December 2003 - cypherpunks-legacy

RE: Anyone considered adding crypto into Microsoft Outlook?
by Robert Barnes 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have downloaded, and strongly recommend, Jon S. Whalen's Microsoft Exchange Client PGP Command Extension. It adds PGP functionality to Exchange Client in a very neat and clean way. Rob -----BEGIN PGP SIGNATURE----- Version: 2.63ui iQCVAwUBMqYkarl39AMaT2JtAQHmtQP/Yu8rh5OkkMC1GVEnz4hY6xFczeDM0Y3U 7toMIDZLVnDwRXuoo9+10sUMnB289mkjoi54fuAhbkjDKYejXVIFilJoSFq+s5FZ K0Rdcaj8qv6VkJwL63gXMdXsFlxHIyQ/oK9/3r7tBgFyzab3tcjVXUGRy/NE5sLD osrJm4WzfVU= =+ffh -----END PGP SIGNATURE-----

1 0

Re: Strong-crypto smart cards in Singapore and Germany
by um＠c2.net 17 Dec '03

17 Dec '03

Peter Gutmann writes: >The standardisation committee of the German banks have also produced >an electronic wallet which should have 25 million (yes, 25M) users by >January of next year. Again, this is a pure electronic wallet, with >2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. >[...] This looks like a very nice system, and unlike Mondex doesn't >rely entirely on the hope that criminals can't get at the data on the >card. For 'security reasons', all transactions are logged in what is called 'shadow accounts'. Not what I would call a very nice system.

1 0

Microsoft & Key Escrow
by Blake Coverett 17 Dec '03

17 Dec '03

Following are some of the relevent snippets from http://www.microsoft.com/intdev/security/export/exporfaq-f.htm. The comments in square brackets are mine. ---cut here--- What is Microsoft's position on supporting key escrow? Key escrow encryption is not a market-driven solution and it raises serious privacy concerns for many customers. It is also new, undeveloped, untested, and uncosted, and it will take a long time to be worked out. Additionally, customers have expressed hesitation about mandatory key escrow, especially if they have to give the keys to the government or a government-selected third party. Therefore, we are not actively adding support for key escrow in our products and technologies. [About as good as we can ask for. I would, however, like that last sentence better if the word 'actively' was missing.] Shouldn't the U.S. government be able to access information that could prevent terrorist acts and crime? Strong non-key escrow encryption is already available from retail outlets, foreign companies, and off the Internet. Thus the U.S. government is already having--and will continue to have--a harder time in the future accessing plain text regardless of U.S. export restrictions. [I suppose it would be too much to expect a third sentence reading. 'This is a good thing.'] What is key recovery? How does it relate to key escrow? Market-driven data recovery refers to a product feature that allows users to maintain a spare private encryption key in a safe place. Generally, a data recovery system escrows a copy of the session key with the message or file and the user (or perhaps his employer) controls the decision whether to utilize this feature. With key escrow the U.S. government holds or has access to a user's private encryption key. It is not yet clear whether such systems are exportable. In the October 1 announcement, the U.S. government referred to "key recovery" without defining it; in all likelihood, however, they still have in mind government key escrow, and not market-driven data recovery. [Hmm... it's just possible that Microsoft's spin doctors are better than those of the US government. Perhaps they can sell the world on their definition of 'key recovery' instead of the one we know the TLAs intended.] ---cut here--- regards, -Blake

