December 2003 - cypherpunks-legacy

JULY BAY AREA MEETING
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, We will be hosting a Cypherpunk meeting this Saturday the 13th. Late notice, but better late than never. Be prepared to bring up your own topics, but I propose we spend some time discussion the meta-question of list dynamics. Is the Cypherpunks list a "sewer"? Is there anything we can do to improve signal-to-noise? Do we need to? Etc. The meeting location will be at the Flatiron building in San Francisco, aka 544 Market, aka 1 Sutter. The building sits on Market and Sutter at Sansome and near 2nd. It is right above the eastern end of the Montgomery BART station. We will try to have someone in the lobby to let you in the 1 Sutter entrance, but if no one is there, call the office so someone can come down (415-392-0526). We will be in the offices of Simple Access on the 5th floor. The time is noon to 6:00 or so. S a n d y P.S.1. We may have a surprise visitor. P.S.2. If you don't know about Cypherpunk Thai brunch on Sundays, ask me. This Sunday, we are going shooting after we eat. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: "White 'Punks on Dope" (w apologies to The Tubes)
by mike＠fionn.lbl.gov 17 Dec '03

17 Dec '03

On Jul 10, 10:12pm, Timothy C. May wrote: > And perhaps worse, _parents_, such as the example I provided, are using it [Ritalin] > to control children. Where once they would've paddled the kid for using > obscene language, or refusing to get dressed for school, now they pop a > pill in the child's mouth. There are certainly legitimate arguments about the level of use of Ritalin or other drugs, their benefits & their costs, but this straw man is just ridiculous, & betrays the author's lack of knowledge. Unfortunately a similar misunderstanding is reflected in the writings of 1 or 2 others on this topic too. Parental (or other) control is not at issue at all with add; self control is the main problem.

2 1

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by jim bell 17 Dec '03

17 Dec '03

At 04:06 AM 7/11/96 +0000, Paul Elliott wrote: >What is to prevent a U.S company to licence a foreign company >to sublicence and distribute a Crypto product abroad, if that >foreign company obtains that product on the pirate market? > >I am not a lawyer, but I look at the definition of "export" >on page 612 of Applied Cryptography and nothing seems to >obviously apply. > >The scenario I imagine is this: U.S. company produces a crypto >product. To be generally useful, the product supports all languages. >(Those CDROMs really do hold a lot of data.) >After all, Americans do need to do business with foreigners. >The company licences and distributes the product in the U.S. >taking special care not to distribute the product to any foreign persons. >When inevitability, the product appears in the pirate market outside >the U.S., the company makes a contract with a foreign company >allowing it to distribute it and sublicence it. The foreign company >can get their copy from the pirate market, being authorized to get >the copy by the U.S. company. When this deal is cut copies >have already been exported and are already being sold by the >pirates, against the will of the U.S. company. I raised this type of idea on CP, twice, and didn't hear a peep about it! (As recently as a couple of days ago.) It doesn't entirely eliminate the illegality; it merely transfers that illegality to an unknown and thus unprosecutable person. But yes, it appears that nothing would prevent this technique from working very well. Any attempted prosecution would fare even less well than the example of Zimmermann and PGP 1.0: There would be no illusion that an encryption product sold in hundreds of stores nationwide could be kept within the borders of the US, so the domestic manufacturer is safe. The foreign distributor isn't violating any of his own country's laws, and probably not arguably any of the US. Both companies could enthusiastically invite the USG to prosecute whoever actually exported the software, laughing all the way to the bank. Jim Bell jimbell(a)pacifier.com

1 0

Irony on strong encryption in Australia
by Richard Charles Graves 17 Dec '03

17 Dec '03

The Australian Broadcasting Authority's report on Internet regulation issues recommends that ISPs be required to support unescrowed strong encryption for their users' privacy and security. Electronic Frontiers Australia is opposed to this idea because it puts too much of a burden on the ISP. http://www.efa.org.au/ -rich

1 0

Green Paper on PICS from ALA
by Kip DeGraaf 17 Dec '03

17 Dec '03

Does anyone still have a copy of the Green Paper on PICS usage in a library setting by Magpantay that was yanked from the ALA web site? I would be interested in reading a copy of it.

1 0

test
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Could someone please post the correct syntax to remove unwanted keys from the secret ring (if there is a way)?

1 0

New Mac Web Server Security Hole Discovered
by Cyberdog 17 Dec '03

17 Dec '03

Try adding /M_A_C_H_T_T_P_V_E_R_S_I_O_N to any of the URL's at http://www.netcraft.co.uk/Survey/Reports/960701/ALL/WebSTAR.html and each server will leak information like --- http://europa.nadc.navy.mil//M_A_C_H_T_T_P_V_E_R_S_I_O_N --- WebSTAR, Copyright ©1995 Chuck Shotton, Portions ©1995 StarNine Technologies, Inc. and its Licensors. All rights reserved. PowerPC (CW) version totalCon 343, maxCon 30, listening 29, current 1, high 8, busy 0, denied 0, timeout 0, maxMem 1140640, currMem 1117024, minMem 1090208, bytesSent 1218888, port 80, maxTimeout 300, verboseMessages false, disableLogging false, hideWindow false, refuseConnections false, upSince 07/11/96:10:48, version 1.2.5(PowerPC (CW)) -- Anyone can use this for denial of service becase this backdoor is so well hidden it won't show up in the logs! The vendor has not commited to an instant fix, but they have told their users not to discuss this on public lists lest their obscurity become unsecure. p.s. The copyright part was their lawyer's idea!

1 0

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by jim bell 17 Dec '03

17 Dec '03

At 01:03 PM 7/11/96 -0400, Mark M. wrote: >> What is to prevent a U.S company to licence a foreign company >> to sublicence and distribute a Crypto product abroad, if that >> foreign company obtains that product on the pirate market? > >Just because the company didn't break any laws doesn't mean that they aren't >going to be harassed by the government. This is similar to the Philip >Zimmermann case. A grand jury investigation could be carried on for as long >as the statute of limitations dictates and then the prosecutor of the case >decided at the last minute not to indict. This is the reason that Netscape >has not yet made a browser with 128-bit encryption available on the Internet. I think the government's ability to "harass" writers of good crypto software has been severely limited by their failure to indict Zimmermann. Remember, today they pretty much have to accept the fact that anybody can write any software, DOMESTICALLY, without any sort of legal impediment by the laws including ITAR. This is particularly true of a company like Netscape, which presumably has the bucks and/or the political clout to make it a difficult target. Any case against Netscape would probably take years if not decades to resolve, and long before this happened the world would have adopted good encryption regardless. Look what happened when MIT put PGP on the Web: "Nothing." Jim Bell jimbell(a)pacifier.com

