December 2003 - cypherpunks-legacy

EzStego in Java!: Now Disappearing At A Site Near You
by romana＠glamazon.com 17 Dec '03

17 Dec '03

EzStego, my tool for "steganography made easy", now has its own web site at http://www.fqa.com/ezstego/ EzStego is currently alpha software. Use it at your own risk. It is a reimplementation in Java, with much improvement, of my notorious shareware product, Stego. EzStego is also shareware. I have made the source code available for peer review and verification. EzStego and EzSteggy are (C) Romana Machado 1996. All rights reserved. Romana Machado romana(a)fqa.com http://www.fqa.com/romana/ http://www.glamazon.com/

1 0

Re: White House crypto proposal -- too little, too late
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

"if you become a dangerous criminal," <> "innocent until proven guilty" At 10:39 AM 10/2/96 -0700, Declan McCullagh wrote: >[But how does one undo the dangerous criminals without violating the >privacy rights of everyone else? --Declan] >---------- Forwarded message ---------- >Date: Wed, 2 Oct 1996 10:30:43 -0700 (PDT) >From: Joe Shea <joeshea(a)netcom.com> >To: Declan McCullagh <declan(a)well.com> >Subject: Re: White House crypto proposal -- too little, too late > > > If you become a dangerous criminal, Declan, I think law >enforcement does have the right to use key escrow to undo you. That has >nothing to do with spying. You need to be a little more selective about >your language, and to make distinctions a little more rationally than you >do. > >Best, > >Joe Shea >Editor-in-Chief >The American Reporter >joeshea(a)netcom.com >http://www.newshare.com:9999 > > >On Wed, 2 Oct 1996, Declan McCullagh wrote: > >> BTW, Joe, I'm still waiting for your response to my comments on why >> your endorsement of key escrow (GAK) is braindead. Or do you still >> think that the Feds should have the right to spy on my conversations, >> just like you thought that "porn isn't speech?" >> >> -Declan >> >> >> On Wed, 2 Oct 1996, Joe Shea wrote: >> >> > Date: Wed, 2 Oct 1996 09:47:59 -0700 (PDT) >> > From: Joe Shea <joeshea(a)netcom.com> >> > To: Declan McCullagh <declan(a)well.com> >> > Cc: cypherpunks(a)toad.com >> > Subject: Re: White House crypto proposal -- too little, too late >> > >> > >> > >> > Declan, how does your list work? Do you only publish comments >> > that agree with you? I didn't see my first two, and this one only came >> > with your response. Is this your version of freedom of the press, or what? >> > >> > Joe Shea >> > Editor-in-Chief >> > The American Reporter >> > joeshea(a)netcom.com >> > http://www.newshare.com:9999 >> > >> > >> > On Wed, 2 Oct 1996, Declan McCullagh wrote: >> > >> > > >> > > >> > > ---------- Forwarded message ---------- >> > > Date: Tue, 1 Oct 1996 20:19:16 -0700 (PDT) >> > > From: Declan McCullagh <declan(a)well.com> >> > > To: fight-censorship(a)vorlon.mit.edu >> > > Cc: joeshea(a)netcom.com >> > > Subject: Re: White House crypto proposal -- too little, too late >> > > >> > > [Joe, this may be yet another area where we disagree. It represents a >> > > power grab by law enforcement; the infrastructure is prone to failure >> > > and can be compromised; it's more government meddling and coercion and >> > > more restrictions on free speech; the Fed bureaucrats controlling this >> > > are vulnerable to special-interest lobbying; the Constitution gives >> > > the Federal government no right to impose such restrictions; the FBI >> > > has demonstrated that we can't trust the Feds with our most personal >> > > information; it violates an absolute right to privacy; and it's >> > > technically impractical for a good number of applications. --Declan] >> > > >> > > >> > > ---------- Forwarded message ---------- >> > > Date: Tue, 1 Oct 1996 15:57:51 -0700 (PDT) >> > > From: Joe Shea <joeshea(a)netcom.com> >> > > To: Declan McCullagh <declan(a)well.com> >> > > Cc: fight-censorship >> > > Subject: Re: FC: White House crypto proposal -- too little, too late >> > > >> > > >> > > Declan's most recent piece makes much more sense than the earlier >> > > one. He is quite correct in emphasizing the future vulnerability of the >> > > encryption logarithms rather than centering on whether or not terrorists >> > > might use them. By making them impossible to crack without the key, and >> > > permitting the key to be available to appropriate law enforcement >> > > authorities when absolutely necessary, everyone's real needs are >> > > satisfied, I think. I enjoyed this report a lot. >> > > >> > > Best, >> > > >> > > Joe Shea >> > > Editor-in-Chief >> > > The American Reporter >> > > joeshea(a)netcom.com >> > > http://www.newshare.com:9999 >> > > >> > > >> > > >> > > >> > > >> > >> >> > > > _______________________ Regards, You cannot depend on your eyes when your imagination is out of focus. -Mark Twain Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: FUCK!!!!!!;-)
by Will Rodger 17 Dec '03

17 Dec '03

Someone who won't put his name to things he writes wrote: At 04:05 AM 10/3/96 -0400, Anonymous wrote: >+ --- begin forwarded text >+ >+ "Keys" are strings of computer code that lock and unlock data. Key recovery >+ is an approach that permits the recovery of lost or damaged keys without the >+ need to store or "escrow" them with a third party. This approach could also >+ meet the needs of law enforcement to act under the authority of a court order >+ without risking the confidentiality of business data. > >Just wondering how much of a problem "damaged keys" really are in >practice. Is this something specific to Microsoft filesystems or >really cheap tape drives? I've never seen that problem under Unix, >and something like a private RSA key doesn't change very often, so you >would expect to have encrypted copies of it on many backup tapes. > >Or maybe this journalist, like most, doesn't know what the fuck he's >talking about? > To which this card-carrying member of the media replies: Companies cited in the PRESS RELEASE - that means public relations product, not journalism product - were involved in signing off on what went into the release. By definition, no member of the press was involved in producing this document It seems directing questions to the companies would be a good idea. Will Rodger Washington Bureau Chief Interactive Week.

