December 2003 - cypherpunks-legacy

EPIC World Crypto Survey
by John Young 17 Dec '03

17 Dec '03

The New York Times, February 9, 1998, p. D10: U.S. Losing Battle on Control of Data Encryption, Study Says By Jeri Clausing Washington -- The Clinton Administration is losing its battle to increase international controls over how reliably computer data can be scrambled to insure privacy, according to a report to be released Monday by an independent research group. ... The Electronic Privacy Information Center <http://www.epic.org> says that its survey of 243 governments showed that the United States is virtually the only democratic, industrialized nation seeling domestic regulation of strong encryption. That finding directly contradicts the Clinton Administration's assertions in Congressional hearings that it has the support of most nations on this issue. ... William Reinsch, the Under Secretary for export administration in the United States Commerce Department, denied that the study contradicted the Administration's assertions. "All the Administration has ever said is that there are more countries that go farther than we do," Mr. Reinsch said. "The study confirms that."

2 1

Airport security cracked by flaw [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://www.cnn.com/TECH/computing/9802/08/security.reut/index.html > REPORT: COMPUTER DESIGN FLAW OPENS AIRPORTS TO TERRORISM > > graphic February 8, 1998 > Web posted at: 1:25 p.m. EST (1825 GMT) > > NEW YORK (Reuters) -- The computer security systems that control > access to 40 airports worldwide through electronic badges have a > design flaw that could make them vulnerable to terrorism, The New > York Times reported Sunday. > > A California computer security consulting firm, MSB Associates, > found the flaw in December in a routine audit of a large California > financial services software company, the identity of which was not > disclosed, according to the newspaper. > > Government buildings, including that of the CIA, and prisons and > industries with sensitive military, drug or financial information or > material also use the system and are also vulnerable to attack, the > Times report said. [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

CYBERsitter caught mail-bombing (fwd)
by Ken Williams 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 6 Feb 1998 23:25:04 -0500 From: bennett(a)peacefire.org To: peacefire-broadcast(a)vorlon.mit.edu Subject: CYBERsitter caught mail-bombing CYBERsitter has been caught in the act of mail-bombing someone who wrote a letter to Brian Milburn, the CEO of CYBERsitter, complaining about their product. Spefically, a lady names Sarah Salls sent the following letter to Brian Milburn at bmilburn(a)solidoak.com: http://peacefire.org/archives/SOS.letters/asherah.2.bm.2.4.98.txt She was writing to CYBERsitter regarding their harassment of Peacefire and their blocking of anti-censorship sites, which is described in more detail at: http://www.peacefire.org/censorware/CYBERsitter/ CYBERsitter replied by flooding her account with over 446 junk messages. While the attack was in progress, Ms. Salls had her ISP's postmaster monitor the incoming attack and shut it off. Naturally, her ISP, Valinet.com, kept copies of the mail logs for that day and has passed them on as evidence to their lawyers. A complaint was also forwarded to MCI's security department, which handles network abuse and illegal denial-of-service attacks that are perpetrated by their customers, which include lower-end network users like CYBERsitter: http://peacefire.org/archives/SOS.letters/valinet.2.mci.2.5.98.txt C-Net's NEWS.com picked up on the story and interviewed Sarah Salls, her ISP, me, and Brian Milburn from Solid Oak Software. Their story is at: http://www.news.com/News/Item/0,4,18937,00.html (Note that the C-Net article compares the act of mail flooding with conventional spam, and says that a bill is being considered in Congress that would outlaw what CYBERsitter did. This is not quite true; flooding a person's account with 500 junk messages is a denial-of-service attack, which is already illegal, and it usually gets you in a lot more trouble than spamming would.) Far from denying the accusations, Brian Milburn gave C-Net the following quote: "Certain people aren't going to get the hint. Maybe if they get the email 500 times, they'll get it through their heads... If they send it to my private email account, they're going to get what they get." No kidding, Brian! bennett(a)peacefire.org (615) 421 6284 http://www.peacefire.org/ ---

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) This remailer list is somewhat phooey. Go check out http://www.publius.net/rlist.html for a good one. Last update: Thu 23 Oct 97 15:48:06 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hera goddesshera(a)juno.com ------------ 5:03:45 99.86% nym config(a)nym.alias.net +*#**#**### :34 95.82% redneck config(a)anon.efga.org #*##*+#**** 2:00 95.44% mix mixmaster(a)remail.obscura.com +++ ++++++* 19:18 95.27% squirrel mix(a)squirrel.owl.de -- ---+--- 2:34:19 95.16% cyber alias(a)alias.cyberpass.net *++***+ ++ 11:26 95.11% replay remailer(a)replay.com **** *** 10:06 94.93% arrid arrid(a)juno.com ----.------ 8:50:34 94.41% bureau42 remailer(a)bureau42.ml.org --------- 3:38:29 93.53% cracker remailer(a)anon.efga.org + +*+*+*+ 16:32 92.80% jam remailer(a)cypherpunks.ca + +*-++++ 24:14 92.79% winsock winsock(a)rigel.cyberpass.net -..-..---- 9:59:18 92.22% neva remailer(a)neva.org ------****+ 1:03:02 90.39% valdeez valdeez(a)juno.com 4:58:22 -36.97% reno middleman(a)cyberpass.net 1:01:28 -2.65% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: the best justice money can buy --Lessig (fwd)
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Jim Choate (ravage(a)ssz.com) wrote: >So do I, and I bet both our incomes combined doesn't add up to 15 minutes of >Bill G's and it won't. Of course not, because Bill has jackbooted copyright enforcers to subsidise his corporation. Without them his income would be dramatically reduced. >From a market perspective we're flies on the back of >great elephant. Please be so kind as to describe how and why this marketing >mechanism (copyleft) will succed? Uh, I said copyright should be abolished, you said noone would write software, I said that Linux disproved that claim. How is this relevant to that discussion? Of course it's not going to take over when companies can get billions of dollars of subsidies in the form of copyright enforcement, but it clearly shows that without copyright people will produce better software than Microsfot has ever written. >I've been using and supporting Linux since >1993 (SSZ is listed as a source site in the back of 'Running Linux' since >day one) in this manner neither I or anyone else has gotten rich. Exactly. So tell us how Bill would have become a billionaire without copyright? >It's copyrighted in the important sense in that it uses the copyright to >enforce its conditions. That is just as important as the marketing decisions >made by it. All it enforces is source-code distribution (and I've yet to hear of a single case where it's ever been used). That's important to the developers, but not to the average user. The situation would be little changed in a world with no copyright, because if anyone did try to keep their source secret anyone who got a copy could freely distribute it. I'm truly amazed to find all these pro-copyright views on the list, when cypherpunks have been at the forefront of creating technologies to make it unenforceable and obsolete. Mark

2 1

Eureka! Tue Feb 10 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Tuesday's issue of Eureka! EROTIC PARADISE One of the largest pay sites on the web, Erotic Paradise, has now opened its doors to FREE memberships. That's right, you can now get an entire week of hot videos, 1,000s of pix, and much, much more - and it's complely FREE. Check it out! ------> http://www.mr-cash.com/cgi-bin/gold.cgi/raw_3266/999 My Sister NAKED! FREE PIX http://205.134.162.9/sister/ I took pictures of my sister naked! EATING AT THE "Y" Creative use of webdesign. Lots of free pix. These are not your ordinary women. These are hot looking babes! Saddle on up to the bar for some real food. Snack on a brunette, dine with a blonde. Maybe food does mix with sex? Surf by. Eating at the Y ... http://207.156.223.181/they/warning.html DEVIL'S DELIGHT This is a paysite. There are three free pix however. They load fast and are high resolution. One is of a woman taking on two large cocks. Next is a hot looking blonde. Pussy! Devil's Delight .............. http://www.devilsdelight.com/ PLANET EROTIC This is a paysite. But that is not a bad thing. There is something you have to see to believe. Click the guest button and proceed by clicking on the free pics text links. After about four pages of these links (located at the bottom) you will arrive at some thumbnails. On the second row of pix third one to the right, click that one. Mysterious labia! Planet Erotic .................. http://www.planeterotic.com PORNO MACHINE Pretty good website! Decent webdesign and use of graphics. They feature some free pix as well. Lots of pussy filled to the brim with cock. The pix are not huge but they load quick. Oh and there are free videos! This is a busy server. Porno Machine ................. http://www.pornomachine.com/ READ THIS!! WIN $25,000 and a Fantasy Date - Click Here Now! $25,000! ---> http://208.195.150.31/us/us_main.cgi/us_5267/A HOORAY! THE ADULT SEARCH ENGINE Now you can search for the sex sites you are looking for and fast! This new search engine is setting the standard others will follow. It offers pop-up search and detailed listings! Hooray! -----------------> http://eureka.abc-web.com/hooray/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here --> http://www.netscape.com/download/ Three dicks -------------------> http://207.168.184.26/trip/ CHAT WITH OTHER READERS Hey, if you haven't checked out the Eureka! Chat sites yet, you're missing out on some great stuff. Every day you'll find hundreds of other readers just like you looking to chat have fun and maybe a little 'cyber'. We know you'll love it! Adult/Sex Chat -----------------> http://137.39.63.229/chat/ General/Fun Chat -------> http://137.39.63.229/chat/funchat/ HOT LIVE PHONE SEX TO MAKE YOU CUM! LD Call only! - Live Hot Girls!!!!----------->1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline-------->1-800-644-8779 FREE: Live 1-on-1 (international call only)--->011-678-77416 NEW! CENTERFOLD PIC OF THE DAY Exclusive! We proudly present unpublished Pictures of your favorite Centerfolds. Featured This Week: Dec 80-PMOY Terri Welles, Dec 89-Petra Verkaik, Sept 93-Carrie Westcott, Kerri Kendall, Rebecca Ferratti, Lydia Schone and many more too! ---------------------------> http://www.gatefold.com/eureka/ AMATEUR SITE OF THE DAY Claire: Claire and her husband (Andy) are true exhibitionists who love to show off, especially together. Claire keeps an erotic diary that puts most magazines to shame. This is one hot couple, check them out and read about all their dirty adventures. ---------------------------> http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY StoriesAndPics.com: StoriesAndPics.com gives you the best of both worlds. Visit the site Yahoo calls "The Ultimate Erotic Stories Site" Over 50 categories of sex stories and XXX pics! ....................... http://www.storiesandpics.com/ DAILY CARTOON ----------> http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Woah, our Adult Star pics are getting hotter and hotter, so make sure you stop by and check out today's - definitely not to be missed! --------> http://www.xxxadultstars.com/eureka/ OTHER EUREKAS! GAY EUREKA! ----------> http://eureka.abc-web.com/gayeureka/ DEUTSCH ------> http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ------> http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ----> http://eureka.abc-web.com/eureka/francais.htm ITALIANO ----> http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE > http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 --------------------------> http://137.39.63.229/?100 Pic 2 --------------------------> http://137.39.63.229/?101 Pic 3 --------------------------> http://137.39.63.229/?102 Pic 4 --------------------------> http://137.39.63.229/?103 Pic 5 --------------------------> http://137.39.63.229/?104 Pic 6 --------------------------> http://137.39.63.229/?105 Pic 7 --------------------------> http://137.39.63.229/?106 Pic 8 --------------------------> http://137.39.63.229/?107 Pic 9 --------------------------> http://137.39.63.229/?108 Pic 10 --------------------------> http://137.39.63.229/?109 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Laptop TEMPEST > Date: Mon, 09 Feb 1998 17:07:23 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > Jim Choate wrote on 1998-02-09 06:57 UTC: > > Doesn't the FCC have to test the RF emissions of all laptops as well as > > monitors for sale as Class A and Class B in the US? Shouldn't that material > > be available? I searched the main site, www.fcc.gov, but didn't find > > anything regarding this. > > I suspect that FCC material is not helpful with regard to Tempest. As to calculating a realistic estimate of range to intercept, I disagree strongly. > Results of such EMI tests only measure the general power spectrum > emitted by a device. Of interest for Tempest purposes however is > not the power spectrum, but the spectrum of the cross-correlation I am aware of how to do Tempest in practice as well as in theory. The process goes something like this. The first target is the vertical retrace. This signal is usualy the strongest because the voltage required (and hence the dv/dt) is the largest to sling that e-beam from the lower right to the upper left. It usualy resides in the 50-70Hz range. The next target is the horizontal retrace. It slews the beam from the right edge of the display to the left in order to start another trace. You can use this signal to syn both the vertical retrace steps (in order to move the beam down verticaly to start another trace) as well as the ramp that is required to slew the beam across the screen to write the pixes. Once these 4 signals are aquired and fed to the appropriate control terminals of a CRT you are ready to begin decoding the actual trace data for each line of the display. This is the hardest since the actual modulation of the e-beam is done via a screen grid (who said tube theory was out of date?) and that signal is quite small and generaly has a cardoid emission pattern aligned axialy along the central axis of the CRT tube. So if given a choise you want your antenna to be behind the viewer in line with the display. It is of some import to note that larger displays are easier to aquire usable signals from since the distances the e-beam is slewed and as a result the control voltages are much larger. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Washington on the verge of being nuked?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

David Honig <honig(a)otc.net> writes: > The water supply systems of LA are easy targets for causing civil > disruption, too. Don't know about LA, but New York City gets its water supplies from open reservoirs upstate - a terrorist's dream. > > Lewinsky for President '2012 Vote for Monica - get a free blow job. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: rec.guns et.al. blocked by censorware
by Animal Protection League 17 Dec '03

17 Dec '03

At 03:22 PM 2/8/98 -0800, Tim May wrote: >At 3:02 PM -0800 2/8/98, Igor Chudov @ home wrote: >>rec.games.mecha Giant robot games. (Moderated) Quest/Illegal/Gamble >>Violence/Profanity Intol > >Perhaps the strategy should be to post material to other newsgroups to get >them blocked as well. (Though I expect the blocking is not being done using >robots to monitor for illegal words, as rec.guns would not have been >blocked this way. Rather, the cyber nannies are probably using their "PC >judgment" to block groups they don't like. You need to consider that rec.games.mecha is primarily a dumbed down alt.flame and includes postings from that obnoxious avowed 300 pound communist bisexual converted jew Camille Klein (she claims she is down to 275 lbs.). I wouldn't my kids to read her garbage posts.