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by Michael Myers 17 Dec '03

17 Dec '03

At 10:39 AM 7/9/96 -0500, Rick Smith wrote: >erehwon(a)c2.org (William Knowles) writes: > >>Ritalin has been a godsend, I am able to dialin when I have to. >>Ritalin is not the only drug for treating ADD, Prozac works for >>some. > >I use coffee, or else I just managed to grow out of the worst effects. >In any case, I drink more coffee than just about anyone I know, and it >doesn't "wire" me at all. Coffee usage seconded here...I've tapered down to about two pots or so a day from four or more, due to the tolerance I was developing. It's about the only thing that gets anything done on time. While I can understand and agree with Tim and Mike's points about government control and "making creative people fit in", there is a point where creativity is the only thing possible, to the exclusion of all else, such as paying bills on time, doing necessary work, or just interacting with others. -- /^^^^^^^^^Instead of being born again, why not just GROW UP?^^^^^^^^^^^\ Michael Myers Vote Libertarian....you'll sleep better! Don't like abortion? Don't have one. Don't like guns? Don't buy one. blackavr(a)aa.net E-mail for PGPv2.6.2 public key \____________ http://www.aa.net/~blackavr/homepage.htm ________________/

1 0

Re: A case for 2560 bit keys
by Chris Adams 17 Dec '03

17 Dec '03

On 9 Jul 96 17:46:00 -0800, markm(a)voicenet.com wrote: >> As an experiment generate a 2047 bit PGP key and a 512 bit PGP key. >> Encrypt a file (preferably of a reasonable size) using both keys. >> Depending on the computer you are using, the time difference between the >> two keys will be a matter of few seconds or even a fraction of a second. > >Now try decrypting the file, or signing another file. I have a 486-66 which >is now considered hopelessly sluggish by today's standards. It takes about >5 seconds, while doing the same operation with a 512-bit key takes less than a >second. I sign every one of my messages, so such a time delay gets quite check your setup. I used to run a 386-20 (5MB RAM) and it took about 3 seconds for a 1024 bit key. Given it didn't even have a copro (not sure when/if PGP uses one) and that it was off of a Stackered drive, I'd expect you to have much better times. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Chancellor Group (symbol = CHAG)
by chag＠moneyworld.com 17 Dec '03

17 Dec '03

http://chancellor.stockpick.com Chancellor Group, Inc. (symbol CHAG) just reported big quarterly earnings. SGA Goldstar issued a "buy" recommendation. I understand other investment advisors are looking to recommend CHAG. The company has a strong book value. The short sellers need to cover. This looks like a good situation to me. What do you think? They are located at: http://chancellor.stockpick.com Bob Williams, 206-269-0846 To terminate from my Investment Opportunities, Reply to chag(a)moneyworld.com with "remove" in the subject field.

11 10

Re: I@Week on crypto export loophole 6/24/96
by jim bell 17 Dec '03

17 Dec '03

At 10:30 PM 7/11/96 -0400, Will Rodger wrote: >>At 04:06 AM 7/11/96 +0000, Paul Elliott wrote: >>>What is to prevent a U.S company to licence a foreign company >>>to sublicence and distribute a Crypto product abroad, if that >>>foreign company obtains that product on the pirate market? >>> >>>I am not a lawyer, but I look at the definition of "export" >>>on page 612 of Applied Cryptography and nothing seems to >>>obviously apply. > >Elliott appears to be absolutely correct. > >Jim Bell replied: >>I raised this type of idea on CP, twice, and didn't hear a peep about it! > >You were ahead of your time, Jim. >There was a cover story peep about the idea in Interactive Week June 24, in >fact. The story followed Bidzos' announcement that NTT would soon be >producing 3-DES chips en masse. >It's at: http://www.zdnet.com/intweek/print/960624/cover/doc1.html I just read the article, and it's very interesting. My first note on the subject was posted June 4, and follows below: At 10:54 AM 6/4/96 GMT, John Young wrote: >Connecting Declan's three dots [...]: > The New York Times, June 4, 1996, pp. D1, D4. > Japanese Chips May Scramble U.S. Export Ban > By John Markoff > Washington, June 3 -- The Nippon Telegraph and Telephone > Corporation has quietly begun selling a powerful data- > scrambling chip set that is likely to undermine the Clinton > Administration's efforts to restrict the export of the > fundamental technology for protecting secrets and commerce > in the information age. > An executive at NTT America said that although there were > no restrictions on the export of cryptographic hardware or > software from Japan, his company was still anxious to > obtain software from RSA Data to use in its chips. That > software is still controlled by United States export law, > he said. Maybe it's just me, but the solution to NTT's problem is obvious. Even assuming that the export of this software would be against the law, why doesn't somebody simply violate that law? RSA would publish that software, possibly encrypted with NTT's public key, on a public system protected against direct export. "Somebody" would download it, write it to a floppy (taking care not to leave any fingerprints, and wetting both the stamp and the envelope with tap water, rather than licking them) and mail that floppy off to NTT in Japan. (Naturally, you don't put a return address on that envelope. The truly paranoid would first take that floppy to some store's PC section, and cross-load the data onto a floppy written by some other floppy drive.) NTT finds that envelope in their mail, opens it, reads the floppy, decrypts the data, and say, "Wow! It's the data we wanted to get!" It verifies that the data is valid by emailing a copy back to RSA in America, who say, "Amazing! Somebody has illegally exported our software!" As far as I know, there is nothing wrong with NTT using this software even if it is assumed to have been exported illegally. Obviously, NTT won't _ask_ for somebody to do this, because then the government will claim it was all a conspiracy, but that doesn't prevent NTT from being the beneficiary of somebody else's activities. Jim Bell jimbell(a)pacifier.com

1 0

Re: New Mac Web Server Security Hole Discovered
by Yanni 17 Dec '03

17 Dec '03

> Try adding /M_A_C_H_T_T_P_V_E_R_S_I_O_N The simple ( unsupported ) fix is to change the strings (they show up twice in the resources) with a resource editor such as resedit. Regards, -jon Jon (no h) S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key We are hiring! http://www.clearink.com/clearink/home/job.html

1 0

Re: rsync and md4
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:05 AM 7/1/96 -0400, "David F. Ogren" <ogren(a)cris.com> wrote: >Irregardless, this argument is moot. This thread is titled "rsync and >md4". It is a discussion about which hash function suits this particular >purpose and he is not particularly concerned with resistance to deliberate >attack. In this case MD4 will function adequately. There are three issues with MD4/5 relevant to rsync 1) Collision probability - if you're concerned that a damaged packet will have the same hash as the original correct packet, that's 2^-128. If you're concerned that you may find a damaged packet with the same hash as _some_ correct packet out there, that's a birthday problem, and approaches 2^-64 if you've really got lots of packets that you can keep track of at once, but in reality the probability is much lower since you won't be keeping 2^64 packets around to collide with. 2) Deliberate collisions, and 3) speed - If I understand the description of rsync, it needs a checksum to detect packets with different values so it can determine whether to send an update packet. It's concerned with people changing _data_ in non-malicious ways that you want to detect, so the security issues about MD4 and MD5 aren't relevant, though systematic changes to data resonating with the hash function are. You can use _much_ simpler hash functions than MD5 - go check out a book on error correcting codes and related math. Most error detection applications these days use 32-bit polynomials, since they're good detectors and can be implemented very efficiently on 32-bit hardware. They're useless for security, since you can invert them, but that's irrelevant. If that's not reliable enough for you (and it may not be), there are polymomials in lengths like 64 bits or 128 bits that should have good change detection, not be too sensitive to patterns in data, and be _far_ faster than MD4 or MD5. If I remember right, rsync was looking at using 16- and 32-bit checksums to get a quick probable result and MD4 as a backup; you can save yourself work by just calculating the 128-bit function and using the first 32 bits as a quick check. If you're _sure_ you're not worried about birthday problems in your collisions, a 64-bit checksum is fine, and will be even faster. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:30 AM 7/12/96, jim bell wrote: >Look what happened when MIT put PGP on the Web: "Nothing." > Go back an read Hal Abelson's message of just a few days ago. MIT may lose out on a large contract with Sandia becuase of their publishing of a _book_ containing PGP code. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 6