3 2

RE: Microsoft & Key Escrow
by Tom Albertson (LCA) 17 Dec '03

17 Dec '03

These issues are also addressed at somewhat greater length than in the FAQ in "Microsoft Policy on Export Controls on Encryption" at http://www.microsoft.com/intdev/security/export/expcont1.htm (updated since the recent Administration announcements). rgds tom >-----Original Message----- >From: Blake Coverett [SMTP:blake@bcdev.com] >Sent: Wednesday, December 04, 1996 6:12 PM >To: 'cypherpunks(a)toad.com' >Subject: Microsoft & Key Escrow > >Following are some of the relevent snippets from >http://www.microsoft.com/intdev/security/export/exporfaq-f.htm. >The comments in square brackets are mine. > >---cut here--- >What is Microsoft's position on supporting key escrow? > >Key escrow encryption is not a market-driven solution and it raises serious >privacy concerns for many customers. It is also new, undeveloped, untested, >and uncosted, and it will take a long time to be worked out. Additionally, >customers have expressed hesitation about mandatory key escrow, especially if >they have to give the keys to the government or a government-selected third >party. Therefore, we are not actively adding support for key escrow in our >products and technologies. > >[About as good as we can ask for. I would, however, like that last sentence > better if the word 'actively' was missing.] > >Shouldn't the U.S. government be able to access information that could >prevent terrorist acts and crime? > >Strong non-key escrow encryption is already available from retail outlets, >foreign companies, and off the Internet. Thus the U.S. government is already >having--and will continue to have--a harder time in the future accessing >plain text regardless of U.S. export restrictions. > >[I suppose it would be too much to expect a third sentence > reading. 'This is a good thing.'] > >What is key recovery? How does it relate to key escrow? > >Market-driven data recovery refers to a product feature that allows users to >maintain a spare private encryption key in a safe place. Generally, a data >recovery system escrows a copy of the session key with the message or file >and the user (or perhaps his employer) controls the decision whether to >utilize this feature. With key escrow the U.S. government holds or has access >to a user's private encryption key. > >It is not yet clear whether such systems are exportable. In the October 1 >announcement, the U.S. government referred to "key recovery" without defining >it; in all likelihood, however, they still have in mind government key >escrow, and not market-driven data recovery. > >[Hmm... it's just possible that Microsoft's spin doctors are > better than those of the US government. Perhaps they can > sell the world on their definition of 'key recovery' instead of > the one we know the TLAs intended.] >---cut here--- > >regards, >-Blake >

1 0

Politeness
by logos 17 Dec '03

17 Dec '03

Dimitri Vulis wrote: >logos <logos(a)c2.net> writes: >> I have been unfailingly polite to you. Do you have it >> within your character to respond to me in kind? >Do you think spelling my last name "Vilus" is polite? I think it was neither polite nor impolite. It was a innocent transposition error. Correcting the error and apologizing were polite, however. Do you disagree? I have already raised the question of your apparent lack of intellectual honesty in that you seem to not apply the same rules of conduct on yourself as you would on others. In English there is the saying, 'what is sauce for the goose, is sauce for the gander'. I note that you have spelt my name as 'logos'. As it is a proper noun in the usage and I have spelt it with the 'L', I would ask you if you consider this spelling of my name to be polite? Logos out

4 4

Chippen@Dale