1 0

Interview with the man who creamed Bill Gates
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 9 Feb 1998 09:29:44 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Interview with the man who creamed Bill Gates Is at: http://cgi.pathfinder.com/netly/opinion/0,1042,1733,00.html -Declan

1 0

Godin Interview - Bill G's pie in the eye [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://cgi.pathfinder.com/netly/textonly/1,1035,1733,00.html > Today's News Let's pie! Let's pie! Nincompoop guys! > by Hugues Henry February 9, 1998 > > Until last week, Noel Godin was relatively unknown in the United > States. A 52-year-old Belgian author, film historian, actor ("The > Sexual Life of the Belgians"), writer ("Cream and Punishment") and > "entarteur" (a Godin coinage that roughly translates as "encaker" or > "pie-er"), Godin led the gang that gave to Bill Gates what so many of > us only dream of: a big wet pie in the face. The attack took place at > the entrance of Le Concert Noble on Arlon Street in Brussels and was > widely reported in the press. > > Godin doesn't own a computer and didn't even know what a URL is. > His girlfriend, however, uses a PC. (This interview was conducted and > translated by Hugues Henry.) > > The Netly News: Who are you, Noel Godin? > > Noel Godin: I'm part of a gang of bad hellions that have declared the > pie war on all the unpleasant celebrities in every kind of domain > (slogan: "Let's pie! Let's pie! Nincompoop guys!"). We began to act > against "empty" celebrities from the artistic world who were thinking > they were the cat's whiskers. Then we attacked the TV news business in > France, for instance, Patrick Poivre D'Arvor [a famous French TV > presenter]. Then it became political with Philippe Douste-Blazy in > Cannes, the French minister of culture, or the other French minister > Nicolas Sarkozy last year in Brussels. > > NN When did you first pie someone? > > Godin: In November 1969, with French writer Marguerite Duras, who > represented for us the "empty" novel. > > NN Why did you choose Bill Gates? > > Godin: Because in a way he is the master of the world, and then > because he's offering his intelligence, his sharpened imagination and > his power to the governments and to the world as it is today -- that > is to say gloomy, unjust and nauseating. He could have been a utopist, > but he prefers being the lackey of the establishment. His power is > effective and bigger than that of the leaders of the governments, who > are only many-colored servants. So Bill Gates was at the top of our > lists of victims. The attack against him is symbolic, it's against > hierarchical power itself. Our war cry was explicit: "Let's pie! Let's > pie the polluting lolly!" [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: rec.guns et.al. blocked by censorware
by Anonymous 17 Dec '03

17 Dec '03

>That the "cyber nannies" are blocking it (and other similarly nonsexual, >nonprofane newsgroups) is exactly what was expected. These cyber nannies >become tools for political correctness. > >Perhaps the strategy should be to post material to other newsgroups to get >them blocked as well. (Though I expect the blocking is not being done using >robots to monitor for illegal words, as rec.guns would not have been >blocked this way. Rather, the cyber nannies are probably using their "PC >judgment" to block groups they don't like. These companies are attempting to provide the services desired by their customers. These are generally cautious, conservative parents who want to allow their young children access to the internet without them stumbling over dangerous or disturbing information. Like it or not, many parents are very protective of their children. We have no right to force our own views of childrearing on them. The filtering companies are filling a legitimate need in the marketplace. They are not evil and they are not trying to prevent adults from viewing the material they desire via their own personal accounts. They give concerned parents a sense of safety in allowing their children to use the internet, and in that way allow young people access to the net who would not otherwise be allowed to use it.

1 0

New Security Paradigm Workshop '98 Call For Papers
by Mary Ellen Zurko 17 Dec '03

17 Dec '03

======================================================================== Call For Papers New Security Paradigms Workshop '98 A workshop sponsored by ACM 22 - 25 September 1998 ======================================================================== Paradigm shifts disrupt the status quo, destroy outdated ideas and open the way to new possibilities. This workshop explores deficiencies of current computer security paradigms and examines radical new models that address those deficiencies. Previous years' workshops have identified problematic aspects of traditional security paradigms and explored a variety of possible alternatives. Participants have discussed alternative models for access control, intrusion detection, new definitions of security, privacy and trust, biological and economic models of security and a wide variety of other topics. The 1998 workshop will strike a balance between building on the foundations laid in past years and exploring new directions. To participate, please submit the following, preferably via e-mail, to both Program Chairs (Mary Ellen Zurko and Steven J. Greenwald) by Friday, 3-April-1998. 1 - Your Paper You should submit either a research paper, a 5 - 10 page position paper or a discussion topic proposal. Softcopy submissions should be in Postscript or ASCII format. Papers may besubmitted in hardcopy. To submit hardcopy, please mail five (5) copies to Program co-chair Steven Greenwald. Please allow adequate time for delivery. The hardcopy deadline is 27-March-1998. Discussion topic proposals should include a description of the topic to be discussed, a pro and con position statement on the topic, identification of the parties who will uphold each position, any assurances that the participants agree to attend, and any other information that the proposer thinks would support their proposal (such as who will moderate). One potential topic for discussion is "Is there a current security paradigm?". 2 - Justification You should describe, in one page or less, why you think your paper is appropriate for the New Security Paradigms Workshop. A good justification will describe which aspects of the status-quo security paradignm your paper challenges or rejects and which new model or models your paper proposes or extends. 3 - Attendance Statement You should state how many authors wish to attend the workshop and should indicate whether at least one author will be able to attend for the entire duration of the workshop. The program committee will referee the papers and notify the authors of acceptance status by 12-June-1998. We expect to be able to offer a limited number of scholarships. More information will be provided on-line as it becomes available. 4 - The Workshop The workshop will offer a creative and constructive environment for approximately 25 participants. It will be held at the Boar's Head Inn in the vicinity of "historic" Charlottesville, Virginia. Steering Committee Bob Blakley, Mary Ellen Zurko, Steven J. Greenwald, Darrell Kienzle, Hilary Hosmer Workshop Co-Chairs Bob Blakley IBM 11400 Burnet Road, Mail Stop 9134 Austin, TX 78758 USA e-mail: blakley(a)us.ibm.com voice: +1 (512) 838-8133 fax: +1 (512) 838-0156 Darrell Kienzle MITRE, Mail Stop W422 1820 Dolley Madison Blvd. McLean, VA 22102 USA e-mail: kienzle(a)mitre.org voice: +1 (703) 883-5836 fax: +1 (703) 883-1397 Program Committee Co-Chairs Mary Ellen Zurko The Open Group Research Institute 11 Cambridge Center Cambridge, MA 02142 USA e-mail: zurko(a)opengroup.org voice: +1 (617) 621-7231 fax: +1 (617) 225-2943 Steven J. Greenwald 2521 NE 135th Street North Miami, FL 33181 USA voice: +1 (305) 944-7842 fax: +1 (305) 944-5746 e-mail: sjg6(a)gate.net Program Committee Alfarez Abdul-Rahman, University College London Steven Cheung, University of California, Davis Shaw-Cheng Chuang, University of Cambridge John Dobson, University of Newcastle, UK Heather Hinton, Ryerson Polytechnic University, Canada Tom Lincoln, RAND Masahiro Mambo, Tohoku University Catherine Meadows, Naval Research Laboratory Ruth Nelson, Information System Security Thomas Riechmann, University of Erlangen-Nuernberg Marvin Schaefer, Arca Systems, Inc. Cristina Serban, AT&T Labs Anil Somayaji, University of New Mexico Brenda Timmerman, University of Southern California / ISI Ian Welch, University of Newcastle upon Tyne John Michael Williams Local Arrangements Chenxi Wang (University of Virginia) +1 (804)982-2291 Scholarships Hilary Hosmer (Data Security Inc.) +1 (781) 275-8231 Publications Marv Schaefer (ARCA Systems) +1 (410) 309-1780 Publicity Daniel Essin (University of Southern California) +1 (213) 226-3188 Treasurer/Registration Dixie Baker (SAIC) +1 (310) 615-0305 ACM-SIGSAC Chair Ravi Sandhu (George Mason University) +1 (703) 993-1659

1 0

VanEck, Noise, & Palmtops...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Palmtops are noisy, this is bad for Van Eck. Van Eck relies on the fact that the device is emitting display signals significantly above the noise floor or that there is a method to pull that signal out of the noise. Considering the power draw of palmtops, while they are noisy they are also very low power. My guestimate on emitted rf is in the micro-watt range. That means for a succesful intercept the receiver would need to be in most situation within feet of the device. It'd be much simpler to simply ask to see the PDA because you were thinking of buying one than lugging all that obvious equipment around... If you want to defeat Van Eck you want either very quite or you want lots of noise smoothly distributed across the rf spectrum. ____________________________________________________________________ | | | The obvious is sometimes false; | | The unexpected sometimes true. | | | | Anonymous | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Argentina rules: no software copyright
by Adam Back 17 Dec '03

17 Dec '03

(from cpsr list, from edupage) : ARGENTINE SUPREME COURT RULES SOFTWARE PIRACY LEGAL : : Executives of Microsoft, IBM and Unisys are protesting a recent : Argentine Supreme Court decision ruling that antiquated copyright : laws don't cover computer software. Software makers point out that : royalties aren't paid on about 70% of the software sold in : Argentina, resulting in roughly $165 million in revenue losses : annually. A recent study by Price Waterhouse & Co. indicates the : biggest abusers are Argentine federal and local government agencies : and small private businesses. "There's no culture in Argentina of : assigning value to software," says a Unisys unit president. (Wall : Street Journal 6 Feb 98) I like best Mark Grant's comment on why copyright should be scrapped: it is a form of government subsidy. Adam

1 0

Computer design flaw opens airports to terrorism
by William Knowles 17 Dec '03

17 Dec '03

NEW YORK (Reuters) [2.9.98] - The computer security systems that control access to 40 airports worldwide through electronic badges have a design flaw that could make them vulnerable to terrorism, the New York Times reported Sunday. California computer security consulting firm, MSB Associates, found the flaw in December in a routine audit of a large California financial services software company, the identity of which was not disclosed, according to the newspaper. Government buildings, including that of the CIA, and prisons and industries with sensitive military, drug or financial information or material also use the system and are also vulnerable to attack, the Times report said. American and British aviation officials have notified airports of the flaw, the Times said. The system, introduced several years ago by a small company, Receptors, Inc., of Torrance, CA., relies on a secure, isolated computer in a guarded room to control door-locks and an inventory of electronic badges, the Times reported. The company found, however, that in some cases an individual could dial in to the computer and create security badges and unlock doors. Receptors' equipment was removed from the House of Representatives after the Inspector General found that 757 former employees appeared on the rolls of active employees and had working badges that would have allowed them access to the House buildings, the Times said. Receptors' chief operating officer Dale Williams said that the problem is not with the system but with the way it was installed in some cases. Some systems were connected to networks instead of being accessible only by a modem that would only be turned on when a Receptor employee performed maintenance, Williams told the Times. Testing the system, MSB found that the problem persisted as late as last week in the company they audited, the Times said. MSB created a fictitious employee, Millard Fillmore, which the company spotted on its rolls and removed. However, even after he was removed, the faux former president was still able to gain access to the company buildings, meaning any dismissed employee would have the same access, the Times said. == The information standard is more draconian than the gold standard, because the government has lost control of the marketplace. -- Walter Wriston == http://www.dis.org/erehwon/

1 0

[test - ignore]
by BMM 17 Dec '03

17 Dec '03

ping

1 0

fingerprinting
by D'jinnie 17 Dec '03

17 Dec '03

Immigration & Naturalization Department has been fingerprinting ppl for years. Does anyone have any ideas what agencies that information is shared with and what they need it for anyway? And what's with that new thumbprint thing in banks? I haven't had occasion to refuse it yet but I wonder if they'd open an account without it... --- Reality leaves a lot to the imagination. jinn(a)inetnebr.com

1 0

Re: Driver Licenses
by Brian B. Riley 17 Dec '03

17 Dec '03

On 2/9/98 12:25 PM, Tim May (tcmay(a)got.net) passed this wisdom: >Lucky is right that that "underage stings" are on the increase. >Underage persons, often in high school, beome self-righteour >warriors in the War On Demon Rum, and "narc out" their local >shopkeepers. As I write this there are advertisements up in the halls at the HS (obviously with school blessings) where I teach (a few miles east of Burlington, VT) specifically soliciting 17 year olds to work for a private company under contract to the state to 'test buy' tobacco products. I haven't heard about any takers yet nor anything backfiring. >Hey, it would serve these junior narcs right if, upon being carded >and being shown to be underage, a store owner made a citizen's >arrest. Perhaps putting the perp in the back freezer for a few >hours would send a message. I wonder, though, how long it would go on if some shopkeeper indeed did this? But, is it a crime to try to buy booze or tobacco underage, if you do not try to show fraudulent indentification? Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "He's not dead -- He's electroencephalographically challenged."