3 2

Net-freedom roundup: Algiers, Malaysia, Burma, Hong Kong...
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 3 Oct 1996 05:59:08 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Net-freedom roundup: Algiers, Malaysia, Burma, Hong Kong... [Update on situations in Algiers, Malaysia, Burma, Singapore, European Union, U.K., Hong Kong, China, and Germany. More at http://www.eff.org/~declan/global/ --Declan] ******** SUSPENDED ALGERIAN DAILY OFFERED INTERNET PAGE Copyright 1996 Reuter Information Service PARIS (Sep 30, 1996 1:24 p.m. EDT) - A press freedom watchdog on Monday offered the suspended Algerian daily La Tribune a page on its Internet site to give it an airing during the six-month ban. "Thanks to this initiative, these journalists, banned from writing by the Algerian authorities, will be able to practice their trade again," the Paris-based Reporters without Borders (RsF) said. An Algiers court suspended La Tribune for six months on September 3 over a cartoon mocking the Algerian flag. [...] Fifty-seven journalists have been murdered by suspected rebels. RsF said authorities had suspended or seized newspapers on 55 occasions and 23 journalists had been held for more than 48 hours since the conflict broke out over the 1992 cancellation of a general election fundamentalists were poised to win. ******** UNITED NATIONS, Sept 27 (Reuter) - Malaysia's prime minister accused the West on Friday of spreading smut and violence, particularly on the Internet. In his speech to the U.N. General Assembly, Mahathir bin Mohamad said that although the information age facilitated worldwide knowledge, it also demeaned moral values. ``Smut and violence gratuitously distributed by criminals in the North is no less polluting than carbon dioxide emissions nor less dangerous than drug trafficking.'' In a reference to the United States he said if one great power could apply its laws to citizens of another country for drug trafficking ``why cannot countries with different moral codes extradite the traffickers of pornography for legal action?'' ``Before the whole world sinks deeper into moral decay, the international community should act. Abuse of the ubiquitous Internet system must be stopped,'' he said. Politically, he said the monopoly of the West's electronic media should be broken on so-called world news networks. ``Not only are distorted pictures of our countries being broadcast but our own capacity to understand what is happening is being undermined,'' he said. [...] ``It is boring almost. And yet nothing much has been done which could bring about amelioration of this sad state of affairs, `` he said. ********* RANGOON, BURMA, 1996 SEP 27 (NB) -- Burma has made owning, using, importing or borrowing a modem or fax machine without government permission a crime, punishable by up to 15 years in jail, according to a report by United Press International. Burma's military government has imposed what's called "The Computer Science Development Law" which empowers the Ministry of Communications, Posts and Telegraphs to specify what exactly can be restricted, UPI reports. UPI quotes the government-run newspaper New Light of Myanmar as saying the same punishment is prescribed for anyone who sets up a link with a computer network without the prior permission of the ministry, or who uses computer network and information technology "for undermining state security, law and order, national unity, national economy and national culture, or who obtains or transmits state secrets." UPI reports that in July a diplomat, Leo Nichols, died in prison after he was sentenced to a lengthy term for illegal possession of fax machines. *********** SINGAPORE, Sept. 28 (UPI) -- Internet users in Singapore are complaining that a new system to police the massive global communications network is slowing down access to websites rather than speeding it up as promised by government officials, news reports said Saturday. Earlier this month, special computers called proxy servers began censoring all requests for websites from Singapore Internet users, blocking access to those deemed ``objectionable'' by the government. The proxy servers, which began regulating cyperspace Sept. 15, delay access to the Internet because they first have to check a list of banned websites before retrieving requested homepages, the Straits Times reported. ``I've found that it can take twice as long to access the sites I commonly access,'' said Teo Mei Chin, a 22-year-old undergraduate. Users pointed out that slower access translated into longer on-line time and higher telephone bills. Although many Internet subscribers in the tightly-controlled city- state anticipated such delays under the new system, the Singapore Broadcasting Authority assured users access to certain websites would actually be quicker since the proxy servers are able to store frequently requested homepages. But Internet users say the filter computers also are dishing up outdated homepages. Walter Wu, who uses the Internet for up-to-date stock market and business data, said some financial websites he requested were at least a day old. [...] *********** LONDON, ENGLAND, 1996 SEP 27 (NB) -- By Steve Gold. The British government has added its support to plans to handle the problem of child pornography on the Internet. The proposals, which have been drawn up by the Home Office with assistance from Peter Dawe, the founder of Pipex, the UK's largest Internet service provider (ISP), are known as Safety Net. According to Dawe, recent discussions in the industry, culminating in a letter from the police to the various ISPs in the UK, has meant there is considerable pressure on the ISP industry to exercise a degree of self-regulation. "Public opinion said that something had to be done. I came to the conclusion that it was going to be impossible to establish industry- wide consensus on how to tackle this issue," he said, adding that the idea of Safety Net is gathering support in the UK ISP community. According to Dawe, Safety Net has the backing of the Internet Service Provider's Association (ISPA), as well as the London Internet Exchange, two groups which claim to represent most of the ISPs currently operating in the UK. [...] Quite how the ISPs will tackle the problem, such as blocking access to those Web pages, remains to be seen, but Dawes claims that the ISPs will have no excuse in law of being unaware of offending Web pages and Usenet newsgroups. [...] ********** BRUSSELS (Reuter) - European Union telecommunications ministers, reacting to a child-sex scandal in Belgium, pledged Friday to consider ways to keep illegal material that could harm children off the Internet. Belgian Telecommunications Minister Elio Di Rupo announced that his government planned to implement new measures requiring Internet access providers to monitor and report material featuring sexual abuse or exploitation of children. He asked his colleagues to join forces with him. ``Today a big legal vacuum exists, for legislation is falling behind technological evolution,'' he said, according to a speaking note that was distributed to reporters. ``There is a big risk that it will create an enormous market of children fed on by criminals.'' The ministers agreed to expand a working party that has already been set up to look at the question of illegal material on the Internet and asked it to come up with concrete proposals before they meet again in November. The group will include representatives of the 15 EU telecoms ministries and of companies that provide access to online services or prepare the content, a statement adopted by the ministers said. The accord follows an agreement by EU justice ministers in Dublin Thursday to extend the scope of the EU police agency Europol so it can fight the sex trade in women and children. The moves come in the wake of the discovery in Belgium of a paedophile network and the murders of four young girls. But some of the telecoms ministers, including those from Britain and Sweden, warned that the EU could not wander into censorship and had to focus on fighting truly illegal material. [...] ******** CENTRAL, HONG KONG, 1996 SEP 26 (NB) -- By Eric Lai. A Hong Kong Internet enthusiast is claiming that his Web site, featuring sexually suggestive photos of himself, was forcibly removed by his Internet service provider (ISP) two days ago in a seeming act of premature censorship. Donald Tu, 32, is a former radio and TV presenter and aspiring bodybuilder and model. In May, he put up his Web site, http://members/hknet.com/~hkstud/ , which featured photos of himself topless, often wearing nothing more than wet, slightly transparent briefs, posing in a studio and outdoors at scenic locations around Hong Kong. Tu, who was interviewed on last night's premiere of the Dataphile On-Air radio show, says his site has received thousands of "hits" coupled with encouraging e-mail, especially after a local Chinese language newspaper on September 17 reviewed his Web site. But a single complaint outweighs those thousands of positive comments, at least according to his Web host, HKNet. After receiving a single complaint from a member of the public, HKNet wrote to Tu on Tuesday that "the government may take action against the site because of its content and 'exposure,' based on the letter of the law governing obscene and indecent materials, and recent experiences in its enforcement. Therefore, we have made the decision to bar access to the questionable materials for the time being." But ISPs which censor and regulate content are not currently being compelled by the government, according to a spokesperson at the Broadcasting, Culture, and Sport Branch. The Branch has been devising Internet content regulations all summer which should be announced soon. [...] ********* BEIJING, Sept 27 (Reuter) - China's Communist Party chief Jiang Zemin moved on Friday to tighten the communists' grip on the state media and to strengthen his position with a blaze of publicity before a party plenum. He used a visit to the Beijing offices of the People's Daily, the party mouthpiece, to deliver a hardline speech on the importance of maintaining communist control of all media, the newspaper reported, splashing the news and three photographs of Jiang across its front page. Diplomats said the speech by Jiang was aimed at bringing back into line Chinese writers and more daring media organisations that have tried to push the limits of propaganda [...] ``Historical experience has proved repeatedly that whether guidance of news is right or wrong has to do with the party growing strong ... the solidarity of the people and the prosperity of the nation,'' Jiang said. [...] ******** HotWired 27-29 Sept 96 The Netizen by Wendy Grossman London, 26 September Last Monday, a unified front of British police, government, and representatives of leading ISPs announced proposals for cracking down on illegal material available on the UK's portion of the Internet. The first target is child pornography, but the protagonists have already said they've set their sights on other types of illegal material such as copyright violations, obscenity, and possibly hate speech. Called R3/Safety-Net, the proposals were presented to the media by Science and Technology Minister Ian Taylor and representatives from the Internet Service Providers' Association (ISPA), the London Internet Exchange (LINX), and the Home Office, which is the government department charged with law enforcement. [...] As it turns out, Demon and the Department of Trade and Industry had been talking without publicity for months about taking action against obscenity on the Net. But the media raised the pressure, as did complaints on uk.censorship about a list of 133 newsgroups that Superintendent Mike Hoskins of the Clubs and Vice unit of the Metropolitan Police had sent ISPs as a guide to the location of illegal material. Hoskins and the ISPs all swear no threat was intended or taken, but the underlying tone was still: You do something about it, or we'll do something about it. R3/Safety-Net is that something. [...] No one is going to oppose these measures. How can they, when the 1994 revision of the Criminal Justice Bill allows the police to arrest, without warrant, people suspected of obscenity and certain child pornography offenses? Child pornography is, of course, illegal to create, distribute, or possess in Britain. For the purposes of the Obscene Publications Act and the Protection of Children Act, if something looks like a child in a sexual act, it is child pornography. [...] So it seemed like with Monday's announcement, everybody wins - almost. The government gets to look like it's doing something big. The ISPs get to stay out of jail. The police get to arrest people. Peter Dawe gets to be a hero. Britain gets to be a world leader. And we get ... well, what do we get? We get the certain knowledge that they will not stop here. They have already said so. Books like the Anarchist's Cookbook are banned here in print, and in a country where last Monday police seized a massive haul of IRA explosives intended to rearrange the landscape, the argument for letting people read alt.engr.explosives is likely to lead to the withdrawal of reference books from the public libraries. Britain has an Official Secrets Act, not a Freedom of Information Act. Government can proceed only with the consent of the governed, and on Monday what that unified panel asked for was our trust. They will not censor free speech; it's just the small percentage of illegal stuff they want cleaned up. So we're left asking before every move, "Daddy, is this illegal?" ********** Subject: Germany Bans Web Pages for Minors - and ALL To: fight-censorship(a)vorlon.mit.edu Date: Mon, 30 Sep 1996 13:37:52 +0100 (MET) Reply-To: um(a)c2.net (Ulf Moeller) Organization: private site, Hamburg (Germany) From: um(a)c2.net (Ulf Moeller) The report is essentially correct. In Hamburg, the prosecutors decided themselves that AOL had done nothing illegal, so as far as I know there was no court decision. Also, it appears that said Federal Office is neither responsible for electronic nor for foreign publications. I think the minister is trying to spead FUD. >From: taxbomber(a)taxbomber.com >Newsgroups: alt.censorship,alt.privacy,alt.security,news.admin.censorship >Subject: Germany Bans Web Pages for Minors - and ALL >Date: Sat, 28 Sep 1996 06:46:58 GMT >Message-ID: <324cc9c7.7567566(a)news.c2.net> >NNTP-Posting-Host: md19-017.compuserve.com According to Germany's leading tabloid paper "Bild" (Saturday edition), Federal Minister for Familiy Affairs, Claudia Nolte (Christian-Democrat), in an unprecedented decision has formally had several Web pages banned for being "X"-rated by the "Federal Office for the Evaluation of Literature Hazardous to Minors". These are pages featured by Ernst Zuendel, a leading political revisionist located in Canada whose purportedly "Neo-Nazi" views have been the subject of much controversy in Germany. Ms Nolte is quoted as saying: "It is not tolerable that the Internet should be an island with special privileges, on which thoughtless or unscrupulous providers may pursue their infamous activities with impunity." This effectively forces Internet providers to restrict minors' access to said pages - a technical impossibility since most minors accessing the net are be using their parents' accounts. No "Netwatch" or other self-censorship software will suffice to conform with this provision, as it is THE PROVIDERS, not the kids' legal guardians who have to comply with this restriction. Following a recent decision by the State of Hamburg's Supreme Constitutional Court to the effect that service providers cannot be held responsible for possibly illegal contents of data transfers via their networks (here, AOL was accused of disseminating child pornography), this move must be regarded as a circumvention tactics to put the thumbscrews on ISPs nevertheless by invoking Minors Protection legislation instead. (Also note that the Hamburg decision ruled that email message were protected by privacy laws as any snail mail letter - hence, providers could not be expected to monitor their contents as this would violate constitutional rights.) This implies that German based ISPs (including AOL's and Compuserve's local services) will actually have to ban ALL GENERAL access to the Zuendel pages from their systems unless they are willing to risk running afault of the law. ******** [Posted to soc.culture.singapore through an anonymous remailer in\ Germany. No wonder the SBA wants to censor the Net! --Declan] Mon, 23 Sep 1996 01:32:06 soc.culture.singapore Thread 228 of 350 Lines 18 SBA is screwed!! No responses mix(a)squirrel.owl.de Squirrel Remailer __ __ __ __/o \_ __/o \_ __/o \_ \____ \ \____ \ \____ \ / \ / \ / \ __ //\ \ __ //\ \ __ //\ \ __/o \-//--\ \_/__/o \-//--\ \_/__/o \-//--\ \_/ \__SBA ___ \ | \__ISP ___ \ | \__PAP ___ \ | || \ |\ | || \ |\ | || \ |\ | _|| _||_|| _|| _||_|| _|| _||_|| #### # # #### # # ##### # # #### ### ### ## # # # # # # # # # # # # # # # #### # # # ## # #### #### #### ### #### # # # # # # # # # # # # # # # # #### #### # # # # # #### ### ### # # ###

1 0

Flood Warning
by jya＠pipeline.com 17 Dec '03

17 Dec '03

BSDI To Share "SYN-Flooding" Protection Software This code is freely available via BSDI's Web and FTP sites at www.bsdi.com and ftp.bsdi.com. TIS will license its encryption key recovery technology to Atalla The agreement comes on the heels of two other recent developments: a new Administration policy regarding export controls on strong encryption, and TIS and Atalla's participation in a new computer industry alliance to promote adoption of a worldwide standard for encryption key recovery. RecoverKey supports the Administration's new policy by allowing emergency recovery of an encrypted message or file. This technology, patented by TIS and first approved by the U.S. government for export in January 1996, is fundamental to approaches now being considered as the basis for a new global standard. For more on RecoverKey, see: http://www.tis.com/docs/products/cke/index.html High-Tech Leaders Join Forces to Enable International Strong Encryption See: http://www.ibm.com/news/alliance2.htm ----- http://jya.com/floodd.txt ftp://jya.com/pub/incoming/floodd.txt

2 1

British Labour leader's pager messages intercepted
by Nicolas J. Hammond 17 Dec '03

