all you never have to leave the house except to get the mail. This multi-level, e-mail order, marketing program works perfectly, every time. E-mail is the ultimate sales tool of the future, and the future is now! If you ever wanted "THE EASY WAY" to make a lot of money... just follow these 3 easy steps using this sure fire system! STEP 1: Send $5.00 in cash to each of the 3 distributors below. Just like new customers will be sending to you, once your name has been placed onto the mailing. Also, include a seperate sheet of paper with your name as it is to appear on this mailing, along with the words, " I WOULD LIKE TO SUBSCRIBE TO YOUR INCOME OPPORTUNITY NETWORKING SERVICE." Once the 3 distributors receive your $5.00 payment, they will each e-mail us your name, verifying that you have paid them their commission. This service also eliminates the possibility of anyone replacing any existing names on the mailing. #1: Venture Inds. 2308 E. Broadmor Tempe,AZ 85282 #2: P.S.B.Wayne PO Box 572772 Tarzana,CA 91357-2772 #3: Classic Communications 1912 California St. Berkeley,CA 94703 STEP 2: Send $35.00, along with your name and address as you want it to appear on this mailing. (You can use your full name, your initials, a business name or what ever you prefer) Once we receive your payment and verification via e-mail that you paid each distributor their commission; we will automatically position your name and address through all 3 mailings until this offer has been e-mailed to 750,000 people. Be sure to include your e-mail address. Once we receive your payment, we will e-mail you our priority e-mail address. This is how you will notify us that you received your payment from customers that want to paticipate in your program. This is a fool-proof system that eliminates anyone from using your service without paying you your $5.00 commission. You can use this program as many times, and as often as you like. By doing this, it is possilbe to create a perpetual cash income. And yes, we accept personal checks. Make check payable to and send to: Internet Marketing Sevices Dept-L23 2375 E.Tropicana #135 Las Vegas, NV 89119 Please note, Internet Marketing Services does not participate in your offer, nor do we share in your income in any way. Internet Marketing Services is a low cost, internet marketing provider only. STEP 3: Go to your mailbox daily and collect your cash. MAKING MONEY JUST DOESN'T GET ANY EASIER THAN THIS! By now your probably asking yourself, "how much money can I really make?" Below are the results of an Internet survey conducted by www.survey.net: 50% of the people on the Internet have made purchases, 40% have made several purchases, 80% like the idea of shopping on the Internet, 50% of those purchases are computer information related, 50% think of e-mail as their second most important application, 20% have made purchases because "I came across it and I liked it, so i bought it." POSSIBLE EARNINGS PER 750,000 E-MAILS 2% Response @ 15,000 X $5.00 = $75,000 1% Response @ 7,500 X $5.00 = $37,500 1/2% Response @ 3,750 X $5.00 = $18,750 1/4% Response @ 1,875 X $5.00 = $ 9,375 HOW MANY RESPONSES DO YOU THINK YOU WILL RECEIVE? As more and more people look for ways to create wealth and financial security, the need for a successful income opportunity is constantly in demand. This higly effective marketing program has only recently been made available. There are millions and millions of people who haven't yet received this offer. THIS IS STILL VERY MUCH A GROUNDFLOOR OPPORTUNITY! BUT IT WON'T BE FOR LONG! If your fed up with the high cost of marketing and advertising then why not take advantage of this powerful opportunity and start creating wealth for you and your family. We hope that you are one of those unique individuals that does more than just dream about creating wealth and has the foresight to see what an incredible money making opportunity that this really is, requiring no effort and a very small investment. JUST IMAGINE WHAT YOU AND YOUR FAMILY CAN DO WITH ALL THAT CASH! FREE WEBSITE: Would you like to create your own website for business or personal use? Just go to www.freeyellow.com and follow the prompts.