2 1

11 CENTS A CLICK - PINKCASH PAYS CA$H UPFRONT
by nobody＠nowhere.com 17 Dec '03

17 Dec '03

Friends, I am Scott Phillips from www.pbits.com, My apologies for this short spam, I`m only sending it because as a fellow ADULT WEBMASTER I know you will be interested in the first click thru system to pay you IN ADVANCE, BEFORE YOU EVER SEND A HIT! Lets keep it short and sweet so HERE IS THE DEAL! Sign up here http://usa-6.gsd.com.au/moremoney And get paid 11c a unique click by ww.pbits.com WE OFFER THE FOLLOWING BENEFITS - Real time stats - Click counts that are 100% real - NEVER BEEN ACCUSED OF SHAVING HITS - Rated "good as gold" on Serge`s good bad ugly sponsor list http://pusi.com/~contest - FRESH banners that pull HARD - straight, gay, hardcore, teen, fetish sites, we have it ALL covered - On the net since May 96 never ripped off a webmaster - The checks are cut by the legendary Serge, who has never been late with a payment ever! - Auto-signup - I answer email personally - Software designed by BobX who wrote the clickthru for cybererotica.com http://usa-6.gsd.com.au/moremoney This is my personal guarantee to you, my fellow webmasters. Pinkcash *is* and will always be the highest paying clickthru on the net. No matter what others claim to pay, at the end of the day you make more money with us, its a FACT! If you earn more with other clickthru programs I will refund the difference. Statistics show that a .11 banner for pinkbits earns TWICE what an xpics banner at 14c does. This is because we DON'T shave hits or filter every AOL proxy to steal from you. http://usa-6.gsd.com.au/moremoney HOW DO WE PAY IN ADVANCE? After you have a trading history with us for a month or two we put you on the advance program. Currently 93% of our traffic is payed before the hits are sent. This is not an idle promise, we send checks everyday. Look at http://www.pbits.com/whosyerdaddy to see a few real checks for people you probably know. And by the way, we pay an extra cent per click when we pay you in advance, its our way of thanking you for being trustworthy honest webmasters just like us. http://usa-6.gsd.com.au/moremoney I live in Australia but I`m travelling around the USA at the moment catching up with webmaster friends and buying more traffic. If you have the ability to send bulk volume traffic contact me and I`ll visit you while I`m in the USA Nobody has ever left our clickthru ever. Nobody has ever had a complaint EVER. This is state of the fucking art software, we are cool people, we want your business, and we treat you right. AND WE PAY MORE! Sign up now http://usa-6.gsd.com.au/moremoney Thanks Scott Phillips --- TO REMOVE YOURSELF FROM THIS LIST CLICK BELOW --- http://207.33.10.200/maillist/remove.html

1 0

Re: TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: TEMPEST > Date: Mon, 09 Feb 1998 21:07:22 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > Things are somewhat more complicated and I am not convinced that > the e-beam is the primary source of radiation. Only of the individual pixel modulations. Go back and re-read my post you missed a whole slew of implications. The vertical and horizontal positioning is via the yoke not the screen grid. Electrostatic steering of an e-beam is expensive and slow, you can't change the charge on the plates that fast. In regards the data for the individual scan lines, where else are you going to modulate that beam than a screen grid? This is a high-voltage low-current point. You can't drive the beam off the screen, the inside of the tube is coated in a carbon based chemical called 'aquadag' that will short the beam to ground and blow your flyback transformer in short order. Not to mention that the inertia of the e-beam will be a bit of a hassle to deal with as well. It won't move that fast. > Your claim that > the Tempest radiation is modulated by the screen grid does not agree with > my practical experience: All signals I get are close to harmonics of > the dot clock and not of the screen grid rate. The screen grid is where the dot clock goes to modulate the e-beam, or is your claim we're going to modulate the filament directly? If so I would suggest you re-take your electronics class and learn how to read a schematic a tad better. A short trip to either your local library or electronics repair business will pay off wonders. You're looking for a Sam's Photo-Facts on the particular monitor you are examining. There is also the fact that the dot clock itself is a low-voltage low-current device until it gets to the tube drive electronics where it switches the high voltage drivers to the tube. If your getting your signal off the harmonics you're doing it the hard way. Go back and re-read your texts on Fourier Transforms and then do a power-spectrum analysis on the signals to the tube; what you will find is that the primary frequencies get the majority of the signal (eg 1st harmonic of a square wave (ie a dot clock) only gets, at best, 1/3 of the energy of the primary). In any case, it's the high voltage emissions of the tube drive electronics that are detected, not the small 5V to 12V drive signals. The same is true for LCD, Plasma, and other flat panel displays. You detect the high-voltage emissions of the display drive electronics. Note that on active transistor displays (where you don't have the high voltage bias as in a LCD) you don't get these sorts of emission magnitudes and they are *much* harder to detect. In addition in the active transistor displays the display drive electronics should buffer the data and so, unlike a CRT, you don't have to send each individual pixel every time. You can actualy send only the changes and impliment those. Unless you're integrating the signals you receive your Tempest display will be gibberish. > In addition, the > Tempest monitor cannot distinguish between an all-black and an all-white > image, which it should in the case of a screen-grid caused modulation. What? This is malarky. If the screen is black the filament emissions are being blocked by the screen grid and the charge cloud gets shunted to ground via the aquadag coating. This means there is no current, and as a consequence no emitted rf field to monitor. And what keeps it from blowing the flyback in this case is that the charge cloud acts as a capacitor and limits the dv/dt to something that the flyback can deal with, it has to leak past the screen grid. You can also discern this using Tempest to monitor NTSC where the black pulse is a negative going pulse at the end of the scanline waveform. It's there so the receiver electronics can know when to turn the e-beam off so you don't get those annoying retrace lines across your screen when it moved back to the left and down one line. Since it's a negative going pulse with respect to the vertical and horizontal retrace it's dv/dt is going in the opposite direction. If you get a schematic find the horizontal retrace clock and disable it and monitor the display. > If there is indeed a screen-grid modulation, then it is *much* weaker > than any modulation that you get by software dithering. This is just plain silly. The switching of the software is drowned in a sea of such noise on the board. Anyone who claims they can pull a valid signal off a cpu pcb at more than a few feet is a liar or else they have some pretty remarkable extra-terrestrial technology. There are litteraly 10's of thousands of state transitions all over the pcb that are going on in parallel and the positive transition fields cancel the negative transition fields so what you end up with is a hash of noise. 30 seconds of looking at a spectrum analyzer will make this obvious. In modern computers what drives the crt is the data residing in the video frame buffer that drives the output electronics on the card and not the data on the cpu pcb. > Monitors are pretty strange antennas: For instance, my monitor still > radiates quite well (although noticeably weaker) if I switch its power > supply off. It can take as much as 20 minutes to drain a good high-voltage supply (read the documents of all power supplies that operate above a couple hundred volts, it should include the discharge time constant - you want to wait through at least 3 of those). There is also the issue that a crt tube sitting unconnected in the open dry air will develop enough of a charge to knock the shit out of you if you're silly enough to grab the grounding connection on the side with one hand and be grounded to earth with the other. So even if the machine is turned off you get a continous charge build up on the tube that gets drained through various resistors to ground. Unfortunately this is a pretty incoherent signal and low power as well. I routinely deal with voltages in the 1MV range and currents (usualy not at those voltages) in the 100A range (I build 12 ft. Tesla Coils for grins and giggles that throw discharges in the 8-12 ft. range). When you start talking about voltages above a few hundred there isn't any such thing as 'off', only a higher impedance path to ground and longer time constants. NOTE: if you do decide to play in your monitor then make shure that one of your hands is in your back pocket at *ALL* times. Otherwise make shure there is somebody there to call 911 so they can haul your body off. If you don't the discharge leakage current through your heart *when* you make a mistake will cause it to go into ventricular fibrillation (v-fib). Unless you got a de-fibrillator handy your dead in about 3 minutes. > Just the passive resonance of the chassis gives a clear > signal in around a meter radius with a simple untuned dipole antenna. If they get within a meter of my machine I seriously doubt they will be using VanEck but rather rubber hose or eye ball monitoring... We're talking real world here not some Tom Clancy novel. > Switching off a monitor alone does not protect you from eavesdropping > a VDU signal, especially if the signal is not just text but a pattern > optimized for reception. True, but instead of being within a couple hundred feet (the average succesful range for interception) you're now talking about 10's of feet. At that range my dogs barking will let me know that Mallet is in the house. > After I unplug the VGA cable however, I can't pick up any signal with > our Tempest receiver unless I bring the antenna almost in contact with > the cable or connector. Duh, can you say 'impedance'....go back and study your analog and rf electronics. A monitors off impedance per line is somewhere in the 50 to 75 ohms range. The impedance of a wire hanging in the air is much higher and as a consequence the current flow and as a result the emitted em field will be much lower. > The closed PC chassis also appears to be no very > big source of VDU emanations, certainly much below the levels that > our receiver can detect. And this surprises you? A pc chassis, provided you put all the screws in it and don't have lots of holes in it, is a Faraday Cage, it's the reason they make them out of expensive metal and not cheaper plastic. A very effective method to confuse Van Eck is to have several monitors sitting next to each other with different displays. A more active display is much more effective than one that is static (eg. such as a person typing in an email to cypherpunks). I strongly suggest the following reference: High-speed Digital Design: a handbook of black magic H.W. Johnson, M. Graham ISBN 0-13-395724-1 ~$60 US ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

E-CDA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Congressional Record: February 5, 1998 (House) ELECTRONIC CAMPAIGN DISCLOSURE ACT (Mr. WHITE asked and was given permission to address the House for 1 minute.) Mr. WHITE. Madam Speaker, in March we are going to vote on campaign finance reform in this House. It is a very important issue but also a very difficult issue, and it is made particularly difficult because most of the bills before us are big bills that deal with the whole comprehensive issue that we have to talk about. I have got one of those bills, and I hope that we can pass one. But just in case we cannot, today I am introducing what we might call a small bill that will deal at least with some of the problems. This bill is called the Electronic Campaign Disclosure Act, and what it does is tell the Federal Elections Commission to get into the 21st century. It directs the FEC to establish a database on-line to search over the Internet for all the information needed about campaign finances in our country. Every campaign would have to file within 10 days a report of every contribution that it receives and contributors, and PACs would also have to file. Madam Speaker, sometimes we cannot do it all in one step. The longest journey begins with a single step, and I think if we cannot pass a big bill a small bill like the one I am introducing today would be a step in the right direction. ____________________

1 0

Driver Licenses
by Anonymous 17 Dec '03

17 Dec '03

Recently had to renew my DL here in Florida. While we are not forced to give up our fingerprints (yet)we have a new little magnetic strip similar to those on a credit card or ATM card and I can see this as a way for the State to start holding more and more data about us on these I.D.'s (like fingerprints, criminal records, etc... Coincidentally, that day when I went into my grocery store to get a six pack of brew, I got carded. I handed my new little card over and the teller and rather than looking at my date of birth she started to swipe the damn thing through her credit card reader machine! I stopped her, grabbed my DL back and told her to manually enter the date as they have always done. When she explained that it is against store policy and that she 'had' to swipe any IDs that had the strip I got my keys outta my pocket and all but removed the strip from the back of my little nemesis. Handed it back to her and told her to swipe away; it is against MY policy to provide ! ! ! the store with my address. I don't want any damn pepsi coupons mailed to me each time I buy coke, or northern tissue coupons when I buy charmin. Nor do I want the store collecting information on how much beer I buy. Sure, I want my alchohol purchases going to the Dept of Motor Vehicles and the other State departments...like hell. My question is, how much information can be stored on these strips?

