December 2003 - cypherpunks-legacy

Re: Bay Area Cypherpunks meeting announcement
by Blanc 17 Dec '03

17 Dec '03

Lucky Green wrote: >o Cypherpunks Tonga will announce [...] > >o Cypherpunks Tonga will then combine [...] ........................................................ What is Cypherpunks Tonga? .. Blanc

2 1

WARNING: Serious Pentium Bug
by Anonymous 17 Dec '03

17 Dec '03

There is a SERIOUS bug in all pentium CPUs. The following code will crash any machine running on a pentium CPU, MMX or no MMX, any speed, regardless of OS (crash as in instant seize, hard reboot the only cure): char x [5] = { 0xf0, 0x0f, 0xc7, 0xc8 }; main () { void (*f)() = x; f(); } This require no special permissions to run, it works fine with average-joe-userspace permissions. I have verified this, it works. Demand a new CPU from Intel.

4 3

YOUR LISTING ON YAHOO!
by brian＠firstgear.com.firstgear.com 17 Dec '03

17 Dec '03

Hi: This email is in reference to YOUR LISTING ON YAHOO! If you are interested in placing your web site in the TOP TEN on the major search engines, please read on. (If not, please disregard this email and accept our apology for any intrusion.) reply with remove in the subject. For those of you who are interested, please read on! (Ed. note: Yahoo asked that we mention that our group and Yahoo are not affiliated --they probably wouldn't let us publish this if we were affiliated). ____________________________________________________________ SEARCH ENGINE SECRETS HOW YOU CAN GET YOUR SITE CONSISTENTLY IN THE TOP 10 ON MAJOR SEARCH ENGINES (and watch your hit count skyrocket) http://www.servicebrokers.com/SES3.htm As you probably noticed with the listing of your site on the search engines, it is becoming more and more difficult to be found among the MILLIONS of listings. If you"re like the rest of us you have found it extremely frustrating. You spend lots of time and money developing your site and then you're listed number 30, or 80, or even 200th. You're NEVER FOUND. *************************** GOOD NEWS The good news is we have found a SOLUTION. After months of fighting the search engine battle we got LUCKY. A programmer recently became associated with our firm who had done some CONSULTING WORK for six months with one of the major search engines. With his help we developed a REPORT on the major search engines and how they really work. ***************************** REPORT His report is excellent. We have been using the material in the report for over five months. IT WORKS! With it, our sites are in the top TEN listings on all major search engines and we have experienced a virtual stampede of people to the web sites. HITS ARE UP, SALES ARE UP, and most importantly, everyone is HAPPY. > > *************************** YOUR COPY > > Now, YOU CAN HAVE A COPY of his report. In it you will find: > > > > How to vault in the TOP TEN on any search engine using any keyword. Strategies that put you ahead of 95% of the other sites online. How to STAY in that TOP TEN. How to improve your chances of being found in about 10 MINUTES. > > How the search engines calculate CONFIDENCE ratings (and what that means to you). > > Killer META TAGS that totally blow away your competitors. > > Which search engines are the very BEST FOR YOU. > > How to get your site REGISTERED for FREE at over 200 locations, in one easy step (it takes 10 minutes). > > How to BLOCK out part of your site from the search engines (and why you should do it). > > The effect of REPEATING KEY WORDS. (good or bad?) What happens when you repeat them too many times? > > LATEST FORMS for developing the best meta tags. Meta Tag strategies that can broaden your audience and build high volume web traffic for you. We tell you exactly what to do and show you SPECIFIC EXAMPLES. And it's SIMPLE and EASY to understand. So you can put the principles to immediate use. > > The benefits of site UPDATING. How often? What NOT to do! Avoid making those errors which can cost you. > > > and even > > How to legally "steal" your competitor's web traffic and send it to your site. Type in your competitor's name and YOUR NAME will appear FIRST! > > > *************************** > > WHAT DOES IT COST? > > The material is only $19.95, and is unconditionally guaranteed to work for you. Just follow the instructions and you will find your site in the top ten too. Ordering is SAFE and EASY. For more information, or to RECEIVE this 18 page report by email just go to our INSTANT-DELIVERY SECURE order form at: http://www.servicebrokers.com/SES3.htm (Order on line and you will receive your report in JUST 60 SECONDS.) Now that your site is up shouldn't you take this MOST IMPORTANT LAST STEP so people can find it. ****************************** UNCONDITIONAL GUARANTEE Remember, we UNCONDITIONALLY GUARANTEE IT WORKS. You can't lose. ******************************** SPECIAL FREE BONUS Order within 48 hours, we and will include, AS A FREE BONUS, information on over 500 SEARCH ENGINES and directories where you can list your site for free. (Some are very specialized and targeted). SPECIAL NOTE: If you are busy and don't have time to go to our web site INSTANT-DELIVERY SECURE ORDER FORM, you can order by FAX. (The unconditional guarantee still applies!) Just fill in the FAX FORM AT THE BOTTOM OF THIS PAGE. Then FAX it to us at: > > 1-305-289-1884 > If you order by FAX your copy of the report will be sent to you by email within 24 hrs. Or, if you prefer, you can send your order with a CHECK by snail mail to the address below. (Be sure to include your email address for delivery.) Whichever method you choose to order, YOU'LL BE GLAD YOU DID! Best of luck with your web site! Leeds Publishing 5800 Overseas Hwy., St. 35-154 Marathon Key, Fl. 33050 Fax 305-289-1884 http://www.servicebrokers.com/SES3.htm ________________________________________________________________________ >________________________________________________________________________ > FAX ORDER FORM > (Please print clearly) > >FAX TO: Leeds Publishing > >FAX NUMBER: 1-305-289-1884 Hi: Here is my order for Search Engine Secrets at $19.95 only. I understand it is unconditionally guaranteed. Include my FREE BONUS of 500 search engines. Send by email ASAP. Date:__________________ > NAME:_______________________________________________ > E-MAIL ADDRESS:______________________________________________________________ (PLEASE be accurate. One small error and we can't send your order). > >CARD TYPE:_________________ > >CARD NUMBER:_________________________________________________ > >EXPIRATION DATE:______________ > >NAME ON CARD:________________________________________________ > > >Thanks for ordering. Your copy of the report will be sent to you by email ASAP. > >____________________________________________________________ >____________________________________________________________ > > >Copyright 1997 Leeds and Rousseau Publishing. All rights reserved. Form 102 GD-Yahoo >

1 0

Totally breakable V(aporware) M(oney-making) E(ncryption)
by semprini＠theschool.com 17 Dec '03

17 Dec '03

I just finished reading the contents of the VME web-site. I have a few things to say. :) First of all the web-site blows elephant cock. You would think with guys smart enough to come up with "unbreakable encryption", they would at least be able to design a good site. Second, they make a big deal about how fast it is and how it can encrypt *ONE WHOLE FAT MEGABYTE A MINUTE*! Big whoop. Hope nobody wants to encrypt anything useful besides teensy weensy e-mails, 'cause you're gonna grow old before it finishes encrypting. Third, what the hell good is it if nobody can see the source code? It's well known that a trademark of bad cryptographic systems are the ones that rely on secrecy of the algorithm. Some happy little geek in his college computer lab is going to spend the time needed to reverse engineer the program, which they claim is "impossible to reverse engineer". Well, they didn't say it was "impossible", but they did say that the code is so complicated that nobody would be able to understand it if they ever did reverse engineer it. Bullshit. I know a 15 year old kid who actually has the patience to go through a few thousand lines of assembly code just to see what a program really does. Fourth, as someone else pointed out, the description of the algorithm is filled with words like "revolutionary" and "super-fast", etc. The descriptions of how the program works are so vague and general that it hards to believe they even have a running program. The description of the encryption sounds all very pretty, but I seriously wonder if that's the extent of the security. Almost like having a gold plated sign on your door saying "Keep out!" and then leaving your door unlocked. Fifth, their "challenge" to these major corportions merely states that they gave IBM, MS, and Netscape this big challenge to crack the system, but it never actually says the companies took up the offer and are actively trying to crack it. How's this one? "Microsoft, Netscape, and IBM!! I challenge you to crack my version of the Caesar Cipher!" There. I can now claim that I have challenged all the big corps to crack my crypto scheme. Challenging a big company doesn't prove a thing. Anyway, that's my rant and rave. Just as a small side note, if you would like to see some good examples of Madison Avenue at work then just visit this web-site: http://www.meganet.com > News report Nov 7, 97: > > AT&T, Hewlett Packard, Intel Corporation, Dell Computers, and > many other leading computer corporations have been added to the > challenge list by Meganet Corporation. The challenge started > last week with Bill Gates, now some of his peers have an opportunity > to validate or discredit the bold claim that Meganet's VME > (Virtual Matrix Encryption) is totally unbreakable. > > Unbreakable encryption is the only answer to security > in our electronic world. This is graphically illustrated > by the recent report from the National Security Agency > reporting the open market availability of a $10 chip that > can test up to 200 million keys per second. The 56-bit key, > government and banking standard, can be compromised in > twelve (12) seconds with brute force using ASIC > (Application-specific Integrated Circuits) chips. > > Meganet has the answer with its new VME (Virtual Matrix > Encryption). The impenetrable VME also has extreme speed, > much faster than any existing program available today. > > Major computer companies are already starting discussions > to acquire the rights to market this incredible new data > encryption system. More information about this > exciting new technology can be found at: www.meganet.com > > ---------- > > Hmm, wonder if it has impenetrable GAK and CAK options. > >

1 0

Free Wallpaper Tip!!
by 62789105＠06090.com 17 Dec '03

17 Dec '03

Free Wallpaper Tip!!!! A lot of people have had dark wallpaper installed or have installed it themselves, over a light colored wall, and over time the wall shows through because the seams have expanded. _____________________________________________________ Here is how to remedy this problem. Take a latex (eggshell finish) paint tinted to the color of the wallpaper background. Paint seam about 3ft down the wall with a small paint brush. (1inch) Wipe off immediately, and continue on down to finish off the seam. Repeat on every seam that needs it. Move the brush up and down to color the wall in between seams. ______________________________________________________ You just saved yourself a new wallpaper job. Now the room is like new, and just in time for the holidays! Want to save more money with great tips like this? Of course you do, everybody would. Well I have ALL of the tips and tricks that the pros use to hang paper. Not because I collected them..no, because I used them every day. I am a retired paperhanger with over 25 years experience. I have written an in depth guide for hanging wallpaper. This guide cuts through all the clutter and gets down to the one thing you need to know...how to hang successfully. This guide will teach you lots of tips and tricks, my way. That's not all, I have also put together a report on all the tricks and tips that paperhangers use! Including devious things unscrupulous contractors use to cheat you. These are the tricks that cost you money. The tricks that homeowners just never know, but the paperhangers do! Now you can too!! You can have both reports for the one low price of just $14.95 Print out form below , fill in and mail with check or m/o to: ImagePro Press 2018 Electric Rd SW, Suite 227 Roanoke,VA 24018 NAME______________________________________________ ADDRESS___________________________________________ APPT#________ CITY__________________ STATE________ ZIP____________ EMAIL ______________________________________________ HOME PHONE___ (____) ______ _______

