December 2003 - cypherpunks-legacy

Re: Digital Cash Escrow
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:11 PM 4/10/96 -0700, Tim May wrote: >At 10:14 PM 4/10/96, Bill Stewart wrote: > >>Of course, if you happen to become dead while you're storing it, >>the paper cash is far more useful to your heirs, so I assume we'll have >>a government-sponsored cash-escrow system announced soon to protect >>the government's interest in collection of inheritance taxes... > >Don't give them ideas, Bill! They are known to monitor our list for >insights into what to regulate next, and I can see the 15-watt lightbulbs >going on over their heads as they ponder the wonderful opportunities >presented by "digital cash escrow." You're one to talk, Tim :-) A couple years back you joked about a "Position Escrow System", and now Dorothy's proposing the technology to actually implement it! # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: GPS-based authentication
by jim bell 17 Dec '03

17 Dec '03

At 11:33 AM 4/11/96 -6, Peter Trei wrote: >I've read with interest your proposed GPS-based authentication >mechanism (it was posted to the cypherpunks mailing list). Can you >confirm that you wrote this? Some people on the list think it may be >a forgery. [deleted] >You say: >" The signature ... is formed from bandwidth compressed raw >observations of all the GPS satellites in view." > >" The location signature is virtually impossible to forge at the required >accuracy. This is because the GPS observations at any given time are >essentially unpredictable to high precision due to subtle satellite orbit >perturbations, which are unknowable in real-time, and intentional >signal instabilities (dithering) imposed by the U.S. Department of >Defense selective availability (SA)." I think that Denning's paragraph is misleading. S/A is stated; what I think they probably mean is closer to A/S, the anti-spoofing signal. The S/A error is small and changes only slowly, the A/S signal is far faster and could hold the data to implement the signatures. Even so, I think it would be comparatively easy to fake a signal if you are in view of most of the satellites in the area you wish to fake; attempting to fake something around the world would be harder. Aside from the technical difficulties associated with this system (everyone has to have a GPS receiver, for instance) there is an obvious political problem associated with trusting the government. After all, only its agents are supposed to know the dithering code which will be transmitted by the GPS satellite; its agents would presumably be able to fake their location since they can anticipate the data being transmitted. Which raises an interesting issue, I think: Would it be possible to remove the ability of the government to fake these signals, even if the rest of the system worked? The goal would be to prevent anybody (including the operators of the GPS system) from being able to anticipate the dithering codes the GPS satellites would send. One way to do that is to combine multiple random/pseudorandom bit streams (from hundreds, thousands, or maybe even millions of independent sources, perhaps you and me) into an overall stream, in such a way (XOR) that no data contributor could know how the result came out until he saw it. Each contributor would be able to verify, however, that his data stream was used to form the eventual bit stream, and he is confident of the randomness of the system he uses to generate that stream. (If he isn't, he should just change systems, or add another system to his equipment and XOR the results before he sends them off, crypted, to the central data combiner.) Release of the decrypt keys could be delayed "just long enough" to prevent faking. BTW, I'm not endorsing the underlying idea. I think it's a leap backwards for freedom. Jim Bell jimbell(a)pacifier.com

1 0

Re: On computer face recognition:
by geeman＠best.com 17 Dec '03

17 Dec '03

There was a piece, I _think_ in Scientific American, tho it might have been an AI journal, on face recognition by use of neural nets together with what were called "eigenface" images: These eigenfaces each have specific characteristics, which when combined together can closely approximate a specific face image. The target face was analyzed in terms of closeness-of-match to a small set of eigenfaces, on the order of 5 to 8, I think. Results of course were promising (else why write about it, eh?) if not excellent. At 12:14 PM 4/11/96 -0700, you wrote: >At 10:02 PM 4/10/96 -0700, you wrote: >> >>On computer face recognition: >> >> >>>> Shaving probably will not be a problem, but holding your head at a >>>> slightly different angle... will screw up the system totally, >>>> unless the system has radically improved since the last time I read >>>> up on it. >> >>At 11:45 AM 4/9/96 -0500, K00l Secrets wrote: >>> Well, the systems I have seen are quite good at finding people's eyes. >>> Scaling (for distance), and rotation (for the angle of your head) >>> therefore don't really confuse the system once it has your eyes. >> >>Finding the eyes can only control for rotations in the plane of >>the image, when you tilt your head to one side. They cannot >>handle the much more common case of 3D rotations, where you >>look slightly to the right or slightly to the left of camera. >>Facial expressions also throw them badly. >> > >Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of >Lawences papers is on using Neural networks to recognize faces. Methinks >that the state of the art is advancing rapidly and such problems as not >looking at the camera or changing your expression are rapidly being overcome. > > >===================================== >dwl(a)hnc.com > >Zippity do da, zippity ah, my oh my what a wonderful day. >Ya right, and hear I am without time to finish a cup of coffee. > >

4 3

Pub Key patent update
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

The battle over the public key patents continues, with no end in sight. Recent events: * Cylink tried to get a preliminary injunction against RSADSI shipping BSAFE for contributory infringement of the Stanford patents. The judge denied it, saying there was doubt about the validity of Diffie-Hellman and about the scope of Hellman-Merkle. * Cylink is appealing the preliminary injunction denial to the Federal Circuit. * Cylink's lawsuit to break the MIT RSA patent on obviousness and other grounds is scheduled to goto trial on July 9 before an LA judge. I don't know where the trial will be held. * RSADSI had a license to the Stanford patents dating back to around 1987, and it argues that it covers BSAFE customers. Cylink recently demanded a 5% royalty, and when RSADSI refused, Cylink unilaterally terminated the license. Cylink is now adding a direct infringement claim against RSADSI. * RSADSI and PKP motions for dismissal of my charges have left most of them intact. In particular, the antitrust charge is still alive. * My motion for summary judgment on the invalidity of the patents is technically still pending, but the judge shows no sign of ruling anytime soon. If my arguments were either clearly correct or clearly incorrect, he would have ruled by now. I cannot predict what will happen. * Trial on the Stanford patents is likely this summer. RSADSI is trying to postpone it. Roger Schlafly phone: 408-476-3550 CompuServe: 76646,323 US Mail: PO Box 1680, Soquel, CA 95073 USA Internet: rschlafly(a)attmail.com

1 0

First Seven-Year-Old to Encrypt Solo!
by tcmay＠got.net 17 Dec '03

17 Dec '03

I know Perry dislikes anything that smacks of mention of our personal lives and that is not related to the IPv95 specs, but this is of interest, I think. If not, ignore it and go back to reading the thread du jour. On Saturday many of us--several dozen Cypherpunks, at least--had a beach party/cookout on Tunitas beach, between Pescadero and Half Moon Bay, roughly 30 miles south of San Francisco and 50 miles north of Santa Cruz. Arranged by Doug Barnes, with help from Jim McCoy amongst others, it was a blast. We looked at Comet Hyakutake, though no longer at peak brightness, and even used the night vision scope provided by Jay Holovacs. Numerous CPs in attendance, including Sandy Sandfort, Eric Hughes, Bill Stewart, Sameer Perekh, Jude Milhon, Jay Campbell, Eric Hollander, Russell Whittaker, Romana Machado, and on and on. (Sorry if I left anyone out...it got dark and I didn't seen everyone, anyway.) Ironically, the little girl who died today in a plane crash stunt was from Pescadero, and took off yesterday from Half Moon Bay's airport. It has no direct relevance to us, but is an interesting coincidence, given the small sizes of these towns. Synchronicity happens. If Sameer can paraphrase Freud, I can paraphrase Jung. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Add me (Net.Enemies List)
by smith＠sctc.com 17 Dec '03