11 17

Re: SOFT TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: SOFT TEMPEST > Date: Mon, 09 Feb 1998 16:44:52 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > The software that displays the license number plus activation instance > random code in your windows toolbar as an easy receivable spread > spectrum barcode would have to take care of this depending on how > exactly your license agreement is formulated. This can be resolved > in many ways. Has your technique been verified by any 3rd parties who are not affiliated with you or your firm? Do you expect to do any public demonstrations of this technology in the near future? Would it be possible to arrange for a indipendant 3rd party to receive a test setup for evaluation? > The technique of hunting software license violators via Tempest > monitoring is not really targeted at providing 100% accurate > and reliable identification of abuse at any point of time as That's good. The thought that given current technology a signal reception van could pull one monitors display out of a building that could potentialy have 1,000+ pc's (my last job had about 1500/floor and 3 floors) at a range of say 200 ft. is truly incomprehensible. If it works that is a feat worth many laurels. > (e.g., has bought a single copy of an expensive CAD software but > uses it on over 80 workstations all day long), which then can > justify to get court relevant proof by traditional means of > police investigation. You show up in my companies parking lot without my permission and start snooping you'll be the one sitting in jail facing industrial espionage charges. Any defence lawyer worth a damn would be able to blow this out of the water, private citizens don't have the right to invade my privacy any more than police without a warrant - and that take probable cause. > One obvious countermeasure are Tempest shielded computers or rooms, It's the monitors that need shielded, the computers already sit in a Faraday cage. Simple copper screen glued to the inside of the monitor case with a paper sheild and then grounded will resolve that problem. Be shure to put a grounded screen on the front of the tube as well (similar to those radiation shields that some companies make that don't work because they aren't grounded). > Another countermeasure are software reverse-engineering and modifying > the broadcast code. This is around as difficult as removing dongle > checking code: Not impossible, but for the majority of users too > inconvenient. A simple Gunn Diode oscillator driving a broad-band 100W rf amplifier will swamp any signal you could hope to catch. Cost, about $250 ea. With the new low-power transmitter rulings there wouldn't be much anyone could do about it either. > an interesting application. Tempest research requires some > expensive equipment (special antennas, very high-speed DSP > experimental systems, an absorber room, etc.). Gee, and to think that when I've done this sort of stuff I only used a Commodore 1702 composite monitor and some rf amplifiers and filters... Duh, silly me. Any claim that it can *only* be done with lots of money is almost always wrong. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 4

Re: Washington on the verge of being nuked?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

David Honig <honig(a)otc.net> writes: > > > LA has a combination of closed pipes and open aqueducts, often > in remote areas. Simple disruption, not poisoning, would > be easier. The resivoirs don't hold enough for more > than a few days. One can "disrupt" the water supply by just making a credible assertion that it's been poisoned - but it won't kill nearly as many people as actual poison (or virus/bacteria). --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 16:36:16 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: Laptop TEMPEST (fwd) > At 08:30 AM 2/9/98 -0600, Jim Choate wrote: > >> FCC RF/EMC testing is well nigh useless for TEMPEST protection. > > > >I disagree, it would give you a gross baseline on the total emissions > FCC specs aren't real tight. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

What Jim Choate doesn't know
by Anonymous 17 Dec '03

17 Dec '03

When Jim Choate writes about something that I know about, he is usually wrong. Look at the hash he made of quantum mechanics recently. And don't get me started on his blunders regarding cryptography. So when he writes about something I don't know about, like the EM emissions of video tubes, I tend to assume the same thing. He's probably all messed up. Anybody else have the same experience? And how about his countless off-topic posts, forwarding all kinds of pointless crap? Is anyone else sick of that, too?

2 1

Re: the best justice money can buy --Lessig (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 14:22:40 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: the best justice money can buy --Lessig (fwd) > Gates got rich not by selling good software, but by selling software > very well. His original money was made by being the first company to sell a CP/M compliant BASIC. It was very heavily pirated and Microsoft became a de facto standard for S-100 using CP/M. Then because of Digital Research's failure to treat IBM with respect he was selected as the supplier for their basic OS. This decision was made because of his reputation with CP/M software. Because of this connection Microsoft was in a position such that Gates couldn't help but make money as long as IBM was selling pc's. And considering nobody ever lost their job buying IBM it was a shoe in that IBM was going to sell machines. His first versions of Windows didn't sell. He looked at what was selling which was a GUI with more features and better looks. He hired the right people to impliment those changes and wallah he had a winner. All those pc's running his old os no longer had to go to Desqview and DR to get a GUI that was acceptable to their users. From their they have used various marketing and licensing tricks to increase his market share. > Copyright is part of the process, but it's possible to > sell your product to computer manufacturers with any customization > they need using contracts instead of copyright to make your money. But a company doesn't make money from selling software to computer manufacturers, they make money by having their software on pc's that the users use. > It's also possible to do copy protection in your software; > games makers do this because they're widely pirated by non-point-source > attacks (kids, mostly) who are hard to track down and sue, > unlike major computer manufacturers who are easier to find, > both to sue if needed or to provide support for. > Copy protection was one of the things people hated about Lotus 123; > I don't remember Excel or MS-DOS ever having it. And in the long run non-copyrighted software has a significant market advantage. It's smaller, it is more stable, and people don't get as pissed off when they want to make their backups. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: What's the latest in factoring? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 09 Feb 1998 13:40:03 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: What's the latest in factoring? > Remember that factoring difficulty is roughly exponential; > adding logn bits about doubles the cracking workload > (depending on which factoring method is being used). > Factoring a 1024-bit number is _much_ harder than factoring a 512-bit > number, and factoring a 2048-bit number is well into age-of-the-universe > difficulty level. The practical level of factoring right now > is about 512 bits, for either a distributed internet effort or > an NSA internal one; in the unlikely event that Moore's law lets > us double processing power 100 times in the next 150 years, > that means a 1500-bit key could be crackable. So 2048 bits > is certainly more than enough for _your_ lifetime. That depends on what current and near-future medical technology can do to extend the lifespan of humans. If your assumption is that most folks younger than about 50 will be dead in 75 years I suspect that you're in for a nasty surprise. The reason I posted those cc:'s regarding such research is enough that current estimates of key strength based on human life times need to be re-evaluated. It is my suspicion that within 10-15 years it will be possible, as a matter of course in regards employer medical insurance, to have ones biological clock reset such that the lifespan will be extended 3-4 times with the main limiting factor being cancers. Under those conditions key strength lifetime computations need to be re-evaluated. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Driver Licenses (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 10 Feb 1998 02:12:05 +0100 (CET) > From: Lucky Green <shamrock(a)cypherpunks.to> > Subject: Re: Driver Licenses > On Mon, 9 Feb 1998, Tim May wrote: > > If a U.S. Passport is not considered enough I.D., because it doesn't have > > the Big Brother Inside magstripe, one walks away from the transaction. > > Just as a data point, in the State of Oregon, an US passport is *not* > valid ID for alcohol purchases. Magstripe or no magstripe. You can add Texas to that list. You can use a passport to get a Tx DL or ID card but it in and of itself is worthless for personal ID in most cases. Most places here specificaly require a valid drivers license from some state, they don't seem too interested in if Big Brother certifies your identity. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

The Wit and Wisdom of Tim May
by Anonymous 17 Dec '03

17 Dec '03

1 0

Re: Washington on the verge of being nuked?
by David Honig 17 Dec '03

17 Dec '03

At 06:34 PM 2/9/98 EST, Dr.Dimitri Vulis KOTM wrote: >One can "disrupt" the water supply by just making a credible assertion that >it's been poisoned - but it won't kill nearly as many people as actual >poison (or virus/bacteria). > Psychops? That doesn't work when you have sufficient health-orgs and telecomm to get the word out that the water's ok. Actually, a lot of people drink bottled water here :-) but the 10 million kilos of shit excreted by LA every day would build up pretty fast. Electric power is probably as vunerable as waterways, despite conscious efforts to make the grid redundant. Of course both are controlled by computers, as uncle sam is realizing. In LA, all it takes to create a looting riot is to cut electricity to the city's alarm systems... .... Major freeway intersections are closed down 2-3 times a year in LA due to bomb threats, which are usually just threats -no bombs are found. You can snarl the roads very easily at the right time of day, since the roads' bandwidth is already exceeded and congestion persists after the clog is removed. At *least* once a month a major piece of freeway is shut down for an hour or so for "police activity", one hears on traffic reports, often around rush hour. Crypto relevance: traffic signals can be controlled by modem, a Civ-E friend tells me. They are built to be fail-safe (blinking red), but ever seen rush hour commuters deal with all blinking red? Even tanks can't get through a gridlocked city (a factor in Korean invasion planning). ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu Lewinsky for President '2012

2 1

RYNO Seminar -- 18 February
by sbcom＠wainfleet.ids.on.ca 17 Dec '03

17 Dec '03

GETTING ELECTRONIC MEDICAL RECORDS INTO THE EXAM ROOM You are cordially invited to join RYNO, 4MD, Citrix and Symbol Technologies for a FREE seminar on a cost-effective method of getting electronic medical records into the exam room. At this half-day event you will hear several success stories on how other Health Care Institutions have implemented this program and benefited from innovative technology to increase profitability and efficiency. If you are interested in this technology, but cannot make it to the seminar, please contact RYNO's Healthcare Vertical Manager, Veronica Henderson at vhenderson(a)ryno.com or call her at 1-800-366-7966, xt 265 to learn more. Date: Wednesday, Feb. 18th, 1998 Time: Registration & Breakfast 9:00am* Seminar: 9:30am Adjourn and Hosted Lunch: 12:00pm* Location: Marriott Hotel, Walnut Creek 2355 North Main St. Walnut Creek, CA 94596 510-934-2000 RSVP: 707-746-6252 x262 or email - jramirez(a)ryno.com Please respond by February 13th *Breakfast and Lunch are complimentary Please feel free to RSVP anyone else who may be interested in attending. We look forward to seeing you there! Joy Ramirez RYNO 4271 Park Road Benicia CA 94510 707-746-6252 x262 jramirez(a)ryno.com SYMBOL TECHNOLOGIES AND 4MD CORPORATION: Healthcare provider needs can finally be addressed electronically. Symbol Technologies and 4MD Corporation provide a complete point-of-care solution for healthcare providers using a Winframe Server. 4MD Corporation has developed a simple, yet powerful, browser-based, Clinical Decision Support (CDS) application that runs on the Symbol wireless thin client over a Citrix Winframe. Healthcare providers can now pull up patient records, review electronic medical records, lab reports, radiology reports and other patient information as well as clinical guidelines all at a patient's bedside, or in the exam room on a handheld, flatscreen, mobile thin client. Symbol Technologies and 4MD Corporation solutions are designed for high-performance data management, and for satisfying the unique demands of healthcare applications where mobility, durability and ease of operations are a must. WINFRAME: Is the only software that allows you to access a single server with virtually any Windows application from across any type of network connection by any desktop without the software being installed on the desktop! Allows you to use existing hardware (old 386, 486 PC's) and still use advanced software applications, thus getting longer use out of the hardware and saving money. Gives IS departments more control and manageability over the network. Allows remote offices to access information easily from the main headquarters. Saves in maintenance costs. WHY WINFRAME? Today, more than ever, I/S professionals are pursuing cost-effective and efficient solutions to enterprise-wide application deployment. Deploying business-critical Windows-based application?s across the enterprise is a monumental task for today?s I/S professionals. They?re faced with huge obstacles including manageability requirements, multiple desktop computing platforms, clogged networks on heavily trafficked LAN?s, inadequate application performance for remote users, and poor security. And, if that?s not enough, they?re expected to solve these problems faster, with fewer people and a smaller budget! RYNO: RYNO is an award winning Bay Area VAR with top level expertise in both networking and software development. We serve healthcare institutions from building the network to developing the GroupWare applications that make a network function efficiently as a whole. RYNO?s mission is to provide our customers with increased profitability and efficiency by providing superior technology solutions. RYNO in partnership with Citrix Solutions is offering you a free seminar introducing WinFrame, a new paradigm in information management systems! DIRECTIONS TO WALNUT CREEK MARRIOTT: DRIVING FROM SAN FRANCISCO: I-101 North - follow signs to Bay Bridge (right lanes) to I-580 East. One mile to Highway 24 Concord/Walnut Creek. Highway 24 East to I-680 North. Continue I-680 North to North Main Street exit. Turn left on North Main Street and right on Parkside Drive. Hotel is located on the corner of Parkside Drive and North Main Street. DRIVING FROM OAKLAND: Follow signs to I-880 Freeway North (towards Oakland). Take I-880 to I-980 - Walnut Creek. This turns into Highway 24. Drive East on Highway 24 (use left lanes) to I-680 Interchange.Drive North to I-680 for 1.5 miles to North Main Street Exit. Turn left on North Main Street and right on parkside Drive. Hotel is located on the corner of Parkside Drive and North Main Street. DRIVING FROM SACRAMENTO: Follow the signs to I-680 South Concord and Walnut Creek. Cross the Benicia Bridge and proceed to Walnut Creek, exiting on North Main Street. (Approx. 5 miles). Stay in the right lane and turn right after exiting North main. The hotel is one block East on the right side of the street. DRIVING FROM SAN JOSE: Follow the signs to I-680. As you approach Walnut Creek, stay to the right and exit at North Main Street. Turn left on North Main Street and right on Parkside Drive. Hotel is located on the corner of Parkside Drive and North Main Street. /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. ////////////////////////////////////////////////////////////////////////////////