1 0

CHALLENGE to Meganet VME: million dollar hype?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Meganet Corporation (818) 757-3890 19528 Ventura Blvd. Suite 317 Tarzana, CA 91356 OPEN CHALLENGE TO YOU over the last 30 years I have seen hundreds of new "unbreakable" encryption programs; all of them have the same claims, the same challenges, and the same secrecy. but, with several notable exceptions, each has contained a fatal flaw. and I have seen even my own "perfect" algorithms fall apart when I awake... therefore, if you want any serious encryption experts to endorse your product as having a factor of "unbreakability" by forcing the level of brute force necessary to do so, provide the algorithm and the associated source code to a few of us who enjoy breaking algorithms as much as we enjoy trying to create them. I dont have time, any more than my colleagues will have time, to waste on foolishness represented by your amateur challenge. until you are willing to submit to an open review by your peers, your supposed encryption product is YAP. secondly, until your methodology is reviewed, we will consider the product a schill to Louis Freeh and other GAK and trap door mandated system advocates. if you wish to be considered a serious contender to replace RSA, it's time to put your cards on the table; we see your nickel and call. in the matter of public encryption, there is no secrecy, or there is no use. your move. attila out... cc: cypherpunks(a)cyberpass.net -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNGRf3LR8UA6T6u61AQGbHgH8CRQZShIUzW0wr1ib7cQGSfMcUbJTygx9 ckzuU/NB4W4u11rEjSQzC5ozybWWxHcjSQel+CZ79wPAP0vM+HM7Jg== =zTyp -----END PGP SIGNATURE-----

2 1

Major security flaw in Cybercash 2.1.2 (fwd)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Bob Antia <antia(a)leftbank.com> Subject: Major security flaw in Cybercash 2.1.2 (fwd) To: mjbauer(a)leftbank.com (Michael Bauer), rah(a)shipwright.com Date: Sat, 8 Nov 1997 10:04:14 -0500 (EST) MIME-Version: 1.0 Approved-By: aleph1(a)UNDERGROUND.ORG Message-ID: <f58bccfc52aba91d0973f9bf33160ddd(a)anon.efga.org> Date: Fri, 7 Nov 1997 22:54:16 -0500 Reply-To: Anonymous <anon(a)ANON.EFGA.ORG> Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> Comments: This message was remailed by a FREE automated remailing service. For additional information on this service, send a message with the subject "remailer-help" to remailer(a)anon.efga.org. The body of the message will be discarded. To report abuse, contact the operator at admin(a)anon.efga.org. Headers below this point were inserted by the original sender. From: Anonymous <anon(a)ANON.EFGA.ORG> Subject: Major security flaw in Cybercash 2.1.2 To: BUGTRAQ(a)NETSPACE.ORG CyberCash v. 2.1.2 has a major security flaw that causes all credit card information processed by the server to be logged in a file with world-readable permissions. This security flaw exists in the default CyberCash installation and configuration. The flaw is a result of not being able to turn off debugging. Setting the "DEBUG" flag to "0" in the configuration files simply has no effect on the operation of the server. In CyberCash's server, when the "DEBUG" flag is on, the contents of all credit card transactions are written to a log file (named "Debug.log" by default). The easiest workaround I've found is to simply delete the existing Debug.log file. In my experience with the Solaris release, the CyberCash software does not create this file at start time when the DEBUG flag is set to 0. The inability to turn off debugging is noted on CyberCash's web site under "Known Limitations". The fact that credit card numbers are stored in the clear, in a world readable file, is not. --jet -b Bob Antia antia(a)leftbank.com The Left Bank Operation, Inc. http://www.leftbank.com TCP/IP Internetworking LAN/WAN/NT/UNIX Admin PGP fingerprint 9B 70 FF 2D 03 CC 5F C1 3E 29 6E D4 16 79 44 A8 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Bay Area Cypherpunks meeting announcement
by Colin Plumb 17 Dec '03

17 Dec '03

Additionally, there will be a release of the PGP 5.0 Unix Specific Source Code Update at the public meeting. -- -Colin

1 0

DO YOU WAGER / GAMBLE ON SPORTS ?
by 99001680＠msn.com 17 Dec '03

17 Dec '03

MR ACTION HAS THE WINNERS FOR SUNDAY & MONDAY NFL & BASKETBALL GUARANTEED TO WIN !!! UP NOW AT 1-900-484-7777 $18.00 per call Under 18 years of age ?? Don't Call!!! This is a guaranteed pick line. If you do not have a winning day with these selections we will replace the selections or make a refund!!

1 0

E-Peso's for tractors - McCaffrey on banking
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Blair Anderson" <blair(a)technologist.com> To: "dcsb(a)ai.mit.edu" <dcsb(a)ai.mit.edu> Date: Sun, 09 Nov 97 01:53:59 +1300 Priority: Normal MIME-Version: 1.0 Subject: E-Peso's for tractors - McCaffrey on banking Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Blair Anderson" <blair(a)technologist.com> 06:24 p.m Nov 05, 1997 Eastern U.S. drug czar appeals to banks to track laundering By Anthony Boadle WASHINGTON (Reuters) - Bankers, watch those ``smurf'' accounts. That was the message drug enforcement authorities gave the American Bankers Association and the American Bar Association at their annual money laundering conference Wednesday. Any innocent-looking person could be depositing a drug baron's cash parceled into amounts smaller that the $10,000 reporting threshhold to avoid suspicion, so get to know your customer, they warned. Traffickers hire individuals or ``smurfs'' who open small accounts at U.S. banks in their own or fictitious names. Once in the system, drug money becomes very hard to trace, White House drug policy director Gen. Barry McCaffrey said. Americans spend $49 billion a year on illegal drugs and much of that cash has to go through banks and corporations to get back to the Colombian cartels that ship cocaine and heroin to the the United States, he said. McCaffrey said drug traffickers were becoming increasingly sophisticated in laundering their proceeds, resorting to high tech communication encryption and ``cybercash'' transactions over the Internet. ``We are not going to find dumb guys stumbling into bank branches in New York City with cardboard boxes full of $20 bills that test positive for cocaine,'' he said. ``We are losing contact with the enemy,'' the general said. ''The government cannot follow laundering by itself. You are going to have to help.'' McCaffrey said the drug trade was moving into new areas such as the securities industry to launder its profits. Treasury Department Undersecretary for Enforcement, Raymond Kelly, said Colombian cartels were using a black market peso brokering system to send home their profits. Cartels sell their dollars at a discount to Colombian businessmen who need to buy goods in the United States. The dollars go to pay the U.S. manufacturer or exporter. The pesos never leave Colombia and end up in the drug baron's account. A hooded Colombian woman testified in Congress last month that she had laundered money through large U.S. banks and corporations unwittingly used by black market peso brokers. She cited the case of drug dollars going to pay for a tractor for a Colombian farmer. Keely, a former New York City police commissioner, warned that money laudering was corroding financial institutions. ``It is the source and the product of a burgeoning global parallel trading system that serves the emerging criminal holding companies,'' he told the bankers and lawyers. Kelly said the Clinton administration has worked to lessen the burden of the Suspicious Activity Reports that banks are obliged to file under the Banking Secrecy Act. The banking industry complained it had to file 12 million such reports in 1996, a time consuming and costly activity. New regulations exempts banks from reporting on certain customers, such as corporations listed on stock markets and their subsidiaries. But a new set of rules exempting additional businesses has caused an uproar among bankers because they would have to track the daily currency operations of these businesses for one year and project their annual currency needs. Copyright 1997 Reuters Limited. All rights reserved. Blair Anderson (Blair(a)technologist.com) International Consultant in Electronic Commerce, Encryption and Electronic Rights Management "Techno Junk and Grey Matter" (HTTP://WWW.NOW.CO.NZ [moving servers, currently inactive]) 50 Wainoni Road, Christchurch, New Zealand phone 64 3 3894065 fax 64 3 3894065 Member Digital Commerce Society of Boston ---------------------------- Caught in the Net for 25 years ---------------------------- For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Content controls
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Sat, 8 Nov 1997 09:29:04 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Content controls Cc: whgiii(a)invweb.net, dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) >>>A whole bunch of people are now talking about these cash-settled recursive >>>auction processes, and they're a direct, and now obvious, consequence of >>>bearer (or at least instant) settlement markets for information on geodesic >>>networks. When you add anonymity to the transaction, you pretty much have >>>the final straw for "rights" tracking. Watermarks just tell you who the >>>information was stolen from, for instance. So, one more industrial >>>information process bites the dust. > >>Whoa! Hang on here. Sure, watermarks will tell you who information was >>stolen from, but they're just a stalking horse... a weak second cousin to >>*persistent* content control technologies (such as IBM's Cryptolopes and >>Intertrust's Digiboxes). These allow rightsholders to manage a wide >>range of parameters (including price, usage context, and any other >>variable for which you can imagine having a certificate). Whats >>fundamentally different about what are generically referred to as secure >>envelopes, is that they can maintain controls *indefinitely* >>(persistence), across an un- >>known, ad hoc, web of distribution over which one otherwise has no >>control. And yes, this can all work even in a completely disconnected >>environment (laptop at 35,000 feet). > >>They allow rightsholders, if they so choose, to *continue* being rights- >>holders in a highly networked, digital world, and in a wide range of new >>ways, based on entirely new (or old) business models, that take advantage >>of rich/elaborate conditions for usage (e.g. you can view this picture >>anonymously, but it will cost you 2X as much, and you can only get it at >>low resolution, and you can't view it at all unless you can prove that >>you don't live in the Middle East). No certificate for these conditions? >>Sorry, no content. > >>They are based the same basic stuff (public key cryptography of course) >>that *can* fuel wild anarchic visions of anonymous exchange. ;) > >>But they aren't at all deterministic of any particular economic model. > >Well how exactly does one prevent data from being stolen once it has been >unlocked? I pay my 2X to view the picture anonymously and now I copy it >save it and distribute it worldwide. I fail to see how any >encryption/watermark scheme can prevent me from doing so. The control technologies to which I referred earlier turn the lock/unlock idea into far more than a binary choice. This is what I meant by "persistence". The content cannot be used without its accompanying control set (which again, *might* include payment). Part of the control set I may impose on anonymous viewers could include preventing them from copying or saving the content directly in digital form. This is counter-intuitive to those of us who are used to having cut/paste available at our fingertips in most applications, but its relatively trivial to disable these functions on a file by file basis. Alternatively, I might impose controls that permit anonymous users to see *only* lower reso- lution versions. (by analogy, if you're going to wear a ski mask into a jewelry store, you aren't likely to be shown the expensive stuff - if they let you in the door in the first place). If you were really determined, you could always take a photo of the screen, re-scan it, do some image enhancement to get rid of the graini- ness, re-save it and post it on your web page for all to see, (the so-called digital-to-analog-to-digital work-around), but this is darned inconvenient. Also, try doing that with music or movies.... while avoiding the roving automated net 'bots that will be out looking for illegal copies of content (these are already common). Not worth it. For most people. If it were, we'd already have massive illegal scanning operations in third-world countries, and plenty of demand for their wares. Sure, this exists, and may even grow a bit around the fringes, but this hardly proves the case for a single vision of an anarchic Robin Hood future for all content (Sell today else I rip you off tomorrow!!) As a non-disclosed third party, I'm not at liberty to discuss the 'guts' of either the Crytolope or Digibox technologies (though I have seen them) Both are covered, as you might imagine, by a fairly extensive array of active and pending patents. If you want to learn more, I'd recommend contacting them directly: www.intertrust.com (or their partner, Softbank NetSolutions) www.infomkt.ibm.com Cheers. - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Hughes Markets? (finally some stimulating debate on dcsb)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Sat, 8 Nov 1997 09:28:21 -0500 To: "R. Jason Cronk" <listmanager(a)orange.redmans.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Re: Hughes Markets? (finally some stimulating debate on dcsb) Cc: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) I wrote: >>Whoa! Hang on here. Sure, watermarks will tell you who information >>was stolen from, but they're just a stalking horse... a weak second cousin >>to *persistent* content control technologies (such as IBM's Cryptolopes >>and Intertrust's Digiboxes). These allow rightsholders to manage a wide > ><SNIP> > >>They allow rightsholders, if they so choose, to *continue* being rights- >>holders in a highly networked, digital world, and in a wide range of new To which R. Jason Cronk replied: >"if they so choose" and here is where I submit the two camps divide. Yep. I couldn't agree more. There will be at *least* two, (and probably more like 2000) 'camps'. And here is where I think we diverge.... >Sure, you can decide to try to hold on to the rights, but it is going to be >market suicide. Your best bet is to sell it all off, get what you can for >it and do it again. In other words, a recursive auction market. With more sophisticated tools for rights management, the market contest can move to another level, with content business models *themselves* vying for attention. Recursive auctions are merely one of these models. They may make perfect sense for the kind of content that is going to decline in value over time anyway (news, for example). Not all content works this way though. Recursive auction markets are exciting because for the most part, they haven't been possible in 'copyright' industries until recently. Its easy to say that they will be more important than they are today. They will. But to say that they are fore-ordained as the only way for creators to get compensated is much too narrow. This view would only make sense if detaching copies from usage controls were easy. Today it is, and there is a common misconception that this will continue. But it won't. Cryptographers especially should understand this. The same base technology that makes it extremely difficult to mint one's own digital coins in someone else's currency will make it extremely difficult to use someone else's digital content without complying with their controls (including payment). It is inconsistent to say that digital money can have persistent value and digital content cannot. Both are information. Both based on a common faith in a 'brand': either the U.S. Treasury or Disney. Same idea. Best, - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