Destabilizing China's Government with Strong Crypto
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:40 AM 7/12/96, Arun Mehta wrote: ... >2) Encourage the production of simple, cheap devices such as a PGP phone >that they can manufacture in Hongkong and other parts of China, which will >allow secure communications. Basically, people without a computer, Internet >connection or sufficient literacy should be able to use effective >encryption. Cheap. > >3) Find people who beam radio transmissions into China (Rupert Murdoch via >his Star TV satellite is one ;-) and ask them to devote an "Internet hour" >in which people can mail or phone in messages (via remailers and encryption >too) to be broadcast. The whole thing can be automated, and *everybody* has >access to radio. More on this subject later. Good ideas, all. And deploying steganography is a natural fit to this situation. And this is yet another example of the negative effects of the U.S. restrictions on crypto export: where widespread crypto tools might be used to destabilize repressive governments, the lack of these tools integrated into common applications makes it harder for freedom-fighters in China, Burma, Iran, France, etc., to use them. I often think the American CIA and NSA are actually just enforcers of the status quo, preferring a New World Order of crypto-restricted citizen-units to a more diverse, anarchic world in which private citizens and corporations can thwart the desires of central governments. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

I@Week on crypto export loophole 6/24/96 (was:Re: Can the inevitability of Software privacy be used to defeat the ITAR?)
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >At 04:06 AM 7/11/96 +0000, Paul Elliott wrote: >>What is to prevent a U.S company to licence a foreign company >>to sublicence and distribute a Crypto product abroad, if that >>foreign company obtains that product on the pirate market? >> >>I am not a lawyer, but I look at the definition of "export" >>on page 612 of Applied Cryptography and nothing seems to >>obviously apply. Elliott appears to be absolutely correct. Jim Bell replied: >I raised this type of idea on CP, twice, and didn't hear a peep about it! You were ahead of your time, Jim. There was a cover story peep about the idea in Interactive Week June 24, in fact. The story followed Bidzos' announcement that NTT would soon be producing 3-DES chips en masse. It's at: http://www.zdnet.com/intweek/print/960624/cover/doc1.html Bidzos' pending deal brought forth several questions: 1 - Could others try something like the DES deal with stuff under copyright and still make money doing it? 2 - If so, was the administration aware of it? and; 3 - Who, if anyone, would be the first to try it? The answers were: 1 - Yes, someone else could try it. 2- The administration wouldn't comment, but had an official reply that showed it grasped all the implications within 15 minutes of our asking. 3 - No one's stepping forward, but Ken Bass, atty. for Phil Karn and Phil Zimmermann, among others, said he knew some folks were considering moves along those lines, though he gave few details. Steptoe & Johnson cyberspace atty. Stewart Baker suggested such a move would be "extremely aggressive advice," though "not quite insane." if I remember correctly. A few caveats to any US citizen who finds himself trying to help such a situation occur: 1) The loophole can be closed by executive order with little or no notice, and 2) Any citizen aiding the export of such software will of course, be brought up on some pretty serious felony charges if caught. Foreign nationals are doubtless subject to the same laws if on US soil while the deed gets done. Then again, Baker said, "if one gets away with it, dozens will try it, too." I won't be the first to try. Will Rodger Washington Bureau Chief Interactive Week. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMeXiJUcByjT5n+LZAQFFEQgAxabELJIV0W5IQW8xBc2fNd/22sV4xlaw KGMHK6waHIQcC12lKJ3Y2nx67kZQUXmlpf6Xu+CmI8wzE5CJPgHmaQCfa8XJxryK PtJkSfCyn+EZvMMLAab3azaJkGAFfzLTOtfajRjAd0TSnmGCb5FRNc1sNZv5HXqO VR3Hmy6xcA3bxtihaAyW71rK1HZ1yXMrbejMtT/MhYWRgtigQFktYnaWG8kn2LD0 m26QgEKNiOIg9qCI5fc1Ivq1jSLyZ9FYcbzwQidaqyJ6LxJNPjmPgoK6RK1V0UU7 7i1EoIJDhC8hadtz/BaFeXLPMD558D1mJySL/J39ySpDer3VitsUMg== =5APc -----END PGP SIGNATURE-----

1 0

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

if anyone knows the site address and file name.please let me know =-} Thanks Adam

1 0

HotWired -- "A Browne Study"
by declan＠well.com 17 Dec '03

17 Dec '03

Date: Thu, 11 Jul 1996 12:10:44 -0500 To: fight-censorship+(a)andrew.cmu.edu From: declan(a)well.com (Declan McCullagh) Subject: HotWired -- "A Browne Study" When Harry Browne was in my office for an interview on Tuesday, he talked a good line, stressing his unabashed support for free speech (online and offline) and government nonintervention in crypto. Read the full article in today's HW/Netizen at the URL below for details... Also in today's Netizen, John Heilemann reports on how "wired" Dick Lamm is, saying that as long as Lamm's politics are in touch with the future, it's good for the Net: http://www.hotwired.com/netizen/96/28/index3a.html I happen to disagree; I think that if a candidate for president wants to portray himself as "wired," he should venture into c-space himself. At least we know Browne's cyber-clueful -- after all, he told me he bookmarked HotWired. :) -Declan --- HotWired, The Netizen http://www.hotwired.com/netizen/96/28/campaign_dispatch3a.html "A Browne Study" Campaign Dispatch by Declan McCullagh Washington, DC, 10 July The newly anointed Libertarian candidate for president dropped by HotWired's Washington bureau yesterday. With netizens appropriately regulation-shy after the Communications Decency Act brouhaha, the White House's Clipper III proposal, and calls from the Justice Department for a new cabinet-level agency to rein in the Net, it was clear the guy knows how to woo online voters. "Can you imagine if I got to the debates, and I made Bill Clinton and Bob Dole justify censoring the Internet - made them justify their blatant disregard for the First Amendment of the Constitution?" Harry Browne asked. No doubt about it, the Libertarian party has its flaws - little things, like that they'd gut environmental laws and auction off America's national parks and wildlife refuges if given half a chance. But it's also pretty obvious that this is the only party that actually understands the Net. [...]