17 Dec '03

Please add my name to your list of Net Enemies. I'd rather start out branded as subversive and retain the freedom to be myself. Otherwise I might be tempted to keep silent and feign political correctness. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: Anonymous Remailer threat: Scientologists may subpoena anonymousremailer records?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:40 PM 4/11/96, Hal wrote: >From: tcmay(a)got.net (Timothy C. May) >> At 7:37 PM 4/10/96, Jim Byrd wrote: >> >to find the identity of -AB-. This turned out to be an alumni account at >> >Cal Tech. The poster has never been heard from again. >> >> This was without a doubt just a user of one of Hal Finney's remailers he >> runs out of an account at Caltech. (There's a tiny chance it was someone >> else, but it fits the description of Hal's "alumni" remailer exactly, and >> is almost certainly just that.) > >Actually, this is not true. The poster, from rumors I have heard, was >someone else with a Caltech alumni account (I don't know who). I have >never been contacted by any representatives of Scientology with respect >to this case. So it is apparently just a coincidence that this case >involved the same system as my remailer. Several other people have sent me e-mail saying the same thing. An odd coincidence.... I'm glad I hedged a little bit. I did not hedge in saying that Klemesrud represented Netcom, which turns out to be wrong (as several people corrected me on). Klemesrud apparently ran "support.com," which got its feed from Netcom. Sorry about any confusion. On the remailer subpoena thing, any Cypherpunks remailer operators who are keeping logs might want to reconsider their strategies. And any such logs should be purged before the subpoenas arrive. (I understand, I think, the issues of abuse that have caused some operators to keep logs. But since the rumors of subpoenas are in the air, now is a good time to send the message that remailer operators _generally_ cannot produce mappings between incoming and outgoing messages. In an ideal mix, this is of course true. And by purging old files, it becomes de facto true for even today's far-from-ideal mixes.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: why compression doesn't perfectly even out entropy
by eli+＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

JonWienke(a)aol.com writes: >I have no disagreements with this. I merely proposed using the compression >function as a means of roughly estimating entropy and preventing the seeding >of the hash/PRNG with potentially "weak key" type data. It's not a useful estimate of entropy, and I don't see what you mean by "`weak key' type data". There are no keys or PRNGs involved here, just a hash function. Now, if you've got a sufficiently compressible data stream, compression may be a fast way to jump-start the distillation, but you absolutely need a priori information on the entropy of the source. >Would anyone like to propose a means of measuring entropy that we can all >agree on? If your definition of entropy is at least as strong as Kolmogorov complexity, it's infeasible to compute. The way to measure entropy is to spend ten years trying to understand the data source, and hope that no one else can afford to spend twenty. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Idea Futures - current application
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Of course, a form using anonymnity would be preferable. I find it very interesting that the Commodity Futures Trading Comission is allowing this; it increases my opinion of them. If someone would forward this to the extropy list, the idea futures folks on there would find it interesting. -Allen Reuters New Media _ Monday April 1 2:32 PM EST _ U.S. Traders Play Political Futures In Cyberspace CHICAGO - As primaries in the American Midwest confirmed Senate Majority Leader Bob Dole's clean sweep, a Wall Street trader logged into the Internet on his home computer and made one last trade before going to bed. [....] These political futures contracts are not available at the huge, traditional exchanges that trade billions of dollars per day. Instead, the contracts are on the 24-hour Iowa Electronic Markets (IEM), which trades several thousand dollars per day. The IEM, setup in 1988 by the University of Iowa, is a not-for-profit political futures market open to traders globally via the Internet, under the regulatory scope of the Commodity Futures Trading Commission. An estimated 5,800 people have registered as IEM members by sending checks or money orders to open trading accounts of $5 up to $500 to trade various world political markets that also include Austria's Vienna City Parliament Election and Canada's British Columbia Provincial Elections. Collectively, accounts total about $150,000, said Joyce Berg, a professor of accounting and director of markets at the University of Iowa. [...] In that race, IEM payoffs are determined by the candidate who wins the majority of popular votes. Contracts in the candidate receiving the largest number of popular votes will pay $1 each while all other contracts will expire worthless. "For those of you with Web access, let me point you to an astounding place for us market geeks -- the Iowa Electronic Market," one trader wrote in the Option Fool newsletter, written and distributed via the Internet. "It's a fun market," said Gary Sparks a stock options trader at Group One Trading who participated in the market during the last presidential election four years ago. But some take the IEM seriously because each candidate's contract price in cents can be translated into his percentage chance of winning. And in the past two U.S. presidential races, the IEM has predicted the winner with an average 0.2-percent absolute margin for error. That compares to the next most accurate Harris poll with a 1.2 percent margin of error, according to the Iowa Political Market's data. That type of accuracy has caught the eyes of at least a few U.S. stock options traders and has earned a weekly spot in a New York Post newspaper roundup of presidential polls. Jeff Yass of Susquehanna Investment Group said he considers what IEM markets are showing when making trading decisions in stocks and options. "Clinton and Dole have been in a tighter race (on the IEM) than any of the Wall Street analysts have predicted," he noted. [...] Copyright 1996 Reuters Ltd.

1 0

No Subject
by Batman 17 Dec '03

17 Dec '03

Please PUT me OUT of YOUR cypherpunks AND other MAIL-LISTS Thankx

1 0

Re: Scientologists may subpoena anonymous remailer records
by Powers Glenn 17 Dec '03

17 Dec '03

- > BTW, has anyone out there created an anonymous web forwarder? I'm sure - > there are a lot of people out there who don't like the idea of having - > their email address in the log files of dozens of web servers... Creating - > a simple web forwarder wouldn't be hard. - - I've heard several people make this statement... Can anyone confirm that - it is really possible to log the uid (username) of the person making the - http request? I know they can get your ip address, but I'm skeptical - of getting the username. Yes, there are several web interfaces to anonymous remailers out there (check altavista). No, they cannot get your username UNLESS you have logged into the site by entering a username and password into a www auth dialogue box -or- you are on a Unix box which is running identd -and- the remote site runs a check (unlikely and DOES NOT apply to dialups, unless you are running identd on your dialup). Even in the extremely unlikely event of a remailer running a check using identd, that would not show up in the standard web logs. It would be theorically possible to get a username/True Name from an IP address if you were on a dialup and the ISP kept track of who was on what dialup and when. glenn

1 0

Re: No matter where you are, you can lie.
by rkmoore＠iol.ie 17 Dec '03

17 Dec '03

4/10/96, Peter Trei wrote: >Therefore any site that can see the same set of satellites as the site it is >trying to simulate can do so, buffering less than 50 ms of waveforms and >pretending to be on the end of a slow link. That's what I assumed in the first place. Thanks, Peter, for doing the math. Do you have a solution as satellites cross the horizon, or for very-distant spoofing? ...co-conspirator nodes tightly-coupled via laser or wire? -rkm (not on cypherpunks)

1 0

Lotus notes 24 bit hack project?
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

reading notes on the recent RSA conference reminds me of something. Lotus announced their 64 bit encryption for foreign users some months ago, with 24 bits secretly "owned" by the NSA. there was some speculation here about how this was handled. could the system be so insecure as to have a unique 24 bits used across every foreign key? or are those 24 bits somehow algorithmically determined from the other 40 bits, with the algorithm a secret? in any case it seems that reverse engineering of Lotus Notes would provide the answer, and we'd be able to embarrass both NSA and Lotus (who imho deserves it, for caving in to the NSA) all in the same sweep by revealing it to the world!!! I would bet this would be worth some more NYT or WSJ almost-front-page ink for some lucky cpunks if someone can pull this off!! this would be a *major* new feather in the cpunk cap, and I'd enthusiastically support anyone attempting to work on this project (maybe writing HTML pages for information or something). cypherpunks, start your disassemblers!!