17 Dec '03

The following article appears in the Electronic Telegraph today (Oct 3) TWO sensitive messages detailing Tony Blair's movements are among a list of electronic pager notes about the Labour leader and members of the shadow cabinet intercepted by hackers. The list of messages, which was shown to The Daily Telegraph, had been read by equipment freely available on the Internet for as little as £200. Further investigations by the Telegraph show that the vulnerability of pagers could expose nearly a million users to blackmail over sexual liaisons, for example, as well as robbery, commercial espionage and terrorist attack. The Blair messages were almost certainly sent to Alastair Campbell, his press secretary, and Tim Allan, Campbell's deputy. Many of them give a fascinating insight into how Mr Blair and the spin doctors who surround him make determined efforts to present Labour favourably in the media. The intercepts for Sept 14 show how the Labour leader's office was bombarded with anxious messages about a front page report in the Sunday Times newspaper headlined: "Blair aide tells Labour to forget about socialism". The transcripts also show how Peter Mandelson, one of Mr Blair's closest aides, closely monitors BBC news reports. On Sept 16 he sent a message to the leader's office saying that a report by one of the BBC's political correspondents, Jon Sopel, referred strongly to the strained links between the Labour leadership and the unions which had dominated the previous week's TUC conference. After Mr Blair made a speech to the City of London, a message from Hilary Coffman, one of his press aides, anticipated the reaction of the newspapers, saying that most papers, except the Telegraph and Independent had reported favourably. In fact, the Telegraph's headline on the story was: "Blair's good times pledge" above a story saying that he was committed to rising living standards and prosperity. One of the most intriguing messages Campbell received from Jonathan Powell, Mr Blair's chief of staff, said: "Pls call when you and TB are free. I have a message from Mrs T. - Jonathan." Jonathan Powell is the younger brother of Sir Charles Powell, who was Lady Thatcher's private secretary at 10 Downing Street. <blockquote><h4>Scotland Yard said this was the first time it had heard that pager messages could be intercepted</h4></blockquote> Around the time of the call Mr Blair's office was making a determined effort to scotch reports, allegedly attributed to Tory spin doctors, that Lady Thatcher found the Labour leader "creepy". Labour spin doctors were later involved in passing on a message from Lady Thatcher countering the reports and making clear that she still "rather admired" Mr Blair's determination to modernise his party. The police, the Home Office and the Department of Trade and Industry expressed surprise at the latest telecommunications tapping and said that they would investigate if pager-hacking becomes widespread. "It is an offence under the Wireless Telegraphy and Interception of Communications Acts for anyone to receive messages not intended for them," a DTI spokesman said. "However, it is not an offence to own the equipment, so we need to catch perpetrators in the act." Scotland Yard said this was the first time it had heard that pager messages could be intercepted. The Federation of Communications Services has called for the legislation to be changed, making illegal the selling or ownership of radio scanners - a market worth an estimated £200 million a year to the telecommunications industry. An investigation published today in What Cellphone explains how hackers have used a radio scanner coupled to a cheap electronic decoder and a computer running freely available software to receive other people's pager messages from anywhere in the country. It is not an offence to own either a scanner - they are used by yachtsmen to monitor weather forecasts - or the electronic decoder, which is advertised on the Internet as a home automation device. It is the marrying of radio and computer technology that makes pager hacking more of a threat to businesses and individuals than eavesdropping on cellphones. If the scanner is left connected to a computer, a log of every pager message sent by anyone in the country can easily be recorded. This log can then be used in a common word processor program and searched for key words, such as the names of politicians, celebrities or companies. Details of how hackers can send false messages has appeared on the Internet in the past few days. <blockquote><h4> Other messages seen include arrangements for sexual liaisons and details of fruit machines that are malfunctioning</h4></blockquote> "Hacking into pagers is very easily done by anyone with some DIY experience and potentially much more damaging than listening in on cellphone calls," said Bob Tomalski, editor of What Cellphone. "With cellphones, hackers have to listen to the messages as they happen. With pagers they can record a day's messages and search through them later." Once a message has been linked to a particular caller, the software can be set up to search specifically for that pager's identification code, which appears at the beginning of each pager message. Retail chains use the pager system to send details of each store's takings to head office. Messages seen by the Telegraph range from "Yesterday takings £659, see you in pub in 10 minutes" to the precise breakdown of the sales of a big supermarket chain. Other messages seen include arrangements for sexual liaisons and details of fruit machines that are malfunctioning and paying out big amounts in pubs. Of particular concern is the revelation that hackers have intercepted passwords used to switch off alarm systems sent to security guards via the pager network. For years, analogue cellphones have been known to be vulnerable, culminating in the publication of conversations between members of the Royal Family. But despite concerns about the vulnerability of mobile phones, little attention has been paid to pagers, which are much easier to tap. Mobile telephones use several thousand radio frequencies and have a limited range, so the eavesdropper must be near the cellphone receiving the call and have technical knowledge to track the call. Pagers by contrast, receive easily decoded analogue signals based on 25-year-old technology and transmitted on only 10 - published - frequencies. Because the networks do not know where each pager is located, each message is beamed across the country, so that a hacker can receive messages destined for any of the 900,000 pager users from Penzance to Aberdeen. -- Nicolas Hammond NJH Security Consulting, Inc. njhm(a)njh.com 211 East Wesley Road 404 262 1633 Atlanta 404 812 1984 (Fax) GA 30305-3774

1 0

Re: FUCK!!!!!!;-) The Book
by jya＠pipeline.com 17 Dec '03

17 Dec '03

A new book, "Digital Soldiers," by James F. Dunnigan, emphasizes that information warfare -- deceiving the enemy -- is as old as war, and that the PR-driven media today work closely with the warfighting industry to protect their mutually lucrative markets. The latest GAK PR campaign fits this. Dunnigan also makes hash of the recent opportunistic "infowar" PR, along with adept grinding of the vast, corrupt high-tech defense industry worldwide, led by the US war-prognosticating PR-media-policy lizards. As he says, bad news is always good news for the Hearsts and Rasputins (Responsible Personages), for the liars of brimstone religion, for all the terrifying doomsayers peddling trust-my-god: me, now tithe or be taxed. Dunnigan's sermon: stop the pork, then there will be plenty of resources to deal with the rest of society's ills. Otherwise, peace, real or vitural, is war, sustained barbarity camouflaged by self-interested civility -- the peacefighting, ticket-punching officer, er, journalist, class. Digital Soldiers The Evolution of High-Tech Weaponry and Tomorrow's Brave New Battlefield James F. Dunnigan St. Martin's Press, New York; $25.95 ISBN 0-312-14588-8

1 0

Cypherpunk forgery.
by scallon＠kiwi.pyrotechnics.com 17 Dec '03

17 Dec '03

I just got word from one of my buddies that someone has been forging my e-mail to cypherpunks talking about the pederast organization NAMBLA. The guys at Penn State where the forgery came from have started to investigate and will bring the perpetrators to a discip- linary hearing. Thank you for your co-operation. BTW: Below is my real .Sig -- Brendan John Francis Scallon When it comes to the net, I'm scallon(a)pyrotechnics.com similar to the thrilla in Manila DROP Squad - Pali-town http://www.pyrotechnics.com/~scallon GEORGE CLINTON for PREZ This country needs a BOOTSY COLLINS for VP Parliament, not a Congress

2 1

Re: The Right to Keep and Bear Crypto
by jim bell 17 Dec '03

17 Dec '03

At 10:09 AM 10/3/96 -0700, Bill Stewart wrote: >At 08:29 PM 10/2/96 -0700, azur(a)netcom.com (Steve Schear) wrote: >>Unless we get the strong support of the gun lobby and NRA. > >The gun lobby and NRA are generally against handgun registration, >but haven't stopped it. We're against crypto key registration. >The gun lobby and NRA are generally against machine gun licensing requirements, >but haven't stopped it. We're against strong crypto licensing requirements. >The gun lobby and NRA are generally against firearms dealers' licensing, >but haven't stopped it. We're against crypto dealers' licensing. >The gun lobby and NRA are generally against assault weapon import laws, >but haven't stopped them. We're against strong crypto import laws. If the wimps at the NRA had any guts, they would poll their membership, asking if anybody would be willing to make "the sacrifice" (presumably due to a recent terminal illness diagnosis). Then, they'd get on the phone to the Supreme Court, and point out that they'd just noticed that Supreme Court appoints were ONLY "good for life" and suggest nicely that if all of the above outrages (WRT guns) weren't reversed within the year, they predict about nine open seats shortly thereafter. Okay, maybe it's only wishful thinking, but... If you take the position that all human life is equally valuable, then you must concede that the deaths of nine fools is no worse than the deaths of nine randomly-selected individuals who found themselves the victim of gun laws. Crypto relevancy? Well, the so-called "gun nuts" have already tolerated far more regulation and restriction of guns than we should ever accept. But if we use their tactics, can we expect any better results? Jim Bell jimbell(a)pacifier.com

1 0

Re: The Right to Keep and Bear Crypto
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:29 PM 10/2/96 -0700, azur(a)netcom.com (Steve Schear) wrote: >>T[i]m May wrote: >>I've argued since 1992 on Usenet and here that "crypto as arms" is a >>potentially dangerous tack to follow. (Others, including legal experts, >>have also argued this point.) >> >>Given that it is well-established, whether we agree or not, that the USG >>may restrict private ownership of atom bombs, nerve gases, CBW weapons, >>machine guns, switchblade knives, nunchuk sticks, and various other "arms," >>the association of crypto with armaments is potentially *DISASTROUS*. > >Unless we get the strong support of the gun lobby and NRA. The gun lobby and NRA are generally against handgun registration, but haven't stopped it. We're against crypto key registration. The gun lobby and NRA are generally against machine gun licensing requirements, but haven't stopped it. We're against strong crypto licensing requirements. The gun lobby and NRA are generally against firearms dealers' licensing, but haven't stopped it. We're against crypto dealers' licensing. The gun lobby and NRA are generally against assault weapon import laws, but haven't stopped them. We're against strong crypto import laws. The NRA supports Instant Background Checks (because it thinks they're less bad than N-Day Waiting Periods). We're against central government permitted-users databases, and we're against Key "Escrow" even if some people think it's less bad than an outright ban. The NRA supports the politically incorrect hunting enthusiasts. We (generally) support politically incorrect tax evasion, black markets in recreational pharmaceuticals, and free speech for people we dislike. If your lobbyists lose and you have to register your gun, it still works. If your lobbyists lose and you have to register your crypto keys, you lose; that means the government or anybody who can get your keys can crack your stuff. If your lobbyists lose and you have to get permission to make guns, most of the interesting guns can still be made. If your lobbyists lose and you have to get permission to write crypto, many of the interesting crypto applications won't get written - we not only depend on the free flow of ideas, but on people doing applications as a hobby or a small business that can't afford to become Registered International Arms Dealers, don't want to wait the months that such registration takes for background checks, and don't want to give up all the privacy involved just so they can write a bug report for somebody else's code or suggest an improvement. Face it, as much as the Gun Lobby has slowed down the growth of anti-gun laws, they've still lost step by step, law by law, against a government that's succeeded in scaring the public about threats to public safety and in convincing the public that only the military needs strong weapons and that registering everyday-use weapons is just fine. I support much of what they do, and I'd be happy if they supported us, and it's probably easier to get their support on crypto than drug rights, but we can't _depend_ on it. Also, getting public support for crypto is a hearts-and-minds deal; the press generally dislikes guns, and generally approves of free speech, and press support is important - especially since the press's default behaviour is to believe government press reports about crypto-narco-porno-terrorists using assault remailers. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/debate.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: Flood Warning
by jim bell 17 Dec '03

17 Dec '03

At 02:47 PM 10/3/96 GMT, John Young wrote: > High-Tech Leaders Join Forces to Enable International > Strong Encryption > > See: http://www.ibm.com/news/alliance2.htm This is apparently no longer valid. Is there a new one? Jim Bell jimbell(a)pacifier.com

2 1

Re: NYT on IBM GAK
by jim bell 17 Dec '03

17 Dec '03

At 07:51 AM 10/3/96 -0500, Adam Shostack wrote: >Rich Burroughs wrote: > >| The word "boycott" leaped into my mind. I personally do not believe that I >| will be buying products from any of these companies, as long as thay >| participate in this GAK charade. > > Folks, > Lets be reasonable. Its time to jump on board the GAK >bandwagon. After all, where better to disrupt the music? We need to >start writing GAK software, and it better be up to the high standards >that the NSA sets for itself. > > Once we've written it, and its being distributed, we can say >'See, another broken bit of GAK software. Not even the NSA could get >it right. Our data is too important to be using broken software to >protect us.' > And we have 56 bit exportability in hand. >Adam The problem is that the appearance of defeat could easily guaranteee the real defeat itself. Jim Bell jimbell(a)pacifier.com

1 0

Key recovery/RSA/Bidzos/WTF?!?
by Walt Armour 17 Dec '03

17 Dec '03

What's up with some of these press releases? Can anyone clear up the confusion with RSA/Bidzos/Key recovery? Here are some quotes: ================= >From NYT:CyberTimes (2 Oct) "Clinton Encryption Plan Is Generating Resistance" Executives of the International Business Machines Corp. said late Tuesday that they were still lining up the final list of companies in the alliance. Those involved will include Digital Equipment and smaller data-security companies including RSA Data, Cylink and Trusted Information Systems. ================= >From NYT:CyberTimes (2 Oct) "Clinton Encryption Plan Is Generating Resistance" "The government announcement is disastrous," said Jim Bidzos, chief executive of RSA Data Security, one of the country's leading developers of data-scrambling software. "We warned IBM that the National Security Agency would try to twist their technology." ================= >From BusinessWire (2 Oct) "JOINT PRESS ANNOUNCEMENT/ HIGH-TECH LEADERS JOIN FORCES TO ENABLE INTERNATIONAL STRONG ENCRYPTION" "Export controls are a fact of life," said Jim Bidzos, president of RSA Data Security. "The key recovery alliance's approach will allow companies to use cryptography with differing levels of security in an interoperable way. When the alliance implements this technology it will give the user a new level of flexibility that did not exist before. In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." ================= So is RSA part of this or not? Is the middle quote above mis-attributed? walt