1 0

Re: Need PGP-awareness in common utilities
by Remo Pini 17 Dec '03

17 Dec '03

At 11:16 PM 7/6/96 +0200, you wrote: > >Let me know. We _could_ adopt the ridiculously simple NoCeM >protocol, or the ever-mutating public key certificates being >designed in a nearby mailing list, or some protocol of our own. >(Shouldn't be too hard to come up with an implementable, useful >protocol.) > Hey guys, as long as I can't get a decent mail program that handles all pgp-stuff automatically (including the cumbersome installation), I don't think pgp-awareness is of much use in "everyday communication programms") ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Irony on strong encryption in Australia
by Sherry Mayo 17 Dec '03

17 Dec '03

> The Australian Broadcasting Authority's report on Internet regulation issues > recommends that ISPs be required to support unescrowed strong encryption for > their users' privacy and security. > > Electronic Frontiers Australia is opposed to this idea because it puts too > much of a burden on the ISP. Are you sure you have this right. I've just joined the EFA, and am concerned about this, but I can't find any such comment on the EFA site. The relevant portion of the ABA document is as follows "The ABA considers that users with particular requirements for privacy should be able to obtain advice from their service providers on the use of encryption and the availability of suitable products to render messages unreadable by unauthorised persons." This is hardly a huge burden and I would be surprised if the EFA objects to it. I looked at their press release concerning the ABA report but saw no mention of any problems with this "encryption advice" policy. Maybe I'm looking in the wrong place? Anyway, the main problem for the EFA at the moment is the "Son of CDA" legislation currently being proposed by the NSW attorney-general. Sherry

1 0

Re: Another bad idea
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 9:40, Arun Mehta wrote: [..] > As I see it, the Chinese communist government will not live to see more > than a few years (if any) of the 21st Century. We are all aware of the > devastating impact of telecommunications, TV and computers on authoritarian > regimes. E.g. in the fall of the Berlin Wall, the Easterners watching West > German TV was a significant contributory factor. Some say Hong Kong might be a contributing factor. > Satellite TV is available all over China.The government may, for a while, be > able to ban satellite dishes, but soon their size will reduce to that of a BTW, similar problems in Iran fro what I've heard. I remember hearing a blurb that VOA Chinese Programs explained how to make a setellite dish out of aluminum foil, so pick up special VOA boradcasts I'm sure... (That's rather intersting, because you can crumple it up or wrap leftovers in it immediately.) [..] > What that does is give us a window of opportunity. Hongkong has one > remaining year of guaranteed unfettered flow of information. China still > has the Internet. What can we do? I'm told by some friends that the Chinese, in large part due to the writing system, prefer FAXs over the internet. That's something to keep in mind. Hm... interesting project: a graphics program that works with PGP or PGPlib. One can import scanned images or draw onto the screen and then encrypt it for mailing. Are there any secure FAX protocols that could be worked into communications software and standard modems? > 1) Collect the e-mail addresses as Allen suggested (including those in > Hongkong), and send them a single, short message offering to teach them free > of cost how to use pgp and all the goodies at > http://www.eskimo.com/~joelm/cbsw.html Might be condescending. 'Civilized white man brings PGP to the barbarians...' They may well know about PGP, but not in a position to make that knowledge widely known. And if I were in a 'totalitarian' or restrictive country I'd be damn suspicious, maybe frightened by this ('are the secret police setting me up?' or 'will the notice if I reply?'). What if that person like the way their country is? They could inform the local authorities and set in motion a crackdown that would not have happened, perhaps. I'd leave the specifics to activists who are already familiar with the respective cultures, societies, politics, etc.... chances are they are already doing things along those lines. Otherwise, if you don't know what you're doing, you can unintentionally mess up somebody else's life, if not your own. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Singapre Sling? FWD "Singapore Unveils Internet Guidelines"
by Deranged Mutant 17 Dec '03

17 Dec '03

>From LI newsday World Briefs, 12 July, p. 21: "Singapore Unveils Internet Guidelines" Singapore unveild steps yesterday to regulate political and religious content on the Internet, and keep its cyberspace free of pornography. According to the Singapore Broadcast Authority, the guidelines, effective after July 15, require all operators to register with the SBA.

1 0

Re: I@Week on crypto export loophole 6/24/96
by jim bell 17 Dec '03

17 Dec '03

At 10:30 PM 7/11/96 -0400, Will Rodger wrote: >Bidzos' pending deal brought forth several questions: >1 - Could others try something like the DES deal with stuff under copyright >and still make money doing it? >2 - If so, was the administration aware of it? and; >3 - Who, if anyone, would be the first to try it? > >The answers were: >1 - Yes, someone else could try it. >2- The administration wouldn't comment, but had an official reply that >showed it grasped all the implications within 15 minutes of our asking. >3 - No one's stepping forward, but Ken Bass, atty. for Phil Karn and Phil >Zimmermann, among others, said he knew some folks were considering moves >along those lines, though he gave few details. > >Steptoe & Johnson cyberspace atty. Stewart Baker suggested such a move would >be "extremely aggressive advice," though "not quite insane." if I remember >correctly. Well, lawyers have to be really careful about appearing to endorse something that's on the edge of legality. Also, it's obvious that the advice given would be vastly different depending on who was doing the asking. If it were one of the two companies potentially involved, they'd probably be told that doing this would be frowned on. If it were the individual considering secretly exporting the program, he'd be told "Don't tell us! And whatever you do, don't get caught!" >A few caveats to any US citizen who finds himself trying to help such a >situation occur: > >1) The loophole can be closed by executive order with little or no notice, It's unclear if a foreign national on foreign soil can be considered within the jurisdiction of the US, especially merely for being the recipient of software whose export would have been illegal under US law. If the copy is re-mailed to him from a third country, he doesn't even know for sure if the software was ever illegally exported. And "executive orders" are already on constitutionally shaky ground anyway, as are export controls for crypto. (As I understand it, "executive order" was originally considered binding only on government employees; it was akin to an order internal to a company.) An executive order prohibiting a private-company's receipt of money for licensing fees on software which, IF EXPORTED, would require a license is straining credulity more than a bit. And moreover, there's the question of whether or not this logic extends to any licensing regardless of how remote it is. Could a US semiconductor company be barred from licensing ordinary semiconductor technology, if the foreign recipient of that license decides to use it for building an encryption chip? What if they use it to build an ordinary DRAM chip that just happens to be installed into a crypto phone, perhaps by a third party? Could the writer of a C++ compiler be denied the right to export simply because one foreign customer used a copy of that program to compile an encryption program abroad? And, they should be able to turn the royalty payment into something that achieves the same payback (say, the use of a logo signifying approval) rather than the specific use of a particular piece of software. and >2) Any citizen aiding the export of such software will of course, be brought >up on some pretty serious felony charges if caught. Foreign nationals are >doubtless subject to the same laws if on US soil while the deed gets done. "Getting away with it" probably involves no more than writing a floppy with software, putting a few stamps on it and addressing it to a foreign country, putting either no return address or a fake one on it, and then tossing it in a convient USnail box. (Taking all the usual precautions against fingerprints, DNA testing, etc.) In practice, the likelihood of getting caught if you're careful is somewhere between zero and nil. Pre-encrypting the data with the recipient's public key makes it that much more difficult for the USG to show that it's being illegally exported. >Then again, Baker said, "if one gets away with it, dozens will try it, too." >I won't be the first to try. As I see it, the most important issue is not the legal status of the one actually doing the export/mailing, but in fact the organization which is the recipient and thus, the beneficiary of this act. _THAT_ organization will be well-identified, yet will not have done anything obviously illegal. Is there any indication that Baker was trying to distinguish between the one physically mailing it, and those receiving it? Jim Bell jimbell(a)pacifier.com