1 0

Financial Cryptography 1998 Workshop UPDATE
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Mon, 9 Feb 1998 14:37:24 -0400 X-Authentication-Warning: online.offshore.com.ai: list set sender to fc98-request(a)offshore.com.ai using -f Subject: Financial Cryptography 1998 Workshop UPDATE To: fc98(a)offshore.com.ai Date: Mon, 09 Feb 1998 10:20:13 -0800 From: Ian Goldberg <iang(a)cs.berkeley.edu> Resent-From: fc98(a)offshore.com.ai X-Mailing-List: <fc98(a)offshore.com.ai> archive/latest X-Loop: fc98(a)offshore.com.ai Precedence: list Resent-Sender: fc98-request(a)offshore.com.ai CALL FOR PARTICIPANTS - UPDATE The Financial Cryptography 1998 (FC98) Workshop for Senior Managers and IS Professionals March 2-6, 1998 The InterIsland Hotel Anguilla, BWI <http://fc98.ai/> FC98 is sponsored by: * RSA Data Security Inc. <http://www.rsa.com/> * C2NET, Inc. <http://www.c2.net/> * Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> * Sicherheit und Privat- International Bank * Offshore Information Services <http://www.offshore.com.ai/> * e$ <http://www.shipwright.com/> FC98 Conference and Exhibition February 23-27, 1998 FC98 Workshop for Senior Managers and IS Professionals March 2-6, 1998 The Inter-Island Hotel Anguilla, BWI Workshop and Conference Reservations: <http://fc98.ai/> Last year, the Financial Cryptography '97 (FC97) Workshop was the world's first intensive financial cryptography workshop for senior managers and IS professionals. This year, the Financial Cryptography '98 (FC98) Workshop will be held Monday through Friday, March 2-6, 1998, at the Inter-Island Hotel on the Carribbean island of Anguilla. This workshop will follow the peer-reviewed financial cryptography conference and commercial exhibition, Financial Cryptography 1998 (FC98), which will be held the preceding week, February 23-27, 1998. The goals of the combined workshop, conference and exhibition are: * to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, * to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, and, * to showcase the newest products in financial cryptography. The Workshop Ian Goldberg, the Workshop chair, has picked an outstanding team of instructors in financial cryptography and internet financial system security to teach the courses in this workshop. The Workshop will consist of 40 hours of intensive instruction and lab time over 5 days. Students will have access to Internet-connected workstations. Who Should Attend The Workshop is intended for senior IS managers and technical professionals who want to get completely up to speed on the design, development, and implementation of financial cryptography systems, the core technology of internet commerce. After the workshop, senior managers will have a hands-on understanding the strengths and liabilities of currently available financial cryptography and internet transaction security software and hardware, and thus be able to make better asset allocation decisions in this area of explosive technology growth. Senior technical professionals with strong IS experience will be able to implement those technologies and to pass on what they've learned to their clients and colleagues when they return home. The Workshop will be held in a casual but intensive atmosphere at the very cutting edge of financial technology on the internet. Someone has likened the experience to a financial cryptography bootcamp. At the end, Workshop attendees should be utterly conversant in cryptography as it applies to finance. Workshop participants will not only know what everyone else is doing now in internet commerce, but, more important, because they understand the implications of strong financial cryptography on ubiquitous public networks, they will be able to know what to do *next*. The Workshop Leader Ian Goldberg is a Ph.D. student in security and cryptography at the University of California, Berkeley. He was the first winner of RSA Data Security Inc.'s Secret-Key Challenge, breaking a 40-bit cipher in just 3.5 hours. In late 1995, he discovered what became a much-publicized flaw in Netscape's implementation of SSL. He is a recognized expert in electronic payment systems, and in DigiCash's ecash digital bearer certificate protocol in particular. He has produced several ecash clients for Unix and Windows, as well as an ecash module for the Stronghold web server, which has extended the existing ecash system for better security, privacy, and ease-of-use. The Principal Instructors Gary Howland has spent the last four years with several companies that are primarily working with secure electronic commerce (including Digicash), where he has been involved with the design and development of secure payment protocols, and the application of these protocols to such tasks as electronic cash, bond trading, loyalty systems, and online gambling. He is also responsible for the development of the a freely available cryptographic library for java and perl. John Kelsey is an experienced cryptographer, cryptanalyst, and programmer who has designed several algorithms and protocols. He pioneered research on secure random number generators, differential related-key cryptanalysis on block ciphers, and the chosen-protocol attack against cryptographic protocols. His research has been presented at several international conferences, and he has broken many proposed commercial cryptographic algorithm, protocol, and system designs. Kelsey has a degree in Computer Science and Economics from the University of Missouri Columbia. Adam Shostack is Director of Technology for Netect, Inc, a Boston based startup building state of the art server security management applications. He has extensive background in designing, implementing and testing secure systems for clients in the medical, computer, and financial industries. His recent public work includes 'Apparent Weaknesses in the Security Dynamics Client Server Protocol,' 'Source Code Review Guidelines,' and comparisons of freely available cryptographic libraries. Workshop Topics * Security on the Internet o Internet Protocols: IP, TCP, UDP o Higher-level Protocols: Telnet, FTP, HTTP, SSL o Solid Foundations for Cryptographic Systems o A History of Internet Attacks o Building Internet Firewalls o Building a Bastion Host o Turning your Bastion Host into a Web Server o Non-internet Internet Security * Cryptography o The Need for Cryptography o History of Cryptography o Classical Methods o Modern Methods o Private and Public Key Cryptography o Authentication vs. Security o Certification and Public Key Infrastructures o Cryptographic Protocols o Engineering a Cryptographically Secure System o Why Cryptography is Harder than it Looks o Security Through Obscurity and How to Recognize Snake Oil * Internet Payment Systems o Payment models: coin-based, cheque-based, account-based o Security Issues o Privacy and Anonymity Issues o Smartcards vs. Software o Existing Payment Schemes + credit cards + First Virtual + CyberCash + DigiCash o Forthcoming Payment Schemes + SET + Mondex + Millicent + micropayments * Setting Up an ecash-Enabled Web Server o Setting up the Web Server o Signing up for ecash o Installing the ecash Module o Setting Prices o Logging o Advanced Methods + ecashiers + moneychangers The price of the workshop is $5,000 U.S. You can pay for your FC98 workshop ticket with Visa or MasterCard, with ecash, or with any of a number of other internet commerce payment protocols, at the regstriation site: <http://fc98.ai/>. Please register and make your plane and hotel reservations as soon as possible; workshop space is extremely limited. The workshop price includes meals (but not lodging) at the InterIsland Hotel and lab space, plus the delivery and installation of hardware, network access, internet commerce software, all to a location like Anguilla. And, of course, 40 hours of instruction and structured lab activity. We have priced the workshop to be competitive with other comprehensive business and professional technology workshops of similar total session length. In addition, the first ten FC98 workshop participants will receive a 50% reduction in their FC98 Conference and Exhibition fee, for a savings of $500 off the $1,000 conference admission. You can register, and pay for, your workshop ticket at <http://fc98.ai/>. Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT, or in the case of St. Maarten, with a short ferry ride to Anguilla. See your travel agent for details. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. Please Note: Your FC98 Workshop fee only covers meals at the InterIsland Hotel. The InterIsland is actually a small guesthouse attached to a large conference facility, and so rooms there are in short supply. Fortunately, there are lots of small hotels and guesthouses nearby. For more information on these hotels, please see <http://fc98.ai/> for more information. Other hotels on Anguilla range from spartan to luxurious, all within easy walking or driving distance of the Workshop at the InterIsland. More information about Anguillan hotels can be obtained from your travel agent, or at <http://fc98.ai/>. Registration and Information for Other FC98 Events To register and pay for your ticket to the FC98 conference itself, see: <http://fc98.ai/> For information the selection of papers for the FC98 conference see: <http://www.cwi.nl/conferences/FC98> If you're interested in Exhibition space, please contact Blanc Weber: <blancw(a)cnw.com> If you're interested in sponsoring FC98, also contact Blanc Weber: <blancw(a)cnw.com> Financial Cryptography '98 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published by Springer Verlag in their Lecture Notes in Computer Science (LNCS) series. The FC98 Organizing Committee: * Vince Cate and Bob Hettinga, General Chairs * Ray Hirschfeld, Conference Chair * Matt Franklin, Conference Co-Chair * Ian Goldberg, Workshop Chair * Blanc Weber, Exhibit and Sponsorship Manager And our sponsors... * RSA Data Security Inc. <http://www.rsa.com/> * C2NET, Inc. <http://www.c2.net/> * Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> * Sicherheit und Privat- International Bank * Offshore Information Services <http://www.offshore.com.ai/> * e$ <http://www.shipwright.com/> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Drivers Licenses
by David Miller 17 Dec '03

17 Dec '03

Anonymous (remailer(a)htp.org) wrote: > My question is, how much information can be stored on these strips? The data that's stored on most of the cards (credit cards, hotel keys, gym cards, etc.) are encoded with 5 bits per character. I believe that this is also known as Baudot encoding. You can store somewhere around 80 characters per track on "normal" cards, and most cards contain a 1/2" magnetic stripe that can hold 4, 1/8" tracks. So, I would estimate that your drivers license would hold a total of about 320 characters on all four tracks with standard encoding techniques. If you are interested in rendering only individual tracks unreadable, it can be done. I have done it by scratching off the magnetic material as you described. Of course, all tracks run horizontally across the card, with track 1 being the track closest to the edge of the card. So, if you wanted to destroy track 1, you could scrape off the 1/8" of the strip closest to the long edge of the license. Have fun. --David Miller middle rival devil rim lad

1 0

The Latest Horiuchi Antics
by Eric Cordian 17 Dec '03

17 Dec '03

Now that the Feds have gotten the Horuichi case moved out of state jurisdiction into a federal courtroom, they want their federal judge to dismiss all charges. ----- BOISE, Idaho (AP) The federal government on Monday sought the dismissal of a state involuntary manslaughter charge against the FBI sharpshooter who killed Randy Weaver's wife at Ruby Ridge six years ago. The Justice Department petition filed in federal court argued that Lon Horiuchi was protected by the Supremacy Clause of the U.S. Constitution so he cannot be subject to state prosecution for actions in the line of duty. "It is imperative that federal officials be protected from state prosecution in such circumstances because without the protection ensured by the Supremacy Clause, rigorous enforcement of federal law would be severely chilled to the detriment of the general public good,'' the petition said. Horiuchi was among dozens of federal agents who surrounded Weaver's remote mountain cabin in the Idaho Panhandle in August 1992 in an attempt to arrest Weaver on an illegal weapons charge. Weaver's 14-year-old son, Sam, and deputy U.S. Marshal William Degan of Quincy, Mass., were killed in the gunfight that touched off the 11-day siege. Vicki Weaver was fatally shot by Horiuchi on the second day. Both Randy Weaver and family associate Kevin Harris were acquitted in 1993 of federal murder and other charges in connection with the siege. Weaver was also acquitted of the weapons charge that had prompted federal agents to confront him. Last August, five years to the day after Mrs. Weaver's death, prosecutor Denise Woodbury filed the involuntary manslaughter charge against Horiuchi. The Justice Department had earlier declined to prosecute Horiuchi. The prosecutor also charged Harris with murder in Degan's death, but that charge was dismissed on a double-jeopardy ruling. On Jan. 7, U.S. District Judge Edward Lodge moved the case to federal court. Horiuchi pleaded innocent. His trial is scheduled for March 10. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" "America is like a corrupt hard drive. It's full of virii and huge inefficient programs written in Java and Visual Basic. Whan a hard drive gets to the point that it is as screwed up as America is, it's beyond repair. America needs to be formatted."