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 07:37 AM 12/4/96 -0800, Dale Thorn wrote: : :If you, Sandy, and the other offenders *really* want to keep the noise :down, then next time ask John directly for a reply, and if none is :forthcoming, say to the list *once*, "John will not answer up", etc., :and let the subscribers draw their own conclusions from the silence, :instead of from your inane "defenses". : Dale, John has no obligation to say anything. In all fairness, no conclusions should be drawn based on any individual's saying nothing. Such thinking is from the Dark Ages. Lighten up, and let go of it.

1 0

PGPfone list
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jmr(a)shopmiami.com Date: Thu Dec 05 22:54:33 1996 [My apologies for cross-posting this, but it's important IMO.] The list owners have given me permission to post an announcement of a list for those of us who wish to play with the new PGP-fone software. This is a list solely for the discussion of PGP-fone. It is to be low volume and on topic, with none of the garbage that the cypherpunks are presently enduring (my killfile filter gets enough of a daily workout as it is). Usual rules apply on the posting of private mail without the other author's consent, polite discussion, etc. Violators of these policies will likely be *truly* "censored," (booted off the list, *and* unable to post). To subscribe to the list, use the web based gateway at: http://www.rivertown.net/cgi-bin/lwgate [To prevent abuse, your subscription will be verified.] PGPfone for Macintosh and Windows 95/NT can be obtained at these locations: US/Canada users [like PGP, PGPfone falls under ITAR export restrictions.]: http://web.mit.edu/network/pgpfone International users: http://www.ifi.uio.no/pgp/PGPfone.shtml Current versions are: Macintosh - version 1.0b7 Windows 95/NT - version 1.0b2 These versions DON'T talk to previous versions. Presently, the PGPfone Owner's manual is a MAC file and unfortunately it won't open in the Windows environment. Those of us who are MAC-impaired can use the on-line manual available at: http://www.pgp.com/products/fone_01.cgi There is also a "PGP Fone Registry" at the Rivertown.net PGP-users site (which is quite extensive and worth a look for other crypto-related stuff). At this site, people willing to test PGP Fone with others can leave their names and e-mail addresses, along with their area code and local telephone exchange (first three digits) which indicates willingness to be contacted via e-mail to possibly set up a time and place to use PGP Fone with each other. It's very basic right now. You can access it at: http://pgp.rivertown.net/pgp-fone and follow the instructions to sign up. The biggest problem folks have had with PGP Fone is finding someone else to use it with. This site can help alleviate this. Rivertown.net also has a fine PGPfone icon by Mike Acklin. P.S. I concur with Peter Trei on the Forbes ASAP big issue. Try to find a Forbes subscriber and read it all. He left out one author, cypherpunk Bill Frezza. I liked Bill's article best of all. IMO, Buckley and Paglia unwittingly proved in their ASAP articles that it's much easier to fashionably label yourself a "libertarian" than it is to actually *be* one. JMR Regards, Jim Ray DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Please note new 2000bit PGPkey & address <jmr(a)shopmiami.com> PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMqeZATUhsGSn1j2pAQFFOQfQzF0pGgGKt9/VR44TzGxAq9yk7dUs0JPK 4G9TIRePcnZ+IYqBFiqGaCws9EGrK/1ztv7ryl0FstROmldTxFj197lSsEysPMQb M8DUbKsDbsLYlNJNCFJkYz9tihM5w5h1YNj4jPwjec3Js/Bh4T3ab6d+h4Ax1ku0 wsWlVv0keP2yXhcFFHPRkkyXmPtTL31/zkGKkwU9dY/efYSf4GeIApfvnYXzInFD vraFSVd0Qi+8py86RZBauKO/vt7mj9r32HCZevPE89AUDVgVnb9Y5SeT9J0f2pXT qHrpDEguBofvsU/q436Vgla+wrHme2rNYqEPqDslSkNzgg== =FH37 -----END PGP SIGNATURE-----