1 0

Re: Another bad idea
by Arun Mehta 17 Dec '03

17 Dec '03

At 05:06 10/07/96 +0000, Deranged Mutant wrote: >On 9 Jul 96 at 18:26, E. ALLEN SMITH wrote: >[..] >> Like China, various other countries are trying to get the Internet's >> benefits (such as technical information) without its other consequences >> (extension of civil liberties into countries that want to deny them). One idea >> that I've had for preventing such problems is to look for addresses from such >> countries that are posting to technical newsgroups, to technical mailing lists, >> or that are attempting to get access to web pages on technical subjects (which >> access they will hopefully be denied, although an alternate possibility). Then >> mail information to those addresses that those countries don't want getting >> into their countries, such as on human rights abuses (or well-written >> pornography...). > >Great idea. Get some (possibly) innocent techie in an oppressive >country thrown in jail or executed. >[..] >Damn aggrevating for that user, and it could get him/her in trouble. > >On a wide-scale it could provoke responses from those countries. Damned right, and it should. Your religion teaches to "DO UNTO OTHERS AS YOU WOULD HAVE THEM DO UNTO YOU." Good advice for anyone on the Internet, and the last thing you want to teach newbies is to spam. Imagine if you were to send the cypherpunks list unsolicited porn, info about some prisoner in Texas who is getting the death penalty... you get the picture. If I were at the receiving end, I'd send back a polite but firm note asking you to desist, and if you didn't, complain to your sysop, or remailer operator. Which is what you would do in my shoes. But if you want to do something, I have a better idea (thanks for the willingness to help): As I see it, the Chinese communist government will not live to see more than a few years (if any) of the 21st Century. We are all aware of the devastating impact of telecommunications, TV and computers on authoritarian regimes. E.g. in the fall of the Berlin Wall, the Easterners watching West German TV was a significant contributory factor. Satellite TV is available all over China.The government may, for a while, be able to ban satellite dishes, but soon their size will reduce to that of a wok (might even double as one). The Internet will soon be widespread. The real crunch will come when Hongkong becomes part of China. Inevitably, other parts of the country will want to know why the special status of Hongkong cannot be extended to them. There is a chance that instead of China taking over Hongkong, the reverse might happen. In cyberspace, the students have the more powerful tanks. Can you imagine how different a massacre a la Tiananmen Square would look in a couple of years? Images captured on camcorders would be beamed back to the Chinese via satellite, all the information would flow both ways on the net, the Hongkong stock market would take a dive, ... I would suggest that tacitly or at least implicitly, the Chinese goverment has conceded that it will never try a major violent suppression of political unrest again. That, or it will decide that the Internet is a bad influence, and should be abolished. What that does is give us a window of opportunity. Hongkong has one remaining year of guaranteed unfettered flow of information. China still has the Internet. What can we do? 1) Collect the e-mail addresses as Allen suggested (including those in Hongkong), and send them a single, short message offering to teach them free of cost how to use pgp and all the goodies at http://www.eskimo.com/~joelm/cbsw.html 2) Encourage the production of simple, cheap devices such as a PGP phone that they can manufacture in Hongkong and other parts of China, which will allow secure communications. Basically, people without a computer, Internet connection or sufficient literacy should be able to use effective encryption. Cheap. 3) Find people who beam radio transmissions into China (Rupert Murdoch via his Star TV satellite is one ;-) and ask them to devote an "Internet hour" in which people can mail or phone in messages (via remailers and encryption too) to be broadcast. The whole thing can be automated, and *everybody* has access to radio. More on this subject later. Thoughts? Arun Mehta, B-69 Lajpat Nagar-I, New Delhi-24, India. Phone 6841172,6849103 amehta(a)doe.ernet.in amehta(a)giasdl01.vsnl.net.in amehta(a)cerfnet.com http://mahavir.doe.ernet.in/~pinaward/arun.htm "I do not want my house to be walled in on all sides and my windows to be stuffed. I want the cultures of all the lands to be blown about my house as freely as possible. But I refuse to be blown off my feet by any."--Gandhi

2 1

RE: Technology and Privacy
by .. 17 Dec '03

17 Dec '03

DM,sir, you always bring good stuff, but...am i really supposed to believe that a warrant or other writ will really control the process? ---------- From: Declan McCullagh[SMTP:declan@well.com] Sent: Monday, July 01, 1996 7:13 PM To: John Young Cc: cypherpunks(a)toad.com Subject: Re: Technology and Privacy > To set the record straight, military thermal imaging is > used to support civilian law enforcement only after other > probable cause for a search warrant, such as power bills, > observation of boarded-up windows, vents on the roof to > draw away heat and buys by confidential informants, are > documented. The military is then called in, using thermal

1 0

Digital Watermarks for copy protection in recent Billboard magaz
by Deranged Mutant 17 Dec '03

17 Dec '03

Paged through a recent (June or July 13) edition of Billboard magazine yesterday. There was an article about the music industry, the internet, and copyright issues. Didn't have a chance to read in thoroughly, but it mentioned using digital watermarks which contained info on to who (CC number) and when the material was sold... the watermarks allgedly could survive if a CD was taped, copied several times and redigitized. It's rather interesting for several reasons... imagine if every CD you owned was tagged with a link to your identity. So imagine getting a used CD or from a garage sale... after several years a pirated edition is floating around the internet... The anti-piracy scheme is only useful for direct sale to a customer though. If you buy music anonymously, how is it traced? This only works for pirating on-demand purchases. Other issues: what if an eavesdropper steals the music or video? It's tagged with your ID. If he spreads pirated material, you get in trouble even though it's not nec. your fault (if no secure communications are available, anyway). If it uses a credit-card number as (part of) an ID, that's pretty bad. Someone can sniff for CC numbers if they know how it's stored. The system will have to rely on proprietary tech and security through obscurity. Even know how watermarks are stored without understanding the math, one must be able to somehow garble the sound without distorting it, but which renders the watermark useless. That a watermark can survive when the music is converted to analog and then redigitized is interesting... (if it's saved as inaudible tones, what's to prevent one from blurting them out with noise in those frequencies?) Guess I'll have to hunt down that issue and post useful excerpts from it...in terms of far use, of course. (Or perhaps an alt-vista search...) Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Minitel "saved" by hackers?
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 5:51, Daniel Salber wrote: [..] > As Minow pointed out, this is not the only case of "hijacking". The > telephone was first intended as a way to listen to remote concerts. Then > users found out they could use it for one-to-one conversations. This is innacurate. No, methinks it's wrong. From every history of telephones I have read and heard, it was never that way. The original conception was of using the telephone for broadcasting. It's implementation in most countries was for point-to-point communication... it wasn't a matter of the users 'found they could use it' (at least not in the US). Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Chancellor Group (symbol = CHAG) (spam)
by David Lesher 17 Dec '03