New GAO y2k reports
by Steve Schear 17 Dec '03

17 Dec '03

The following General Accounting Reports recently became available: - Year 2000 Computing Crisis: National Credit Union Administration's Efforts to Ensure Credit Union Systems Are Year 2000 Compliant. T-AIMD-98-20. 14 pp. October 22, 1997. http://www.gao.gov/new.items/ai98020t.pdf NCUA admits that they are in deep do-do. "... (1) current agency efforts to determine industrywide compliance are behind the generally accepted schedule for achieving Year 2000 compliance, and, consequently, NCUA does not yet have a complete picture of where credit unions stand individually or as an industry, (2) the agency lacks a formal, documented contingency plan in case credit unions do not become compliant in time or have other problems, (3) credit union internal auditors may not be thoroughly addressing Year 2000 issues as part of their work, and (4) NCUA does not have enough technical capability to conduct Year 2000 and other examinations in complex systems areas." "... the problem could lead to numerous problems when calculations requiring the use of dates are performed, such as calculating interest, calculating truth-in-lending or truth-in-savings disclosures, and determining amortization schedules. Moreover, automated teller machines may also assume that all bank cards are expired due to this problem. In addition, errors caused by Year 2000 miscalculations may expose institutions and data centers to financial liability and risk of damage to customer confidence. Other systems important to the day-to-day business of credit unions may be affected as well. For example, telephone systems could shut down as can vaults, security and alarm systems, elevators, and fax machines." - Social Security Administration: Significant Progress Made In Year 2000 Effort, But Key Risks Remain. AIMD-98-6. 17 pp. plus 2 appendices (6 pp.) October 22, 1997. http://www.gao.gov/new.items/ai98006.pdf The SSA reports that about 80% of its core code has been converted and tested and is confident of completion by January 1999, but that significant y2k exposure remains due to possible contamination from non-compliant sources of information (e.g., state disability and other federal agencies). --Steve

1 0

S/MIME Mail Security WG approved - IETF
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Sat, 8 Nov 1997 12:37:28 -0500 To: dcsb(a)ai.mit.edu From: Vin McLellan <vin(a)shore.net> Subject: S/MIME Mail Security WG approved - IETF Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Vin McLellan <vin(a)shore.net> <Forwarded message; off the IETF-Announce mailing list> ------------------------- To: IETF-Announce: ; Subject: WG ACTION: S/MIME Mail Security (smime) Date: Fri, 07 Nov 1997 18:19:29 -0500 From: Steve Coya <scoya(a)cnri.reston.va.us> A new working group has been approved in the Security Area of the IETF. Contact the Area Director or Working Group Chair for more information. S/MIME Mail Security (smime) ---------------------------- Chair(s): Russ Housley <housley(a)spyrus.com> Security Area Director(s): Jeffrey Schiller <jis(a)mit.edu> Security Area Advisor: Jeffrey Schiller <jis(a)mit.edu> Mailing Lists: General Discussion:ietf-smime@imc.org To Subscribe: ietf-smime-request(a)imc.org Archive: http://www.imc.org/ietf-smime/ Description of Working Group: The S/MIME Working Group will define MIME encapsulation of digitally signed and encrypted objects whose format is based on PKCS #7. [1] X.509 Certificates and CRLs as profiled by the existing PKIX Working Group will be used to support authentication and key management. The Working Group will base its work on the S/MIME version 2 specification (available from RSA Data Security), but the Working Group will be free to change any part of that specification. In particular, the Working Group will prepare a new document that allows algorithm independence, based on PKCS #7 1.5. The message syntax specification, based on PKCS #7 version 1.5, will be expanded to allow additional key signature and key exchange algorithms. The message and certificate specifications will be revised to allow them to become standards. The optional security extensions document will specify protocols that allow for additional security features, such as signed message receipts. The S/MIME Working Group will attempt to coordinate its efforts with the OpenPGP Working Group in areas where the work of the two groups overlap, particularly in specification of cryptographic algorithms and MIME structure. [1] RSA Data Security publishes the PKCS Series of documents. RSA Data Security has permitted the IETF to publish them as Informational RFCs as well as to extend and enhance them. Goals and Milestones: Nov 97 Submit First draft of message syntax specification as an I-D. Nov 97 Submit First draft of S/MIME v3 message specification as an I-D. Nov 97 Submit First draft of S/MIME optional security extensions as an I-D. Nov 97 Submit First draft of S/MIME v3 certificate specification as an I-D Dec 97 WG Last Call on Message Syntax. Dec 97 WG Last Call on Certifiticate Specification. Dec 97 WG Last Call on Message specification. Jan 98 WG Last Call on Optional Security Extensions. Jan 98 Submit Message Syntax I-D to IESG for consideration as a /end forwarded message/ "Cryptography is like literacy in the Dark Ages. Infinitely potent, for good and ill... yet basically an intellectual construct, an idea, which by its nature will resist efforts to restrict it to bureaucrats and others who deem only themselves worthy of such Privilege." _ A thinking man's Creed for Crypto/ vbm. * Vin McLellan + The Privacy Guild + <vin(a)shore.net> * 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Senator Ashcroft on Encryption
by John Young 17 Dec '03

17 Dec '03

[Congressional Record: November 7, 1997 (Senate)] [Page S11959] ENCRYPTION Mr. ASHCROFT. Mr. President, I wanted to take a moment to associate myself with the comments of the majority leader from October 21, 1997. Senator Lott has correctly highlighted the FBI's constantly shifting arguments and the Bureau's seemingly relentless attempts to grab more power at the expense of the Constitution, particularly the fourth amendment's protection of privacy and the fifth amendment's guarantee of due process. The FBI legislative proposal goes far beyond the Commerce Committee's misguided encryption legislation in further disregarding our Constitution. Instead of working with those who understand that S.909 gives the FBI unprecedented and troubling authority to invade lives, the FBI has attempted to grab even broader authority. The Senate would be foolish to pass S.909. In no way can we even consider the ill-advised FBI approach. The reach of the FBI has now extended so far that the President has taken the other side of the issue and supported a free market approach, according to his public comments delivered abroad. I can only conclude that the FBI has introduced its proposal as a ploy to make S.909 look like a reasonable compromise. The only other explanation for the FBI's proposal is that the Bureau will not be satisfied with S.909, but instead will continue to work to erode our Constitutional protections. In fact, the new proposal only draws attention to the many problems of the Commerce Committee language. Neither proposal is acceptable. The issue of encryption must be revisited in a real and serious way next year, both at the committee level and in the Senate chamber, to examine the many Constitutional implications of the various proposals. I look forward to working with the Majority Leader and other Senators who have expressed interest in encryption legislation. I yield the floor. [End] See Senator Lott's comments on encryption: http://jya.com/lott-crypto.htm