2 1

Re: Know Your Net.Enemies Project
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:47 AM 4/11/96, Declan B. McCullagh wrote: >Would anyone be interested in collaborating on a "Know Your Net Enemies" >project? > >We'd start with a resource like Bob Chatelle's excellent web pages at ><http://world.std.com/~kip/bcfenatl.html> and with permission build on >it and list the deceptions and misrepresentations each Net-Enemy has >engaged in -- what each has done to restrict liberty online. We'd >include original documents and links as appropriate. .. Sort of like Nixon's Enemies List? Have we become the enemy? Flippancy aside, this strikes me as being a terribly negative, destructive, and counterproductive way of approaching things. It could easily backfire in the media, as they note the "Enemies List," or "The Page of Shame." Recall how the recent "List of Shame" was reacted to, as some people clamored to be added. And just how would "Net-Enemies" be decided upon? By vote? By acclamation? By whomever wants to create an entry? Would Denning (Dorothy) be on the list, but not Denning (Peter)? How about Barlow? Maybe the whole EFF power structure at the time of the Wiretap Act should be added to the Net-Enemies list...I'll start working on this right away. Well, count me out. I know who I think are the people receptive to my concerns and viewpoints, and the people not receptive...and I don't need an Enemies List to tell me. I'd prefer to evaluate people I haven't yet reached a decision on based on their own merits. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: questions about bits and bytes [NOISE]
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-11 20:26:44 EDT, jeffb(a)sware.com writes: >[I told myself I was going to stay out of this, but Jim Bell's dogmatic >stance irks me... ] Here's a citation from "Portability of C Programs >and the Unix System" by S.C. Johnson and D.M. Ritchie (yes, that Richie) >in the Bell System Technical Journal volume 57, Number 6, July-August 1978. Citing sources from 1978 in the computing field is a little like using dictionaries from the 1800's to dictate modern English usage. My desktop machine has as much computing power as some colleges had during that era. We've come a long way, baby! Yes, in the past, the term "byte" applied to entities other than 8 bits, but "8 bits" IS the commonly accepted, standard meaning of "byte" now, in the present. The fact that the meaning and usage of words can change over time is not relevant to current meaning and usage. Anyone who wishes to dispute this should study the etymology of the word "gay." Jonathan Wienke

2 1

Re: Digital Cash Escrow
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: Cypherpunks(a)toad.com from: jf_avon(a)citenet.net date: 11 Avril 96 ======================================= John Deters <jad(a)dsddhc.com> wrote: >ObOtherListComplaint (doesn't everyone?): Has anyone suffered ill-effects >by having their mail program filter Jim Bell's postings? Does anyone, especially in Canada, ever noticed that them or their local net friends had their snail mail opened? A friend of mine has his regularly opened; he complained to Canada Post three times, but it stills goes on AFAIK. He is pissed off at me, convinced that the forwarding of Jim Bell's AP related articles is what justified the mail opening. Actually, he does not even reply to my e-mails anymore. We used to be great friends... Neither of us ever engaged in any subversive activities or are involved in illegal actions. It seems that FUD got him. ...sigh... He even refused to *touch* PGP. He is a professionnal programmer, in C++, win, and OS-2. Can you believe it?!? Any comments? JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAwUBMW1pKsiycyXFit0NAQG3Rwf+PUFu0geKEXOEYktp5MP6ao4Yb0CfPSWA dbnZ4R4kJsLm7jQ8tNXdo8KsLRhL7+Qe3NNfAKvTQVmvrN45QImyKk+fZd77Cady TLKuNEYCx1FCrIpLewM13sLj4twCcNpvCIJNRsVV8Q3xcyWkfNJ6PSAakDa2POnD spPnEz0Ptepw58KXoM0G36lE6fJnfv83PEeaogjE+h8Gsxf1uzhK1ZAQxpB6QHLP 4cizjFyKNfEZIVKK4kXebWr7wlalE87XTC6wWpXLQ8XuNYtbzKWG+wB747IpbN2a ijKDBf9fXAZRB/qVQUdF/toEWJ/+Vg6LniFgmYq1EQqToUiPMRT48A== =NnBW -----END PGP SIGNATURE-----

1 0

Re: Protocols at the Point of a Gun
by Bill Stewart 17 Dec '03

17 Dec '03

There are serious technical problems with the suggestion that labelling packets as "Adult" or "Child" using IP options and filtering at ISPs for censorship. IP works on a per-machine basis (technically, a per-network-interface basis, though for most client machines that's the same thing.) That means that a web or nntp server including some "Adult" material and some "Child" material either needs a way for an application process to communicate this to the network drivers, or needs to label all packets as "Adult" to avoid the politically incorrect risk of mislabelling a packet as "Child" when it's not. The standard TCP/IP API programming interface software on Windows, Mac, and Unix machines doesn't provide for applications to _tell_ the network drivers about IP options, so even if IPng had censorship features added, the applications couldn't use it. (There are a few military multi-level security versions of Unix that give you more flexibility for this sort of thing, but they tend to provide mandatory security so you _can't_ send a packet marked "UNCLASSIFIED" from a "TOP SECRET" session.) Another problem is that it only addresses single-user client machines, rather than multi-user operating systems such as Linux, which has a million or so users out there. The model works fine when you treat a PC as a fancy version of a dumb terminal, but a machine shared by multiple users (whether many at one time, or one at a time) uses a single connection to support all of them - that means you can't have censored material available to the child and uncensored material available to the parent unless the networking software can pass the censorship labels on to the application program - but again, the standard operating system interfaces (developed over many years by thousands of The Free World's finest developers :-) don't have a way to implement it, because it was never a design goal. Trying to implement censored sessions at a transport level instead has its own problems. First of all, TCP provides reliable sessions; censoring packets based on IP labels in the middle of a transaction means that TCP will retransmit until the packet gets through or it gives up and drops the connection, so any "Adult" packets would dump a Registered Child out of the browser, even if they were unintentional (e.g. from an Adult who labels all packets "Adult" to avoid being liable for mistakes, or packets from Europe that were default-labelled by a service provider to avoid having to read them all, or from the Library of Congress Online Edition if the Librarian labels each packet correctly.) On the other hand, UDP packet exchange, which doesn't use sessions, would require validating the user's ID and authorization on each packet. Furthermore, if the censorship information is carried at the transport level, or at a higher level (i.e. headers in the message itself), the only way the ISP's routers, which work at the IP level, can censor packets is to perform the equivalent of the Post Office steaming open envelopes before delivering them to your house, and refusing to deliver them if there's a child living in the house and the letter either contains a bad word or is written in a language the Post Office doesn't understand, such as Finnish or Japanese or PGP. At 04:03 PM 4/10/96 -0700, Lucky Green wrote: >At 9:48 4/10/96, Duncan Frissell wrote: >>We know that governments would like to impose things like the Simple >>Tax Transfer Protocol on the Net as well as Is A Person (and Is A Minor) >>Protocols. > >There is one thing about the proposed minor flag addition to IP that I >don't understand. [No, I am not surprised by this. Mandatory authorization >to establish a connection and an "Internet Driver License", probably in the >form or a smart card are coming]. >If my computer creates the IP packet, what is there to prevent me from >modifying the value of the "Minor/Adult" flag at my leisure? If you create outgoing packets that are labelled "Minor", and contain "Restricted to Government-Certified Adults Only, and No Felons or Foreigners Allowed" material, you can get busted for it. So you have to either restrict all your outgoing packets to be labelled "RtG-C Adults O,aNFoFA", or else make sure all the material you transmit passes the "Government-Approved-for-Minors, Foreigners, and Victorian ladies" filter. On the other hand, if you don't log in to your ISP with a "government-certified adult, non-felon, non-foreigner, politically stable, not-a-Commie-or-Jew" id, it'll block any packets not approved for you. Any news or web server will also have refuse to send any "Adult"-labelled material to you if the requests arrived on a "Kid"-labelled connection - this means that either the server machine will have to only carry Kid-approved traffic, or only talk to Adults, or add an "Adult" label to all outgoing packets whether marked "Kid" or not, or else it will have to break protocol boundaries by passing IP-layer information up to the application. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