2 1

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 07:17 AM 10/3/96 -0400, Black Unicorn wrote: >On Thu, 3 Oct 1996, Remo Pini wrote: >> Date: Thu Oct 03 08:08:42 1996 >> > >* A launch vehicle or payload shall not, by reason of the launching >> > >* of such vehicle, be considered an export for purposes of this >> > >* subchapter. >> > Okay, everybody, call Estes! We've got some crypto to export...er...laun >> > ch! >> If I get the above wording correctly (unicorn, help me!), it is sufficient >> to put the cryptostuff on a disc in a LAUNCHABLE device, it never says that >> the payload has to be delivered by air. So, just put that thing in a bag >> and get it through customs... (or does "by reason of ..." mean that the >> exclusive means of export allowed is launching ?) > >The launching alone will not cause it to be an export. If it is launched >and then ends up outside the U.S., it could be an export. Certainly if it >is launched with the purpose of exporting crypto, it will be an export. Too bad you didn't support this with a logical argument. The wording was clearly intended to be an exception to a rule. What the wording doesn't include is the "exception to the exception," most likely because they weren't thinking in too great a detail when they wrote the regulations. But if the regulation is "wrong," the fault of that is those who wrote the regulation. (and we, the public, are entitled to assume that the regulation is "right" in its literal meaning.) It appears that the government left a loophole so large that you could drive a truck...er...shoot a rocket through it. Jim Bell jimbell(a)pacifier.com

4 3

chaining remailers
by scottb＠aca.ca 17 Dec '03

17 Dec '03

Can someone point me to where I can get software to take advantage of chaining remailers for Windows 95?? Actually, can this be done through a Windows enviroment, or do I need to run Linux? /sb

1 0

Re: ADJ_ust
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 1 Oct 1996 10:26:12 -0800, Timothy C. May wrote: >Personally, I think there's a lot of hype about this whole "infowar" thing. >Sure, security measures and vulnerabilities always need to be looked at, >but a lot of the rhetoric is being driven by journalists looking for lead >stories. This is certainly the case with 99% of the computer industry press! I certainly have no problem believing that a group of well-supplied professionals could, with enough time and [political] support, take down a single target. For instance, if the CIA,FBI and NSA wanted to hose the 1st Bank of China, I have a feeling that they would - eventually. I have strong doubts that someone would come up with a non-nuke that could destroy stuff indiscriminately within a useably large area. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

5 4

Re: support for "crack DES"
by Omegaman 17 Dec '03

17 Dec '03

> NetScape might not hawg the glory, but Bully Billy will trumpet > to the world that HE devised the means, HE directed the breakers, > and MicroSlop is the "benevolent" [read greedy, vicious, corrupt, > threatening predator] organization which "pulled freedom loving > Americans clear from the *very* mouth the the beast." Considering the situation -- considering that RSA has even signed on to this scheme -- I'd have to say that I don't give a rat's ass what Bill Gates claims. If Micro$oft bucks the system, I'll gladly applaud their stand. The situation is not good at all. Cracking DES (whether distributed or through a hardware crack, or both!) seems critical at this point. me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

How to Compete under Clipper-3
by John Gilmore 17 Dec '03

17 Dec '03

> * Even if some industry participants fall for it, the majority will not. > The "deal" is simply not any good for anyone but the Administration. > Expect the same opposition to Clipper III as we saw with Clipper I and II. The difference is that some weak companies will decide to fall for it. These companies may think that two years of 56-bit un-escrowed products (with promises of key escrow in future releases) will be competitive against 40-bit un-escrowed products. They're right, but that's not the competition they will be facing. The right competitive strategy is to build strong crypto using 168-bit Triple-DES, in a country that has a sane government and a respect for privacy. Such products would sell well against 56-bit products or key-escrowed products produced by the weak companies that tried to lean on the government for a competitive edge. If the US government ends up ever imposing import restrictions on crypto, it will be completely clear to everyone that their goal all along has been to restrict the availability of privacy to AMERICANS. The export laws, their continual announcements that "Americans are free to use any crypto they want", and all their preaching about impacts on foreign intelligence would be known as an obvious sham all along. Import restrictions would not be any more Constitutional than export restrictions. The Constitutional right to receive information (in the form of source code) from outside the US will enable companies to bypass any import restrictions that survive Constitutional scrutiny. They can do their crypto development in a free country, ship binaries to most of the world from there, ship source code to the United States, and compile that source code to binaries for local US distribution. None of these actions will violate any US export or import controls that can be Constitutionally imposed. Such development can be done in dozens of countries. Some countries who aren't afraid of their citizens having privacy will find it economically advantageous to remain free, despite US pressure to suppress privacy. A small industry of good cryptographers will grow into a large industry there, as the US pressures the rest of the world to become less free. John

3 2

The New GAK-Clipper Thing will Fail
by Timothy C. May 17 Dec '03

17 Dec '03

Comparing the latest GAK/Clipper III (or is it Clipper IV?) thing to the original Clipper announcement in April 1993, I sense a lot more confusion, a lot more thorny issues, and a lot more vagueness. They just seem more disorganized and less committed than the last time around. Each iteration of Clipper gets less focussed and seems to last a shorter time before the next version is being talked about. A good thing, of course. Some random points: * Unlike with Clipper, where a specification existed and was available within a few weeks for analysis, and where hardware existed (the Mykotronx chips, the AT&T phone), what has been publically presented so far is just a vague commitment to participate. * There seem to be many ways around the new GAK: --superencryption is essentially impossible to stop (e.g., use PGP on text messages, then use the officially-approved GAK--how could this be outlawed?) --the large pool of _existing_ crypto products means people will be using these products for years to come (possibly within GAK wrappers, as just noted)...unless the New World Order (tm) somehow locates, seizes, or otherwise makes criminals out of those who use a once-legal product, how could this be stopped? --the "degrees of freedom" for messages have sharply increased in the last several years: messages inside Web accesses, messages "sent" by posting to message pools (*), direct phone calls, the Net, etc. (* Will posting encrypted messages to the Usenet or world-readable Web sites become a crime? Or will attempts be made to limit distribution of Usenet and access to Web sites? Neither of these seems feasible, but how else could the stated goals of the Administration ("stopping terrorists, etc. from conspiring") be stopped?) (On this point above, yes, I know that there has been no talk of illegalizing the sending of mere encrypted data, only the export of non-GAKked programs. But I think it likely that the LEAs will realize that "criminals" are still conspiring with crypto. One thing they may try is to require that any communication with a non-U.S. site involve GAK. This then raises the Usenet/message pool directly. Since such sites have world-distribution, currently, posting encrypted messages to alt.anonymous.messages or to a mailing list like this necessarily involves export of the messages. It gets complicated to enforce, naturally.) * The Cabal itself seems confused as to what's involved. They seem to be counting on IBM and/or TIS to deliver the solution, and may be just signed on for what they think are reasons of political expediency. * As the IBM scheme gets attacked (in the way Matt Blaze attacked Tessera), as questions are raised about the Key Authorities and their cooperation, and as the _costs_ are revealed....well, I expect further crumbling. (On the "costs" issue, running these Key Authorities, staffing them, complying with subpoenas (and who will _fight_ the subpoenas?), etc., will not be cheap. For software products like Navigator and Explorer, that are either free or very cheap, just who will pay for this infrastructure? Someone at the EPIC Pro-CODE conference in Palo Alto a few months ago--I forget whom--presented calculations of just how expensive a "key recovery" infrastructure could be. Will it cost $50 to send a message to a foreign site? Better to use message pools! :-}) I apologize for the random nature of my comments here. I just see so many points of attack, so many ways to skirt the intentions of GAK, and so much ambivalent commentary from the companies involved, that I am convinced this whole thing will crumble. Unless a "major terrorist incident" galvanizes the effort, it looks to start falling apart almost immediately under the onslaught of Cypherpunks, hackers, other governments (think France wants the USG having access to their traffic?), and the "crypto anarchy" of nations whose borders are not even speed bumps. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: The New GAK-Clipper Thing will Fail
by jim bell 17 Dec '03

17 Dec '03

At 11:11 AM 10/3/96 -0800, Timothy C. May wrote: > >Comparing the latest GAK/Clipper III (or is it Clipper IV?) thing to the >original Clipper announcement in April 1993, I sense a lot more confusion, >a lot more thorny issues, and a lot more vagueness. They just seem more >disorganized and less committed than the last time around. Each iteration >of Clipper gets less focussed and seems to last a shorter time before the >next version is being talked about. A good thing, of course. Sort of like a "political" version of Zeno's paradox? B^) > >Some random points: >--the large pool of _existing_ crypto products means people will be using >these products for years to come (possibly within GAK wrappers, as just >noted)...unless the New World Order (tm) somehow locates, seizes, or >otherwise makes criminals out of those who use a once-legal product, how >could this be stopped? And I suspect that there will be large numbers of people using non-GAK simply as a protest. Trying to convict even one of them will be difficult; the government has to admit that they're not doing anything illegal, etc. Yet, if the gov't FAILS to prosecute them, that'll destroy an law requiring GAK. [snip] >(On the "costs" issue, running these Key Authorities, staffing them, >complying with subpoenas (and who will _fight_ the subpoenas?), I think it would be appropriate to contact each of the companies which have publicly signed on to this most recent propsal (Clipper 3.XX? Clipper IV?) and point out that (if they still won't revoke their approval) they should publicly and irrevocably commit to challenge each and every key subpoena with a full legal challenge (to the SC if necessary), INCLUDING informing and participation of the key owner/user, with all of his attorney fees paid for by an insurance policy issued specifically for the purpose. This process would probably take at least months, if not years. (This is important, because I believe that wiretaps have set a false precedent: AT+T (before breakup) and local telcos afterwards, being monopolies, had no motivation to challenge wiretap orders, and the practice was to not inform those tapped, perhaps not even after the tap was removed. There is no reason to assume, however, that key-escrow systems should follow that precedent, because the relationship between AT+T and government was not an "arm's length" one. Presumably, key-escrow companies should be entitled, no REQUIRED to verify the legitimacy of any key-release. "It's only fair!" ) The resulting legal atmosphere would become so distasteful to the Dept. of Injustice that it would make key escrow useless as a practical tool, even though it would exist as a technicality. If the DOI objected, companies need merely say the magic words "Richard Jewell" and all ordinary citizens would recognize the problem. The point, of course, is NOT to encourage these companies to support Clipper IV. Rather, goal is to suggest to them a "poison pill" which would make their cooperation meaningless in the end, while at the same time giving them a 2-year free 56-bit export. Think of it as a monkey-wrench they can throw into the works. We can use such a proposal as a sort-of "loyalty to freedom and their fellow citizens oath" because any company which refused such a REASONABLE protection to ordinary citizens would be, in effect, giving their middle finger to the public. Jim Bell jimbell(a)pacifier.com

1 0

RE: The Right to Keep and Bear Crypto
by jim bell 17 Dec '03

17 Dec '03

At 11:39 AM 10/3/96 -0400, Mullen Patrick wrote: >This may (will?) limit the products which are produced by large corporations, >as their need for a single, globally distributable product is respected. >However, smaller companies who have neither the desire nor finances to >distribute their product on a global scale will be unaffected. Shareware/ >freeware products will also be unaffected (unless someone from another >country pulls it off a website, or similar means). > >However, all of this is irrelevant, because I must say, Tim May has the >proper idea -- We may have the right to bear crypto, but the government >has the right to limit the types/amounts of crypto we bear. > >** Success in this matter is classifying crypto as speech ** >Patrick While I agree we shouldn't push the crypto/arms connection, on the other hand I think we can push BACK: If the government tries to equate crypto with arms,take the position that while we disagree with this equation, to the extent the government is using it, it must take the good with the bad and accept the "keep and bear arms" interpretation literally. Jim Bell jimbell(a)pacifier.com

1 0

RSA's position on espionage-enabled crypto.
by Peter Trei 17 Dec '03

17 Dec '03

RSA has put up a 'position statement' on clipper 4 at their home page at www.rsa.com. They're not rejecting it, but are clearly not wildly pro-GAK either. It's clearly early days yet. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Re: Clipper III on the table
by dustman＠athensnet.com 17 Dec '03

17 Dec '03

Ernest Hua <hua(a)chromatic.com> wrote: > I predict, therefore, Netscape and RSA would NOT capitulate to this > latest bitter carrot. Huh? RSA has already gone over to the dark side. According to http://www.rsa.com/PRESSBOX/releases/keyrecov.htm: "The recently announced Key Recovery Alliance, of which RSA is a part, ..."