1 0

Re: Content controls
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <v02140b10b08a1ba0a4ac(a)[198.115.135.201]>, on 11/08/97 at 09:29 AM, hutchinson(a)ncri.com (Art Hutchinson) said: >>>>A whole bunch of people are now talking about these cash-settled recursive >>>>auction processes, and they're a direct, and now obvious, consequence of >>>>bearer (or at least instant) settlement markets for information on geodesic >>>>networks. When you add anonymity to the transaction, you pretty much have >>>>the final straw for "rights" tracking. Watermarks just tell you who the >>>>information was stolen from, for instance. So, one more industrial >>>>information process bites the dust. >> >>>Whoa! Hang on here. Sure, watermarks will tell you who information was >>>stolen from, but they're just a stalking horse... a weak second cousin to >>>*persistent* content control technologies (such as IBM's Cryptolopes and >>>Intertrust's Digiboxes). These allow rightsholders to manage a wide >>>range of parameters (including price, usage context, and any other >>>variable for which you can imagine having a certificate). Whats >>>fundamentally different about what are generically referred to as secure >>>envelopes, is that they can maintain controls *indefinitely* >>>(persistence), across an un- >>>known, ad hoc, web of distribution over which one otherwise has no >>>control. And yes, this can all work even in a completely disconnected >>>environment (laptop at 35,000 feet). >> >>>They allow rightsholders, if they so choose, to *continue* being rights- >>>holders in a highly networked, digital world, and in a wide range of new >>>ways, based on entirely new (or old) business models, that take advantage >>>of rich/elaborate conditions for usage (e.g. you can view this picture >>>anonymously, but it will cost you 2X as much, and you can only get it at >>>low resolution, and you can't view it at all unless you can prove that >>>you don't live in the Middle East). No certificate for these conditions? >>>Sorry, no content. >> >>>They are based the same basic stuff (public key cryptography of course) >>>that *can* fuel wild anarchic visions of anonymous exchange. ;) >> >>>But they aren't at all deterministic of any particular economic model. >> >>Well how exactly does one prevent data from being stolen once it has been >>unlocked? I pay my 2X to view the picture anonymously and now I copy it >>save it and distribute it worldwide. I fail to see how any >>encryption/watermark scheme can prevent me from doing so. >The control technologies to which I referred earlier turn the lock/unlock >idea into far more than a binary choice. This is what I meant by >"persistence". The content cannot be used without its accompanying >control set (which again, *might* include payment). Part of the control >set I may impose on anonymous viewers could include preventing them from >copying or saving the content directly in digital form. >This is counter-intuitive to those of us who are used to having cut/paste > available at our fingertips in most applications, but its relatively >trivial to disable these functions on a file by file basis. >Alternatively, I might impose controls that permit anonymous users to see >*only* lower reso- >lution versions. (by analogy, if you're going to wear a ski mask into a >jewelry store, you aren't likely to be shown the expensive stuff - if >they let you in the door in the first place). Can't do it. :) Once you have given me the keys to unlock and display the data I can save it, copy it, reproduce it and distribut it. To assume otherwise shows a lack of understanding of computer systems and moderen OS's. Sure I would need to write some software and jump through some hoops to do it but there is nothing that your system can do to prevent me from doing so. Now wether it is worth the effort to do so will depend on the value of the data involved. Once you have given me the ability to display the data you have lost the battle as I can do whatever I want with it. As far as the anonymous purchaces, no a big deal. Wan Sin Soo pays the full $$$ amount decrypts the data, copies it and send it too his buddies in Bangledesh. Next week there is a million copies of your data floating around the Far-East and Wan Sin Soo is nowhere to be found. The fact that he bought it non-anonymously is of little relevance. >If you were really determined, you could always take a photo of the >screen, re-scan it, do some image enhancement to get rid of the graini- >ness, re-save it and post it on your web page for all to see, (the >so-called digital-to-analog-to-digital work-around), but this is darned >inconvenient. Also, try doing that with music or movies.... while >avoiding the roving automated net 'bots that will be out looking for >illegal copies of content (these are already common). Not worth it. >For most people. digital-analog-digital is completly unnessasary. >If it were, we'd already have massive illegal scanning operations in >third-world countries, and plenty of demand for their wares. Sure, this >exists, and may even grow a bit around the fringes, but this hardly >proves the case for a single vision of an anarchic Robin Hood future for >all content (Sell today else I rip you off tomorrow!!) There are. China, Russia, Eastern Europe, Far East. You have multi-million dollar operations that all they do is pirate software, movies, music, ...ect. If the can make money pirating your data then the will do so. >As a non-disclosed third party, I'm not at liberty to discuss the 'guts' >of either the Crytolope or Digibox technologies (though I have seen >them) Both are covered, as you might imagine, by a fairly extensive array >of active and pending patents. If you want to learn more, I'd recommend > contacting them directly: I have not looked at Digibox but I have looked at Crytolope and the technology can be defeated. All these systems do is make it hard for Joe SixPack running WinBlows 2000 to make a couple of copies for his freinds. For anyone determined to pirate the data this is just a minor inconvienance just like other such schemes in the past. - -- - --------------------------------------------------------------- William H. Geiger III http://users.invweb.net/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNGSJEY9Co1n+aLhhAQFOtQP/WlOYl/33Qeko3eFaBAWR6ajYcFoONYQ/ +vDLDgY55x3fVwoVumB62AjtUIXM+deHAruKjDw0rgLhzRhqilOndw/0D+FT8HV3 4W0rehoSG3s3T2hqkJq1vq29X+fQJ7LqE7nWTS0wWEZjBEMkPZyIv50/rRTSK+rB /VIF1esIG3o= =/qfm -----END PGP SIGNATURE-----

1 0

F00FC7C8 Kills P5
by Eric Cordian 17 Dec '03

17 Dec '03

In comp.sys.intel, the keeper of the Intel Secrets Website, rcollins(a)slip.net (Robert Collins) writes this absolutely amazing paragraph: > If nobody knew about this problem, nobody would be affected > by it. Therefore, without knowledge of this problem, there > really isn't a reasonable security risk to multi-user > systems. > No, I had no desire to publicize the bug. Egads. Talk about "Security by Obscurity"! Someone buy this poor man a Cypherpunks subscription. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Mathematician Sidney Darlington Dies
by John Young 17 Dec '03

17 Dec '03

NYT obit November 8: Sidney Darlington, a Bell Labs mathematician who pioneered the design of electronic circuits and whose formulas helped launch rockets 300 times without error, died on Oct. 31 at his home in Exeter, N.H. He was 91. At Bell Labs, in Murray Hill, N.J., where he headed the mathematics research center, Dr. Darlington was ranked alongside his colleague Claude Shannon for breakthroughs in communications networks that foreshadowed the integrated circuit and in turn computers and modern communications. Dr. Darlington's discovery of ways to custom-design circuits using precise mathematical specifications, a speciality now called network synthesis theory, made him a leading authority in electronic cirsuits for decades, said Dr. Ernest Kuh, a former colleague who is now at the University of California at Berkeley. Before Dr. Darlington's work, circuits were designed in an intuitive, ad hoc manner. His advances won him the highest award in his field, the Medal of Honor of the Institute of Electrical and Electronic Engineers. At a chalkborad at Bell labs with three or four other rocket guidance experts, he would scrawl equations that became the basis for guiding the Air Force Titan I, the Thor-Delta and dozens of other rockets. His rocket guidance formulas could instantly plug in the information from several sources -- the trajectory designed to launch a staellite, the data from radar that tracked the rocket, and the instruments in the rocket itself -- and could then return a flow of commands to the rocket. Always a tinkerer, Dr. Darlington in the 1950's spent a weekend at home playing with a new gadget, the transistor. Trying to get more gain from an amplifier the size of a kernel of corn, he found a way to combine two or more transistors in one chip, an idea that became the Darlington Compound Chip and pointed the way toward integrated circuits. ----- For more see NYT online: http://www.nytimes.com

1 0

Mixed Messages / Re: F00FC7C8 Kills P5 AND Re: Major security flaw in Cybercash 2.1.2 (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Eric Cordian wrote: > In comp.sys.intel, the keeper of the Intel Secrets Website, > rcollins(a)slip.net (Robert Collins) writes this absolutely amazing > paragraph: > > If nobody knew about this problem, nobody would be affected > > by it. > > No, I had no desire to publicize the bug. > Egads. Talk about "Security by Obscurity"! Robert Hettinga wrote: > Subject: Major security flaw in Cybercash 2.1.2 (fwd) > CyberCash v. 2.1.2 has a major security flaw that causes all credit > card information processed by the server to be logged in a file with > world-readable permissions. This security flaw exists in the default > CyberCash installation and configuration. We at the Electronic Fraud Foundation also have no desire for these bugs to be publicized. We're making a goddamn fortune off of them. (Damn near as much as we're making off of our remailer-donation scam.) Ura Fishpal, Flounder, Electronic Fraud Foundation [Note: You are required by Federal Law to pay me one dollar for reading this post. Send $1 to EFF, Box 281, Bienfait, Sask. Canada S0C 0M0] [Note From Your System Administrator: Failure to comply with the above will result in loss of your access privileges and a hernia.]

2 1

Re: Content controls
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

William H. Geiger III wrote: > Someone typing with gloves on wrote: > >by analogy, if you're going to wear a ski mask into a > >jewelry store, you aren't likely to be shown the expensive stuff Sounds like the voice of experience. > Once you have given me the keys to unlock and display the data I can save > it, copy it, reproduce it and distribut it. > As far as the anonymous purchaces, no a big deal. Wan Sin Soo pays the > full $$$ amount decrypts the data, copies it and send it too his buddies > in Bangledesh. Next week there is a million copies of your data floating > around the Far-East and Wan Sin Soo is nowhere to be found. The fact that > he bought it non-anonymously is of little relevance. I have found WGMicro$oft.com to be much faster than the original web site as well as having much better prices. e.g. - $9.95 for Win95. As well, access to the CIA Internal Search Engine ("The Search Engine that Searches Back!") is just one of the many nice touches to be found on pirate sites. A.B. User "It's not free until the *judge and jury* say it's free."

1 0

Re: [SURVEY try again] pgp5.x / pgp2.x users
by 3umoelle＠informatik.uni-hamburg.de 17 Dec '03

17 Dec '03

> > 20 % of the users who have posted digitally signed messages that are > > available in my news spool (international and local newsgroups and > > mailing lists) use PGP 5. The sample contains 545 unique e-mail > > addresses. YMMV. > > These are very interesting results. One question: what are the groups > about? Are they close in to PGP topics or far away? A number of them are crypto related, including the OpenPGP and a German PGP users' mailing list. Perhaps someone with access to a large newsserver could grep for PGP signatures on the rec.* hierarchy?

1 0

FREE Software makes you MONEY
by Success＠www.kse.or.kr 17 Dec '03

17 Dec '03

Fellow Networker: Please take a close look at MEGA RESOURCE software for fast cash building and advertising you product and program on software WORLDWIDE! This is NOT Meganets, Megabucks, or like any of those other software programs out there. You actually get a product for each code you buy to unlock the software. UNLIMITED LEVELS-unlike the other programs where you drop off the disks. For a FREE EVALUATION copy and the download site and info, "mail to: freeinfo(a)globals-ads.com" for instant info back. DO NOT HIT "REPLY" If you wish to be REMOVED from *this* mailing list, please hit reply and type "REMOVE" in the SUBJECT field (not the body). Our servers are will automatically remove you from our database within 24hrs.