1 0

Intellectual dishonesty
by logos 17 Dec '03

17 Dec '03

Dimitri Vulis wrote: > > LOGOS <logos(a)c2.net> writes: > > > > Yes, that and other catagorizations which are > > irrelevant to the primary focus of this list. > It's funny that you should say this, since Tim May and other prominent > "cypher punks" devote so much attention to their "enemies'" ethnicity and > religion. Recall the attacks on "crazy Russians", "immigrants who abuse > American freedoms", the recent attack on Hispanics, the attacks on Jews, > the attacks on Mormons... Yes I do recall some of those statements. Since you feel that those 'attacks' were inappropriate, is it not intellectually dishonest to engage in such 'attacks' yourself? If it was wrong for them, how can it be right for you? If your age, sex, sexual preference, race, ethnicity, mother tongue, nationality, etc. are irrelevant to the discussions on this list, what possible justification is there for you to raise such issues in my case? I wrote: > > In any case, it is a good example of the informal logical > > fallacy of 'over generalization'. As I understand it, there > > are circa 1000 people subscribed to Cypherpunks. To paint > > an entire group with such a characterization is both > > illogical and unfair. I also question your use of the To which you replied: > What about painting entire ethnic or religion groups, as Timmy May does? This is truly a non-sequitor. I am sure you know better than this. Tim May is responsible for his actions; you are responsible for yours. Taken to it's logical conclusion, if Tim were to murder a random Russian immigrant, you would be justified in killing a random native American. As I said before, you are obviously too smart to seriously entertain such an irrational viewpoint. Thus it is difficult to draw any conclusion other then that you are rationalizing your inappropriate behaviour. > You sound like someone who doesn't read this list, but only "reads the > logs" and sees the complaints from the likes of Arsen... Actually, I read it quite thoroughly. > I've recently quoted the selected writings of Paul Bradley, most of > which were far more "uncultured; crude; or boorish" that anything I > ever said. For example: [elided] Again, would you please explain the logical basis for committing the same abuses you cite from others? I would think you would seek to distance yourself from such behavior, rather than to exceed it. The inappropriate abuse of the 1000 members of this list by others can in no way excuse their further abuse by you. > > It is obvious to me that you are an intelligent person. > > I am concerned, however, with your apparent intellectual > > dishonesty. It would appear that you know perfectly well > You want intellectual dishonesty - look upstairs from toad.com. No, I want intellectual honesty. But even if I look upstairs from toad.com and find intellectual dishonesty, how would that in any way mitigate your apparent intellectual dishonesty? Are you arguing that one is somehow dependent on, or the result of the other? This makes no sense to me. Does it to you? > > that your posts serve no purpose in the cause of promoting > > privacy through the use of cryptography. It is hard to > > draw any other conclusion then that you are intentionally > > being provocative for the purpose of disrupting the work > > of this list. If this is not so, I apologize, but how > > else can we judge your actions? Please step outside of > > yourself for a moment and give us an honest self-assessment > > of your behavior and the motives behind it. > The work of this list appears to be character assassination. If people like > Paul Bradley and Tim May insist on slandering people and trying to harm > their professional reputations (see the thread on "don't hire" lists), > I will do my best to defend them and their freedom of speech,... The above does not appear to make sense. Did you leave something out? It is unclear to me how rude and provocative personal attacks and broad, unkind generalizations about Cypherpunk list members defends freedom of speech, protects privacy or promotes cryptography. Would you please explain the rationale behind your actions? Logos out