2 1

Re: Tense visions of future imperfect
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >What the bank does is keep a list of all spent serial numbers, not all >issued ones (since it doesn't know those). That way it can detect double >spending. Correct me if I'm wrong: It means that the weakest point of the digital cash chain is the server. If the server's database is tampered with, or lost, then, the double-spending can be done (in case of loss, if ever the server is put back online) Does that means that for all practical purposes, a server should be run from a vault with security comparable to a big money repository? JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAwUBMW1dnsiycyXFit0NAQFpPQf6A/IvZWumneiGU1IERxbs/udunwFWHWVG p+rbAK9h7bDYG+6NcFCIJp97n4MGfH8/+bbPLV4eIuv+5eyTKRkB+1IdOkVNUhEq LGcKGN1iAScQvLxj+cM/3nthAhDxdaMBXmyaylnphgqh9slKJg7FppWpBfLI56nt YYZJ69ThyYMVCN/g9o5G0zbzYefKFOzV/0lbxaGUn0G/KoKbURMut1NlMdfmhmqw BbTd50ae8LVWLjxlVs5Gi5Ui9Loa2DKlSR5PIp1vlFDSk1UBAjTbbK8fSKVhkEFn thI+YXLifA73LOJNdBWwvneTWyy+kdVxHBSDVFEXH2HMsR4LYeHF1g== =JxPP -----END PGP SIGNATURE-----

1 0

Re: Know Your Net.Enemies Project
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 10, 1996 23:47:54, '"Declan B. McCullagh" <declan+(a)CMU.EDU>' wrote: >Would anyone be interested in collaborating on a "Know Your Net Enemies" >project? Feel free to use my writings on the CyberAngels. --tallpaul

1 0

Mystery of the unsuvscrives: SOLVED?
by Black Unicorn 17 Dec '03

17 Dec '03

On replying to one of the many recent unsubscrivers I got this in return: A creative spam attack? ---------- Forwarded message ---------- Date: Fri, 12 Apr 1996 11:34:53 +0100 From: Batman <batman(a)infomaniak.ch> To: Black Unicorn <unicorn(a)schloss.li> Subject: Re: your mail On Thu, 11 Apr 1996, Black Unicorn wrote: > On Thu, 11 Apr 1996, Batman wrote: > > > Please PUT me OUT of YOUR cypherpunks AND other MAIL-LISTS > > > > Thankx > > Please LEARN to UNSUBSCRIBE from MAILING lists and OTHER THINGS. > > --- > My preferred and soon to be permanent e-mail address:unicorn@schloss.li > "In fact, had Bancroft not existed, potestas scientiae in usu est > Franklin might have had to invent him." in nihilum nil posse reverti > 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information > > I don't think you're the mail-list admin, so, don't send me your advices. I've been flooded and put in that shit mail-list without my permission. GET OUT

1 0

Re: GPS-based authentication
by jim bell 17 Dec '03

17 Dec '03

At 11:33 AM 4/11/96 -6, Peter Trei wrote: >Ms Denning, Mr. MacDoran > >I've read with interest your proposed GPS-based authentication >mechanism (it was posted to the cypherpunks mailing list). Can you >confirm that you wrote this? Some people on the list think it may be >a forgery. > >The participants of the list have noted some apparent vulnerabilities >in the system, and I am curious as to how you address them. If you >respond to me and give permission, I'll forward your response to the >list. > >The problems are two-fold: > >1. The system is easily spoofed. >2. It leaks sensitive location data. It should occur to all of us that what you (and we) call "problems" are, to government sympathizers, actually FEATURES. Identifying people's locations is probably going to be considered enormously important to the government (if it lasts that long). And since the government runs all the GPS transmitters, and can presumably modulate the S/A function any way it wishes, it has a leg up on all of us who have to depend on the integrity of the system. There is also the possibility of them jamming the system locally to either deny the user the ability to make the identification system work and thus deny access, or detect the location of the user by subtly modulating the local signal in such a way as to leak through the otherwise-secure system. (If we trust it that far, which I don't.)

1 0

Australia cracking down on the internet?!?!
by an366601＠anon.penet.fi 17 Dec '03

17 Dec '03

X-Anonymously-To: an366601 Reply-To: an578849(a)anon.penet.fi Thank you CRAM for your informative and interesting peices aznd snippets from the American Press. Out here in the land of Oz, the state governements are whipping up a frenzy of legislation, including laws prohibiting the uploading or downloading of any material that may be offensive to minors. Penalty: $25000 and/or 1 year in jail. The push is on to make ISPs the defacto publishers and censors of all material that passes through them. And as always its the child pronography thing that predominates the discussion. It is unfortunate that at the same time the internet is booming, there is a huge peadophile hunt going on here in Sydney (turns out the peodophiles have powerfull allies amongst the policians and judges, no surprises there). People open their newspapers and see "Peadophiles use internet" and their minds shut like steel doors. Keep up the good work. --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: questions about bits and bytes [NOISE]
by Mark J. Reed 17 Dec '03

17 Dec '03

JonWienke(a)aol.com writes: \ In a message dated 96-04-11 20:26:44 EDT, jeffb(a)sware.com writes: \ Citing sources from 1978 in the computing field is a little like using \ dictionaries from the 1800's to dictate modern English usage. My desktop \ machine has as much computing power as some colleges had during that era. \ We've come a long way, baby! Yes, in the past, the term "byte" applied to \ entities other than 8 bits, but "8 bits" IS the commonly accepted, standard \ meaning of "byte" now, in the present. The fact that the meaning and usage \ of words can change over time is not relevant to current meaning and usage. \ Anyone who wishes to dispute this should study the etymology of the word \ "gay." \ \ Jonathan Wienke \ No, no. What started this whole discussion was someone claiming that bytes have ALWAYS been 8 bits. That was the argument. NO-ONE is claiming that byte doesn't mean 8 bits NOW. I think we have now established that, yes, 'byte' is synonymous with 'octet' in the modern computer era, and no, this was not always the case. Now can we move on to other matters? -- Mark J. Reed Email: mark_reed(a)sware.com - Voice: +1 404 315 6296 x158 - Fax: +1 404 315 6407 Hewlett-Packard Co. / 2957 Clairmont Rd Suite 220 / Atlanta GA 30329-1647 E-Mail Privacy by SecureMail. Visit URL:http://www.secureware.com/ for details. -- Mark J. Reed Email: mark_reed(a)sware.com - Voice: +1 404 315 6296 x158 - Fax: +1 404 315 6407 Hewlett-Packard Co. / 2957 Clairmont Rd Suite 220 / Atlanta GA 30329-1647 E-Mail Privacy by SecureMail. Visit URL:http://www.secureware.com/ for details.