1 0

Sloppy Chips from Intel
by Eric Cordian 17 Dec '03

17 Dec '03

By now everyone has probably heard that Intel Pentium and Pentium MMX chips hang when executing the instruction sequence F00FC7C8 even when in an outer ring of privilege or in V86 mode. With numerous small Linux-based ISPs out there, often providing shell services to anonymous customers, or serving customer-provided CGI programs, the existence and public disclosure such an easily exploitable flaw in their CPU's hardware protection mechanism is catastrophic. Intel, rather than extensively verifying their microprocessors before shipping them out the door, now advertises that its chips may contain "errata," or "deviations from published specifications" and doesn't seem to regard such problems as any big deal. This latest flaw is the third unexpected surprise in Intel's Pentium product line. A serious precision problem in double precision floating divide was discovered in early Pentium chips, and it was recently disclosed that there are circumstances under which the Pentium Pro may fail to generate an exception when a Float to Integer conversion overflows. While today's problem does not permit clandestine entry into a system, since it kills the system when it is exercised, it does raise the question of whether there are other more subtle problems in the hardware protection mechanism, which might enable knowlegable users to execute an occasional instruction at the wrong privelege level, or otherwise do things which should be prohibited according to the published hardware specifications. It is interesting to note that such problems have not been reported in compatible chips manufactured by AMD, a competitor of Intel. Buggy microprocessor microcode can produce very subtle exploitable faults in a chip, which are almost impossible to notice when running ordinary applications and operating systems. Instructions may do the wrong thing only when they follow certain other instructions. There may be rare times when the processor is wrongly interruptable, or when a restricted instruction is not forbidden, or is given access at the wrong privilege level, or with incorrect address translation. Were such features to be deliberately introduced into a chip, in order to permit a backdoor for undetected entry, they could be made completely undetectable, and could depend upon any number of unlikely conditions, or even specific hidden register values, in order to be made manifest. Every microprocessor could even have its own "key" for the activation of such "special features." Unlike Unix, for which complete compilable source code is available, we know little about what what microcode is run through the several million transistors on a typical microprocessor. If sloppy engineering alone produces such dangerous faults, imagine what could happen should industry decide to deliberately cooperate with various LEAs and TLAs. (In the national interest, of course.) The possiblities are truly mind-boggling. Perhaps exploits like tapping Aldrich Ames' PC and crashing Saddam Husseins' PCs en masse were not done by black bag jobs and viri, but by the activation of "National Security" backdoors present in all complex modern microprocessors. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Re: [SURVEY try again] pgp5.x / pgp2.x users
by Robert A. Costner 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:23 AM 11/9/97 +0100, Ulf Möller wrote: >> > 20 % of the users who have posted digitally signed messages that are >> > available in my news spool (international and local newsgroups and >> > mailing lists) use PGP 5. The sample contains 545 unique e-mail >> > addresses. YMMV. Just to skew the numbers, I for instance have PGP 5.0 but am using a 2.6.2 DOS generated key that is RSA, not DSS. Grepping would show me to be PGP5.x, which perhaps technically I am, but my key is really 2.x -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQBVAwUBNGUQUEGpGhRXg5NZAQF7fQH5AfV2VfTwuLYs1ND6UTwoWIzAf3OjTSA8 saBlUQJquCUotwr5zk3cU+KiJJ9/hgLsLzOfet16ow1Do3zop7zUJw== =VDPv -----END PGP SIGNATURE----- -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh@efga.org http://www.efga.org/ run PGP 5.0 for my public key

1 0

Make money From People Watching TV
by skyway＠t-1net.com 17 Dec '03

17 Dec '03

Just Released Bill Gates has just joined with Ted Turner and Rupert Murdock to form the greatest consortium of combined technology and opportunity available today! Their plan is to take over the digital communications market by setting up people with DSS satellite equipment at no charge. As a representative with our company, you will get paid between $25 and $100 for "giving away" Digital Direct Satellites, For every person that joins the business with you to give away free Digital Direct Satellites, you will make an additional $55 to $280 We are getting paid for getting consumers set up with a total Digital Direct Satellite system with no charge, and building the distribution network of the future. Imagine how easy it is to give these away! In the first week sharing it with friends I gave away 5 not even trying and made an extra $375. There are no credit applications for the client to fill out, no mandatory 12 month contracts to join, and no surprises later down the line. The company will even upgrade the system later if it becomes obsolete, For Free! This new union was created intentionally to capture a huge active ongoing database of consumers. That's right, consumers who will purchase continuously from shows like QVC, HSN and many others, and when they purchase off of the TV you as a distributor will also make a commission off everything that they order, even while you are out golfing or sleeping, 24 hours a day. All this from you having them fill out an application that should take no more than 60 seconds. There are several other ways to get paid also, and I have enclosed the actual application for you to review. Could you imagine Christmas when they are buying like crazy and you are getting paid up to 30% of what they purchase off the television? I could and that's why we are here. Come "profit from the future of television" and join the fastest growing segment of this company and become a winner with us. If you are ready for the greatest business opportunity to come down the pike, don't miss this one, it is only 2 months old!!! Give our information hot line a call at 1-800-942-9304 pin #20088 CHECK OUT http://www.millenniumgroup2000.com -------------------------- Removes to skyway(a)t-1net.com, put remove in subject, thanks.

1 0

Re: [SURVEY try again] pgp5.x / pgp2.x users
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Robert A. Costner wrote: > Just to skew the numbers, I for instance have PGP 5.0 but am using a 2.6.2 > DOS generated key that is RSA, not DSS. Grepping would show me to be PGP5.x, > which perhaps technically I am, but my key is really 2.x > > -----BEGIN PGP SIGNATURE----- > Version: PGP for Personal Privacy 5.0 This information is mostly for advertising/accreditation purposes. As such, it provides very little information useful for statistical purposes. e.g. - whether people are using PGP 5.X mostly for management of their PGP 2.6.X keys.

1 0

Re: Return of the Living Zundel, from The Netly News
by Steve Thompson 17 Dec '03

17 Dec '03

In local.lists.cypherpunks-moderated you write: >http://cgi.pathfinder.com/netly/editorial/0,1012,1561,00.html >The Netly News Network (http://netlynews.com/) > "A lot of people think this case is about censoring the Net," > said Bernie Farber, national director of community relations for the > Canadian Jewish Congress. "It isn't. It's about a Canadian violating > Canadian law. In Canada and in every other Western democracy but the > U.S., there are limits to free speech and one of those points is > vilification. I should feel I have as much right to get on the Net and > not feel demeaned because I'm a part of a particular group." I took a short 'course' on hate-crimes in downtown Toronto where this goof was the speaker. In very short order, I had decided that his agenda was merely to be in some small position of authority. He's a pro-censorship freak who wants to protect the chiiillldreeeen from views he doesn't like. It was quite amusing to pin him down a little -- he squirmed and stated that he _did_ want the government to protect him from things he didn't want to hear; in a rather shrill tone. It made me laugh in retrospect but at the time I was, I confess, shocked -- having encountered such idiocy only in print or on USENET. I wish that I had been better at articulating my thoughts during some of the discussions during the 'course'. It was difficult to portray the idea that well-supported arguements are the only _fair_ means to debunk someone else's ideas with which you disagree. I suppose that I should not have been suprised that the other participants in the course were sympathetic to Bernie's right-wing leanings, but there was a woman who owned or ran a feminist bookstore who admitted that many books ordered by her store had been held (or outright banned(?) by Canada Customs based on content; and yet, she was more-or-less in agreement with this proto-tyrant with respect to the issue of supressing the ideas of white supremists. It boggles the mind. -- Steve Thompson Misanthrope System Admin O.B. Spam: bogus(a)myofb.org --------------------------------------------------------------------------- Lately every time you turn around somebody's saying: "The eighties are coming!" Like at the stroke of midnite on New Year's Eve it's all gonna be _different_! And when you tell 'em, "Come on, you know everything's just gonna keep on slowly sinking," they get downright _mad_! -- Lester Bangs, December 1979

1 0

Sloppy Chips from Intel
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

>The possiblities are truly mind-boggling. Perhaps exploits like tapping >Aldrich Ames' PC and crashing Saddam Husseins' PCs en masse were not done >by black bag jobs and viri, but by the activation of "National Security" >backdoors present in all complex modern microprocessors. Of course a conspiracy theorist might guess that this "new bug" is really a result of somebody hitting some "national security opcode" and we just happened to hit one of the more benign "bugs". I think you alluded to this.

1 0

Rape as Performance Art
by Anonymous 17 Dec '03

17 Dec '03

I can sympathize with the demonstrators that the Humboldt Sheriff's Department sprayed with pepper spray during their sit-in/protest. The police have done the same thing to me during the closing scenes of my performance art, as I climb out of the performance victim's window and try to make a run for it. I have found that judges are seldom impressed with a plea of, "Everyone wants to be a critic!" Art Lover (aka 'SouthSide Slasher') "It's not art until *I* have slashed it with a razor."

1 0

Re: Return of the Living Zundel, from The Netly News
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Steve Thompson wrote: > In local.lists.cypherpunks-moderated you write: > >http://cgi.pathfinder.com/netly/editorial/0,1012,1561,00.html > >The Netly News Network (http://netlynews.com/) > > "A lot of people think this case is about censoring the Net," > > said Bernie Farber, national director of community relations for the > > Canadian Jewish Congress. "It isn't. It's about a Canadian violating > > Canadian law. In Canada and in every other Western democracy but the > > U.S., there are limits to free speech and one of those points is > > vilification. > I took a short 'course' on hate-crimes in downtown Toronto where this goof was > the speaker. In very short order, I had decided that his agenda was merely to > be in some small position of authority. He's a pro-censorship freak who wants > to protect the chiiillldreeeen from views he doesn't like. It was quite > amusing to pin him down a little -- he squirmed and stated that he _did_ want > the government to protect him from things he didn't want to hear; in a rather > shrill tone. It made me laugh in retrospect but at the time I was, I confess, > shocked -- having encountered such idiocy only in print or on USENET. After the government has finished arming park rangers, as well as all federal daycare workers and filing clerks, I suppose they will begin giving surplus military weapons to USENET censors, and the like, and deputizing them so that they can legally enforce their own narrow views. > It boggles the mind. Hey! Watch your language, pal. You can't say 'boggles' on a family list! BogglesMonger