3 2

RE: Microsoft & Key Escrow
by Blake Coverett 17 Dec '03

17 Dec '03

Igor wrote: > this is unfortunate -- key escrow is a very good thing as long > as it is not mandated by law. > > any reasonable employer concerned about secrecy and recoverability > of his data should use key escrow solutions for their employees' > encryption. It appears you only read the first question and answer. Go back and read the third one. regards, -Blake

1 0

for future reference
by logos 17 Dec '03

17 Dec '03

1 0

No Subject
by Julian Assange 17 Dec '03

17 Dec '03

>From smtpd Fri Dec 6 03:03:59 1996 Return-Path: <owner-foreignc(a)presence.lglobal.com> Received: (from smtpd@localhost) by suburbia.net (8.8.3/8.8.2) id DAA08167 for <proff(a)suburbia.net>; Fri, 6 Dec 1996 03:03:59 +1100 (EST) Received: from presence.lglobal.com(207.107.12.2) via SMTP by suburbia.net, id smtpd008159; Thu Dec 5 16:03:41 1996 Received: (from majordom@localhost) by presence.lglobal.com (8.6.12/8.6.12) id PAA02103 for foreignc-outgoing; Thu, 5 Dec 1996 15:43:37 GMT Received: from presence.lglobal.com (jessepub(a)presence.lglobal.com [207.107.12.2]) by presence.lglobal.com (8.6.12/8.6.12) with SMTP id KAA02097 for <foreignc(a)lglobal.com>; Thu, 5 Dec 1996 10:43:34 -0500 Date: Thu, 5 Dec 1996 15:43:33 +0000 (GMT) From: Local GlobalPublishing <jessepub(a)lglobal.com> To: foreignc(a)lglobal.com Subject: ForeignCorrespondent REVENGE OF HER MAJESTY'S SPOOKS Message-ID: <Pine.BSI.3.93.961205154318.2075A-100000(a)presence.lglobal.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Precedence: bulk Reply-To: emargolis(a)lglobal.com Sender: proff Foreign Correspondent Inside Track On World News By International Syndicated Columnist & Broadcaster Eric Margolis <emargolis(a)lglobal.com> ,,ggddY"""Ybbgg,, ,agd888b,_ "Y8, ___`""Ybga, ,gdP""88888888baa,.""8b "888g, ,dP" ]888888888P' "Y `888Yb, ,dP" ,88888888P" db, "8P""Yb, ,8" ,888888888b, d8888a "8, ,8' d88888888888,88P"' a, `8, ,8' 88888888888888PP" "" `8, d' I88888888888P" `b 8 `8"88P""Y8P' 8 8 Y 8[ _ " 8 8 "Y8d8b "Y a 8 8 `""8d, __ 8 Y, `"8bd888b, ,P `8, ,d8888888baaa ,8' `8, 888888888888' ,8' `8a "8888888888I a8' `Yba `Y8888888P' adP' "Yba `888888P' adY" `"Yba, d8888P" ,adP"' `"Y8baa, ,d888P,ad8P"' ``""YYba8888P""'' REVENGE OF HER MAJESTY'S SPOOKS by Eric Margolis 5 Dec 1996 Comrade-in-Chief Leonid Ilyich Brezhnev banged his fist onto a solid oak table, knocking over bottles of Armenian mineral water and vodka, and bellowed at the ashen-faced chiefs of the Soviet aircraft industry: `The Motherland's honor is a stake. Beat the Concorde! Or you will all be designing coal mines cars in Siberia!' Such is the story I'm told by someone who was there. I'm recalling these events now because a group of US aircraft companies and NASA have partnered with Russia's Tupelov aircraft firm to take the old TU-144 supersonic transports out of mothballs and fly 32 test flights. My advice to the eager US aviation people is: watch the tests from the ground. Here's why: In the late 1950's and early 1960's, the Soviets were boasting they would shortly overtake America's capitalist technology. Soviet propaganda dismissed France as a nation of foppish boulevardiers, and Britain as a degenerate, toothless old lion. The `degenerate' British and French stunned and mortified Moscow by announcing development of a supersonic jet transport, made with European technology. The outcome of this project was the exquisite, technologically superb Concorde, which continues today to fly passengers at twice the speed of sound. The Kremlin ordered a crash program to develop a Soviet supersonic transport, or SST, no matter the cost. The famous Tupelov design bureau was selected to develop the plane, by `storming,' if necessary, 24-hours a day, until completion. Unfortunatly, Tupelov designers couldn't develop a workable design in the short time given them by the Kremlin. So KGB was ordered to steal the blueprints of the Concorde. A score of KGB agents were dispatched to England and France in a highly complex and expensive mission designed to infiltrate plants where the Concorde was being built. Such military-industrial spying is often used by nations trying to save time, money, or both. Agents of Israel's Mossad, for example, managed to steal the complete blueprints of the French Mirage III fighter after Paris refused to supply them to Israel. Now comes the fun part- as told to me by the late, distinguished RAF commander, Air Marshall Menaul. British counter-intelligence, MI5, according to Menaul, learned of the Soviet penetration and identified many of the agents whose haste, and deviation from KGB standard operating procedures, made them sloppy. The wicked British got their top aviation engineers to doctor a set of Concorde plans - so that the aircraft's center of gravity was too far aft, making it dangerously unstable, particularly at low speeds. The bogus drawings were left where they could be purloined by the KGB. A few days later, the tainted plans were in Moscow. On Dec 31, 1968, the TU-144 - instantly dubbed `Conkordski'- made its maiden flight - a few days before the Concorde's inaugural flight. Chairman Brezhnev was ecstatic. In 1973, the Soviets triumphantly sent their TU-144 to the Paris Air Show. There,. before the world's eyes, the `Conkordski' went out of control and crashed. The horrified Soviets became the butt of international ridicule. Another TU-144 crashed outside Moscow in 1978. From 'pride of Soviet aviation,' the poor TU-144 soon was called, `the supersonic coffin.' A few were put into Moscow-Tashkent service, first flying terrified passengers, then just mail. The `Conkordski' were taken out of service in 1978 after the second spectacular accident. I'm sure many toasts were drunken that night in London at MI5 headquarters. The new TU-144 flights are being conducted with the Americans to develop a future, 300-passenger SST. Tupelov has refurbished some of the aircraft, but I'm uncertain if the basic design flaw introduced by Her Majesty's spooks has been corrected. Probably not, leaving the Conkordski lethally wobbly. Such is the revenge of British intelligence, served up cold and lethal - as the best revenge always is. copyright eric margolis 1996 ***************************************************************** ***************************************************************** --------------------------------------------------------------- To receive Foreign Correspondent via email send a note to Majordomo(a)lglobal.com with the message in the body: subscribe foreignc To get off the list, send to the same address but write: unsubscribe foreignc WWW: www.bigeye.com/foreignc.htm For Syndication Information please contact: Email: emargolis(a)lglobal.com FAX: (416) 960-4803 Smail: Eric Margolis c/o Editorial Department The Toronto Sun 333 King St. East Toronto Ontario Canada M5A 3X5 ---------------------------------------------------------------