1 0

Re: Protocols at the Point of a Gun
by frantz＠netcom.com 17 Dec '03

17 Dec '03

For information on the "Internet Philosophy" there is a IETF draft that might be of interest at: ftp://ds.internic.net/internet-drafts/draft-iab-principles-02.txt ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Private Idaho 2.6b3 release
by Joel McNamara 17 Dec '03

17 Dec '03

Private Idaho 2.6b3 (a freeware Windows front-end to PGP, anonymous remailers, and nym servers) is now available at: http://www.eskimo.com/~joelm New features include: licensed IPPort - no more "nag" screen on start-up support for multiple nym servers and nyms support for multiple PGP keys for signing support for printing messages support for transfer to multiple applications Questions, comments to joelm(a)eskimo.com

1 0

Re: No matter where you go, there they are. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > GPS works by measuring the differing distances to a number of satellites. Actualy, it measures doppler shift as well. > It might be possible to seperately record the signals from several > different satellites, delay them each just the right amount of time, and > then recombine them to simulate being at another nearby location (within > several hundred miles). However, this might not be possible. Examine the > following quote from Denning's paper: Seems to me that standard satellite tracking software would work just fine for this once the correct orbital parameters were included. To get the necessary orbital parameters look on sci.space.news and they are announced regularly. > :The location signature is virtually impossible to forge at the > :required accuracy. If you can measure the accuracy you can spoof it. It is only a question of cost at that point. > :orbit perturbations, which are unknowable in real-time, and intentional > :signal instabilities (dithering) imposed by the U.S. Department of Defense > :selective availability (SA) security policy. Which are going to be turned off. I have to draw exception to the 'dithering' in regard to the lsb's of the data. They are actualy encrypted. It is not random which is what 'signal instability' implies. Were it random then a 'flying capacitor' type filter or a digital filter could get the bits out. I have two years of experience using such 'flying capacitor' type filters in LORAN-C equipment I calibrated and repaired for Austron. The signal on LORAN is a damped sinusoid, very precisely damped. The timing sequence of sites are drawn on maps as well as published in book and electronic form. You set the filter for the same repeat rate as the signal you wish to detect. As the signal is fed over and over into the bank of capacitors the random noise cancels out and you are left with a remarkably clean signal. You then feed this to a 2055 microstepper (nS/S) and compare it to a time reference standard (1210 Time reference standard, my specialty). When the signals cancel you can get a very accurate reading and change that to lat/long quite easily. I would regularly sync the 1210's to USNO and the NIST to measure the oven heated crystal oscillators drift in frequency over time. By applying a voltage to the circuit you can compensate for this drift using a 2055 microstepper (a time delay unit). At that time we were making both the 2000 and 5000 series receivers. The 68000 based machine was due out when I left for a job at UT Austin. The neatest part of the job was flying cesium beams around the world and measuring their drift to accurately measure the rotation rate of the Earth. You can defeat even the encryption if you take a long enough time to interpolate. The reason it isn't done is that by the time you get the fix the target you were going to shoot your missile at is gone. If it is so large (a city) or slow (grunts) that it won't move significantly in that time you don't need that accuracy in the first place. I base this on a years worth of technical support I did for CompuAdd for Desert Shield/Storm. I handled several problems related to MLRS and Naval systems related to target selection and tracking & GPS in regards our computers. > It's possible that the orbit perturbations may be enough to screw up an > attempt to forge a signal Which would be enough to scramble the signal as well. As a matter of fact this might create another means of attack. Namely that the orbit varies is a given. That the orbit can be predicted to quite good accuracy in less than real-time is a given. By comparing these to the actual orbit it might be possible to creat a situation where a fake signal was more accurate than the real signal making the receiver filter the real signal as noise. The one drawback here is that it would require considerable power to effectively impliment the masking. ; the variations in signal timings won't provide > enough information to an attacker to be able to accurately replicate what > the signal would look like at another location. The doppler shift directly corresponds to altitude. If you have the normal orbital parameters it is a relatively simple matter to use a computer to predict where it will be in the near future (5 minutes). NASA and United States Space Command (USSC) regularly track over 8,000 items in orbit. Some as small as bolts. Tracking accuracy is a well understood problem. > It remains to be seen > whether it is reliably possible for the secure host, at its location, to > distinguish between an accurate signature and an inaccurate but plausible > forged signature. Anybody got a GPS receiver in Austin? I believe I can arrange the necessary equipment and support to attempt it. I know several EE's as well as somebody with commercial radio service equipment I am shure some of the other local cpunks might want to help as well. I propose that what be attempted is making a GPS receiver believe it is 100 miles from where it actually is. I will forward a copy of this to the Experimental Science Instrumentation mailing list (tesla(a)ssz.com) to see if anyone on there might be interested. Jim Choate CyberTects ravage(a)ssz.com Tivoli - IBM jchoate(a)tivoli.com

1 0

Re: LACC: CDA Court Challenge: Update #6
by Julian Assange 17 Dec '03

17 Dec '03

> This would ONLY impact packets that carry pornographic material, and all > other packets would remain unchanged. Naturally, you would not be able > to have Classified Pornographic material under this scheme, but I think > that's probably an acceptable tradeoff. Oh, I don't know. The remote satalite imaging lab in reston has been known for sometime now to have enough resolution to look down a good clean cleavege, and certainly their perspective is vertical enough. > Furthermore, any parent that wanted to allow a child to attach to the > Internet and wanted pornographic protection would be responsible for > setting their own filter up to limit these packets. Thus the provider > of pornographic material and the parent of the child using the net are > the only two groups affected by this change. The rest of the net can > continue unhindered. ISPs don't have to identify users. After all, it > is the parent and the bookstore owner who are responsible for keeping > children out of the dirty book section, not the bus driver who brings > the child to the neighborhood or the company that paves the street. I've thought about this as well. You could also use the IP TOS minimise-cost bit, which is defunct, doesn't require IP options, is included in every packet and in most modern unix's and rfc1122 complient TCP/IP protocol interface stacks can be set at user level with a simple setsockopt() call. That said, it has a granularity of one. To my mind, it is value judgement, and a difficult one at that to decide when information is appropriate or otherwise for a given age group. A given community may feel the age of maturity is something other than 18, and physiologically the age of maturity is different for differing racial groups. It is a strange world where it is permissible to get married at 16 -- and all that implies, but not permissible to think freely until 18, or 21 in certain states. More appropriate would be content flags. Using the security option there is a resonable number that could be assigned. OPT_R_UPPER_NUDITY, OPT_R_LOWER_NUDITY, OPT_R_FULL_NUDITY, OPT_R_FEMALE, OPT_R_MALE, OPT_R_BIZARRE, OPT_R_HOMOSEXUAL, OPT_R_BESTIALITY, OPT_R_DISECTION, OPT_R_INTERCOURSE, OPT_R_VIOLENCE and OPT_R_ADVERTISING come to mind. Unlike TOS however, many IP stacks have no real support for the security option. The value of re-using it then for this purpose it dubious. There is no reason another IP option couldn't be added. Perhaps the spare TOS bit could be used as a catch-all until a content option is implimented. Most french wouldn't be concerned about OPT_R_FULL_NUDITY provided OPT_R_HOMOSEXUAL wasn't set. -- "I mean, after all; you have to consider we're only made out of dust. That's admittedly not much to go on and we shouldn't forget that. But even considering, I mean it's sort of a bad beginning, we're not doing too bad. So I personally have faith that even in this lousy situation we're faced with we can make it. You get me?" - Leo Bulero/PKD +---------------------+--------------------+----------------------------------+ |Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | |proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | |proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | +---------------------+--------------------+----------------------------------+