1 0

RE: Cyber 'Nannys"
by WebWarrior3＠InfoWar.Com 17 Dec '03

17 Dec '03

An anonymous person wrote, in reference to CyberSitter type 'blocking' software: "These companies are attempting to provide the services desired by their customers... They give concerned parents a sense of safety..." While I do not disagree that these companies should be able to market their products, I wholeheartedly disagree with the fact that often their customers (the adults who bought the software or subscribed to he 'service') are not allowed to have a list of what is actually blocked, and decide for themselves if they want their kids to have access to any of these sites. It would be beating a dead horse to describe, here, the potential value of some of the information that is blocked by these packages; one only has to take a look at any of the published news reports (or actually use one's sense of reason) to see that there are many web sites that contain some of the words that are automatically bloked by these 'services' that are absolutely not...smut <for lack of a better term>, hate speech, or illegal/illicitly oriented. On another, perhaps more severe (to you, Anonymous poster,) angle, they DO NOT, NOR CAN THEY provide a genuine saftey zone for the children who are to be 'protected.' They are providing a false sense of security to parents who, for one reason or another, feel that they are not able to provide their children with direction on what to, and what not to, view on the internet as well as what to do if the instance arises that something that is deemed taboo happens to pop up on their monitor when they click on the 'Chutes and Ladders' web site <for example, I don't know if there is one...trying to be safe and guess that there is not>. I am assuming that there is no latent support for the use of these packages in public libraries, so I won't go into that issue. In general, these programs are flat out crap. They purport to do something that is impossible to accomplish and they often refuse to even inform their customers what they actually ARE doing. Scott R. Brower http://www.infowar.com http://www.efflorida.org

5 11

Algorithms used in PGP 5.x; Relative strength of Blowfish
by Alan Tu 17 Dec '03

17 Dec '03

What are the algorithms used in PGP 5.x, symetric ones, that is? For anything besides 3DES and IDEA, what are their relative strengths to 3DES or IDEA? Could someone tell me what their key lengths are? Also, what's the relative strength of Blowfish to 3DES or IDEA? Its key length is variable, as I recall. Could someone tell me the range? --Alan

2 1

Re: What's the latest in factoring?
by Alan Tu 17 Dec '03

17 Dec '03

Dear Bill, Sorry, but you may see this message twice. Bill Stewart wrote: >>>>> There are two countervailing arguments about very long keys; one is that if you understand cryptography well enough to evaluate the issue, you'll know you don't need to bother, but the other is that if you don't understand crypto very well, maybe you should be overly conservative. <<<<< Well, personally, I guess by your def I'm in the second group, since I didn't know I don't need to bother. >>>>> Remember that factoring difficulty is roughly exponential; adding logn bits about doubles the cracking workload (depending on which factoring method is being used). Factoring a 1024-bit number is _much_ harder than factoring a 512-bit number, and factoring a 2048-bit number is well into age-of-the-universe difficulty level. The practical level of factoring right now is about 512 bits, for either a distributed internet effort or an NSA internal one; <<<<< I kind of knew this from a hypothesis, so PGP 5.x is being conservative, possibly overly so by your definition. I've seen a screen on a friend's computer and the default is something like 2048. By the way, we don't know about NSA. They may be able to factor any number, if they have an algorithm. >>>>> in the unlikely event that Moore's law lets us double processing power 100 times in the next 150 years, that means a 1500-bit key could be crackable. So 2048 bits is certainly more than enough for _your_ lifetime. Increasing processing power 2**100 times is likely to be tough :-) After all, features in current microprocessors are on the order of 100 atoms wide. And by the time we've developed the level of nanotechnology needed to speed up processing that much, there'll be tiny audio bugs listening to you type your passphrase into your keyboard and reporting it back to the Central Intelligence Corporation, or picking up the electromagnetic fields from your direct neural interface, so the crypto strength won't matter much. <<<<< I believe in Moore's law, since in 1992-1993 I read an analysis that Moore's law was true for the last 100 years. I think its still true today. Your last set of thoughts is chilling, isn't it? But consider this. People 10, 20, 30 years ago like us are saying that the government can eavesdrop on their communication in the future, just as you are saying now. Look now. I am very proud that I am part of the e-crypto revolution (my coined word). I am helping to slow down NSA. I hope that, by the time the tech you hypothesize about is here, we again will have technology to slow down NSA. >>>>> But do you really _need_ to factor the prime number to crack PGP? No. Remember that PGP uses the RSA key to encrypt session keys for IDEA, or for signing MD5 hashes of documents, rather than using it directly. So you can decrypt the message by cracking IDEA, or forge a message by finding MD5 collisions. Cracking IDEA's 128-bit keys was estimated to be about as hard as factoring a 3100-bit number, though improvements to factoring technology may make a 4096-bit number as easy as IDEA. Also, PGP 2.x passphrases are encrypted with IDEA, so if they've got your secring.pgp and can crack 4096-bit keys, you're toast, <<<<< I know this. The point is that most if not all people know that RSA is the weak link, not IDEA. Would you rather start to work on a 1024-bit RSA key or IDEA passphrase of an enemy? Obviously the RSA key. Barring any mathematical weakness in IDEA, I am not worried about IDEA. By the way, my three-year-old info says that IDEA was being mathematicly attacked in many quarters, civilian and non-civilian alike. If they was anything, I would have heard by now, but I still want to ask. Has any significant cryptanalysis attack against IDEA been "successful"? >>>>> even if your passphase isn't just your dog's name spelled backwards. Similarly, by the time processing power doubles 100 times making your 1500-bit key insecure, MD5 will be long toasted. Either way, there's no need to go beyond 4096-bit keys ever, with old-style PGP. Even if you're being overly conservative, that's more than enough. <<<<< You seem to be suggesting that MD5 will lead to the downfall of all of our keys. Let's think about your toasting of MD5. The worst thing that can happen to a one-way hash function is that it can go both ways. So its dead for signatures. So let's suppose now that I can take any document and produce another document with a higher or lower dollar figure in it and come up with the same hash. I can do this easily. But to somehow exploit MD5 to crack a passphrase it is impossible because you have nothing to start working with. You only have an encrypted key, encrypted with an 128-bit IDEA key. Look, for our lifetimes, I don't see much point in going beyond 4096 bits either, maybe even 3072. >>>>> Newer versions of PGP dump RSA and IDEA for patent reasons, but they also offer alternatives to IDEA and MD5 which may be stronger. (SHA-1 is stronger than MD5, triple-DES requires immense amounts of storage to reduce it to a strength similar to IDEA, and just being extensible means you can replace algorithms that are obsolete.) <<<<< Triple-DES is not stronger than IDEA, although it is secure for the most part. According to Phil Zimmerman, its effective key length is 112 bits to 128 bits for IDEA. Its also 3 times slower than DES, which is comparably slow anyway. Also, to settle this issue once and for all in my mind, the Win95 version of PGP, what symetric algorithms do you have to choose from? Does anyone have any comments on the relative strength of Blowfish? What about the mathematics of Blowfish? Has anyone tried to cryptanalyze it yet? Also, I apologize for going on like this, I'll post a separate question on that. >>>>> The other side of practical is how much work it takes to use long keys, and how many people who want to talk to you use them. The answer to the latter is "Not many" for RSA keys over 2048. The former is about N**2 for decryption and N**3 for key generation, and about linear for encryption with short exponents, so it'll take you 64 times as long (once) to generate the key, and 16 times as long to decrypt or sign anything, compared to the far-more-than-strong-enough 2048-bit key, which is already 4 times as hard to use and 8 times as hard to generate as a 1024. <<<<< As I said, I have a 2048-bit key in hibernation. I haven't posted it to a key server, but a friend who recently got PGP decided to use my public key ring, and use my 2048-bit key. There are only two places in which this key of mine is accessible. Anyway, I don't see the 4 time slowdown for using my secret key. (I have a 133 MHz). However, the effect is probably true for slower processors. I agree that we shouldn't bother with keys above 4096 bits because its not necessary and it takes too long to communicate with people who have slower processors. >>>>> It's not worth the bother, unless you know have a really, really special application that needs to remain secret until long after you've overthrown the government. On the other hand, at least the RSA patent will have expired by then :-) <<<<< I already addressed this point. >>>>> The Diffie-Hellman implementations in PGP 5.x will let you use key lengths up to 4096, but the speed behaviour is a bit different. In particular, key generation is much faster, so generating overkill-length keys isn't as boring. <<<<< First of all, Win95 (not my computer) seems slow to me, even if that person's processor is faster than mine. And I hear so much disk reading or writing, no wonder its slow. Boring? Win95 cannot make you bored. Go do something else, or play a MIDI file. You can multi-task. --Alan

1 0

Re: 145 Million
by Anonymous 17 Dec '03

17 Dec '03

Someone wrote: >>If someone with an 8th grade >>education can make a personal >>fortune of $145 million in network >>marketing with herbs, And someone else replied: >that's a shitload of weed! it would >be quite risky too trying <sic> to >move over 45,000 lbs of quality >weed. All I can say is that if you are paying $145 for 45K pounds, you are getting ripped off no matter if it is the kindest Norhtern Lights you ever smoked. That is $18,777.78+ a pound.

1 0

King Willie:-- He's between Iraq and a Hard-On
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Well... It looks as though the 17th will be a "good day to die" if your an Iraqi...Many sources seem to be targeting the window of Feb 17 - Feb 23 for the start of hostilities... Wag the dawg... comes to mind of course... I wouldn't put it past King Willie to do such a thing to deflect attention from Peckergate.. It seems to me though that the lunatic in charge of North Korea might just find that Feb 17- 23 is also a good time to play games in the south :( after all... the worlds policeman will be preoccupied and stretched mighty thin...

1 0

CFP - Recent Advances in Intrusion Detection (RAID'98)
by Marc Dacier 17 Dec '03

17 Dec '03

Call For Participation - RAID'98 First International Workshop on the Recent Advances in Intrusion Detection September 14-15, 1998 Louvain-la-Neuve, Belgium We solicit your participation in the first International Workshop on the Recent Advances in Intrusion Detection. This workshop, the first in an anticipated annual series, will bring together leading figures from academia, government, and industry to talk about the current state of intrusion detection technologies and paradigms from the research and commercial perspectives. Research into and development of automated intrusion detection systems (IDS) has been under way for nearly 10 years. In that time, only a few systems have been widely deployed in the commercial or government arena (e.g., DIDS, NADIR, NetRanger, Stalker). All are limited in what they do. At the same time, the numerous research systems developed have been more engineering than scientific efforts, with scant quantitative performance figures. As we survey the field of automated intrusion detection, we are faced with many questions: 1) What *research* questions have yet to be answered about IDS? 2) What are the open questions, limitations, and fundamental concerns about existing intrusion detection methodologies? 3) What metrics shall we use to measure IDS performance and thus compare different IDSes? These measurements should highlight the successes and expose the limitations of current IDS approaches. 4) What factors are inhibiting transfer of research ideas into functional deployed IDSes? How can those be addressed? 5) What is the role of a deployed IDS? How should or can it fit in with other security systems? 6) What are the typical operating environments and policies in which IDSes are used? 7) What are the challenges for IDSes in very large environments, such as the Internet? 8) Is it time to be thinking about IDS standards? What are the advantages and disadvantages of standardizing components of IDS? What forums (e.g., IETF, ISO) would be appropriate for pursuing such standards? 9) What are the problems of turning the results of intrusion detection tools into legally reliable evidence? What are the problems of admissibility and of court-room presentation? We invite proposals and panels that explore these questions or any other aspect of automated intrusion detection. We especially solicit proposals and panels that address: 1) New results related to intrusion detection methodologies and technologies. 2) Innovative ways of thinking about intrusion detection; for example, the applicability of R&D in the fields of survivable and/or dependable systems, data mining, etc. 3) User experiences and lessons learned from fielded intrusion detection systems. 4) IDS for emerging computer environments (e.g., Java, CORBA, NT ). 5) Commercial intrusion detection systems. We have scheduled RAID'98 immediately before ESORICS'98, at the same time as CARDIS'98, and at the same location as both of these conferences. This provides a unique opportunity for the members of these distinct, yet related, communities to participate in all these events and meet and share ideas during joined organized external events. INSTRUCTIONS: Proposals for presentations must include a title followed by an abstract that is a maximum of 600 words in length. The presenter may include a full paper with the abstract, and will have either 15 or 30 minutes (including questions) for the talk. Panel proposals should include a title, proposed chair, tentative panelists, a description (under 300 words), format of the presentation, and short rationale for the panel. Panel sessions must fit into one hour time slots. Each proposed participant must include his or her name, organization, position, e-mail address, facsimile and telephone number, and a brief biography. All proposals must be in English. Plan to give all panels and talks in English. We must receive all proposals before June 15, 1998. We strongly prefer they be submitted by e-mail to raid98(a)zurich.ibm.com. Various formats (ASCII, postscript, Word, WordPro, Framemaker, and LaTex) are acceptable. If necessary, hardcopy proposals may be sent to: Marc Dacier Global Security Analysis Lab IBM Zurich Research Laboratory Saeumerstrasse 4, CH-8803 Rueschlikon, Switzerland IMPORTANT DATES: ---------------- Deadline for submission: June 15, 1998 Notification of acceptance or rejection: August 1, 1998 GENERAL CO-CHAIRS: ------------------ Marc Dacier (IBM Zurich Research Laboratory, Switzerland) Kathleen A. Jackson (Los Alamos National Laboratory, USA) PROGRAM COMMITTEE: ------------------ Matt Bishop (University of California at Davis, USA) Dick Brackney (National Security Agency, USA) Yves Deswarte (LAAS-CNRS & INRIA, France) Baudouin Le Charlier (Universite de Namur, Belgium) Stuart Staniford-Chen (University of California at Davis, USA) Rowena Chester (University of Tennessee, USA) Deborah Frincke (University of Idaho, USA) Tim Grance (National Institute of Standards and Technology, USA) Sokratis Katsikas (University of Athens, University of Aegeans, Greece) Jean-Jacques Quisquater (Universite Catholique de Louvain, Belgium) Mark Schneider (National Security Agency, USA) Peter Sommer (London School of Economics & Political Science, England) Steve Smaha (Trusted Information Systems, USA) Gene Spafford (Purdue University, USA) Chris Wee (University of California at Davis, USA) Kevin Ziese (WheelGroup Corporation, USA) For further information contact one of the General Co-chairs: Marc Dacier Kathleen A. Jackson IBM Zurich Research Laboratory Los Alamos National Laboratory Switzerland USA E-mail: dac(a)zurich.ibm.com E-mail: kaj(a)lanl.gov Tel.: +41-1-724-85-62 Tel.: +1-505/667-5927 Fax.: +41-1-724-89-53 Fax: +1-505/665-5220 More information will be available at: <URL:http://www.zurich.ibm.com/~dac/raid98/>. Information about ESORICS'98 is available at: ESORICS 98 home page: <http://www.dice.ucl.ac.be/esorics98> ESORICS series home page: <http://www.laas.fr/~esorics> Note: Papers and panel proposals for ESORICS'98 are due before February 28, 1998. Information about CARDIS'98 will be available at: <http://www.dice.ucl.ac.be/cardis98> -- Marc Dacier Mgr. Global Security Analysis Lab (GSAL) IBM Zurich Research Laboratory Saeumerstrasse 4 - CH-8803 Rueschlikon - Switzerland E-mail: dac(a)zurich.ibm.com Tel.:+41-1-724-85-62 Fax.:+41-1-724-89-53