17 Dec '03

|Chancellor Group, Inc. (symbol CHAG) just reported big quarterly earnings. I hear tell "enforcement(a)sec.gov" is interested in hearing of such.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Minitel "saved" by hackers?
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 14:07, Daniel Salber wrote: [..] > Well, sorry if it is. That's what I read in a book about the early history > of telephone. I don't have the reference handy right now, though. Understandable. > BUT: how do you explain that from the original conception (using the > telephone for broadcasting), the telephone came to be a one-to-one > communication tool ? Even if the implementation allowed it, someone had to > think of it, right ? Bell thought of the idea orig. as a broadcaster. Then somehow when it was set up he or someone else in AT&T did that. If I recall (no refs handy) it had to do with the telegraph being (sort of) point-to-point... Bell used to tour the vaudville circuit showing off the telephone. I think the idea emerged during that time... during such shows of tech (common at the time) there was a Q&A from the audience. Rob > > Thanks for the clarification anyway. > > Daniel > > > > --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Word lists for passphrases
by Remo Pini 17 Dec '03

17 Dec '03

At 01:18 AM 7/6/96 -0500, you wrote: >At 12:09 AM 7/6/96 -0500, snow(a)smoke.suba.com wrote: >>On Fri, 5 Jul 1996, Erle Greer wrote: >> >>> Word-List Builder (this is not an ad) >Unix, you can do, but the recursive subdirs aren't a prob for me. A final dream >would be to convert it to VB4, use MS's WWW custom control, and unleash it as a >spider. If you send me the source, I'll give it a shot (port to vb4 with x-controls) ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Re: Net and Terrorism.
by Remo Pini 17 Dec '03

17 Dec '03

>While the guys fighting the Israelis in Lebanon are more or >less honorable men who fight according to the laws of war, >the Islamic fundamentalists in Algeria are simply vicious subhuman >monsters who deserve to die, each and every one, and their pals in >Egypt and the Sudan are not much better. I hope you're not serious. In case you are: It seems to be typical of American beliefs that Israelis are good, and everybody else "down there" is bad. On the other hand, Israel wouldn't stand a chance if US weren't having them as a pet. They are getting more and more fundamentalistic (yes, there are zionistic fundamentalists, big surprise) and they are not one bit better than anyone around. It seems to me, that a few hothead terrorists create the image of all arabic people in western heads. Consider this: Islam is a lot younger then Christianity. If the Islamic people act like the Christian people we will have a huge problem. A few hundred years ago everybody who didn't agree with the pope was killed (Earth is flat after all). Now, according to my timekeeping, Islam should reach that state around 2100. So there is plenty of time for them to get nastier. (I don't think they will, because Islam is a bit more tolerant than christianity ever was). ps: I'm not Islamic, nor will I ever be, but I don't like fundamentalists, and your views, should they be serious, sound *VERY* fundamentalist to me. ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Re: Need PGP-awareness in common utilities
by Remo Pini 17 Dec '03

17 Dec '03

At 02:30 AM 7/7/96 +0200, you wrote: > >Which is where the small payments to ratings producers from >ratings consumers comes in. Again this is just the >quantification of a phenomena that we all take for granted. >(Namely, that people who produce quality ratings are producing a >value and trading/contributing it to others.) It sure sounds like I'll have to pay, so someone decides for me, wether some piece of info is important to me. Now, if that isn't the first step to censorship! That kind of reminds me of an insurance company where I can call a toll-intensive number to talk to a salesman who tries to sell my something I don't really need. ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

2 1

Re: Need PGP-awareness in common utilities
by Remo Pini 17 Dec '03

17 Dec '03

At 02:30 AM 7/7/96 +0200, you wrote: > >Which is where the small payments to ratings producers from >ratings consumers comes in. Again this is just the >quantification of a phenomena that we all take for granted. >(Namely, that people who produce quality ratings are producing a >value and trading/contributing it to others.) It sure sounds like I'll have to pay, so someone decides for me, wether some piece of info is important to me. Now, if that isn't the first step to censorship! That kind of reminds me of an insurance company where I can call a toll-intensive number to talk to a salesman who tries to sell my something I don't really need. ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Re: Word lists for passphrases
by Remo Pini 17 Dec '03

17 Dec '03

At 03:51 PM 7/6/96 -0400, you wrote: > > AwakenToMe(a)aol.com writes: > > > I have a util that will create a word list starting from > > > aaaaaaaaaaa on up to anythingggggggg basically you could do every > > > combination. Let me know if ya want it. > > > > That would really be of great use for doing wordlist crack runs. It > > must have taken you a long time to write -- generous of you to offer > > it. I don't think any decent programmer has never tried such an aproach to crack for example PKZIP archives (the one on CD-ROMs, where you have to pay to get the passwords). I certainly did back in 1991. I don't want to put down the usefullness of such a program, but since probably more than 50% of all passwords are vulnerable to dictionary attacks, such a utility has not too much value. (have you ever tried all combinations from "aaaaaa" to "zzzzzz" (there are around 2'176'782'336 <36^6> if you concider all umlauts like the German auml;, uuml;, ouml;, ...). On the other hand, there won't be much more than 10'000 6-letter words in any dictionary. So it seems, a wordlist generator and a wordlist using cracker works a lot better (and is almost as trivial to do - if you keep aside nice features) ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Re: DoD and IRS tax systems (fwd)
by Jeff Barber 17 Dec '03

17 Dec '03

I'm taking the liberty of forwarding this excellent RISKS posting. There are a couple of other related ones in the latest RISKS digest -- see comp.risks. -- Jeff oo -----------------------------cut /\ here------------------------------ Date: Thu, 27 Jun 1996 14:12:51 -0400 From: Carl Minie <CarlM(a)qsc1po.qstr.com> Subject: Re: DoD and IRS tax systems (Wexelblat, RISKS-18.23) As an ex-liberal and small-l libertarian, I submit that the true danger to privacy in the Republic is the practice of gathering detailed financial information from all (law-abiding) Americans under threat of asset confiscation and jail terms, and then giving tens of thousands of government employees access to this information in the course of their employment. I further submit that passing a few wimpy privacy laws and expecting them to prevent this information from being used for personal and political purposes is magical thinking. It doesn't take a genius to surmise that IRS data is used regularly for illegal purposes by everyone from the sitting President (of either party) down to grudge-bearing neighbors and ex-spouses. I believe the IRS attempted to assess the depth of the problem in their Southeastern Region (where my mother worked) at one time, and stopped at well over 300 violations. You or I would have ended up at Leavenworth, but all but a few of the most egregious violators were simply warned not to do it again. You can take voluntary action to keep yourself out of the TRW/ Equifax/TransUnion food chain and off junk mail lists...but Federal law requires you to remain in the IRS's gunsights for your entire productive lifespan. Neither party supports privacy when it means privacy from the government; it is a Democratic president who is enthusiastically supporting the FBI and NSA in their efforts to prevent American citizens from using encryption that they can't break, and to require that every phone, fax, and modem in the United States contain a chip that would allow government agencies to tap in at will. Do I need to add here that the very concept of economic privacy is anathema to those who believe that a portion of everything you earn, keep, spend, or invest belongs to them, and that not handing over the fraction they demand is stealing from them? > Is the Department of Star Wars and the $700 toilet seat > really so excellent a contracting agency that they are the > clear choice to handle IRS business? I don't expect the IRS to be abolished anytime soon...but letting the DoD design its computer systems would be an acceptable second choice. The DoD may be expensive, but they're not very good. My fondest hope is that with a spanking new Government Issue computer system, the IRS that the GSA says can't figure out where 60% of its own budget goes won't be able to find 60% of mine. I don't like paying for $700 toilet seats (or $320,000 spotted owls) any more than you do. The solution which provides the smallest RISK to privacy is not to gather the data in the first place. If tax compliance is truly voluntary, then the IRS should trust that we are reading 21,000 pages of IRS rules and case law and sending in the correct amount. Long Pig ------------------------------