1 0

Margaret Milner Richardson loses her breakfast...
by Robert Hettinga 17 Dec '03

17 Dec '03

>From the Wall Street Journal Wednesday October 2, Page 1: Use of the internet to attract tax-dodgers rings alarm bells at the IRS. The rapidly expanding new worlds of the internet and electronic money are stirring deep concern at the IRS. "We know that some foriegn banks are now using the internet to solicit new customers with promises of complete anonymity and a haven from all taxes," IRS commissioner Margaret Milner Richardson said. She said this issue is being "carefully monitored" by tax administrators around the world. Ms. Richardson, in a recent speech, cited a world-wide-web advertisement offering a "one-of-a-kind book" covering topics such as, "Banking in Silence" and offering information on setting up an offshore trust that "could include protection from a large IRS assessment." Ms. Richardson's reaction: "I almost take that personally." Another ad touts "excellent interest rates, offered in a stable, tax-free environment...Clients communicate with the bank any time from anywhere via the internet." Ms. Richardson said: "How would you like to be responsible for administering tax laws and have to read these ads over breakfast?" Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

4 4

Re: White House crypto proposal -- too little, too late
by watson＠tds.com 17 Dec '03

17 Dec '03

Joe Shea, Editor-in-Chief of The American Reporter, said: > Declan, how does your list work? Do you only publish comments that agree with you? I didn't see my first two, and this one only came with your response. Is this your version of freedom of the press, or what? - Maybe Joe would agree to publish everything we send him if we agree to publish everything he sends us. Dave Love to get published

1 0

Re: Clipper III on the table
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:50 PM 10/3/96 -0400, Anonymous wrote: > >Ernest Hua <hua(a)chromatic.com> wrote: >> I predict, therefore, Netscape and RSA would NOT capitulate to this >> latest bitter carrot. > >Huh? RSA has already gone over to the dark side. According to >http://www.rsa.com/PRESSBOX/releases/keyrecov.htm: > "The recently announced Key Recovery Alliance, of which RSA is a part, ..." I think we should refer to what they are pushing as the "Key Recovery Alliance Program". K.R.A.P. is a good description as to what we are going to get from them. --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

5 5

Did Sun get a sweetheart deal?
by Ernest Hua 17 Dec '03

17 Dec '03

So why did Sun cave in? Ern -------- From San Jose Mercury: "Good Morning Silicon Valley" NASA has its day in the Sun Sun Microsystems Inc. said Wednesday it received two contracts from NASA's Goddard Space Flight Center worth a total of $100 million. The Mountain View-based company said the pact calls for software development and the design about 34,000 computer-aided engineering and design workstations. NASA will use the workstations to design integrated circuits.

6 6

Re: [FACTS] Mountain Meadows Massacre
by Deana Holmes 17 Dec '03

17 Dec '03

On 3 Oct 96 at 14:42, Dr.Dimitri Vulis KOTM wrote: > "Deana Holmes" <mirele(a)xmission.com> writes: > > <snip mor(m)on propaganda> > > > > <snip Dmitri Vulis nonsense> > > No wonder the criminal cult doesn't want its foul deeds subjected to > public scrutiny by "dead-agenting" its critics. Is Timmy May a > paid cult apologist? Sheesh. You know you're doing good when both Dmitri Vulis and Attila both badmouth you. (For the record, Attila's badmouthing consisted of stating via private email that I was "the same air head pseudo-intellectual who has poisoned her own life with hatred and ignorance in so many other venues.") Some people are just terribly threatened, I guess. Deana Deana M. Holmes April 1996 poster child for clueless $cientology litigiousness alt.religion.scientology archivist since 2/95 mirele(a)xmission.com

2 1

paging nets
by Jeff Ubois 17 Dec '03

17 Dec '03

Interesting recycled bits from Newsbytes concerning a BBC story drawn from Usenet: BBC Blows Radiopager Security Systems Wide Open LONDON, ENGLAND, 1996 OCT 2 (NB) -- By Steve Gold. The British Broadcasting Corporation (BBC) has revealed that radiopaging messages on the UK's paging networks can be read by anyone with a radio scanner and suitable PC software. In addition, the British TV company claims that it is also possible to insert bogus messages onto the paging networks using instructions on the Internet. ... BBC journalists, meanwhile, said that UK radiopaging transmissions were unencrypted and, as such, were insecure when viewed alongside digital cellular phones, where signals are encrypted. ...the BBC claimed it had been shown messages reporting on the activities of Tony Blair, the head of the British Labor Party, along with a message referring to a residence of a member of Royalty. Newsbytes noted that the same system is used in the US.

1 0

Re: Fighting Clipper III
by apteryx＠super.zippo.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- erm, a boycott means not _buying_ a product, as opposed to not _using_ a product. In the case of PGP, I never intended to purchase it from RSA. As for Netscape, there are other browsers out there (or so I heard). Realistically, a boycott is likely to be ineffective. Writing letters to companies and congresshmucks and working with non-US crypto companies to create a standard that can be legally imported into the US (for now) would be more effective, IMHO. Boycotts rely on large numbers of participants, and not enough people understand or care about encryption. We'd be better off trying to change that first. Mark On Thu, 3 Oct 1996 06:37:45 -0700 (PDT), Declan McCullagh <declan(a)eff.org> wrote: >You'll have trouble doing a successful boycott of RSA. What, you won't >use Netscape Navigator or PGP? > >-Declan > > >On Wed, 2 Oct 1996, Jim McCoy wrote: > >> Rich Burroughs <richieb(a)teleport.com> wrote: >> [...] >> >>>On Wed, 2 Oct 1996, John Young wrote: >> >>> >> >>>> The New York Times, October 2, 1996, pp. D1, D8. >> >>>> Executives of the International Business Machines >> >>>> Corporation said late yesterday that they were still lining >> >>>> up the final list of companies in the alliance. Those >> >>>> involved will include Digital Equipment and smaller >> >>>> data-security companies including RSA Data Security, Cylink >> >>>> and Trusted Information Systems. >> >>> >> >>>We are in deep trouble. >> >> >> >>Wouldn't a letter-writing campaign be in order here? >> >[snip] >> > >> >The word "boycott" leaped into my mind. I personally do not believe that I >> >will be buying products from any of these companies, as long as thay >> >participate in this GAK charade. >> >> Such an initiative will need publicity and letter-writing early in the >> campaign will help us set the tone and points of debate on this issue. >> A boycott works best when everyone knows why and there are a few key >> phrases which can be used to get the message across. Something like >> "company X is helping build big brother, boycott their products" or a >> few similar sound bites are needed fast. The big brother inside stickers >> from the last campaign were nice, maybe people can come up with variations >> of various corporate logos or marketting phrases which help get the message >> across? >> >> jim >> >> > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com // > > > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMlQmC936bir1/qfZAQF9dwL/fN1HZhHWbnOa6gZ71WMwf32nuOGS1CGm H2f9MlNvZhYF6TVAwCmfUG4hgeJQLkC97GrR/0hIfNYzir0Eb+qmF2Mptvl5tUiJ I89H2WRVl+BJBoqThGXJx8BqL6uVDX9H =sBVJ -----END PGP SIGNATURE----- Mark Heaney finger snipe(a)starburst.cbl.cees.edu for public key PGP Fingerprint= BB D8 9B 07 51 87 05 AC 47 7B F2 4F A6 AB 1A CD ----------------------------------------------------------------- Vote against government *** Vote Libertarian

2 1

Re: Clipper spin [was Re:Flood Warning]
by jim bell 17 Dec '03

17 Dec '03

At 12:00 PM 10/3/96 -0800, Jim McCoy wrote: >[...] >> >> High-Tech Leaders Join Forces to Enable International >> Strong Encryption >> >> See: http://www.ibm.com/news/alliance2.htm > >The "International Strong Encryption" phrase is something that we >need to become active in stopping. Anything which responds to such >announcements should put a different spin on this phrase. If the >Clipper farce is accepted as "strong" encryption then the battle is >lost; maybe something like "it is _international_ strong encryption >because it is the strongest encryption people like Saddam Hussein [insert >bogeyman du jour] want Americans to have access to" Idea 1: It should be called "International Weakened Encryption." Idea 2: The "alliance" term above in the URL should be replaced with "Axis." Jim Bell jimbell(a)pacifier.com

1 0

gack vs. key escrow vs. key recovery
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

cpunks, a note about recent developments in "key recovery" initiative. I think cpunks as a group should reconsider very seriously their own positions on cryptography and come up with something more sophisticated than "any government bill or plan associated with crypto is evil" which is the functional equivalent of the ideology behind many recent posts. what is the precise difference between gack, key escrow, and key recovery? TCM has argued that the administration is muddying the issue by manipulating the terminology. perhaps so, but I feel that cpunks are equally guilty, by branding anything that emanates out of the government as inherently orwellian. do you always have to have an enemy? is the government always going to be your enemy, no matter what they do? I have posted here before that many companies find the concept of "key recovery" highly acceptable and even desirable. the basic question is, what does this mean to wiretapping and search warrants and subpoenas? it is clear we are coming to a fork in the road at this moment. there are going to be two types of cpunk opinions based on recent developments. 1. those who feel that wiretapping was illegitimate from the start and are working to make wiretapping impossible. confronted with a legal search warrant/subpoena etc. for personal data, they would not hand over keys. they would "superencrypt" in systems that do etc. 2. those who feel that there is such a thing as a legal warrant or subpoena for information protected by cryptography keys, and would agree that this logically means that governments will be getting access to "key recovery" infrastructures. personally I am leaning toward 2, because I feel that we already live in such a society, and that it is not orwellian. companies are going to lean toward (2). I do agree that the gov't has the potential to twist this process to evil ends, but that has always been true of everything about democratic government, and the recipe for 200+ years has always been and remains "eternal vigilance". in other words, I am in favor of some kind of mechanism by which the government can obtain keys via subpoenas/warrants. cpunks, I think we should try to clarify our terms and come to some conclusions. those who continue to pursue (1) are going to be perceived as more and more radical and extremist, because arguably it is not even a system we have today or one that was ever devised. remember, the constution guarantees freedom from *unreasonable* search and seizure, but never prohibited search and seizure in the first place!! apparently at least our found fathers believed that "reasonable" search and seizure was a wholly legitimate function of government, based on this wording. regarding (2): the government may actually help bring crypto to the masses via the post office and other routes. are cpunks going to continue to hold the simplistic, reactionary, knee-jerk, black-and-white opinion that "anything with the word 'government' in it is evil"? "if the government is doing something, then we must sabotage it"? I'll be watching the debate closely, as the true extremists incapable of compromise (and thereby living in a fantasy world) show their colors....