3 2

Re: Some IDIOT called CRYPTO CZAR INTERNATIONAL
by VME Encryption 17 Dec '03

17 Dec '03

Please forward to this coward that have no balls to put his real email address on his emails (I using you guys as he put CC to you guys in his letter, but by no means does this reffer to you). Dear CRYPTO CZAR INTERNATIONAL Idiot, usually we ignore people at your level, but we'll try our best for you, as it might be just temorary insanity. 1) The million dollars challenge have ended at May 15,1997. The current challenge have NO monetary prize. 2) VME flowchart, algorithms and the VME application itself is already in the hands of the large 250 sotware corporations for evaluation. If any of them will prove otherwise, then you might be able to jump and make an idiot of yourself as you did now. 3) We beleive they might like what they saw, as we currently have them lined up to license the technology. 4) Try to keep your pathetic self away from the court room, as next time around you will face legal steps for alleging "fraud". Maybe you really should try and develop some future encryption algorithm instead of mumbling with envy showing your stupidity and ignorance, But on the other hand you're probably not capable of - you're too narrow minded and busy sticking your long nose where it does not belong. Do us and you a favour, keep yourself in your pathetic hole and shut your mouth up. Thanks and worst regards, (we won't bother putting our name on the same email with your name). At 11:06 PM 11/8/97 -0600, you wrote: >CCI: > CRYPTO CZAR INTERNATIONAL ANNOUNCES UNBREAKABLE CRYPTO CHALLENGE > ---------------------------------------------------------------- > >Crypto Czar International would like to announce the development of the >fastest and most secure encryption product on the market today. >We plan to develop this product early next week, as our employee has >already finished the first two chapters of 'Applied Cryptography.' > >We are so confident of our future product that we are challenging >MagNuts, Micro$oft, Nut$crape and everyone else to break it. We are >willing to pay out a $10,000,0000 prize to anyone willing to give us a >$1,000 good-faith deposit, which will be returned upon completion of our >open-ended Crypto Challenge. > >Please send ten copies of this to your friends and to your business >associates. > > The address to send the good-faith deposit to: > Crypto Czar International > c/o Electronic Fraud Foundation > Box 281, > Bienfait, Saskatchewan > CANADA S0C 0M0 > >

4 4

Re: Some IDIOT called CRYPTO CZAR INTERNATIONAL
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

VME Encryption wrote: > Please forward to this coward that have no balls to put his real email > address on his emails (I using you guys as he put CC to you guys in his > letter, but by no means does this reffer to you). Obviously, no one has informed the night janitor at VME that regular list subscribers generally just put Toto's email address in replies to particularly cowardly and/or stupid anonymous posts, since we then have a 90% chance of having sent it to the right person. As an act of mercy toward Toto, I will personally correct the spelling and grammar in the night-janitor's post and forward it to the madman at 'Che(z) Sympatico.' > Dear CRYPTO CZAR INTERNATIONAL Idiot, > 1) The million dollars challenge have ended at May 15,1997. The current > challenge have NO monetary prize. ... > 4) Try to keep your pathetic self away from the court room, as next time > around you will face legal steps for alleging "fraud". According to a claim by TruthMonger, Dr. Vulis found the backdoor in VME's encryption program, and the test message contained a plea for donations from the Georgia Cracker remailer operators. I was originally skeptical about this claim, until sources at C2Nut confirmed it. Sincerely, Ura Fishpal, Flounder and Comptroller Electronic Fraud Foundation

1 0

Re: 1st Ammendment Tossed in Paladin Case
by John Young 17 Dec '03

17 Dec '03

Tim May wrote: >But in many ways, this is good news. The war is coming faster than I thought. WSJ reports today on the increasing conservatism of the military and disputes about the pretense of civilian control, with some officers calling for responsible action to compensate for societal breakdown. It cites several examples of military members preparing for war at home, as mentioned here earlier by Attila and others, with two Marine writers claiming that the next Somolia will be here. This, coupled with reports on LEA inheritance of military equipment and lavish civilian funding to fight terrorism, portends more than Jim Bell (Tim May?) -type sniper takeouts. Free fire zones may be in the offing, or surgical wasting of underground bunkers and germmakers (troublemakers). Wrathful Mars sees no innocents, so preaches the terrorist freedom warfighters pursuing a dream of winner take all, so sorry constitutional fundies, we're the warmonger biz.

2 1

Your Internet Privacy
by brian＠firstgear.com 17 Dec '03

17 Dec '03

"NET DETECTIVE" EASY WAY TO FIND OUT ANYTHING ABOUT ANYONE ON THE INTERNET (Special Business Owner's Edition} http://www.servicebrokers.com/DET3.htm DID YOU KNOW THAT: With the internet you can discover EVERYTHING you ever wanted to know about your EMPLOYEES, FRIENDS, RELATIVES, SPOUSE, NEIGHBORS, even your own BOSS! You can check out ANYONE, ANYTIME, ANYWHERE, right on the internet... The Internet is a HUGE and POWERFUL SOURCE of information, if you only know WHERE TO LOOK. You WOULD be amazed to discover the amount of PERSONAL information other people can find out about YOU! Or you can find out about THEM. ******************************************* INFORMATION AVAILABLE ABOUT YOU Right now, with just your name and address, I can find out what you do for a living, name and age of your spouse and children, the make and color of your car, the value of your home, (and probably how much you paid for it), credit information, your employment records, family tree, military records, which web sites you visit, etc., etc., etc. I can even find that long forgotten drug bust you had in college. AND THAT'S JUST THE BEGINNING, but you get the idea. ****************************************** GOOD NEWS The good news is that now YOU can find the same information, and more, about almost anyone. We have compiled a MAMMOTH COLLECTION of internet investigative tools that will provide you with ... * Over 210 gigantic internet resources and URLs to locate people, credit records, social security, current or past employment, mail order purchases, addresses, phone numbers, maps to city locations... It's truly incredible, the information available... *********************************** YOUR COPY Now, YOU CAN HAVE A COPY of this gigantic resource. Here are just a few of the things you can do with it: * Check out business associates and employees. * Someone owe you money? Now you can track them down and find hidden assets. * You can locate an old friend, a missing family member, classmate, even a lost love. * Find e-mail, telephone or address information on anyone! Even look up "unlisted" phone numbers! * Investigate your family history! Check birth, death, or social security records. Check service records of Army, Navy, Air Force or Marine Corps. * Check your own credit reports so you can correct WRONG information that may be used to deny you credit. * Trace your FAMILY TREE. * Check adoption records. Find long lost or missing children or parents. * Check out your daughter's new boyfriend! * Find trial transcripts and court orders! * Find out how much ALIMONY your neighbor is paying. * Find EMPLOYMENT opportunities ALL OVER THE WORLD! * SCREEN PROSPECTIVE EMPLOYEES -- Check their credit, driving or criminal records Verify income or educational accomplishments AND * You'll even find TIPS to help you "discover" the amount of someone else's INCOME. ********************************* WAIT, THERE'S MORE! You will also discover: * How to "CLOAK" your email so your TRUE email address can't be discovered. * How to make phone calls through a third party so the number called doesn't appear on your phone bill. * Where to find a list of SPEED TRAPS throughout the USA. * How to check out the ETHICS and business practices of businesses worldwide, including those on the internet. * Where you can get SECURITY PRODUCTS such as recording and tracking equipment, bomb detectors and much more. * Information on UNTRACEABLE ASSET protection (anonymous banking) and more * How to locate MILITARY records from Viet Nam, Korea, WW II, etc... * How to search LEGAL opinions, trial transcripts, etc... *Find Wanted FUGITIVES -- maybe your secretive neighbor! *Great for checking out PROSPECTIVE EMPLOYEES. EVERY BUSINESS SHOULD HAVE A COPY! Allows you to check for driving and criminal records BEFORE you hire them. RESEARCH YOURSELF FIRST! You may be astounded at how much data is available on the internet about YOU, YOUR FAMILY, AND YOUR BUSINESS. There are THOUSANDS of BUSINESS and PERSONAL USES for these tools. ******************************************************************** "NET-DETECTIVE" Now, YOU CAN HAVE YOUR OWN COPY OF NET-DETECTIVE! With it you can VERIFY your own records, or find out the information you want and need to know about others for personal and business reasons. And this huge collection is ONLY THE BEGINNING! While not all the sites are free, many are. And at many you'll find even MORE links to even MORE information! ********************************************* HERE'S MORE! * With this research kit you'll discover what information is available to you, and the EXACT URL to get you there! * Includes easy-to-browse, categorized compilation of information, with a simple and easy to understand explanation of how to use each site, and what you'll find when you get there -- with shortcuts to extract the most current and best data available anywhere! INCLUDING ... Personal ads, logs of personal e-mail, any mention of individuals anywhere on the internet (including PRIVATE bulletin boards), lists of resources to find even more information (private investigators, etc...), how to leverage one database against another, up-to-the-second news reports on any subject you choose, and MORE... With "NET DETECTIVE" you can explore the HIDDEN PAST of anyone; and discover those LITTLE SECRETS EVERYONE HAS HIDDEN. > ************************************************* > > WHAT DOES IT COST? > > Order within 48 hours and you get the entire kit of investigative tools (approximately 35 printed pages) at a special reduced price of just $22. (The regular price for the kit is $35). Our order forms are SAFE and SECURE. The material is UNCONDITIONALLY GUARANTEED to work for you. Over 1,000 hours of research and testing went into the development of this material. And now it can be yours. Just follow the instructions below, and your copy will be delivered to you by email so you can have it IN YOUR HANDS WITHIN MINUTES from now. ********************************************** SPECIAL FREE BONUS Order within 48 hours and we will also include as a special FREE BONUS, a copy of our INVESTIGATIVE SOURCES PROGRAM. This program contains the tools and resources used by private investigators across the country and comes with its own Windows/Win95 interface making it quick and easy to use. ************************************************ UNCONDITIONAL GUARANTEE Remember, as with all of our publications, we UNCONDITIONALLY GUARANTEE IT WORKS and that you will be delighted with it. YOU CAN'T LOSE. *************************************** HOW TO ORDER Ordering is SAFE and EASY! For more information, or to RECEIVE this 35 page report and your bonus materials by email just go to our INSTANT-DELIVERY SECURE ORDER FORM at: http://www.servicebrokers.com/DET3.htm SPECIAL NOTE: If you are busy and don't have time to go to our web site INSTANT-DELIVERY ORDER FORM, you can order by FAX. (The unconditional guarantee still applies!) Just fill in the FAX FORM AT THE BOTTOM OF THIS PAGE. Then FAX it to us at: 1-305-289-1884 If you order by FAX, your copy of NET DETECTIVE will be sent to you by email within 24 hrs. OR. if you prefer, you can send your order by SNAIL MAIL to the address below. (Be sure to include your email address for delivery.) We will send your copy BY EMAIL the same day the order is received. ORDER NOW! YOU'LL BE GLAD YOU DID! Leeds Publishing 5800 Overseas Hwy., St. 35-154 Marathon, Fl. 33050 Fax 305-289-1884 http://www.servicebrokers.com/DET3.htm ___________________________________________________________________ ___________________________________________________________________ FAX OR MAIL ORDER FORM (Please print clearly) (Report is sent by EMAIL) FAX TO: Leeds Publishing 1-305-289-1884 OR MAIL TO: Leeds Publishing 5800 Overseas Hwy., St. 35-154 Marathon, Fl. 33050 Hi: Here is my order for "NET DETECTIVE" at $22 total. I understand it is unconditionally guaranteed. Include my FREE DOUBLE BONUS copy of INVESTIGATIVE SOURCES--WINDOWS/WIN95. Send by email ASAP. Date:__________________ > NAME:_______________________________________________ > E-MAIL ADDRESS:______________________________________________________________(IMPOR TANT PLEASE double check your address and PRINT CLEARLY. One small error and we won't be able to deliver your order.) > PAYMENT METHOD (check one) ___ Credit card ___ Check or Money Order Enclosed >CARD TYPE:_________________ > >CARD NUMBER:_________________________________________________ > >EXPIRATION DATE:______________ > >NAME ON CARD:________________________________________________ > > > Your copy of NET DETECTIVE and bonus materials will be sent to you by email ASAP. Thanks again for ordering! Brian Leeds Leeds Publishing > >____________________________________________________________ >____________________________________________________________ > > >Copyright 1997 Leeds Publishing. All rights reserved. Form 10-24 GD-ND >