1 0

Re: CCC Crypto Lock
by Remo Pini 17 Dec '03

17 Dec '03

At 04:10 AM 7/6/96 -0700, you wrote: >MicroPatent, 4 July 96 > > >Systems and methods for protecting software from >unlicensed copying and use (Assignee -- Convex Computer >Corporation) > >... > >Assignee: Convex Computer Corporation > >Patent Number: 5530752 > >Issue Date: 1996 06 25 > >Inventor(s): Rubin, Robert J. > >If you would like to purchase a copy of this patent, >please call MicroPatent at 800-984-9800. > >Copyright 1996, MicroPatent I think there are already such algorithms in use in Europe. (Why buy the patent, if it's already around?) ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Reasonable validation of a software package
by Anonymous User 17 Dec '03

17 Dec '03

Fellow cpunks: I am working on various software packages for UNIX and Windows and since this is commercial work and prior NDA's are involved, I can't include the source code for absolute validation. What would assure one that a package has not been tampered with from the company to the user? (Currently, I am using PKZIP's rather anemic AV protection, as well as signing the archive with my PGP key. I am wondering if there are any other steps I need to take to assure that a package came from me, and wasn't damaged/altered/tampered with in transit.) Thanks in advance.

4 3

Can't block caller ID in Massachusetts?
by David Mazieres 17 Dec '03

17 Dec '03

My last phone bill said that Nynex is now giving out people's names in addidtion to their phone numbers over caller-id. I therefore called Nynex and told them to block caller-id on my phone line. They said no problem, but... They said nothing I can do will block it when I call 800 numbers. "The people with 800 numbers have special software, and there is nothing you can do to block your identity when calling them. Not even *67." Wow. Maybe I'm not paranoid enough, but I never expected this. I can never again call an 800 number anonymously to get information about something unless I go out to a pay phone. What an incredible inconvenience, and how truly depressing. I know 800 number owners probably used to be able to get lists of calling phone numbers on their phone bills, but this is less disturbing as it would take significant effort to match up the lists after the fact. I just want to be able to call up companies and say, for instance, "If I buy your product, can it do X?" as opposed to, for instance, "I'm stuck with your product, can it do X?". People are often more helpful in the former case. Now, though, they'll know exactly who I am before they even say hello. David

19 31

Re: Destabilizing China's Government with Strong Crypto
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 0:04, Timothy C. May wrote: [..] > And this is yet another example of the negative effects of the U.S. > restrictions on crypto export: where widespread crypto tools might be used > to destabilize repressive governments, the lack of these tools integrated > into common applications makes it harder for freedom-fighters in China, > Burma, Iran, France, etc., to use them. The US has a sad history of supporting its own 'friendly dictators' though. Makes it hard to support flow of decentralizing tech to destabalize countries like Iraq but keep countries like El Salvador in the fold. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Arun Mehta 17 Dec '03

17 Dec '03

At 23:38 10/07/96 -0700, Will Price wrote: >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download Sorry if this has been discussed before (please point me in the right direction if that is the case), but VSNL, my government-owned ISP (which also has a monopoly on all international traffic) made me sign that I will not use my Internet connection for voice traffic. Is there any way they could find out if I were using PGPfone, or rather, could I prevent them from finding out? Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://mahavir.doe.ernet.in/~pinaward/arun.htm The protestors of Tiananmen Square will be back. Next time, the battle will be fought in cyberspace, where the students have the more powerful tanks...

1 0

Re: Minitel "saved" by hackers?
by Arun Mehta 17 Dec '03

17 Dec '03

At 05:51 12/07/96 +0200, Daniel Salber wrote: >At 2:37 AM +0500 on 7/11/96, Arun Mehta wrote: > >> I'd love to find out exactly what happened. > >"Hacking" is inaccurate: the users >were not necessarily computer-litterate but just found another way to use >the help feature of the server. Rheingold's Virtual Community has a pretty >accurate account of the facts (see chapter 8, also online as ><http://www.well.com/user/hlr/vcbook/vcbook8.html>). Thank you for the correction. I checked Andre Lemos' original, and he uses both terms. To quote, "Through thie detournement -- literally, a 'hijacking' was born the messagerie. By hacking and then making available the bulletin board software, a counter-current to the French technocratic approach produced a usage of the system which was never a planned objective." Slightly inaccurate. >In a previous post, you said: > >> So, shocked by this, what does the government do? Being unable to >> distinguish between different kinds of messageries, the government put a 30% >> tax in 1989 on all, and raised it to 50% in 1991! No wonder the Internet is >> gaining rapid popularity in France. > >I think this is wrong. These taxes were only for sex messageries and the >30% tax didn't actually stop most of them from making money. I think the >50% tax wasn't actually enforced and the tax rate remains at 30% (see >http://www.univ-paris8.fr/~babelweb/voltaire/v_no23.htm -- this is in >french, sorry). > >You must realize that the government has no interest in stopping all >messageries: France Telecom is (at least for the coming few months) a >government agency and makes a lot of money from the messageries. Once again going back to the original: "In 1986 the first roadside billboards for the messaggeries rose appeared (picturing, for example, a robust male or a woman with slogan '3515 BUSTY', the online address of a Mintel rose chat service). French traditionalists were outraged and Charles Pasqua, acting Minister of the Interior, attacked the gay messagerie Gay Pied. Worse, the French state gains 36% of the total charges paid. Taxes on all the messagerie services became the order of the day. France Telecom has no way of distinguishing between the messagerie rose and any other board or messagerie. In 1989 the government tax was 30% and in 1991 a 50% tax was imposed in the hope of eliminating all messageries." That's seriously innacurate, it seems to me: but I would appreciate some confirmation before I attack the guy in my review. Will check out the urls you suggested, problem is during the monsoons the phone connection to my ISP keeps dropping. > >The Minitel is no more "centralized and bureaucratic" than the Internet was >only a while ago (ie, when NSF was in charge of most of the core >infrastructure). >The Minitel may look centralized and bureaucratic because anyone who wishes >to open a server has to go through France Telecom (which delivers unique >names like Internic). Has FT ever denied permission (to hard-core sex servers or neo-Nazis, for example)? That, the tax they charge and the prohibition of encryption make it too centralized for my taste. And will ultimately kill it. The longer the French take to migrate to the Internet, the worse for them (IMHO). >There were even some experiments of a european Minitel system linking >several european videotex services a few years ago. I think they fell short >because the videotex technology has been so quickly outdated. Why not link up videotex in every country with the Internet? Let people surf the Web using their TVs and remotes (and maybe a keyboard with an infra-red link). That's what I'm trying to tell our utter failure of a videotex service in India. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://mahavir.doe.ernet.in/~pinaward/arun.htm The protestors of Tiananmen Square will be back. Next time, the battle will be fought in cyberspace, where the students have the more powerful tanks...