6 6

How to fight GAK by obeying the law
by Ernest Hua 17 Dec '03

17 Dec '03

It seems that the best method for fighting GAK is to accelerate wide-spread domestic use of freely redistributable non-GAK crypto. The Lynux automatic firewall concept that John Gilmore is pushing is a great idea, but it is still brewing, and he's shooting for developing an exportable ... er ... importable version. That will take much time to develop, and time is what we don't have much of. We need to work on applications, API's, flexible software modules, etc. and the primary reason we cannot do it so easily is because we cannot redistribute the software so easily. First thing we definitely need is a way to determine with fairly good accuracy, whether a host is in the U.S. This MUST be an automagic mechanism ... no person involved so there is little delay in getting the goodies. The best implementation would automatically set the group of an incoming anonymous FTP session daemon to a special group if there is a high degree of certainty that the originating host is within the U.S. Second thing we definitely need is a convenient way and universal way to clearly notify the recipient of the current export restrictions of such software, so that the recipient knows what he/she is in for. Basically, we have to do our best to NOT violate the law, no matter how much we hate it. What the government wants to happen is that everyone will get hooked on GAK, and it will be too inconvenient to use something else. A good counter-strategy is to get everyone hooked on the good stuff. Right now, the FBI/NSA is looking for an excuse to prosecute anyone not jumping on their bandwagon. We have to avoid give them an excuse to prosecute us while still enabling rapid application development. Communication and distribution are key. Ern

3 2

Clipper III questions
by Eric Murray 17 Dec '03

17 Dec '03

The recent CDT policy post sez of Clipper III: >* Access to keys internationally "would be provided in accordance with > destination country policies and bilateral understandings." This reminds me of the understanding between CIA/NSA and their counterparts in British Intelligence. Both sides are prohibited from spying within their own countries borders but are encouraged to spy in other countries. Both would very much like to spy on their own citizens (for legitimate law encorcement/national security reasons only, of course). So, they have a simple system in place. The British spy on the American citizens that the Americans want spied on and then turn over the intercepts. The Americans do the same for the British in Britain(*). Sometimes they lie to each other or withhold material, but that's what spy organizations do all the time. If Clipper III passes and the OECD gets their member nations in line with what the American miliary wants, I predict a similar system will evolve. "Destination country policies" will allow decryption of incoming GAKked messages from non-citizens. After all, they have no rights, do they? Cooperating intelligence agencies will then exchange intercepts. Presto Chango, pesky privacy rules vanish right before your eyes! Of course this is in our best intrest, we must fight against terrorisim with all methods possible. The ends justify the means. A question: What happens if a company decided not to go along with Clipper III? Can they still ship the "old" 40-bit-style GAKware unimpeded? Or will there be a slow tightening of the rules to force compliance? The existing way of doing things depends to a large degree on a set of "common practice" which the NSA doesn't have written down. For example you won't find the 40 bit limit written anywhere in ITAR, and if you want to export something that's already been approved elsewhere (i.e. another implementation of SSL) you still have to go through the approval process. (*) this comes from "The War Aginst the Jews" which is worth reading. Sorry I can't find my copy at the moment, maybe someone who's got it handy will provide authors/ISBN. Capsule review: covers government dirty dealing from the early 1900s on, mostly British and American. Concentrates on Jews and Israel of course but they seem to have been the brunt (sometimes the instigator) of a lot of the dirty pool that governments have played. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

3 2

DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

What about the heuristics of partitioning the keyspace? Seems to me that a _subset_ of all possible keys is much more likely to appear than a random selection from an equidistributed population 0..2^56. (P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. So a keysearch strategy should be something other than a partitioning of 2^26 into N bins with a linear search within each bin. I realize that it is POSSIBLE that a key of 1010101010... was used, (excluding weak keys from consideration) ---- but I have seen "certifiable" RNG's and, God Bless 'em, they just dont ever produce anything with any predictability. Is not the lack of predictability a predictable, and therefore exploitable, attribute? Any thoughts here? ----------

9 9

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 02:05 PM 10/3/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >Alas, a common fallacy. > >You have committed a prohibited export when the stuff lands outside the >USA....It's not illegal when it goes up ("by reason of the launching" and, >e.g. *stays up* in orbit) but it is illegal when it comes down abroad. Sure about that? The regulation said something like "launch vehicle" or "launch," apparently indicating that a "launch vehicle" could actually be exported, THEN launched, etc, without violating ITAR. And since the regulation does not go into any detail about the "launch", other than it is a "launch" (and does not explicitly prohibit landing subsequent to launch) the implication is that there is no prohibition. I still think the regulation was just written sloppily. Jim Bell jimbell(a)pacifier.com

2 1

EzStego in Java!: Now Disappearing At A Site Near You
by romana＠glamazon.com 17 Dec '03

17 Dec '03

EzStego, my tool for "steganography made easy", now has its own web site at http://www.fqa.com/ezstego/ EzStego is currently alpha software. Use it at your own risk. It is a reimplementation in Java, with much improvement, of my notorious shareware product, Stego. EzStego is also shareware. I have made the source code available for peer review and verification. EzStego and EzSteggy are (C) Romana Machado 1996. All rights reserved. Romana Machado romana(a)fqa.com http://www.fqa.com/romana/ http://www.glamazon.com/

1 0

Re: support for "crack DES"
by jim bell 17 Dec '03

17 Dec '03

At 01:26 PM 10/3/96 +0000, Omegaman wrote: >Considering the situation -- considering that RSA has even signed on >to this scheme -- I'd have to say that I don't give a rat's ass what >Bill Gates claims. If Micro$oft bucks the system, I'll gladly >applaud their stand. > >The situation is not good at all. > >Cracking DES (whether distributed or through a hardware crack, or >both!) seems critical at this point. Just remember that it would be far better to make the crack look easy, than to make it look hard. quantity 9000+, $1,000 Pentiums for a year (plus maybe $500,000 in electricity) looks "hard." 1000 dedicated chips (whether they be FPGA or custom or...) for 1.5 months or so looks "easy." The latter crack looks far more likely to be repeated. The former is OBVIOUSLY a stunt. Jim Bell jimbell(a)pacifier.com

2 1

Esther Dyson: Pro-crypto in Poland
by Joel McNamara 17 Dec '03

17 Dec '03

I'm in Warsaw doing some consulting for a local ISP and got invited to an Internet conference last night targeted toward government ministry officials. Even though I speak no Polish, I decided to go because Esther Dyson was one of the keynotes. The three day conference is being held outside of Warsaw. The location has to be one of the most unique conference settings I've ever seen. How about in a classroom of what appeared to be the government police training barracks. Guarded gates, barking German shepherds in kennels, and armed, marching cops in camo fatigues. Interesting. Got to suggest it to the DefCon folks instead of Vegas. Anyway, not knowing what Esther was going to talk about, I started to smile when she launched into a very pro-crypto (as in anti-key escrow) presentation. Through a translator, she did a good job of covering most of the issues near and dear to Cypherpunks's hearts. She closed with urging the Polish officials to make their own decisions regarding privacy and crypto, and not be swayed by the actions of the US government. Someone in the audience asked what the average American thought of the ongoing crypto controversy. Esther answered correctly, that they're mostly clueless. Of course I had to stand up and mention the grassroots Cypherpunk efforts just to let folks know not everyone besides EFF is idly standing by (I think my host did a pretty good job of translating). Esther's comment was that Cypherpunks weren't average. You decide if that was a compliment or not. I don't know. Despite the bashing she got on the list about anonymity, I was impressed. Presenting the issues in a very logical and rational manner to government officials in "crypto-neutral" territory counts for something in my book. Anyway, based on all of the nonsense going on in the US, it's interesting to be in an environment where there are strong concerns about privacy and government abuses by the average citizen. I think Americans have taken for granted many things, that only living under a repressive regime would make them appreciate. Joel

1 0

Lack of reporting on CALEA and Encryption issues ...
by Ernest Hua 17 Dec '03

17 Dec '03

I must first say that your program is one of the finest in news reporting, and I tune in every day. However, nothing is perfect, and your program is no exception: I am very concerned by the lack of reporting on CALEA (the US $500 Million Digital Telephony bill) and the continuing maneuvering by the Clinton administration on the encryption issue. Two years ago, FBI Director Louis Freeh managed to slip a $500 Million wire tap bill into the Congressional budget using last-minute sneaks. (He and his predecessors had tried unsuccessfully for several years to do it in the full light of open democracy, so this was the only way they could force it down American's throats.) After seeing this pass, many Congress members refused to fund it because the FBI continued to violate terms of CALEA which required full accounting to Congress of how the wire tap capacities were to be designed and used. When the figures were finally published, the public balked. Not surprisingly, Freeh had to resort to the same last-minute maneuvers to sneak in funding for CALEA this year. If the news media had reported either incident (or both), I would probably not be so upset, but the news media completely ignored this horrible abuse of the democratic process. The same goes for the encryption issue. It is clear that all present and past administrations have sided strongly with law enforcement and national security agencies, and have refused to allow for the proliferation of strong encryption despite the fact that it is probably the single biggest technical obstacle to Internet commerce and personal privacy. Again I would not be so upset if they let the issue be decided in the full light of democracy rather than behind closed doors using the "if you only knew what we knew, you would agree with us" argument. This sentiment is precisely echoed by the Congressional study done by the NRC on national cryptographic policy. The Clinton administration was hoping that the two year study would buy time and would eventually agree with its opinion, and when it did not, the Clinton administration dismissed it as uninformed, despite the fact that most of the NRC panel did get the infamous "secret briefing" by the NSA. Basically, they are not open to reason on this issue; they are open to one and only one idea: that law enforcement and national security agencies having guaranteed access to information when they want it, and they don't care about the technical or the privacy implications. Oh .. and by the way, they want access to all information, not just that which crosses national borders. The significance of these two issues are difficult to summarize in a sound bite. The best I can think of is to watch the Tom Clancy movie "Clear and Present Danger". While watching this movie, note how the CIA finds the telephone conversations of the drug dealer's agent. That sort of capability is called "drift net fishing" (for obvious reasons). "drift net fishing" was not possible in the old days of wire taps because the phone company barely kept enough written logs to find the cables and the wires, let alone figure out exactly where they go. The problem is especially difficult in older/larger cities where phone company technicians often tap a wire (for normal services) wherever it works. By the FBI's estimates, each physical wire tap costs on the order of $50K. Basically, the huge cost barrier (in man power) kept the government's powers in check. Enter the digital and wireless age, and suddenly every signal from every phone, beeper, computer and other neato gadgets are sent all over the place. True, it has become more difficult to figure out where a signal is routed, and that is what the FBI complained about. On the other hand, it has become infinitely easier to intercept communications without detection because every transmission is just a perfect verbatim copy of the original. Suddenly, the cost of monitoring a phone is not so high. If the routing capability is there, the FBI agents can sit in their comfortable offices and press the right buttons, and the contents of the call is duplicated at their desks. Of course, they don't have to have real people monitoring such calls; they can have voice analysis computers do it. They can search for anything that sounds like "bomb" or "kill" or "shoot" or "blow up". In the Clancy movie, such "drift net fishing" capability is clearly being used for good purposes, and I certainly applaud that. I hope that all of the leading edge technologies used by our law enforcement and national security agencies are used for good purposes. But that is not what history tells us. History tells us that such technologies are oblivious to the morals and ethics of their masters. Even in the older days of wire tapping techniques, the FBI was able to illegally intercept communications of civil rights leaders and other "dangerous" elements of society. Therefore, to grant the government capabilities that would enable "drift net fishing" on our own citizens is setting a very dangerous precedence. What if the FBI decides to search for "democratic" or "republican" or "pro-choice" or "pro-life"? What if they search for "muslim" or "jewish" or "christian"? These are the real dangers of CALEA and encryption restrictions. The boogie men that will plan bomb attacks and kidnap children have always found a way to do it, and some have gotten away, without any help from encryption or secure telephones. If the law enforcement and national security agencies truly want to save lives and promote public safety, there are many other issues and problems to deal with, and they are wasting valuable time with these two issues; other the other hand, if they just care about keeping and enhancing their abilities to be omniscient, then their current behavior is quite consistent with that goal: 1. Lies and misrepresentations: a. Louis Freeh now claims that CALEA will cost $2 billion. b. The CALEA slush fund Freeh got passed at the last minute of this Congress is actually unlimited. c. Despite their promises of full reporting, they have actually succeeded in defeating all the reporting clauses in CALEA, again, thanks to this last minute sneak. d. Clinton, Gore and company have consistently denied that they intend to restrict domestic encryption. However, if you listen to Gorelick, Freeh, Reno, Crowell and others, you will find out that they absolutely against domestic encryption. 2. Beaurocratic maneuvering: a. Spent 3 years "investigating" Phil Zimmerman and then dropped without comment. b. Used every trick in the book to keep ITAR encryption rules from ever being directly considered for Constitutionality. (NSA internal counsel believes it will not withstand such a legal challenge.) c. Refused to clearly define what is exportable and what is not. (Keep it confusing so that most will stay away just to be safe.) Also refused to clearly define what is "export", given that encryption is just algorithms and information in the purest form. I appeal to you, as a respected news organization, to investigate this in detail and expose the facts and let the public decide. Thank you. Ern

1 0

Re: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 03 Oct 1996 19:47:06 +1030, Petr Snajdr wrote: > is Windows NT secured system ? No. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

4 4

[ANNOUNCEMENT] Cyclic codes
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Now is the time for all good little boys to cum in Timmy May's big mouth.