1 0

How to TEMPEST for less
by Bill Frantz 17 Dec '03

17 Dec '03

>From my archives: ---------------------------------------- Preventing Electromagnetic Eavesdropping --------- NOTE: Even though the author of this document uses the term "TEMPEST" at various points, he certifies that his text consists of general concepts to reduce electromagnetic emissions, and was not based on any actual TEMPEST specifications or data. Further questions on this topic should be directed to the author, "grady(a)netcom.com". -- PRIVACY Forum Moderator --------- Abstract Eavesdropping on personal computers is not limited to looking over the shoulder of the operator or physically tapping in to an Ethernet cable. U.S. Government standards relating to the prevention of information capture via the emission of electromagnetic radiation from computers and peripherals are known as TEMPEST. However, actual TEMPEST specifications are classified. TEMPEST aside, there are inexpensive and easily applied means for individuals to minimize unintentional emissions from equipment. My document "Preventing Electromagnetic Eavesdropping," discusses these techniques. Grady Ward <grady(a)netcom.com> --------- Preventing Electromagnetic Eavesdropping A note discussing the prevention of electromagnetic eavesdropping of personal computers. Grady Ward <grady(a)netcom.com> public key verification by PK server, finger, or by request Version 1.0 22 March 93 TEMPEST is the code name for technology related to limiting unwanted electromagnetic emissions from data processing and related equipment. Its goal is to limit an opponent's capability to collect information about the internal data flow of computer equipment. Most information concerning TEMPEST specifications is classified by the United States Government and is not available for use by its citizens. The reason why TEMPEST technology is particularly important for computers and other data processing equipment is the kinds of signals components in a computer use to talk to each other ("square waves") and their clock speeds (measured in megahertz) produce a particularly rich set of unintentional signals in a wide portion of the electromagnetic spectrum. Because the spurious emissions occupy so wide a portion of that spectrum, technologies used to block one portion of the spectrum (as pulling the shades closed on a window to stop the visible light portion) are not necessarily effective in another portion. Unintentional emissions from a computer system can be captured and processed to reveal information about the target systems from simple levels of activity to even remotely copying keystrokes or capturing monitor information. It is speculated that poorly protected systems can be effectively monitored up to the order of one kilometer from the target equipment. This note will examine some practical aspects of reducing the susceptibility of your personal computer equipment to remote monitoring using easily-installed, widely available after-market components. I One way of looking at TEMPEST from the lay person's point-of-view is that it is virtually identical to the problem of preventing electromagnetic interference ("EMI") by your computer system to others' radios, televisions, or other consumer electronics. That is, preventing the emission of wide-band radio "hash" from your computers, cabling, and peripherals both prevents interference to you and your neighbors television set and limits the useful signal available to a person surreptitiously monitoring. Viewing the problem in this light, there are quite a few useful documents available form the government and elsewhere attacking this problem and providing a wealth of practical solutions and resources. Very useful for the lay person are: Radio Frequency Interference: How to Find It and Fix It. Ed Hare, KA1CV and Robert Schetgen, KU7G, editors The American Radio Relay League, Newington , CT ISBN 0-87259-375-4 (c) 1991, second printing 1992 Federal Communications Commission Interference Handbook (1991) FCC Consumers Assistance Branch Gettysburg, PA 17326 717-337-1212 and MIL-STD-188-124B in preparation (includes information on military shielding of tactical communications systems) Superintendent of Documents US Government Printing Office Washington, DC 20402 202-783-3238 Information on shielding a particular piece of consumer electronic equipment may be available from the: Electronic Industries Association (EIA) 2001 Pennsylvania Ave NW Washington, DC 20006 Preventing unintended electromagnetic emissions is a relative term. It is not feasible to reduce to zero all unintended emissions. My personal goal, for example, might be to reduce the amount and quality of spurious emission until the monitoring van a kilometer away would have to be in my front yard before it could effectively eavesdrop on my computer. Apartment dwellers with unknown neighbors only inches away (through a wall) might want to even more carefully adopt as many of the following suggestions as possible since signal available for detection decreases as approximately the inverse square of the distance from the monitoring equipment to your computer. II Start with computer equipment that meets modern standards for emission. In the United States, the "quietest" standard for computers and peripherals is known as the "class B" level. (Class A level is a less stringent standard for computers to be use in a business environment.). You want to verify that all computers and peripherals you use meet the class B standard which permits only one-tenth the power of spurious emissions than the class A standard. If you already own computer equipment with an FCC ID, you can find out which standard applies. Contact the FCC Consumers Assistance Branch at 1-717-337-1212 for details in accessing their database. Once you own good equipment, follow the manufacturer's recommendations for preserving the shielding integrity of the system. Don't operated the system with the cover off and keep "slot covers" in the back of the computer in place. III Use only shielded cable for all system interconnections. A shielded cable surrounds the core of control wires with a metal braid or foil to keep signals confined to that core. In the late seventies it was common to use unshielded cable such as "ribbon" cable to connect the computer with, say, a diskette drive. Unshielded cable acts just like an antenna for signals generated by your computer and peripherals. Most computer manufacturer supply shielded cable for use with their computers in order to meet FCC standards. Cables bought from third-parties are an unknown and should be avoided (unless you are willing to take one apart to see for yourself!) Try to avoid a "rat's nest" of wire and cabling behind your equipment and by keeping all cables as short as possible. You want to reduced the length of unintended antennas and to more easily predict the likely paths of electric and magnetic coupling from cable to cable so that it can be more effectively filtered. IV Block radiation from the power cord(s) into the house wiring. Most computers have an EMI filter built into their body where the AC line cord enters the power supply. This filter is generally insufficient to prevent substantial re-radiation of EMI voltages back into the power wiring of your house and neighborhood. To reduce the power retransmitted down the AC power cords of your equipment, plug them in to special EMI filters that are in turn plugged into the wall socket. I use a model 475-3 overvoltage and EMI filter manufactured by Industrial Communication Engineers, Ltd. P.O. Box 18495 Indianapolis, IN 46218-0495 1-800-ICE-COMM ask for their package of free information sheets (AC and other filters mentioned in this note are available from a wide variety of sources including, for example, Radio Shack. I am enthusiastic about ICE because of the "over-designed" quality of their equipment. Standard disclaimers apply.) This particular filter from ICE is specified to reduce retransmission of EMI by a factor of at least 1000 in its high-frequency design range. Although ideally every computer component using an AC line cord ought to be filtered, it is especially important for the monitor and computer CPU to be filtered in this manner as the most useful information available to opponents is believed to come from these sources. V Block retransmitted information from entering your fax/modem or telephone line. Telephone line is generally very poorly shielded. EMI from your computer can be retransmitted directly into the phone line through your modem or can be unintentionally picked up by the magnetic portion of the EMI spectrum through magnetic induction from power supplies or the yoke of your cathode ray tube "CRT" monitor. To prevent direct retransmission, EMI filters are specifically designed for modular telephone jacks to mount at the telephone or modem, and for mounting directly at the service entrance to the house. Sources of well-designed telephone-line filter products include ICE (address above) and K-COM Box 82 Randolph, OH 44265 216-325-2110 Your phone company or telephone manufacturer may be able to supply you with free modular filters, although the design frequencies of these filters may not be high enough to be effective through much of the EMI spectrum of interest. Keep telephone lines away from power supplies of computers or peripherals and the rear of CRTs: the magnetic field often associated with those device can inductively transfer to unshielded lines just as if the telephone line were directly electrically connected to them. Since this kind of coupling decreases rapidly with distance, this kind of magnetic induction can be virtually eliminated by keeping as much distance (several feet or more) as possible between the power supply/monitor yoke and cabling. VI Use ferrite toroids and split beads to prevent EMI from escaping on the surface of your cables. Ferrites are magnetic materials that, for certain ranges of EMI frequencies, attenuate the EMI by causing it to spend itself in heat in the material rather than continuing down the cable. They can be applied without cutting the cable by snapping together a "split bead" form over a thick cable such as a power cord or by threading thinner cable such as telephone several times around the donut-shaped ferrite form. Every cable leaving your monitor, computer, mouse, keyboard, and other computer peripherals should have at least one ferrite core attentuator. Don't forget the telephone lines from your fax, modem, telephone or the unshielded DC power cord to your modem. Ferrites are applied as close to the EMI emitting device as possible so as to afford the least amount of cable that can act as an antenna for the EMI. Good sources for ferrite split beads and toroids include Amidon Associates, Inc. P.O. Box 956 Torrance, CA 90508 310-763-5770 (ask for their free information sheet) Palomar Engineers P.O. Box 462222 Escondido, CA 92046 619-747-3343 (ask for their free RFI information sheet) and Radio Shack. VII Other practical remedies. Other remedies that are somewhat more difficult to correctly apply include providing a good EMI "ground" shield for your computer equipment and other more intrusive filters such as bypass capacitor filters. You probably ought not to think about adding bypass capacitors unless you are familiar with electronic circuits and digital design. While quite effective, added improperly to the motherboard or cabling of a computer they can "smooth out" the square wave digital waveform -- perhaps to the extent that signals are interpreted erroneously causing mysterious "crashes" of your system. In other cases, bypass capacitors can cause unwanted parasitic oscillation on the transistorized output drivers of certain circuits which could damage or destroy those circuits in the computer or peripherals. Also, unlike ferrite toroids, adding capacitors requires actually physically splicing them in or soldering them into circuits. This opens up the possibility of electric shock, damage to other electronic components or voiding the warranty on the computer equipment. A good EMI ground is difficult to achieve. Unlike an electrical safety ground, such as the third wire in a three-wire AC power system, the EMI ground must operate effectively over a much wider part of the EMI spectrum. This effectiveness is related to a quality known as electrical impedance. You desire to reduce the impedance to as low a value as possible over the entire range of EMI frequencies. Unlike the AC safety ground, important factors in achieving low impedance include having as short a lead from the equipment to a good EMI earth ground as possible (must be just a few feet); the gauge of the connecting lead (the best EMI ground lead is not wire but woven grounding "strap" or wide copper flashing sheets; and the physical coupling of the EMI into the actual earth ground. An 8 ft. copper-plated ground may be fine for AC safety ground, but may present appreciable impedance resistance to an EMI voltage. Much better would be to connect a network of six to eight copper pipes arranged in a six-foot diameter circle driven in a foot or two into the ground, electrically bonded together with heavy ground strap and connected to the equipment to be grounded via a short (at most, several feet), heavy (at least 3/4-1" wide) ground strap. If you can achieve a good EMI ground, then further shielding possibilities open up for you such as surrounding your monitor and computer equipment in a wire-screen Faraday cage. You want to use mesh rather than solid sheet because you must preserve the free flow of cooling air to your equipment. Buy aluminum (not nylon) screen netting at your local hardware store. This netting typically comes in rolls 36" wide by several feet long. Completely surround your equipment you want to reduce the EMI being careful to make good electrical bonds between the different panels of netting and your good earth ground. I use stainless steel nuts, bolts, and lock washers along with special non-oxidizing electrical paste (available from Electrical contractors supply houses or from ICE) to secure my ground strapping to my net "cages". A good Faraday cage will add several orders of magnitude of EMI attenuation to your system. VIII Checking the effectiveness of your work. It is easy to get a general feeling about the effectiveness of your EMI shielding work with an ordinary portable AM radio. Bring it very close to the body of your computer and its cables in turn. Ideally, you should not hear an increased level of static. If you do hear relatively more at one cable than at another, apply more ferrite split beads or obtain better shielded cable for this component. The practice of determining what kind of operating system code is executing by listening to a nearby AM radio is definitely obsolete for an well-shielded EMI-proof system! To get an idea of the power and scope of your magnetic field emissions, an ordinary compass is quite sensitive in detecting fields. Bring a compass within a few inches of the back of your monitor and see whether it is deflected. Notice that the amount of deflection decreases rapidly with distance. You want to keep cables away from magnetic sources about as far as required not to see an appreciable deflection on the compass. VIIII Summary If you start with good, shielded equipment that has passed the FCC level B emission standard then you are off to a great start. You may even be able to do even better with stock OEM equipment by specifying "low-emission" monitors that have recently come on the market in response to consumer fears of extremely low frequency ("ELF") and other electromagnetic radiation. Consistently use shielded cables, apply filtering and ferrite toroids to all cabling entering or leaving your computer equipment. Finally, consider a good EMI ground and Faraday cages. Beyond this there are even more effective means of confining the electrical and magnetic components of your system through the use of copper foil adhesive tapes, conductive paint sprays, "mu metal" and other less common components. Copyright (c) 1993 by Grady Ward. All Rights Reserved. Permission is granted for free electronic distribution. ------------------------------------------------------------------------- Bill Frantz | Market research shows the | Periwinkle -- Consulting (408)356-8506 | average customer has one | 16345 Englewood Ave. frantz(a)netcom.com | teat and one testicle. | Los Gatos, CA 95032, USA