1 0

Entropy Estimator
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

I just added a feature to my entropy graphing program that estimates the number of bits of entropy in the file, in addition to making the graph. I tested it on some ZIP files, comparing the sum of the results obtained from each file individually to the results from the ZIP file containing all of them. So far, the results have been consistent within 20%. EXE's show 3-4 entropy bits/byte, ZIP files show 6-7, and DLL's and text files show 1-2. Source code (Visual Basic) available to anyone who wants it, but I think I will hold off on the EXE and VBX's until I find someone who will put it on their FTP/WEB site. Suggestions via email regarding this would be appreciated. Jonathan Wienke

1 0

Re: (Fwd) British Study Claims That Photo Credit Cards Don't Work
by jim bell 17 Dec '03

17 Dec '03

At 08:42 AM 4/11/96 -0400, Clay Olbon II wrote: >At 11:10 AM 4/9/96, jim bell wrote: >>At 07:57 AM 4/9/96 -0500, Mike McNally wrote: >>>There are supposedly some new techniques that look at the infrared >>>signature of your face (like, I guess, distribution & position of >>>hot & cold spots), and that's less likely to be fooled by facial >>>hair and other superficial disguises. It's probably a fairly simple >>>technology, and could be applied to the credit card ID problem. >> >>I think this is based on looking at your face with near-infrared, not the >>medium and far (thermal) infrared. Near infrared is supposed to penetrate >>flesh far better, so your blood vessels are visible and form a pattern >>which can be recognized. >> >>Jim Bell >>jimbell(a)pacifier.com > >Jim, > >Where did you get your info? Near IR is around 1-1.5 microns, at these >wavelengths, the body radiates very little energy. I think most of the >systems you are discussing use mid (3-5) or long-wave (8-12) IR, where >objects that are room to body temp radiate most of their energy. I get most of my information in this area from Photonics Spectra magazine, and Laser Focus World magazine. No, Clay, I did not say that the flesh RADIATED near IR. (it does, but only a very tiny amount.) The identification system I describe would probably use 940 nm IRLEDs to illuminate the face, and a silicon CCD detector to pick up the images. Or it would use ambient near-IR, perhaps from the sun or a tungsten filament or fluorescent lighting, along with an IR filter to ensure that the CCD camera picked up only the IR bands of interest. It would be easy to check out the results: Put such an IR-passing filter in front of a CCD-based camcorder, and take a picture of somebody. Incidentally, this simplicity shows the flaw in using this kind of system as an identifier: Since people's faces are usually visible, and can be photographed in the near-IR surreptitiously, it isn't clear how to prevent faking a face which appears to have the same IR signature and pattern. Jim Bell jimbell(a)pacifier.com

1 0

Re: No matter where you go, there they are.
by David Loysen 17 Dec '03

17 Dec '03

[CHOMPED] > Close, but not quite: >S/A is an ADJUSTABLE variable, not on/off. it can reduce accuracy to >10 meters or 100 meters or whatever. It's a DoD term, not NWO term. > The "this is where you really are" percision location (forgot >the designation off hand) is ENCRYPTED (yes, there is crypto >revelance here...) in the data stream from the satellites. The >difference S/A makes is on the order of magnitude, therefore not >"useless." It should be pointed out that different regions of the >earth can have different degrees of accuracy based on the S/A system. > I doubt S/A will ever be turned off, but this is my opinion. I >know Jim's opinion. Discussion of this point is pointless. > DGPS transmission are made from a multiple single points, which >(to the best of my knowledge) are not networked. > glenn Does anyone else get a little upset at the thought of one Government agency (DoD) spending money to install the GPS system, then making it less accurate than it should be, and then a second Government agency (US Coast Guard) spending money to improve the system by installing DGPS stations. Plus, in order to get the real accuracy of GPS right now I have to spend more money on a much more expensive DGPS unit. Pisses me right the F### off.

1 0

Demonizing the Opposition: Bruce "The Toolman" Taylor
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At CFP96, Bruce Taylor, Brock Meek's "lawyer with brass balls", and Declan McCullagh's "architect of the CDA" (who seems like a Pretty Stand-Up Guy, except he wants to tell us how to think), sat on the dias and made repetitive inflamatory references to a picture of "female genitalia nailed to a board", and others to a picture of "a penis with a blister on it", citing them as examples of the Rampant Filth and Corruption We Find on the Internet Today, Brothers and Sisters, Say Haleluja. Unfortunately, as hard as I tried to remain true to the Spirit of CFP, and not Demonize the Opposition, I couldn't help but come up with a spiffy new moniker for Mr. Taylor, which I will try to remember to use from time to time, viz., Bruce "Penis with a Blister" Taylor abbreviated PWAB, or "Blister" I suppose Of course, the CDA-able version of this proposed new handle would be, Bruce "The Toolman" Taylor shortened to "Toolie"? "The Tool"? "Toolboy"? ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Mardi Gra Cash Card
by John Young 17 Dec '03

17 Dec '03

WSJ 4-12-06 reports that England's "Mardi Gra" bomber is demanding of Barclays "access to the bank's cash reserves through the use of a special cash card, although details could not be confirmed." Police are communicating with the bomber through cryptic notices in personal columns of newspapers, the latest stating: "MARDI GRA We are ready to help and give value. Contact us on the verification number." Barclays says 25 bombs have been sent to its branches. The bomber -- who has been compared to America's Unabomber -- may be a former employee among those 18,500 laid off during the past 5 years, or a small businessman with a grudge. [Or ...]

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 09:17 PM 4/11/96 -0500, Sten Drescher wrote: >>>>>> jim bell writes: > >jb> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >>> No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. > >jb> I notice you gave no examples. Why is that? > > As I recall, the Honeywell H6000 used 6-bit bytes and 36-bit >(6 byte) words. Here's the problem with this kind of counter-example: You do not explain whether or not these data structures were actually called "bytes" by the manufacturer, or whether the term "byte" was inflicted later on by people who didn't know better. Remember, in the absence of any name for a "6-bit data object" I'm sure the temptation was probably very strong to misuse a term, especially in hindsight. See, I do not challenge the fact that there were plenty of data objects of length other than 8-bits. The issue is whether or not the people back then actually believed that a correct, official usage of the term "byte" included lengths other than 8. Dmitri Vulis at least acknowledged that when he looked back into the documentation, he discovered that the term used for his counter-example was "character", not byte. How many other of these counter-examples would show this kind of thing?