1 0

Re: Bill Gates, the Bully Savior
by Declan McCullagh 17 Dec '03

17 Dec '03

There was a good op-ed in the WSJ on Monday. The Politics of Envy, basically. Why everyone in Silicon Valley hates Microsoft... But some of the complaints about Microsoft come down to personal taste. The masses offend refined sensibilities when they buy Windows 95 in droves. Rein them in! Stop them from buying what they want! Don't let them get free copies of Internet Explorer. I share Lizard's distaste for Microsoft products. My Unix workstation at home has not one MSFT application on it. I have only Microsoft Word on my Duo at work, and I could get by with WordPerfect. But our dislike for their products doesn't mean that we are morally justified in restricting what the company can do. -Declan At 10:42 -0700 10/22/97, Lizard wrote: >Uhm...how do 'we all' benefit from having the same Justice Department which >defended the CDA (and which is pushing for GAK) decide for us all what is, >and is not, part of an operating system? > >These people are not qualified to make ANY judgements about computers -- I >have to assume the 'experts' they got to tell them about OS software are no >more qualified than the 'experts' they got to testify about the CDA (L-18, >anyone?). > >I have no great love for Microsoft (I don't think anyone forced to use >their crappy software does), and, emotionally, I'd like to see them get >taken down a peg -- but legally and ethically, they are not doing anything >wrong. They're just being tough competitors. Microsoft has prospered not >due to any technical brilliance on their part, but due to sheer >incompetance on the part of the rest of the industry, who have made a hobby >of underestimating Bill Gates and overestimating their own customers loyalty. > >It's a pity I'm a mind-flaying victim. If I wasn't, I could forget >principles and ideals and just say, "Microsoft Big. Microsoft Nasty. Uncle >Sam stomp Microsoft. Yay, Uncle Sam." But because I work from principle >FIRST, I have to grant Microsoft the same rights I would grant Sam's Deli >or Joe's Shoe Store, and that includes the right to offer any combination >of products or services they wish, and let the market decide to buy or not. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

2 1

Re: PGP, Inc.--What were they thinking?
by spencer_ante＠webmagazine.com 17 Dec '03

17 Dec '03

Declan, perhaps the Big Brother vs. The Boss debate has been talked about for years in the crypto community but, as far as I can tell, it hasn't crossed over into the mainstream mediasphere. And that's partly due to the rhetoric of cyberlibertarians, who have consistently pointed their finger (justifiably most of the time) at the evil government, at the expense of seriously analyzing surveillance in the private sector. For example, how many people know what their company's security policy is? Do they read your email? How often and with what cause? I think any type of surveillance system is cause for concern--whether it originates from the government or IBM. Lastly, I think you overestimate the amount of wiggle room folks have in the labor market, which is never perfect. What happens when most of the Fortune 500 starts eavesdropping on company email? (Incidentally, I think that most working people--unlike the digerati--are not in a position to launch their own company.) It reminds me of the drug testing issue. Sure, it sucks and may even be unconstitutional, but that hasn't stopped a lot of companies from doing it. -Spencer (posting this from my the computer in my corporate cubicle) At 15:08 -0700 10/22/97, spencer_ante(a)webmagazine.com wrote: >But with this new product, I agree that they run the risk of alienating >their core user group of cypherpunks and hackers. Encryption is a very >complicated topic that doesn't lend itself well to sloganeering and >histrionics. And one major thing that needs to be pointed out: PGP's key >recovery system is *voluntary and private*--not mandatory and gov. >controlled, which is what the Feds and Louis Freeh have been pushing for. >One potential positive side effect of PGP 5.5 is that it could realign the >crypto debate and force people to consider this question: Whose back door >should netizens be more worried about: Big Brother or The Boss? Spencer, the folks on the cypherpunks list know better than perhaps anyone else that encryption is a complicated topic. I know it's tempting to search for New Things to Say about the crypto debate. I try it myself sometimes. But the question you posed about "whose backdoor should netizens be more worried about" has been debated for years and is hardly new. The short answer to it is: when Big Brother is my Boss, I have remedies. I can leave the company or pressure it to change policies. I can file a union grievance. If all else fails, I can leave the company and start my own. This is not the case when Big Brother is Louis Freeh or Janet Reno. When worldwide GAK is the rule, where else can I go? Also: governments have guns; governments have jails. They have unique coercive powers, which the law and western philosophical traditions recognize -- and try to limit. -Declan (posting this before a soccer game somewhere in virginia)

3 2

PGP 5.5 and the corporate environment
by Roger J Jones 17 Dec '03

17 Dec '03

Just a small aside. Our help desk handles about 50 to 75 "I forgot my password" requests per day. This might be one small motivating factor why corporations desire an alternative method to recover encrypted files.