1 0

Vulis is asking for it
by Information Security 17 Dec '03

17 Dec '03

> From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > A psychopath like Guy Polis could just call a TV station and claim that > he put some poison in the water supply which would take a few days to > test for. > I recall that there was a bunch of bomb threates at Salomon Brothers last > year, right after Guy Polis was fired from his contractor job. Do you > suppose the psychotic pedophile did it? > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps Your continued defamation is going to get you in a lot of trouble. Cease it now, asshole. Or you'll be the next Tawana Brawley defamation trial. > From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > # Guy Polis (guy(a)panix.com, eviljay(a)bway.net) is a pedophile child ^^^^^^^^^^^^^ > # molester who was fired from his consulting position at Salomon Brothers > # after he was caught masturbating in his cubicle at the child pornography > # JPEGs that he downloaded from the Internet. > # > # In retaliation, Guy Polis spammed the firewalls mailing list with megabytes > # of e-mail logs that he "intercepted" at Salomon Brothers, and accused > # several of his former co-workers and supervisors of various crimes. > # > # As far as I can determine, Guy Polis has been unemployed since the time > # he was fired from Salomon. If anyone knows otherwise, please let me know. Besides the obvious, you've got _everything_ wrong. o I was not fired o I am not a psychopath o I did not download child porno o I am not AIDS-infected o I am not a faggot o I have been continuously employed since completing my Salomon contract o no one (name them) at Salomon or any other firm has stated otherwise. o I am not a pedophile You'd better stop lying. ---guy Don't cross the line again.

1 0

Eureka! Wed Feb 11 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Wednesday's issue of Eureka! HE GIRLS! This site calls itself "The original She-Male, slut wonder- land", and it's hard not to agree. With multiple live she- male slut video feeds. Huge numbers of amazing shemale pics, extra hot stories and so much more, you'll just love this site. And what's more, we have arranged a special free trial membership for all Eureka! subscribers. So go check it out! HeGirls ... http://207.33.10.198/cgi-bin/gate1/pbm/he_0024/0 COLLEGE NUDES GET NASTY http://www.collegenudes.com/eureka.htm BRAND NEW SITE!!! Just opened. The hottest AMATEUR TEENS getting nasty. Pics In All Categories, and tons of Porno material. Cum Back to School for The Hottest sex on the Web. LESBIANS Free hot pix! Wet pink pussy, models and young ones. Simple interface, just text links to jpeg images. Check out number seven, she has a star trek style shaved pussy. It's a quickie! Lesbians ........ http://207.30.50.221/lesbians/lesbian.html SIR CUM A LOT Not a bad website. Stop on by and see the samples for this paysite. They are all quick and easy thumbnails. Featuring panty, pussy, teen, asian, big tits, blowjob and a lot more! Sir Cum A Lot .......... http://www.sircumalot.com/main.html PAGINA DO ROSERA We had to go around the world to find this one! Easy text links to huge super high resolution images of pussy and dick. Double dicks in one mouth, and a wild shot of a large glass electrical insulator up some womans vagina! You must see it! pagina Do Rosera ........... http://www.gold.com.br/~rosera/ MICHELLE Now I know why the Beatles sang about Michelle. This one very sweet hot young amateur teen. She is images of herself in various states of dress including a cheerleading outfit, up her skirt shots and a great bedroom image with some nipple action showing. Check this little lady out for certain! Michelle .............. http://mhgnet.com/michelle/mich.html READ THIS!! WIN $25,000 and a Fantasy Date - Click Here Now! $25,000! ---> http://208.195.150.31/us/us_main.cgi/us_5267/A HOORAY! THE ADULT SEARCH ENGINE Now you can search for the sex sites you are looking for and fast! This new search engine is setting the standard others will follow. It offers pop-up search and detailed listings! Hooray! -----------------> http://eureka.abc-web.com/hooray/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here --> http://www.netscape.com/download/ Pregnant ----------------------> http://207.168.184.26/preg/ CHAT WITH OTHER READERS Hey, if you haven't checked out the Eureka! Chat sites yet, you're missing out on some great stuff. Every day you'll find hundreds of other readers just like you looking to chat have fun and maybe a little 'cyber'. We know you'll love it! Adult/Sex Chat -----------------> http://137.39.63.229/chat/ General/Fun Chat -------> http://137.39.63.229/chat/funchat/ HOT LIVE PHONE SEX TO MAKE YOU CUM! LD Call only! - Live Hot Girls!!!!----------->1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline-------->1-800-644-8779 FREE: Live 1-on-1 (international call only)--->011-678-77416 NEW! CENTERFOLD PIC OF THE DAY Exclusive! We proudly present unpublished Pictures of your favorite Centerfolds. Featured This Week: Dec 80-PMOY Terri Welles, Dec 89-Petra Verkaik, Sept 93-Carrie Westcott, Kerri Kendall, Rebecca Ferratti, Lydia Schone and many more too! ---------------------------> http://www.gatefold.com/eureka/ AMATEUR SITE OF THE DAY Wendy: "A fine ass blonde co-ed with perky tits" is how one person describes this beautiful babe. Her hobbies include writing and drawing, this talented woman is the girl next door. She loves computers and sex (imagine that!) so visit her and see if she will interface with your HARD drive. ---------------------------> http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY TeenStories.com: Dozens of steamy sex stories about teen sexual experiences! This site is as hot as they come! Visit TeenStories.com today! ......... http://www.teenstories.com/ DAILY CARTOON ----------> http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Woah, our Adult Star pics are getting hotter and hotter, so make sure you stop by and check out today's - definitely not to be missed! --------> http://www.xxxadultstars.com/eureka/ OTHER EUREKAS! GAY EUREKA! ----------> http://eureka.abc-web.com/gayeureka/ DEUTSCH ------> http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ------> http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ----> http://eureka.abc-web.com/eureka/francais.htm ITALIANO ----> http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE > http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 --------------------------> http://137.39.63.229/?110 Pic 2 --------------------------> http://137.39.63.229/?111 Pic 3 --------------------------> http://137.39.63.229/?112 Pic 4 --------------------------> http://137.39.63.229/?113 Pic 5 --------------------------> http://137.39.63.229/?114 Pic 6 --------------------------> http://137.39.63.229/?115 Pic 7 --------------------------> http://137.39.63.229/?116 Pic 8 --------------------------> http://137.39.63.229/?117 Pic 9 --------------------------> http://137.39.63.229/?118 Pic 10 --------------------------> http://137.39.63.229/?119 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Re: SOFT TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 10 Feb 1998 03:03:53 +0100 (CET) > From: Lucky Green <shamrock(a)cypherpunks.to> > Subject: Re: SOFT TEMPEST (fwd) > I don't know about displaying the screens of several thousands of PC's at > a site, but you can easily select any given screen of several dozens of > PC's. Using $100 worth in equipment plus a [>>$100] quality frequency > generator. What is the $100 worth of equipment? > At HIP'97, I watched a van Eck demonstration given by a German professor. > Using cheap analog equipment and one of the better HP frequency What equipment, not necessarily the manufacturer or model but the functional description? Do you remember the configuration? > I am told screen images can be captured up to 600 meters along the power > line. As long as there isn't a transformer in there. The impedance shift will strongly attenuate the signal. This same limitation effects X-10 controllers. If the PC's are plugged into a UPS (which they should be in a business) you're SOL here. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Great H/P/V/A Site...packed with useful filez. Check it out!
by o0brainiac0o＠hotmail.com 17 Dec '03

17 Dec '03

Sup, I found this great H/P/V/A site that You gotta see. Its packed with tonz of useful texts and programs...it's worth the visit. http://www.ndi.net/~toot/ and please dont ferget to visit his sponsors since he is presently making only half as much as he needs to keep the site up and running. http://www.ndi.net/~toot/cash/ o0brainiac0o

1 0

KCKSG Helpers List
by Janyce.com, Inc. Union Gap WA USA 17 Dec '03

17 Dec '03

At 03:56 PM 1/2/98 -0800, you wrote: >I noticed that on the helpers section my ph # is listed.. I must have >accidentally entered that. I would prefer that its not there.. > >Could you please remove it? >-Jim > > I have no idea who a Jim whose address cypherpunks(a)toad.com is. If you are a member, give me your membership no. and full name. As requested please address member concerns to CUSTOMER.SERVICE(a)janyce.com If you are not a member, how did you find the helpers list? -= Janyce =- Kissing Cousins Korner http://www.janyce.com/genecous/book.html JOIN TODAY: http://www.janyce.com/misc/ccformC.html

1 0

Re: Driver Licenses
by Anonymous 17 Dec '03

17 Dec '03

Lucky Green <shamrock(a)cypherpunks.to> enlightened us with: > On Mon, 9 Feb 1998, Tim May wrote: > > If a U.S. Passport is not considered enough I.D., > > because it doesn't have the Big Brother Inside > > magstripe, one walks away from the transaction. > > Just as a data point, in the State of Oregon, an US > passport is *not* valid ID for alcohol purchases. > Magstripe or no magstripe. Of course not! The People's Socialist Nirvana of Oregon is a foreign country. Just the fact that almost all other foreign countries recognize the U.S. passport as valid identification for things far more momentous than the purchase of alcohol doesn't mean that the PSNofO has to! What do they require in Oregon? A little holographic tatoo in paisley? A barcode on the tongue? Oh, I know! A machine-readable ID on the inside of the rectum! Has anyone figured out the obvious answer to this shit? If you have, don't answer. And don't send me the bodies by UPS collect, either.

1 0

Re: SOFT TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 10 Feb 1998 06:46:55 +0100 (CET) > From: Lucky Green <shamrock(a)cypherpunks.to> > Subject: Re: SOFT TEMPEST (fwd) > That would be my analysis as well. Note that the van Eck demonstration I > saw didn't even make use of the common analog tricks, such as using a > super heterodyne receiver. In what context? The only place a super-het would buy you any selectivity, and its tight bandwidth may actualy work against you, is in capturing the data on each trace. The syn pulses aren't amplitude sensitive so much as time ordered. If you can get a clear signal use that to fire a Schmitt trigger and synthesize your sync pulses and ramps/stairstep generators from that. Using a super-het for this is over-kill. > Not to mention the near magical capabilities of > a few Fourier transforms for pulling a nice, fat signal spike out of all > that "white noise". Doing a Fourier on the grass won't pull the signal out unless you've got an integration function in there to filter the noise (ala flying cap filter). If the signal is strong enough that a Fourier can be applied to it then the signal is most likely strong enough to use directly. The data we're trying to get out isn't that complicated; two sync pulses and the e-beam modulation data. I would like to request that you provide a better description of the equipment used at HIP for the demo. If the various descriptions of that are accurate his signal detection range was around 50 - 100 ft. and he was using specialy sized fonts (special in the context that you wouldn't use them for a spreadsheet or document processing). Is this correct? ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0