4 4

Re: On computer face recognition:
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:14 PM 4/11/96, David Loysen wrote: >Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of >Lawences papers is on using Neural networks to recognize faces. Methinks >that the state of the art is advancing rapidly and such problems as not >looking at the camera or changing your expression are rapidly being overcome. One system I read up on a few years ago relied heavily on ear shape....it seems that the profile of ears varies tremendously and ear profiles are fairly easy to get a kind of hash of, assuming the ear profile is not obstructed by hair. "Get a haircut" may once again return to favor. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: No matter where you go, there they are.
by Peter Trei 17 Dec '03

17 Dec '03

> From: Roger Williams <roger(a)coelacanth.com> > >>>>> Hal <hfinney(a)shell.portal.com> writes: > > > Note however that Denning did not mention the Internet in her > > spiel. > > Well, assuming that she wrote *any* of the spiel, she does: > > "Where it works > > ... Location-based > authentication could facilitate telecommuting by countering the > vulnerabilities associated with remote access over dial-in lines and > Internet connections..." She wrote it. The original of the paper may be found at http://all.net/journal/csi/csi-96-01.html Peter Trei trei(a)process.com

1 0

Re: On computer face recognition:
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:48 PM 4/11/96, Alan Horowitz wrote: >How do _people_ recognize faces? Still an open question, last I heard. It may be unknowable, at least in a formal sense. That is, we know that babies can recognize the faces of their mothers in fractions of a second (no, I don't have a reference for this, but I remember the number from my days as an AI person at Intel). There may be no simple description that is used, such as angles between eye line and mouth, convexity of chin, whatever. What is important is that face recognition happens in about 30-100 "cycles" of the brain, implying massive parallelism (hardly surprising). There are, of course, very few recognition algorithms that run on conventional computer architecures in so few cycles. By "unknowable" I don't mean "supernatural," merely not practically describable as an algorithm runnable on conventional von Neumann-type machines. "Neural net" is the buzzword usually associated with this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: why compression doesn't perfectly even out entropy
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:36 AM 4/11/96, jamesd(a)echeque.com wrote: >At 10:36 PM 4/9/96 -0400, JonWienke(a)aol.com wrote: >> Would anyone like to propose a means of measuring entropy that we can all >> agree on? I haven't seen anything yet that everyone likes. > >Nor will you: To measure entropy is a deep unsolved philosophical >and physical problem. Indeed. That there can be no simple definition of entropy, or randomness, for an arbitrary set of things, is essentially equivalent to Godel's Theorem. (To forestall charges that I am relying on an all-too-common form of bullshitting, by referring to Godel, what I mean is that "randomness" is best defined in terms of algorithmic information theory, a la Kolmogorov and Chaitin, and explored in Li and Vitanyi's excellent textbook, "Algorithmic Information Theory and its Applications.") Think of it this way: when can a set of things, a string, etc., be _compressed_. Answer: whenever a compression is found. Most things have no real compressions, that is, they have no shorter description than themselves. But they _might_ have a shorter description, a compression, and we can never say for sure that they do not. Thus, even a set which we think is of "high entropy" (roughly, "high randomness" or "no order" or "not compressible") may actually have some hidden order, or compressibility, not apparent at first glance. That we can never know when we have achieved maximum compression is a profound result of modern mathematics and information theory. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

[NOISE] Why there are so many cluless people
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Today, I heard a commercial on the radio. Some company wants to help you make $1k+ per day as an Internet expert. Simply listen to their one week audio tape course and you know everything you need to work as an Internet consultant. Sigh, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Re: No matter where you go, there they are.
by Bill Stewart 17 Dec '03

17 Dec '03

[ Dorothy - there's been substantial discussion on cypherpunks about your position escrow proposal; the paper that's on your web page was posted here.] At 03:01 PM 4/11/96 -0400, perry(a)piermont.com wrote: >Paul_Koning/US/3Com%3COM(a)smtp1.isd.3com.com writes: >> Suppose I want to pretend that I am 1000 feet closer to satellite 4 than >> I really am. Simple, I take the signals from all the other satellites >> and delay them by 1 microsecond. That looks like a 1 microsecond >> local timebase error together with a 1 microsecond delay reduction >> to satellite 4. >Aren't things even worse? Since the satelite signals are not >authenticated with anything like public key methods, couldn't I just >synthesize a signal appropriate to any spot on the planet, knowing the >positions of the satelites relative to that spot? No, you can't. One problem is that the Selective Availability coding isn't predictable, since it uses some kind of secret military code - so you don't know what its values are until you hear them. So as long as you share any satellites with the recipient, you need to be sure to output the correct codes for that satellite, which means you need to either be in range or have access to some internet "position remailer" site that's making them available. As far as predicting relative timing between satellites to fake your position, if that's sufficiently unpredictable that you can't fake it, as Denning and MacDoran say, then it should also be equally unpredictable to the verifier who wants to know if you're telling the truth or faking it. And if you require systems to respond to requests for "Where are you now?" or especially "Where were you on the night of April 13th at 8:37pm?", the spoofer can request that information just as easily as the verifier. One method that could be used to prevent faking is GPS receivers with "tamperproof" digital signature capability, which would not only receive the location information but sign it; that's not much more secure than just having a "tamperproof" token in the first place. As far as the multipath issues that some people have brought up, I searched for "MacDoran" on altavista, and found several papers on GPS multipath, so they're aware of the issue, though I don't know how they're planning to address it. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: questions about bits and bytes
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:05 AM 4/11/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >>- From a really quick web search, we find that the SGI Impact jams 9-bit >>bytes [that's what it says] across the Rambus internally. I'm not sure >>if the memory itself is 9-bit. > >Are you sure they're not referring to 8 bits of data and a parity bit? In >any case, please give the address to the list so that it can be checked out. www.altavista.digital.com, which is the address of almost everything :-) If you don't count the parity bit as part of the byte here, you probably shouldn't count it in a typical 7-bit-ASCII-plus-parity situation either. As far as jamming 9-bit-bytes across a bus, that almost certainly _is_ 8 bits of data and one parity bit; people have been agitating for and debating parity on memory busses for a long time. AT&T's Datakit switch (an ancestor of ATM) used 9-bit bytes on its data busses, where 8 bits were data-from-outside and one bit was a control-vs-data indicator, which let cards listening to the bus decide whether to think about the byte with their control processors or just shove them onto an output wire. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: "Contempt" charges likely to increase
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 6-APR-1996 16:17:13.99 >I might add that the Cayman Islands are full of trust companies with >provisions which forbid the disclosure of data to a client who is >coerced. A law on the books refuses to recognize "consent" orders made >under judicial compulsion. This would give the appearance of total >unavailability of evidence and suggest the futility of contempt >charges. Yet courts have still, and with no small measure of success, >imposed sanctions on witnesses so protected. What measure of success? Getting the data, or locking up the witness? -Allen

2 1

Re: Protocols at the Point of a Gun
by Marshall Clow 17 Dec '03

17 Dec '03

Scott Brickner wrote: >Somebody who might be Marshall Clow wrote: >>Multiple IP #s, multiple machines, multiple users, ONE account. >>Which router will insert the "suggested" flag, and how will it decide which >>packets to tag? > >The way I envision it (in my nightmares), you'd have two options: have >the account configured as "kid safe", and live in a cyberspace playground, >or have it configured as "adult", and accept responsibility for your kids' >use. > I have no problem whatsoever with this. Guess which option I'd choose :-) However, given the hysteria that is surrounding the CDA, etc., I think that the second option would be "politically unacceptable". The whole thrust [ sorry for the sexual imagery ;-) ] behind [ oops, now it's sodomy ] the CDA is that it's not good enough for parents to take responsibility for their children's use; the government must be involved. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "Eternal vigilance is the price of PostScript" -- MacUser Jan 96 DTP and Graphics column

1 0

Re: Spinners and compression functions
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I have had a somewhat related idea to this on compression regarding steaography and which bits are the best ones to use. How about those that a lossy compression method that's reasonable loses first? These are the ones that aren't going to be noticed by the viewer, and (if the compression method is good) will have at least somewhat higher entropy than the rest. -Allen