1 0

Unlocking crypto-secrets Wired article -- request for help
by Declan McCullagh 17 Dec '03

17 Dec '03

I'm working on a Netizen article for Wired Magazine on secret crypto-briefings and thought I'd ask the list for help. You know the briefings I'm talking about -- classified sessions where the FBI director, the Commerce Dept, NSA, and occasionally anti-drug officials pressure Congressmen to place restrictions on encryption. Sometimes it works, and our elected representatives vote to put strict limits on encryption technologies. (The secret briefings certainly seemed to work on the House Commerce committee.) I'd like to unlock those closed doors. If anyone has insights into what happens during these sessions, I'd be very interested in learning more. Pointers to open sources would be great. I will keep your identity confidential. I'd also be interested in learning more about the secret briefing practices of other countries. Please feel free to recirculate this message. I've attached my PGP key below. Please use it sparingly; I keep my private key on a non-networked machine and it's laborious to move data back and forth. If you want to send a tip through an anonymous remailer, a web-based one is at: http://www.replay.com/remailer/anon_no_ssl.html Thanks, Declan ****************** http://www.well.com/user/declan/.pgpkey PGP Key fingerprint = F4 0A 36 1F 7F B1 4B CB 5C 38 2C 13 FE 1E 4D 80 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzF5mVcAAAEEALKyL4tjF7t4h+hmbY+q0b0FdSZy3dx8LuUwkTmAY6Ib/YX7 WhZR22+T1Tts/JaC7iAhr/zfxI9IrHqT1C7NV/aqdEVAuI+pjYKpcRKOU7i0ccAx db/jddUvzX4bjqKQQLLcOihcle6BD2+7vEXxaaMOA5nTU5i/Sn7vt7V2BpKxAAUT tCJEZWNsYW4gTWNDdWxsYWdoIDxkZWNsYW5Ad2VsbC5jb20+iQCVAwUQMXmajn7v t7V2BpKxAQG6NAP/RUEBrnFfR6vbIdoAeyt2jXsuPPcH944mnyp4fNLH3OEzQlj6 tXee9eYaqazUgkLNCyWXDDGQJxsok58hqIEOHoTgilAcomMW3mIoqN7uMIevyvmo NH170+a6drNwY4kNXNUsDDx6qfgQz5wTxaVyxbZuyslX1k3kDID8vPSyxbs= =dofB -----END PGP PUBLIC KEY BLOCK----- ******************

1 0

Re: Bill Gates, the Bully Savior
by Paul Spirito 17 Dec '03

17 Dec '03

At 01:34 PM 10/22/97 -0700, Declan McCullagh wrote: >Or it's like buying a Ford Mustang that comes with brown carpets. Auto >manufacturers "bundle" lots of things with their cars... Where's the DoJ >when we need them?!? Not sure where I stand on this. An OS is more like a highway than a car. Or, better, a rail track -- since it imposes severe compatibility requirements on those who want to utilize it. Imagine that someone owned the rail track standard & had the exclusive IP-rights to manufacture it. Non-standard tracks exist, but they don't go nearly as many places. Then the company uses its position as owner of the tracks to demand... Oh screw it. I don't feel like going down analogy road any further. Detail is the enemy of ideology, & the significant detail re: Microsoft is the rare & happy (for Bill Gates) character of its business that it is more important to have a standard OS than to have a quality OS. Therein lies his billions, & it seems to me reasonable to scrutinize attempts to parlay that counter-ordinary-market reality into dominance in other areas. Perhaps this could be settled as the online service spat was: bundle Netscape with Win98 (& Opera, Arachne &c). Or perhaps the US could nationalize Windows. Whoo-hoo! Therein lies a Plan... Paul Her name was Julie, she wore Batman sneakers, And she laughed when she sang, "Money can't buy me love!" North of Petaluma where the 1 meets the 101 -- Oh man, we took a lot of drugs...