1 0

Re: gack vs. key escrow vs. key recovery
by jim bell 17 Dec '03

17 Dec '03

At 05:33 PM 10/3/96 -0700, Vladimir Z. Nuri wrote: >cpunks, a note about recent developments in "key recovery" initiative. > >I think cpunks as a group should reconsider very seriously their >own positions on cryptography and come up with something more >sophisticated than "any government bill or plan associated with >crypto is evil" which is the functional equivalent of the ideology >behind many recent posts. We don't think they're all NECESSARILY evil...they just turn out that way. Whose fault is this? >what is the precise difference between gack, key escrow, and >key recovery? Phase of moon? Season? Maybe it has something to do with the 11-year sunspot cycle? Bi-millenialism? >TCM has argued that the administration is muddying >the issue by manipulating the terminology. perhaps so, but I feel >that cpunks are equally guilty, by branding anything that emanates >out of the government as inherently orwellian. do you always have >to have an enemy? is the government always going to be your >enemy, no matter what they do? The government seems to be BEHAVING as if it is always going to be our enemy. Whose fault is that? >I have posted here before that many companies find the concept >of "key recovery" highly acceptable and even desirable. the >basic question is, what does this mean to wiretapping and >search warrants and subpoenas? >it is clear we are coming to a fork in the road at this moment. And it is our goal to not "get forked." >there are going to be two types of cpunk opinions based on recent >developments. > >1. those who feel that wiretapping was illegitimate from the >start and are working to make wiretapping impossible. confronted >with a legal search warrant/subpoena etc. for personal data, >they would not hand over keys. they would "superencrypt" in >systems that do etc. That's me... >2. those who feel that there is such a thing as a legal warrant >or subpoena for information protected by cryptography keys, and >would agree that this logically means that governments will be >getting access to "key recovery" infrastructures. On the contrary: The existence of a "legal warrant" doesn't mean that the government ought to (or even can) get access to data via a "key recovery" system. It's been mentioned numerous times that there are plenty of things that could be done (multiple encryption; encryption of GAK'd key; foreign key escrow with no request cooperation, etc) to prevent this. >personally I am leaning toward 2, because I feel that we already >live in such a society, We also live in a violent, oppressive society. Does this mean that we shouldn't try to fix its problems? > and that it is not orwellian. Pollyanna, meet Eric Blair. > companies are going to lean toward (2). No, they're going to lean towards yet another system, (3), whatever suits them. > I do agree >that the gov't has the potential to twist this process to evil >ends, If it had not had the desire to "twist this process to evil ends" government wouldn't have interfered with the natural development of key-keeping systems which serve only the key owner, not anyone else. > but that has always been true of everything about democratic >government, and the recipe for 200+ years has always been >and remains "eternal vigilance". in other words, I am in favor >of some kind of mechanism by which the government can obtain >keys via subpoenas/warrants. And I am in favor of some kind of mechanism by which the government can be destroyed by ordinary citizens. >cpunks, I think we should try to clarify our terms and come to >some conclusions. > >those who continue to pursue (1) are going to be perceived as >more and more radical and extremist, because arguably it is not >even a system we have today or one that was ever devised. I'd disagree with that. I've devised a system... >remember, the constution guarantees >freedom from *unreasonable* search and seizure, but never >prohibited search and seizure in the first place!! apparently >at least our found fathers believed that "reasonable" search >and seizure was a wholly legitimate function of government, >based on this wording. I guess that means that anything they call "reasonable," you'll agree with? Hint: Between about 1932 and 1968, wiretaps in the US were ILLEGAL. Nevertheless, they were done anyway, by the telephone company on request by the cops. (they were not admissible in court, however.) Question: Should we define the standard of 'reasonable' on the opinion of a group of people (cops, officials, politicians) who have a proven habit of using illegal techniques to get information? Apparently, cops are unwilling to let illegality get in their way. I'd say, on the whole, cops must have a rather enormous motivation to get wiretaps, and only a fool would think that this would fail to motivate them to adjust their standard of "reasonableness." >regarding (2): the government may actually help bring crypto >to the masses via the post office and other routes. are >cpunks going to continue to hold the simplistic, reactionary, >knee-jerk, black-and-white opinion that "anything with the >word 'government' in it is evil"? "if the government is doing >something, then we must sabotage it"? So far, such an opinion would fit the facts far better than anything you've said so far. Jim Bell jimbell(a)pacifier.com

1 0

Re: Flood Warning
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Oct 03, 1996 10:30:37, 'jim bell <jimbell(a)pacifier.com>' wrote: >> High-Tech Leaders Join Forces to Enable International >> Strong Encryption >> >> See: http://www.ibm.com/news/alliance2.htm > >This is apparently no longer valid. Is there a new one? ----- Sorry. It seems that you need to go through IBM's home page at: www.ibm.com, then follow the links to the full press release where the URL above comes up. This is the release that most of the media parroted. It does include hand-rubbing quotes by industry rats, er, finks. Anybody who can't get through and wants the PR-dirty, send me a blank message with the subject: RAT_ibm

1 0

Re: paging nets
by Mark Neely 17 Dec '03

17 Dec '03

>BBC Blows Radiopager Security Systems Wide Open >LONDON, ENGLAND, 1996 OCT 2 (NB) -- By Steve Gold. Now, why does he sound familiar :) Regards, Mark Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author

1 0

Re: Censorship?
by Omegaman 17 Dec '03

17 Dec '03

> What say ye?? > > :From: Zimm2(a)gnn.com (Zimm2) > :Newsgroups: alt.security.pgp > :Subject: Cypherpunks engaged in censorship? > :Date: Wed, 02 Oct 1996 08:39:50 > : > :It has come to my attention that Cypherpunks no longer allows users of > :Microsoft browsers to access their archives. The "cypherpunks archives" is not owned by the cypherpunks or maintained by toad.com (which is the host of the actual list). The owner of infinity.nus.sg/cypherpunks webpage maintains the archive. It is his effort and his choice to restrict the browser. Anyone is free to provide an archive the list. And anyone can read the list. > :Is it contradictory for an organization who proclaims an interest in the free > :exchange of ideas through the mechanism of the Internet to limit the exchange > :of ideas using an individual's software decisions as the criteria? Agreed. But the cypherpunks is not an "organization" in the strictest sense. The only "official" aspect of cypherpunks is the list hosted at toad.com. > :Are issues of annonymity and privacy and the encouragement of private use of > :powerful encryption and remailer tools secondary to and less important than a > :crusade against a software manufacturer? Of course not. But the owner of http://infinity.nus.sg/cypherpunks disagrees and since it's his website and he pays for it and compiles it... me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