1 0

Re: Entropy Estimator
by rick hoselton 17 Dec '03

17 Dec '03

At 12:19 AM 4/12/96 -0400, JonWienke(a)aol.com wrote: >I just added a feature to my entropy graphing program that >estimates the number of bits of entropy in the file, Hey, that's just what I need. I have these two 8-million byte files. One is a recording made by a geiger counter, every bit is uncorrelated with anything else in the universe and each bit is equally likely to be a one or a zero. The second file is an IDEA encryption of all the four-byte numbers from one to two-million. Here's my problem. I can't remember which file is which, and I've forgotten sixty-four bits of the key I used to produce the encrypted file. That's where your technique come in. The first file has sixty-four million bits of entropy. The second file has only sixty-four bits of entropy, total (the missing key bits). Surely, your technique can tell me which file is which. Estimating entropy can be difficult, and I don't expect perfection. But any measuring technique that is not a complete HOAX must be able to clearly find a difference of six orders of magnitude. If you tried to give me a ruler that couldn't detect the difference between a millimeter and a kilometer, I might think you misunderstood something about the concept of distance. If encouraged me to use a clock that could not measure the difference between a minute and a year, many would conclude that you were not an expert in chronology. So, if your technique is worth anything at all, it should be able to accomplish this easy task. PS. I think it is your patriotic duty to report this technique to the Federal government. They frequently need to distinguish between ciphertext and just plain random digits. A breakthrough like this would have a major impact on national security. They might be willing to remove ITAR restrictions from cryptography, out of gratitude to the cypherpunks.

1 0

PICS
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I had a chance for a brief look at the PICS protocol, and it seems to have a lot of cypherpunks relevance. It includes features such as: Multiple third party rating systems Digital signatures I will have to find time to look at it in more detail. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Cypherpunks Bay Area - Saturday 1:00 Printer's Ink
by Bill Stewart 17 Dec '03

17 Dec '03

The usual suspects for meeting places having fallen through, there will be a Bay Area Cypherpunks meeting at 1:00 Saturday at Printer's Ink on Castro Street in Mountain View. Meet at the outside tables by the side of the building, and we'll see if the meeting migrates from there. If we're not there, and the meeting has moved when you arrive, look for a note on a lamppost in front of the building. Directions: Castro Street goes between the Central Expressway and El Camino Real in the middle of Mountain View; Printer's Ink is on a corner in the middle. Parking is around back. Coffee is upstairs, books are inside. Directions from far away - take Route 101 to the Moffett exit, head west/south, watch the street name mutate at the Central Expressway and train tracks. Public Transit: Take CalTrain to the Mountain View Exit, walk about three blocks west/south. Agenda: As you've guessed from this highly timely notice, there's a full schedule of events planned. I'd like to talk about remailer spam prevention, and there's been a lot of activity recently on Denning's position escrow, Scientology court cases, CDA, and other entertaining politics. Thanks! Bill Replies to: stewarts(a)ix.netcom.com

1 0

Edited Edupage, 4 April 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 5-APR-1996 01:25:00.85 >***************************************************************** >Edupage, 4 April 1996. Edupage, a summary of news items on information >technology, is provided three times each week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** >IBM'S INTELLIGENT MINER DIGS OUT THE GOOD STUFF >IBM plans to offer companies "data mining" software and services, allowing >them to make better use of disparate pieces of information stored in their >computer systems. The Intelligent Miner software will be available on IBM's >RS/6000 servers by the fall, and on other platforms by year end. The >company also plans to develop Intelligent Decision Server software for local >area network-based information analysis. (Investor's Business Daily 3 Apr >96 A9) Anyone have any _specific_ ideas on how their Intelligent Miner system works? It would appear to be relevant to the identity-spoofing discussions. -Allen >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >mail to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage Marilyn Monroe (if your name is Marilyn Monroe; if it's >not, substitute your own name). ... To cancel, send a message to: >listproc(a)educom.unc.edu and in the body of the message type: unsubscribe >edupage. (If you have subscription problems, send mail to >educom(a)educom.unc.edu.)

1 0

Re: Protocols at the Point of a Gun
by rah＠shipwright.com 17 Dec '03

17 Dec '03

How fortuitous! At 8:09 PM 4/12/96, Marshall Clow wrote: > However, given the hysteria that is surrounding the CDA, etc., I think >that > the second option would be "politically unacceptable". The whole thrust [ > sorry for the sexual imagery ;-) ] behind [ oops, now it's sodomy ] the >CDA > is that it's not good enough for parents to take responsibility for their > children's use; the government must be involved. Yeah. What *he* said. Actually, this gratuitous waste of bandwidth brought to you by my new .sig, courtesy of my samoan attorney, one Vincent Moscaritolo. Vinnie, to his friends... Cheers, Bob Hettinga Note new .sig! \|/ \|/ \|/ V V V ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they just passed a few more laws, we could all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

How the other half lives - why encryption is necessary
by Dave Emery 17 Dec '03

17 Dec '03

The following showed up on a public radio-oriented mailing list I occasionally read - if this is really a true report by a confessed cordless/cellular scanner freak who got caught taping calls and passing the tapes around it is certainly illuminating as someone in an official position may have possibly said much more than more sophisticated law enforcement eavesdroppers would ever admit to. Clearly most people would think the law in the matter was very different than the attitude here expressed, though I think that many of the more cynical would view this as no surprise at all and indeed SOP in most investigative agencies, I cannot vouch for the identity of the poster or the veracity of this. However I think it certainly shows the official attitude that has made many of us advocates of encryption, particularly of wireless communications, and deeply suspicious of the notion that court ordered wiretaps are the only ones used by the police and other agencies. Forwarded message: From scan-mass-east-request(a)nomad.n-reading.ma.us Old-Return-Path: <merk!tiac.net!kilo> Date: Fri, 12 Apr 1996 19:17:41 -0400 Message-Id: <199604122317.TAA17404(a)zork.tiac.net> X-Sender:kilo@tiac.net X-Mailing-List:<scan-mass-east(a)nomad.n-reading.ma.us CORDLESS PHONE MONITORING: -- I was accused of monitoring phone conversations of public officals over a scanner. I was accused of taping said conversations in which the public officals were conducting town buissness in a illegal manner etc. The allegded tapes (copies) were allegedly passed around to "other" town officals for them to hear what was being "said", "done", and what actions were about to unfold. A investigation by the Mass. District Attoney was ordered and the results if that investigation is as follows ---- "The information available during this investigation indicated that the telephone calls which were tape recorded were made on a cellular telephone or a portable telephone. No evidence was obtained indicating a wire communication was illegally intercepted and recorded. The audio tape that was around the town of $%#@!%^%$$ and played for several individuals was not recovered. @@ @#$$#% ^%%&* found the tape left on the front seat of %$^ car and had it for a period of time, but does not have it or knew where it was at this time. This officer (police) explained to those directly involved that cellular telephone conversations and any conversation that is transmitted over the airwaves is not protected communitations, as there is no expectation of privacy in the open airways. I further informed those involved that there are people who have nothing better to do then listen and record such cellular telephone calls and this means of communication is not secure. This officer requests that this investigation be closed". That is from the Masssachusetts District Attoney's Office in Barnstable,Mass. ******** In fact when I was interviewed I was told flat out that lawenforcement "does not want" it to be against the law, because not only do they hear about drug transactions which allows them to bust subjects, "BUT" it is also a saftey tool, for at times the people under survailance talk using this type of communication and they (POLICE) can find out if the subject(s) have weapons, etc. etc......!!!!! That's what my experience in this area is... Happy Scanning!!!!!!!!!! Vietnam Vets - "USMC"

1 0

Re: So, what crypto legislation (if any) is necessary?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 5-APR-1996 06:26:05.96 >There are ways to resist compelled discovery. These are not they. Any methods you're willing to mention sans a money order? -Allen

2 1