1 0

Laws recognizing digital signatures
by Vincent Cate 17 Dec '03

17 Dec '03

I have talked to people in government and the offshore private sector here and think Anguilla has a very good chance of passing a law making digital signatures legally recognized, at least for corporations. I think we would be the first taxhaven to do so. Currently companies use corporate seals. I mentioned that there were a few other jurisdictions that had passed some laws like this and they would like me to try to pin down which and, if possible, get copies of the laws. I remember some talk about this on cypherpunks, so I am hoping someone here can tell me which places (think there was some state) have such laws, and if possible tell me where I can get a copy. Thanks, -- Vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vincent Cate Offshore Information Services Vince(a)Offshore.com.ai http://www.offshore.com.ai/ Anguilla, BWI http://www.offshore.com.ai/vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

Re: PGP, Inc.--What were they thinking?
by Anonymous 17 Dec '03

17 Dec '03

>Agreed. What amazes me is how PGP, Inc. would decide this should be a core >part of their company. "PGP for Business," indeed. What were they thinking? Um, maybe that they wanted to stay in business?

3 2

Federal Key Recovery Demonstration Project ?!
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: 20 Oct 1997 14:29:39 -0400 From: Mark Atwood <zot(a)ampersand.com> (by way of rah(a)shipwright.com (rah-news)) To: rah(a)shipwright.com Subject: Federal Key Recovery Demonstration Project ?! Mime-Version: 1.0 Path: thing1.leftbank.com!thing2.leftbank.com!cam-news-feed2.bbnplanet.com!cam-news-hu b1.bbnplanet.com!cam-news-feed5.bbnplanet.com!news.bbnplanet.com!ftp.ampersand.c om!not-for-mail Newsgroups: talk.politics.crypto Organization: Ampersand, Inc. Lines: 62 NNTP-Posting-Host: colon.ampersand.com X-Newsreader: Gnus v5.2.40/Emacs 19.31 Xref: thing1.leftbank.com talk.politics.crypto:23766 X-Newsreader: Yet Another NewsWatcher 2.3.0 -----BEGIN PGP SIGNED MESSAGE----- Just saw the fallowing ad on pg 42 of Federal Computer Week, Vol 11, Num 33, Oct 20, 1997. If I was closer, I would go, just to see what the "enemy" has to demonstrate. ================================================== The Government Information Technology Services Board Federal Key Recovery Demonstration Project invites you to attend A TECHNOLOGY CONFERENCE Wednesday, November 15, 1997, Omni Shoreham Hotel, Washington DC 7.30 a. m. - 8: 00 a. m. Conference with exhibit demonstrations following from 8:00 a.m. - 5:30p.m. For details, visit out Web site: http://gits-sec.treas.gov or contact Lisa McGrady Pellegrin at (202) 293-3835 or Terry Painter at (202) 986-0200 Registration fee: $100.00 (includes breakfast, lunch) To register, please call and mail check by October 24, 1997 payable to: McPell Communications Company 1140 Connecticut Avenue, N.W. Suit 606, Washington, D.C. 20036 ================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBNEui9jecHWvdAD3dAQF2uAP+OJMD/t7wFl1YiHqS+P/Dor0D5lDXOk6S 0b4fkVqeBih/gRwM0UYOxqlpxh7uyHjXyQQIsaLRUtMD3f+Rg3vPkBHubGwPq513 98upODawMD5znT/xUT5TZHeWWxlnisBrmcH308jG1zLYh4Ls1qJat75n2ldj+HWI RhdMsNvIn/Y= =VJyz -----END PGP SIGNATURE----- -- Mark Atwood | Thank you gentlemen, you are everything we have come to zot(a)ampersand.com | expect from years of government training. -- MIB Zed --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