CDT Policy Post 2.35 - Latest Admin Crypto Policy Pushes KeyEscrow
by Bob Palacios 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 35 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 35 October 3, 1996 CONTENTS: (1) Latest Administration Crypto Policy Continues Push Towards Key Escrow (2) Analysis of the Administration's Next Step: Short-Term Export Relief to Compel Long-Term Key Escrow (3) How to Subscribe/Unsubscribe to the Policy Post list (4) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) LATEST ADMINISTRATION CRYPTO POLICY CONTINUES PUSH TOWARDS KEY ESCROW This week the Administration announced the latest in a series of encryption policies designed to promote the use of key escrow systems, both domestically and abroad. This latest initiative continues the drive towards a global guarantee of law enforcement access to all encrypted communications and stored data. CDT believes that such governmental access systems -- whether through "key escrow" or "key recovery" -- threaten the fundamental privacy rights of computer users, both domestically and abroad. The latest Administration proposal would promote key escrow by temporarily easing current export restrictions on moderately strong encryption products. The proposal would raise the current export limit from 40 bits to 56 bits for companies that agree to produce key escrow products. Companies would be required to report their progress every six months. After two years, all exportable encryption systems stronger than 40-bits would have to include key escrow. Encryption producers will be compelled to be part of this scheme in order to stay competitive, eventually producing and adopting key escrow systems which so far have been largely rejected by the public. An overview of the latest Administration policy, considered within the context of the government's relentless drive towards key escrow, is attached below. - THE UNSWERVING GOAL: GOVERNMENT ACCESS TO ALL COMMUNICATIONS AND STORED DATA The long-standing goal of every major encryption plan by the Administration has been to guarantee government access to all encrypted communications and stored data. In 1993, the Clipper Chip policy achieved access through keys held by the government. In 1995, the "Clipper II" proposal allowed export relief for commercial key escrow systems. This summer, "Clipper III" sought access to keys through the dual incentives of export controls and a new government "key management infrastructure." In each case, the ultimate goal has been a guarantee of government access to the plaintext of encrypted information. Law enforcement and national security interests have driven this process. The attempt to institutionalize key escrow worldwide is a fundamental threat to the privacy and security of Internet users both domestically and abroad. * GUARANTEED ACCESS TO INTERNET COMMUNICATIONS AND STORED DATA WOULD BE A DRAMATIC EXPANSION OF CURRENT LAW ENFORCEMENT CAPABILITIES. Guaranteed access to Internet communications and stored files is a far greater intrusion into the privacy of computer users than current wiretapping. As individuals conduct more aspects of their lives online, key escrow is tantamount to guaranteeing law enforcement access to all of our most intimate conversations, sensitive personal records, musings and thoughts in a way never available before. Within the United States, Congress and the courts have established a delicate balance in electronic surveillance between law enforcement and individual privacy rights. Key escrow destroys that balance, providing law enforcement with a comprehensive dossier of individual lives and activities. * GLOBAL KEY ESCROW ENDANGERS THE PRIVACY RIGHTS OF COMPUTER USERS COMMUNICATING IN COUNTRIES THAT HAVE NO FOURTH AMENDMENT OR OTHER PRIVACY PROTECTIONS. An international key escrow scheme will necessarily entail the escrow of key information in foreign countries, with access by foreign governments through much weaker privacy protections. Such global key escrow jeopardizes the privacy rights of any American who communicates or stores files abroad, where key information might be released with few privacy protections. Moreover, global key escrow endangers the privacy and free expression of computer users everywhere by establishing the global machinery for government surveillance without privacy protections. * THE CHOICE TO ACCEPT THE COSTS AND RISKS OF KEY ESCROW SHOULD BE MADE BY INDIVIDUAL USERS, NOT FORCED UPON THEM. Additional access points to encrypted data will create added vulnerabilities, new security problems, and additional costs. While some users may decide that the benefits of key escrow outweigh the costs, governments should not be imposing these costs and risks on users who do not want them. Individuals should be able to choose the type of encryption they want. The global adoption of government access systems has serious, negative consequences on the privacy of computer users. The recent Administration announcement is another step in that wrong direction. ----------------------------------------------------------------------- WHAT YOU CAN DO -- ADOPT YOUR LEGISLATOR As Members of Congress head home for the fall elections, they need to hear from Internet users about the importance of encryption policy reform for the future of the Net. Adopt your legislator -- tell them that the Administration's Key Escrow plan threatens the basic privacy rights of Internet users, and let us know what they say! Please take a moment to join the "Adopt Your Legislator" campaign. By taking a moment to sign up to contact your member of Congress, you can make a critical difference in the debate over privacy and security on the Internet. Details can be found at: http://www.crypto.com/ and http://www.cdt.org/crypto/ Tell them it's "My Lock, My Key!" (The Adopt Your Legislator Campaign is a joint effort organized by the Voters Telecommunications Watch (VTW), the Electronic Frontier Foundation (EFF) and the Center for Democracy and Technology (CDT)). ----------------------------------------------------------------------- (2) ANALYSIS OF THE ADMINISTRATION'S NEXT STEP: SHORT-TERM EXPORT RELIEF TO COMPEL LONG-TERM KEY ESCROW The latest Administration encryption policy, announced October 1, continues this trend towards governmental access to all encrypted information. Using a carrot-and-stick approach, the plan promises moderate, short-term export relief in return for the development and eventual adoption of key recovery systems. The Administration unveiled its encryption initiative at a White House briefing by CIA Director John Deutch, Domestic Policy Advisor to the Vice President Greg Simon, Undersecretary of Commerce William Reinsch, and high-level representatives of the Department of Justice and the Office of Management and Budget. The basic outlines of the proposal included below were culled from the Administration's statement and Tuesday's White House briefing. Major features of the new policy include: * ALLOWS EXPORT OF 56-BIT ENCRYPTION PRODUCTS FOR THE NEXT TWO YEARS, "contingent upon industry commitments to build and market future products that support key recovery." Six-month licenses for 56-bit exports would be granted and renewed for up to two years -- contingent on satisfactory progress towards key escrow. * REQUIRES KEY ESCROW CAPABILITIES AFTER TWO YEARS in all exportable products with more than 40 bits. * "ENCOURAGES" THE ADOPTION OF KEY ESCROW SYSTEMS through international agreements, standards processes, and a new key management infrastructure. * TRANSFERS JURISDICTION OVER ENCRYPTION EXPORT LICENSING TO THE DEPARTMENT OF COMMERCE, but grants the Department of Justice a formal vote in the process. The President is expected to sign an Executive Order enacting many of these changes in mid-October. Other pieces will be published as agency rules or regulations; a small part of the proposal (rules governing key holders) may require legislation. WHAT IT ALL MEANS FOR INTERNET USERS: In the short run, computer users may see more widespread availability of moderately stronger encryption products (up to 56-bit key length) if vendors choose to and are able to meet the "commitments" required under the proposal. In the longer term, however, even these moderately stronger products will only be exportable with key escrow. Ultimately, this proposal is designed to force the widespread adoption of key escrow systems, both domestically and abroad. A. EXPORT CONTROL RELIEF AS AN INCENTIVE FOR KEY ESCROW: The Administration proposal would allow for short-term export of 56-bit DES equivalent encryption products in return for commitments from exporters to develop "key recovery" systems. * Starting on Jan. 1, 1997, the Administration would begin granting six month general licenses for export of 56-bit encryption products. * Licenses would be granted "contingent on commitments from exporters to explicit benchmarks and milestones for developing and incorporating key recovery features into their products and services." * Additional six month licenses would be granted "if milestones are met." * In two years, "the export of 56-bit products that do not support key recovery will no longer be permitted." * Export of longer key lengths would continue for certain sensitive financial applications. * Export of longer key lengths may be allowed more generally once key escrow mechanisms are in place. Questions remain as to exactly what form the commitments from exporters will take, who will qualify for these relaxations, and what will happen at the end of two years to 56-bit non-escrow products in the marketplace and how they will be supported. No interoperability restrictions on products have been mentioned, and the Administration seemed to indicate that it would be willing to tolerate a greater degree of interoperability between products. WHAT EXPORT CONTROLS MEANS FOR INTERNET USERS: This Administration export control scheme coerces industry into developing key escrow systems, domestically and abroad, whether they want to or not. Since 1992, export controls have been the favorite vehicle for enforcing the adoption of such key escrow systems. The strong public desire for secure global communications has allowed government to use key escrow as a precondition for export relief. Export controls are a force for key escrow in the domestic market as well as the international market because of the need for secure international communications and the cost of producing product lines for U.S. use only. The Administration realizes this: as CIA Director Deutch stated at the White House press briefing, he was more concerned with encryption that people "buy at Sears" than about less popular strong encryption products that the Administration concedes will always be available. In addition to their impact on the market for key escrow, the proposal's export controls and key length limits themselves hurt user privacy and security. * Export controls don't make sense for a global Internet; they place business at a competitive disadvantage and prevent deployment of a secure global infrastructure. * 56-bits is not enough for many applications. CDT welcomes the Administration's recognition that 40-bit products are not strong enough, but last winter's study by a panel of encryption experts argued that DES keys can be cracked relatively quickly by well- financed groups, and that 70- to 90-bit keys are more appropriate. * Key length limits are a flawed approach because they presuppose that some entities should be able to break keys and some should not -- a solution that is unlikely to appeal to worldwide consumers of encryption. B. "KEY RECOVERY": Government access to the plaintext of encrypted data remains the centerpiece of the Administration proposal. Major features of the key escrow requirements in the latest proposal include: * Key escrow systems would rely on a trusted party to recover a user's confidentiality keys for use by law enforcement acting under "proper authority." * The trusted recovery party might in some cases be internal to the user's organization, but in all cases notice to surveillance targets that their key information had been released would be prohibited. * Access to keys internationally "would be provided in accordance with destination country policies and bilateral understandings." * The Administration will pursue legislation to govern the release of keys, provide criminal and civil penalties for unauthorized releases or theft of keys, and provide liability protection for key holders. * The Administration will continue to "encourage" the adoption of key escrow systems through it's broad efforts to promote international key escrow agreements, government key escrow purchasing standards, and the creation of a key management infrastructure. None of the officials at the White House briefing were able to give specific information about the requirements to be placed on key holders (e.g., response times, security clearances, etc.) The Administration did indicate a broader approach to allowing industry key escrow systems that more limited access to confidential information through, for example, recovery of specific plaintext or separation of key information. NOTE: KEY ESCROW V. KEY RECOVERY -- CDT recognizes that real progress has been made in the development of systems that provide access to the plaintext of encrypted data while minimizing the collection and disclosure of sensitive key information. However, from a privacy policy perspective these approaches have the same basic privacy problem: they are designed to provide law enforcement with guaranteed access to all encrypted information. WHAT "KEY RECOVERY" MEANS FOR INTERNET USERS: CDT recognizes that some companies and users may wish to use key escrow systems. The Administration's apparent recognition that these systems are best designed in the private sector is welcome. However, this policy's acknowledged desire to widely promote key escrow is dangerous and threatens the privacy of users: * Users are being pushed towards key escrow, whether they want it or not. The Administration is using the enormous pressure of export controls, competitive markets, and industry standards to force adoption of key escrow. Each user should be free to decide for themselves whether to accept the costs of key escrow. * International key escrow doesn't protect privacy in a world without a Fourth Amendment -- What legal standards apply to communications when keys are held in foreign countries? Officials have been unable to clearly explain how the privacy of computer users will be preserved. * Key escrow dramatically expands law enforcement capabilities -- Guaranteed access to encrypted information is a far greater intrusion into our lives than the delicate balance struck under U.S. privacy law. * Key escrow is unproven -- The NRC's recent study argued that a policy relying on key escrow is "not appropriate at this time" and "is likely to have a significant negative impact on the natural development of applications." * Key escrow creates new security vulnerabilities, such as the creation of large aggregations of sensitive key information, that are poorly understood. C. TRANSFER OF JURISDICTION TO THE COMMERCE DEPARTMENT: According to the White House, "after consultation with Congress, jurisdiction for commercial encryption controls will be transferred from the State Department to the Commerce Department." * Encryption licenses will be reviewed under the Commerce Department's "normal process" by a committee with representatives from the Departments of Commerce, State, Defense, Energy, and for encryption exports, Justice. * The Justice Department will have a single vote in the review committee, which will make its decisions by majority rule. * The State Department will only have jurisdiction over special, single customer, military-specific encryption products. WHAT TRANSFERRING JURISDICTION MEANS FOR INTERNET USERS: While the switch to Commerce has been perceived as helpful by some, CDT believes the benefits are unclear if fundamental policy remains unchanged. The switch to Commerce will have little impact on the underlying policy direction aimed at institutionalizing key escrow. Moreover, the Commerce Department's review committee is heavily weighted towards the law enforcement and national security perspective (State, Defense, Justice, and Energy), with the Commerce Department the lone representative of industry and consumer interests. Finally, the presence of domestic law enforcement in export control decisions raises serious questions about the ultimate goal of this policy. IV. CONCLUSION The Administration's latest encryption proposal remains wedded to a flawed, key escrow and export control oriented approach that does not address the privacy concerns of users. While it contains some welcome ideas, at its heart the Administration proposal uses the short-term easing of export controls to promote key escrow through a Faustian bargain with an industry desperate to produce strong security products. Such manipulation of the market for encryption products is designed to forward law enforcement's dangerous agenda of worldwide governmental access to all encrypted information. The march towards institutionalized key escrow is a real threat to the privacy of computer users, particularly in a world where not everyone has a Fourth Amendment. The United States should be a force for Internet privacy and security worldwide. Rather than forcing key escrow on a wary public, the Administration should look to work with Congress, privacy and Internet advocates, the user community, and industry to craft a truly voluntary policy that meets the privacy and security needs of computer users in the global Information Age. ----------------------------------------------------------------------- (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: http://www.cdt.org/ FTP ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.35 10/3/96 -----------------------------------------------------------------------

1 0

Re: ITAR satellite provision
by Greg Broiles 17 Dec '03

17 Dec '03

On Thu, 3 Oct 1996, jim bell wrote: > The wording was > clearly intended to be an exception to a rule. What the wording doesn't > include is the "exception to the exception," most likely because they > weren't thinking in too great a detail when they wrote the regulations. Yow. The "if we put it in a rocket it's exportable" interpretation made me think twice before posting the text of that definition, because it's seductive and wrong. I posted it because it's amusing to think about and because we all had a good laugh about it at the Mac crypto conference; but I'd feel like a jerk if someone got themselves in a lot of trouble with an enthusiastic misreading of that sentence out of pages and pages of regulations (plus quite a few more pages of opinions interpreting those regulations). > It appears that the government left a loophole so large that you could > drive a truck...er...shoot a rocket through it. If you think you've found an enormous loophole in a regulation which has been around for 15-20 years, you should double-check your research and get a good nights' sleep. Law is like science this way - if you think you have found room-temperature fusion you should stop and check your work. It's much more likely that you're not reading carefully or you've missed something. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Pager security
by Dave Emery 17 Dec '03

17 Dec '03

Lest anyone doubt this, pagers in the US have the same exact vulnerability as those in the UK. No current paging systems use any kind of serious encryption and all can be intercepted by using a scanner, a very simple data detector consisting of one IC and an ordinary PC running appropriate software. I wrote a USENET article about decoding POCSAG paging back in 1993, and am aware of at least four different individuals who have implemented programs based in part on my description of the protocol - three of whom have sold the product to the hobbiest market. Dave Emery N1PRE die(a)die.com

1 0

RE: gack vs. key escrow vs. key recovery
by blanc 17 Dec '03

17 Dec '03

From: Vladimir Z. Nuri, [who still doesn't get it] what is the precise difference between gack, key escrow, and key recovery? [and] I'll be watching the debate closely, as the true extremists incapable of compromise (and thereby living in a fantasy world) show their colors.... ............................................................................... The precise difference is: who is in control. In order to understand this critical point you must understood the idea of having personal authority as a standard for living. But you would expect that everyone should accept being subject to inspection by default, as if governments owned everyone within the national boundaries and keeping personal things away from them were a sin. The more that governments obliterate the lines of division between what is exclusively one's own to manage and what they have "the right" to share in (including holding your extra keys) or to demand (access to private communication), the less defined the concept of individuality becomes (as compared to being a "borg" of the State) and the more difficult it becomes intellectually to uphold one's separateness from it, since it all seems to be the same, undifferentiated control over things in general ("we are all One - how could you object?"). It is right to resist any attempts by the State to assimilate everyone into its fold by blurring the boundaries of authority (in its favor). It is a better thing to strengthen each individual's ability to maintain their own, than to put them in a situation where they *must* use the assistance of (become dependent upon) the (supposed) benevolence and rational judgement of an overwhelming overseer. It is better to reserve the right of authority over who & when anyone may keep one's software keys in escrow. It is better than to forfeit the right to make that decision on one's own good time and according to one's own plan, which would otherwise weaken that authority. .. Blanc [If 51% of the true extremist voters would elect Harry Browne, GAK would not be a problem.]

1 0