1 0

LEARN HOW TO WIN MORE AT THE HORSE & DOG TRACKS!!!
by 98052＠juno.com 17 Dec '03

17 Dec '03

FINALLY... A PROVEN AND UNCOMPLICATED METHOD TO INCREASE YOUR WINNINGS AT THE HORSE AND DOG TRACKS! YOU MUST SEE IT TO BELIEVE IT IT WORKS!!!!! CLICK ON OUR WEBSITE FOR MORE INFORMATION CLICK HERE NOW!! To remove your name from our list click below. Remove

1 0

[URGENT] ZKP
by Anonymous 17 Dec '03

17 Dec '03

Tim C. Maypole, a product of anal birth, appeared with a coathanger through his head. (_) _____ (_) /O O\ Tim C. Maypole ! I ! ! \___/ ! \_____/

2 1

Re: WARNING: Serious Pentium Bug
by nobody＠neva.org 17 Dec '03

17 Dec '03

Anonymous <anon(a)anon.efga.org> wrote: >There is a SERIOUS bug in all pentium CPUs. The following >code will crash any machine running on a pentium CPU, MMX or no >MMX, any speed, regardless of OS (crash as in instant seize, hard >reboot the only cure): > >char x [5] = { 0xf0, 0x0f, 0xc7, 0xc8 }; > >main () >{ > void (*f)() = x; > f(); >} > >This require no special permissions to run, it works fine with >average-joe-userspace permissions. I have verified this, it works. >Demand a new CPU from Intel. This didn't crash my Pentium. Hoax?

6 5

Re: WARNING: Serious Pentium Bug
by Anonymous 17 Dec '03

17 Dec '03

>Anonymous <anon(a)anon.efga.org> wrote: >>There is a SERIOUS bug in all pentium CPUs. The following >>code will crash any machine running on a pentium CPU, MMX or no >>MMX, any speed, regardless of OS (crash as in instant seize, hard >>reboot the only cure): >> >>char x [5] = { 0xf0, 0x0f, 0xc7, 0xc8 }; >> >>main () >>{ >> void (*f)() = x; >> f(); >>} >> >>This require no special permissions to run, it works fine with >>average-joe-userspace permissions. I have verified this, it works. >>Demand a new CPU from Intel. > >This didn't crash my Pentium. Hoax? Absolutely not. It crashed mine and is a major bug. It doesn't seem to affect the PPro, though, and not the P2 due to its relation to the PPro. It might be fixed in later Pentiums, which begs the question of why Intel didn't issue a recall back then. Supposidly they were informed about it months ago. Read comp.sys.intel.

3 2

Money Laundering Nonsense.
by Black Unicorn 17 Dec '03

17 Dec '03

Note- cypherpunks: reply by mail, I'm not on the list any longer. Chicago Tribune Monday, November 10, 1997 Money Laundering law netting more small fry. Prosecutors putting new tool to work. A sentencing weapon Congress intended for use against drug lords is being wielded against other defendants. Judges and others say this has diminished legal fairness. By Jan Crawford Greenburg Washington Bureau Washington- Jose Caba considered himself a hardworking, law-abiding man, and immigrant who built a business selling groceries in a poor Brooklyn neighborhood. But when he started illegally redeeming food stamps and depositing the proceeds into a bank account, prosecutors thought otherwise. They accused him of money laundering and sought a harsh sentence. Caba, who thought he was only bending administrative rules, isn't the kind of criminal Congress had in mind when it decided to give prosecutors a weapon to bring down powerful drug lords. Nevertheless, he is one of a growing number of defendants who commit routine fraud and find themselves facing big-time charges of money laundering. [...] More and more prosecutors are invoking [money laundering statutes] in simple fraud, bribery and embezzlement cases, a trend that doesn't sit well with many federal judges or the U.S. Sentencing Commission. In a strongly worded report, the commission... is recommending that the sentences for money laundering be reworked. The penalties are unfair, the commission said, because they often vastly exceed the seriousness of the crime. Caba would have faced 2 to 2 1/2 years in prison for food stamp fraud, but because he deposited the funds in a bank- thereby meeting the definition of laundering the money- he was looking at 10 to 12 years. [...] Nationally, statistics show a marked increase in money laundering cases. In 1995 prosecutors charged 1700 people with money laundering, up from 250 in 1990. More than half of the defendants charged in 1995 were involved in non-drug related crimes. Critics say the charged is used even more than the figures show because prosecutors threaten defendants with the charge to get them to plead guilty to the underlying crime. "It has tremendous implications in the criminal justice system because prosecutors can use it as a tremendous bargaining stick..." said Gordon Greenberg, a defense attorney and an expert on money laundering. "Every single crime, theoretically, can be converted into money laundering because the statute is that broad." What's more, prosecutors in some areas routinely file the charge, while others decline to do so. As a result, "proportionality is lost and appropriate uniformity is lost," said Jonathan Wroblewski, director of legislative and public affairs for the sentencing commission. [] stiff sentences also apply to defendants who make no attempt to cover up their proceeds. Caba laundered money by depositing it into a bank, even though his deposits were by check and he paid taxes on his proceeds. "For all intents and purposes, if you use your ill-gotten gains, it's money laundering." said Alan Chaset, a lawyer who chairs the American Bar Association's committee on sentencing guidelines. "If you take money and put it in a bank and then withdraw it and buy a stick of gum, it's money laundering." Some judges refuse to impose the sentence in cases where there was no elaborate scheme to conceal the money, such as a 1994 case in which prosecutors charged a defendant with money laundering when he put cash from drug sales into a shoe box. [...]

1 0

Re: Freeware SET?
by Donald E. Eastlake 3rd 17 Dec '03

17 Dec '03

The SET reference implementation was written only with a concern for protocol correctness and essentially no concern for operational usability. It is not clear to me that a product could be based on it without a lot of additonal work. But I suppose it might be useful for hacking... Donald On Sat, 8 Nov 1997, Robert Hettinga wrote: > Date: Sat, 8 Nov 1997 10:12:49 -0500 > From: Robert Hettinga <rah(a)shipwright.com> > > > Date: Sat, 8 Nov 1997 04:49:34 +0100 (CET) > From: Lucky Green <shamrock(a)cypherpunks.to> > To: cypherpunks-announce(a)toad.com, cypherpunks(a)algebra.com, > cryptography(a)c2.net, andrada(a)earthlink.net, andrea.liles(a)nike.com > Subject: Bay Area Cypherpunks meeting announcement > Sender: owner-cypherpunks(a)cyberpass.net > Reply-To: Lucky Green <shamrock(a)cypherpunks.to> > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Tomorrow's Bay Area Cypherpunks meeting will be held at the offices of > C2Net Software in Oakland. > > Agenda: > o Andrea Liles will present some cool new ideas about virtual CA's. > > o Lucky Green will demonstrate the Dumb Mouse, a universal chipcard > reader, and associated analysis/manipulation software. If you are at all > interested in smartcards, especially smartcards for crypto and > authentication purposes, you don't want to miss this one. If there aren't > too many attendees, we will host a workshop. Attendees are encouraged to > bring any smartcards in their possession and discover what is /really/ > happening on the card. The Cypherpunks Smartcard Developers Association > will accept smartcard donations after the workshop. > > o Cypherpunks Tonga will announce the release of BSAFEeay, a BSAFE 3.0 API > compatible crypto library based on SSLeay. > > o Cypherpunks Tonga will then combine BSAFEeay with the freeware SETref > (which requires BSAFE for the underlying crypto) and demonstrate the first > ever globally available *freeware* SET solution. > > Location: > C2Net Software > 1440 Broadway > 7th Floor > Oakland, CA > > Date/time: > Saturday, 11/8, noon > > Directions: > By BART: > Exit the system at 12th Street Oakland. Walk north on Broadway one block. > 1440 is on the right side of the street. > > By car: > http://www.mapquest.com/ > Choose "Trip Quest" from the menu. > > - -- Lucky Green <shamrock(a)cypherpunks.to> PGP v5 encrypted email preferred. > "Tonga? Where the hell is Tonga? They have Cypherpunks there?" > > -----BEGIN PGP SIGNATURE----- > Version: PGP 5.0i > Charset: noconv > > iQA/AwUBNGPhYvXUPTw3WtkkEQKztACeIQwx4voyUVIP6u1HmosCWklX7osAnROD > TTJn3K2jCIrKUQtOc5Z3oW1P > =byR/ > -----END PGP SIGNATURE----- > > --- end forwarded text > > > > ----------------- > Robert Hettinga (rah(a)shipwright.com) Philodox > e$, 44 Farquhar Street, Boston, MA 02131 USA > "... however it may deserve respect for its usefulness and antiquity, > [predicting the end of the world] has not been found agreeable to > experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' > The e$ Home Page: http://www.shipwright.com/ > Ask me about FC98 in Anguilla!: <http://www.fc98.ai/> ===================================================================== Donald E. Eastlake 3rd +1 978-287-4877(tel) dee(a)cybercash.com 318 Acton Street +1 978-371-7148(fax) dee(a)world.std.com Carlisle, MA 01741 USA +1 703-620-4200(main office, Reston, VA) http://www.cybercash.com http://www.privacy.org/ipc

1 0

Motorola Boo-Boo
by Eric Cordian 17 Dec '03

17 Dec '03

In the discussion of the Intel F00FC7C8 problem, it was alleged that the instruction "unlk a7" will lock up a Motorola 68040 CPU even from user mode. Would someone care to test this on an old MAC? Is anyone aware of non-privileged instructions which kill other popular CPUs, like Alphas, SPARCS, and MIPS? -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Kill -9.9
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Eric Cordian wrote: > In the discussion of the Intel F00FC7C8 problem, it was alleged that > the instruction "unlk a7" will lock up a Motorola 68040 CPU even from > user mode. > Is anyone aware of non-privileged instructions which kill other popular > CPUs, like Alphas, SPARCS, and MIPS? In a world where government agencies using fear of the 'enemy' and bragging about their 'dirty tricks' to gain increasing funding, I am surprised that few seem to realize that many of the 'bugs' are actually 'features,' and that when one finds a true, non-designed bug in major hardware or software, there are certain government agencies which may pay handsomely for the information, depending on the potential and obscurity of the bug. In a world where the value of 'tracking chips' and 'kill switches' on personal automobiles is recognized, does anyone truly believe that government agencies with billions of dollars worth of funding have not recognized and instituted this technology surrupticiously in the same areas where they brag about introducing 'faulty parts' into weapons systems? The government is desperate to maintain their electronic snooping and warfare abilities as Year2000 approaches. Hardware & Software == Intel & MicroSoft == VX-Chip & GAK/GMR The government is using Anti-Trust actions to muscle both computer giants. A million dollar a day assault on MicroSoft, and release of compromising 'bug' information to put the squeeze on Intel. KillMonger