2 1

Re: A case for 2560 bit keys
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 11 Jul 1996, Chris Adams wrote: > check your setup. I used to run a 386-20 (5MB RAM) and it took about 3 > seconds for a 1024 bit key. Given it didn't even have a copro (not sure > when/if PGP uses one) and that it was off of a Stackered drive, I'd > expect you to have much better times. That's consistent with the timings I've been getting. It should take about 9 seconds to decrypt an arbitrary message with a 2048-bit key with the setup you describe. Of course, I usually use X, so that probably does throw off the timings a bit. - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xe3bf2169 http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348 "Freedom is the freedom to say that two plus two make four. If that is granted, all else follows." --George Orwell, _1984_ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMeXTXLZc+sv5siulAQEnAAP8Dbr/WWFKDhD0CRPePVtF2o7386Na89Xd GUC7D2x9hFAcMS+YynQnLpNULHWY4e/ziY3GkpFVydSYrQfIZ7Xj8P7RPgFUmWnz 4Zo5zTIJif1jigWEmMqAr7nMBtDCFTJrB0ogD7ZlGcALHxjUKW7j20QtHyIg5/sr nS7OAI2gZgc= =/LMb -----END PGP SIGNATURE-----

1 0

Re: Another bad idea
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:40 AM 7/12/96 +0500, Arun Mehta wrote: >What that does is give us a window of opportunity. Hongkong has one >remaining year of guaranteed unfettered flow of information. China still >has the Internet. What can we do? {good ideas snipped] Another thing to do is get more web sites containing information of interest to people living in such regimes on SSL enabled web servers. If the web redirectors can be set to redirect SSL traffic undisturbed, then there is another level of encryption for the chinese to have to hack through to find "dissidents". And if someone could sneak them a few copies (hint... hint...) of the 128 bit version, it would make their lives even more difficult. I see a point where the repressive regimes of the world are going to be trying to prevent their people from getting to information that is against the regime, but getting run over by the shear volume of the information. It may be possible to filter for such things, but in doing so, you destroy any usefulness the network has in the first place. Of course this is all a moot point, because it has been proven by computer projections that all informative net traffic will be buried under advertisements by the year 2000 anyways. I expect some legislative body to try and make money fast on the net by selling ad space on IP packet headers. ("This packet sponsored by Preparation H!") I think I will go drink more coffee now... --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

[NOISE] Ritalinpunks
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just got the latest issue of Scientific American, and interestingly enough, there is an article on page 12 that deals with the issue of overdiagnosing ADD. It's pretty interesting reading for anyone that may have an opinion on the subject (which is definitely a high number of cpunks). - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xe3bf2169 http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348 "Freedom is the freedom to say that two plus two make four. If that is granted, all else follows." --George Orwell, _1984_ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMeamMLZc+sv5siulAQFBYAP/UJkevlONxJywp0MsNQ0c9UwfKb7cZQgs 8F0BfVSAn31zatJ9lchNVo8ui57ojmbbdBBPGKtr2EqPgkheFGbVwn26fcZmfJ1b 8h4hq715hi+6bokrdrtIgXTGDT/lWt7FTQ01nB/VLgClB8h/X2gSQSCeXIJename Nh+liBowdKY= =kfcI -----END PGP SIGNATURE-----

1 0

Needed: Bay Area "Cracker" for TV Show
by abacard＠well.com 17 Dec '03

17 Dec '03

July 11th, a San Francisco television reporter called me. He wants to broadcast a story about "crackers". He'd like someone who can describe, on-the-air, examples of what crackers can do. In particular, he'd like someone who can provide a demonstration. Do you want to be on Bay Area TV? If not, whom in the Bay Area do you recommend? This could be a chance for you to publicize your favorite security flaws in voice box systems, or whatever. The reporter wants to run this story during the week of July 15th. If interested, please contact me as soon as possible. The reporter uses telephones, not e-mail, so I'll need your phone number. Thanks. See you in the future, Andre Bacard ====================================================================== abacard(a)well.com Bacard wrote "The Computer Privacy Stanford, California Handbook" [Intro by Mitchell Kapor]. "Playboy" Interview (See Below) Published by Peachpit Press, (800) http://www.well.com/user/abacard 283-9444, ISBN # 1-56609-171-3. =======================================================================

3 2

Wiretaps
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Wiretaps Up Sharply in Clinton Administration WASHINGTON (Reuter) - The Clinton administration has sharply increased use of federal telephone wiretaps and other electronic surveillance in the United States since taking office, The Washington Post reported Sunday. ... Civil rights and privacy advocates were upset with the trend but unable to do much about it ... Frederick Ness, who runs the Justice Department office that approves applications for court-ordered wiretaps, told the Post: ``We are up 30 to 40 percent this year.'' In 1992, the last year of the Bush administration, there were 340 federal court orders permitting electronic surveillance in criminal cases, the newspaper said. Quoting unidentified officials, the report said that number had risen to 672 last year and almost certainly would exceed 700 in 1996. The figures did not include ``national security'' wiretap orders, obtained under intelligence legislation, which also had been rising dramatically, the Post said. Preparing for expected continued growth in surveillance of domestic criminals, the Justice Department was buying additional high-tech equipment, developing new eavesdropping techniques and adding support personnel, the report said.

1 0

Quantum Communications
by Derek Bell 17 Dec '03

17 Dec '03

By mistake, I sent a message in reply to a list member and forgot to include the list. I also misremembered *Austria* as Australia when I sent my original question to the list. The item I read was a news item on the bottom of p.16, July 6 Issue of _New Scientist_, enititled "It's good to talk in quantum trits". The researchers are Klaus Mattle, Harald Weinfurter and Anton Zeilinger of the University of Innsbruck and Paul Quiat of Los Alamos National Laboratory in New Mexico. Weinfurter said "It's the first experiment which demonstrates a communications system using pure quantum states". I don't know enough QM to tell if it has the same immunity to eavesdropping as the scheme studied by British Telecom. I'll send more details tomorrow, as I have to leave now. Derek

1 0

Re: Can't block caller ID in Massachusetts?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:54 AM 7/12/96 -0700, Eric Murray wrote: >When I called the Pac Bell customer service droids to get my "complete" >blocking I asked them why they won't block CID to 800 numbers. >Their answer: "that's just the way it works". Since they can't bill you for LD numbers you call without reporting the calls on your bill, they can't charge 800 (or pay 900) number owners without reporting which numbers called them. I suppose you could just trust them (like the UK) and not demand a list of numbers you called and then the 800/900 businesses might do the same. Likely? DCF

1 0

Re: I@Week on crypto export loophole 6/24/96
by jim bell 17 Dec '03

17 Dec '03

At 03:05 PM 7/12/96 -0400, Will Rodger wrote: >>As I see it, the most important issue is not the legal status of the one >>actually doing the export/mailing, but in fact the organization which is the >>recipient and thus, the beneficiary of this act. _THAT_ organization will >>be well-identified, yet will not have done anything obviously illegal. Is >>there any indication that Baker was trying to distinguish between the one >>physically mailing it, and those receiving it? > >Yup. He was speaking only of the US company. Any indication about what the USG might be able to do, SPECIFICALLY, legally or in retaliation? Jim Bell jimbell(a)pacifier.com

1 0