[rc5] The unknown message is...
by David McNett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It is a great privilege and we are excited to announce that at 13:25 GMT on 19-Oct-1997, we found the correct solution for RSA Labs RC5- 32/12/7 56-bit secret-key challenge. Confirmed by RSA Labs, the key 0x532B744CC20999 presented us with the plaintext message for which we have been searching these past 250 days. The unknown message is: Its time to move to a longer key length In undeniably the largest distributed-computing effort ever, the Bovine RC5 Cooperative (http://www.distributed.net/) under the leadership of distributed.net, managed to evaluate 47% of the keyspace, or 34 quadrillion keys, before finding the winning key. At the close of this contest our 4000 active teams were processing over 7 billion keys each second at an aggregate computing power equivalent to more than 26 thousand Pentium 200s or over 11 thousand PowerPC 604e/200s. Over the course of the project, we received block submissions from over 500 thousand unique IP addresses. The winning key was found by Peter Stuer <peter(a)dinf.vub.ac.be> with an Intel Pentium Pro 200 running Windows NT Workstation, working for the STARLab Bovine Team coordinated by Jo Hermans <Jo.Hermans(a)vub.ac.be> and centered in the Computer Science Department (DINF) of the Vrije Universiteit (VUB) in Brussels, Belgium. (http://dinf.vub.ac.be/bovine.html/) Jos only comments were that "$1000 will buy a lot of beer" and that he wished that the solution had been found by a Macintosh, the platform that represented the largest portion of his teams cracking power. Congratulations Peter and Jo! Of the US$10000 prize from RSA Labs, they will receive US$1000 and plan to host an unforgettable party in celebration of our collective victory. If youre anywhere near Brussels, you might want to find out when the party will be held. US$8000, of course, is being donated to Project Gutenberg (http://www.promo.net/pg/) to assist them in their continuing efforts in converting literature into electronic format for the public use. The remaining US$1000 is being retained by distributed.net to assist in funding future projects. Equally important are the thanks, accolades, and congratulations due to all who participated and contributed to the Bovine RC5-56 Effort! The thousands of teams and tens of thousands of individuals who have diligently tested key after key are the reason we are so successful. The thrill of finding the key more than compensates for the sleep, food, and free time that weve sacrificed! Special thanks go to all the coders and developers, especially Tim Charron, who has graciously given his time and expertise since the earliest days of the Bovine effort. Thanks to all the coordinators and keyserver operators: Chris Chiapusio, Paul Chvostek, Peter Denitto, Peter Doubt, Mishari Muqbil, Steve Sether, and Chris Yarnell. Thanks to Andrew Meggs, Roderick Mann, and Kevyn Shortell for showing us the true power of the Macintosh and the strength of its users. Wed also like to thank Dave Avery for attempting to bridge the gap between Bovine and the other RC5 efforts. Once again, a heartfelt clap on the back goes out to all of us who have run the client. Celebrations are in order. Id like to invite any and all to join us on the EFNet IRC network channel #rc5 for celebrations as we regroup and set our sights on the next task. Now that weve proven the limitations of a 56-bit key length, lets go one further and demonstrate the power of distributed computing! We are, all of us, the future of computing. Join the excitement as the world is forced to take notice of the power weve harnessed. Moo and a good hearty laugh. Adam L. Beberg - Client design and overall visionary Jeff Lawson - keymaster/server network design and morale booster David McNett - stats development and general busybody -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE5sy7N5xKXkPF/DEQLBMwCfadBDxP97DhosT7ILs9vdYRha9nIAnRCl ydiRYhdAplj25nDSZNbXYILS =4dNQ -----END PGP SIGNATURE----- -/\/ugget ________________________________________________________________________ |David McNett |To ensure privacy and data integrity this message has| |nugget(a)slacker.com|been encrypted using dual rounds of ROT-13 encryption| |Birmingham, AL USA|Please encrypt all important correspondence with PGP!| ---- To unsubscribe, send email to majordomo(a)llamas.net with 'unsubscribe rc5' in the body.

4 4