2 1

FREE Downloads on the new RealPlayer 5.0; FREE November Music Madness for RealPlayer Plus users
by RealPlayer News 17 Dec '03

17 Dec '03

RealPlayer just got BETTER and it's FREE Dear RealPlayer User, We are delighted to announce that the beta (preview) version of RealPlayer 5.0 has just been released. The great quality audio you already enjoy in the RealPlayer has gotten even BETTER! The video is LARGER. We have added NEW FEATURES like streaming RealFlash animations and near-CD voice quality at 28.8 kpbs. Best of all, these new features are all ABSOLUTELY FREE! You can upgrade free to the RealPlayer version 5.0 right now simply by visiting: http://www.real.com/50/index.html And there's new content to enjoy at the touch of a button. Whether you want music and videos, or business programming, you can get there faster through new Destinations choices. Like we said, it's all FREE. Download it now! We've also released a new version of /---------------------\ RealPlayer Plus, which ENHANCES the | November Music | RealPlayer, giving you the BEST-QUALITY | Madness by Capitol | RealAudio, RealVideo, and RealFlash. | Records. Hot music | | by cool artists, | RealPlayer Plus delivers these | only for RealPlayer | great benefits: | Plus users. Visit | | the URL below for | - The Best-Quality Live and On-demand | the complete artist | RealAudio, RealVideo, and RealFlash | list and more info. | - Scan for Live Audio and Video Sites \---------------------/ - Presets for Your Favorite Content - 30-day Money Back Guarantee So make your computer the world's COOLEST entertainment center with RealPlayer Plus. Visit: http://www.real.com/50/order.html Maria Cantwell Sr. Vice President RealNetworks, Inc. --------------------------------------------- For information about this e-mail including how to subscribe to or unsubscribe from future announcements, please visit: http://www.real.com/mailinglist/index.html

1 0

Re: WARNING: Serious Pentium Bug
by Anonymous 17 Dec '03

17 Dec '03

"William H. Geiger III" <whgiii(a)invweb.net> wrote: >For the same reason Intel does nothing about any of thier bugs: they are >assholes. The only way any of these type of things are ever addressed is >by enough users putting pressure on Intel to fix their fuckups. (Really >slopy not testing the microcode) Yeah. A conspiracy theorist might be prompted to theorize that Intel deliberately placed this in their processor, took a chance that nobody else would find it and publically release it, and then leaked the information themselves. If they refuse to replace the P5s many people will upgrade to a PPro or a P5. Of course Cyrix and AMD throw a wrench into this theory, but I doubt there are a whole lot of people who won't be buying any more Intel products due to this, and some of the clones have or did have big problems such as annoyingly slow FPUs. If they don't make it extraordinarily easy for me to replace my processor I'll probably be one of the people who falls into the latter catagory and goes off to Cyrixland.

1 0

Key Signing
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: > > In particular, if you publish the key with your first posting, > then you can demonstrate later that you're the poster who > used that name. Thus, Checkered Daemon announced his nym with > a key, and since I could find no other record of use of that name, > I was willing to sign that key 0x50EC521D as his (I do use > a separate key for signing nyms; I've signed them for a few other > people such as Black Unicorn, some of whom I've since met in person.) > You can also get similar results by posting your key fingerprint > in your messages and sending the key to a keyserver, and it's > a bit more compact, but for a first posting using a nym > it's worthwhile to include the key. Excellent advice, Bill! I am including the key (below) for my new nym, which has not been used before, and would like for people to sign it and send the signed key to the list. This way, people will know by the signature, that it is, indeed: Necessarily Knot, ME - -----BEGIN PGP MESSAGE----- Version: 2.6.2 lQD4AzRmZWoAAAECAMnJrqd/TERCLeFscdgNvwVxrVG4tRm0VThMEXXkctCGMaUD jcETxcV0ZseRUcyUKfqlLd3CRsIwClozlWHHR7EABREAAfwJ5D1Ecilit/Mwsn4N GcWZXWpg3mM6/Epzs2pEhi3I926ZiWPB1DKmdZR4nVemsnwv47SWLJyCnE4sben5 h8oHAQDTFaJDJSN7+9NToOE4NFiruAXXMIHEQ6ZH21oW1sYSiwEA9LmhvfahDVKo 1/CMtxxozAtG8rWycBYVIVrkDKiVgjMBAKeB2VY/f7tzmv7KxUUtN9607+CQlWPp E3HBLTlwtuRAUxC0FU5lY2Vzc2FyaWx5IEtub3R0LCBNRQ== =caeb - -----END PGP MESSAGE----- -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQBVAwUBNGZSSApaM5Vhx0exAQHWcQH/VHc1j8RenSUsPd+UJMCcrPWS5Euu+VVn hD4zGvaJ9irsyh1eKDLbMOUO5dOwxQuOQGDI5rB6cRuoh9ULdQjQyw== =c+x0 -----END PGP SIGNATURE-----

2 1

Re: [patent] Secure electronic message transfer and voting scheme
by ulf＠fitug.de 17 Dec '03

17 Dec '03

>Patent Number: 5682430 >Inventor(s): Kilian, Joseph John{#buSako, Kazue#} The full text is available at <http://patent.womplex.ibm.com>. The novelty in this patent is an algorithm that uses Fiat-Shamir to prove that the mixes operate correctly. The general idea of using non-interactive zero-knowledge proofs to verify that mixes follow the protocol was already published by Rackoff and Simon in 1991, although that is not acknowledged in the patent specification. Does anyone have details about Kilian's patent application on identity escrow, other than the paper at <http://www.princeton.edu/~erez/ident.ps>?

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

In the grand tradition of RSA-in-3-lines-of-perl, we present Crash-A-Pentium-in-44-characters: main(){int i=0xc8c70ff0;void (*f)()=&i;f();} - f00fie

6 6

No Subject
by Mix 17 Dec '03

17 Dec '03

Monday, November 10, 1997 - 04:25:17 MET The following is from http://www.mobil.com/speedpass/ Note that I've only quoted the parts I think are relevent to a security discussion... ---begin quote--- How does Mobil Speedpass work? Speedpass uses an electronic system located in the pump to "talk" with a miniature radio-like device (a transponder). Together, these electronic devices provide "instant" access to gasoline by automatically charging fuel purchases to the credit card you've selected. The technology is similar to the state-of-the-art technology successfully used by many tollways. What happens if my Speedpass is lost, stolen or damaged? Treat it just like a credit card. Immediately notify our Service Center at 1-800-459-2266. Tell us your name or Speedpass number. And we'll cancel your old Speedpass and send you a new one right away. You should write down your Speedpass number (8 digits on tag) and keep it in a safe place. Is there a pin code with my Mobil Speedpass? No. Can other people intercept the transmission of my credit card number? No. The Speedpass system operates on a dedicated transponder identification code. Your credit card code remains outside the Speedpass signal system, maintaining the confidentiality of that information and protecting your account from unauthorized use. ---end quote--- I see several options, none seem too secure: 1) "dedicated transponder identification code" (dtic from now on) is sent in the clear. Anyone who can listen and re-transmit can get free gas. 2) Speedpass and the gas pump negotiate DH key exchange and use DES/RC5/IDEA/Whatever. Anyone who can impersonate a gas pump can gain access to dtics and get free gas. 2) Gas pumps have an RSA keypair, and all of the speedpasses know the public key. The dtic is encrypted to the gas pump's key along with some random data. Anyone who can compromise the gas pump's private key (including service station operators/employees?) can imitate a gas pump and get dtics, with which to get free gas. The third option seems pretty secure at first, until you realize that it's like putting all of your eggs in one basket and giving thousands of people physical access to the basket. Anybody know how they are actualy doing it? Is there some more secure way I haven't thought of? -Some anonymous guy with no 'nym

1 0

Gun Control brings on a new arms race
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: At the San Francisco Gun Show this past weekend, I watched with great amusement as the San Mateo County Sheriff's Office deputies and Brisbane Police stared in apparent horror as citizen-units loaded up on high-capacity mags, armor-piercing ammo, Class III body armor, and on and on. The cops are stationed at the door, ostensibly to spot gross violations of the law, such as carry of loaded weapons. The cops asked me if I was carrying guns into the show to sell...I just shrugged. Without a warrant, they were helpless to do more than just ask. It was a gas. Gee, sounds like Christmas. Christmas starts earlier every year. Sparticus

1 0

Australian banks using uncracakble IDEA!
by Anonymous 17 Dec '03

17 Dec '03

Conflicting agendas cloud accord on internet trading By John Davidson http://www.afr.com.au/content/971110/inform/inform3.html Banks will lose their shirts; retailers will go bust if the import tax threshold isn't lowered; retailers will go bust if the threshold isn't raised; individuals will be monitored by a person or persons unknown; the Tax Office will kill it first, or maybe it won't. These are just some of the often strange and always contradictory claims heard by the Joint Parliamentary Committee of Public Accounts during the Sydney leg of its inquiry into internet commerce last week. [...] One expert witness, who said he had been involved in the establishment of the internet more than 20 years ago, testified that internet commerce should be banned because the speed and security of the network had barely improved in the last decade. Modem speeds, said Richard Marschall from Marschall Acoustics, were still limited to 9600bps (contrary to the claims of ISPs and modem makers, which offer speeds of around 50kbps) and using the internet was still grossly inefficient compared to putting a disk in the post. Worse, 90 per cent of all internet bandwidth was used to (slowly, one presumes) download pornography. Claims that the internet could be used for serious business were also grossly inflated, he said. Dr Marschall said that any banks that chose to use the internet for commerce would "lose their shirts" because the security of the internet was so poor. The cryptography relied on by banks to scramble data on the public network could readily be cracked, he said, because law enforcement agencies refused to let people use strong versions of the software for fear of it falling into the hands of criminals. (Those Australian banks that offer Web banking sites do, in fact, use a strong form of cryptography known as IDEA, which is thought to be effectively uncrackable.) "The internet (is) an ideal media (sic) for fraud and other unethical practices," he said in his submission. "It is not clear if there is any fix for these problems -- short of pulling the plug and banning internet commerce. Commercial transactions were banned for the first 15 years of the internet's existence for precisely these reasons."

2 1