1 0

W3C Picks PICS for Censorship
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>> W3C ISSUES PICS AS A RECOMMENDATION; PICS READY FOR WIDESPREAD ADOPTION; ENABLING USERS TO FILTER INTERNET CONTENT WITHOUT CENSORSHIP - The World Wide Web Consortium today endorsed the Platform for Internet Content Selection specifications as a W3C Recommendation. This Recommendation represents the W3C's highest "Stamp of Approval." It signifies that PICS specifications are stable ... [Business Wire, 854 words] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

NEWS.COM Dispatch, Dec. 4, 1996
by The CNET newsletter 17 Dec '03

17 Dec '03

**************************************** NEWS.COM DISPATCH Wednesday, December 4, 1996 San Francisco, California, USA *************************************** WELCOME! *************************************** NEWS.COM DISPATCH summarizes the up-to-the minute technology news presented by NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd *************************************** SCOOPS AND TOP STORIES Gore gets an earful from cybermoguls on encryption policy Steve Jobs tells tech crowd, "It's the content, stupid!" Microsoft's Ballmer takes verbal digs at NC-happy competitors ANNOUNCEMENTS An easy way for you to customize NEWS.COM Send us your questions, comments, flotsam, and jetsam How to subscribe and unsubscribe *************************************** SCOOPS AND TOP STORIES GORE GETS AN EARFUL FROM CYBERMOGULS ON ENCRYPTION POLICY Al Gore, the ultimate information highway cheerleader, won't like what he sees in his in-box: stern criticism of the White House's encryption policy. The Business Software Alliance's letter says Bill and Al are heading in the "absolute wrong direction." But giving is better than receiving (it is, after all, the holidays), and the industry group offers five ways out of the morass. http://www.news.com/News/Item/0%2C4%2C5909%2C00.html?nd STEVE JOBS TELLS TECH CROWD, "IT'S THE CONTENT, STUPID!" The man who helped launch the computer revolution of the 1980s is now exhorting creative types to take their rightful place at the digital table. Citing blockbuster films Toy Story, Jobs preached that only the combination of technology AND creativity will get the consumers' juices flowing. http://www.news.com/News/Item/0%2C4%2C5913%2C00.html?nd MICROSOFT'S BALLMER TAKES VERBAL DIGS AT NC HAPPY COMPETITORS Perhaps you thought Microsoft was worried, or at least cranky, about all the predictions Ellison and company have been making about the network computer dethroning the PC as machine du jour? Not at all. In fact, says Steve Ballmer, "it's fantastic!" http://www.news.com/News/Item/0%2C4%2C5896%2C00.html?nd *************************************** ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify topics, keywords, or sections you're interested in, and Custom News will a create a page of headlines and summaries for stories matching your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com HOW TO SUBSCRIBE AND TO UNSUBSCRIBE To subscribe to News Dispatch: Send mail to listserv(a)dispatch.cnet.com with the message: subscribe news-dispatch (your name) in the message body. To unsubscribe send the message: signoff news-dispatch *************************************** CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Re: PGP 5.0??
by William Knowles 17 Dec '03

17 Dec '03

Ares GodOfWar <ares(a)imaginet-us.net> writes: >lo all > >i am in a terrible mess... >can someone inform me as to the location of PGP 5.0 shareware?? >i need it asap ;] Telnet to: all.net login: your name Password: guest Good Luck! William Knowles erehwon(a)c2.net -- William Knowles <erehwon(a)c2.net> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key -- Sitting on the razors edge of freedom of speech.

5 4

I would like to get on the mailing list
by Lee Elder 17 Dec '03

17 Dec '03

I don't know anything about this subject but I do know it's a must because of what's happening in the country.

1 0

Re: Logos -vs- Vulis
by logos 17 Dec '03

17 Dec '03

Dale Thorn wrote: > Dimitri Vulis wrote: > > Lame losers who call themselves "cypher punks" and bend > > over for John Gilmore. > It is obvious that you, Dimitri Vulis, intend to be > disruptive to the operation of this list. I have politely > asked you several specific questions about your motives. Sorry for the noise, but could Logos be specific as to the fallacy in each item he/she is addressing? I thought that was the purpose of the Logos character. I indicated in my original post that I would be addressing both logic and decorum. With regard to the questions above, I was asking Dimitri Vulis to give a more detailed explanation of his thinking process. Once some of his assumptions are made explicit, it will be easier to make meaningful comments about the rigor of his reasoning process. It was never my intent to nit pick about every bit of sloppy reasoning by every poster to Cypherpunks. Rather, I am trying to elevate the general level of discourse via selective commentary and (hopefully) by example. If Dale Thorn, or anyone else, feels that a more rigourous attention to logic and/or decorum is called for, I heartily welcome your participation. Logos out

3 5

Re: IP address
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 2 Dec 1996 04:38:46 -0600 (CST), Igor Chudov @ home wrote: >> >What is the risk of publishing your dynamic IP address to a web page while you are on line? How vulnerable is >> >someone just connected to the internet, w/o any server running? What attacks are feasable? --Internaut >> Well, if you are running Win95 (all) or 3.1 (w/certain TCP/IP stacks) your >> machine can be locked up or rebooted at *any* time using just PING! >Isn't is Unix that is actually vulnerable? Actually, it anything from Windows systems to Unix boxes to routers to printers to firewalls, etc can be vulnerable..! I know that linux got a patch out in 2 hours 35 minutes 10 seconds and that OS/2 hasn't been vulnerable since 1990 or so, but that's just because I use those systems. Check http://www.sophist.demon.co.uk/ping/ for details on your system. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

[CRYPTO] Forgery detection
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timmy `C' May uses an Adolf Hitler action figure as a dildo. >\\\|/< |_ ; (O) (o) -OOO--(_)--OOOo- Timmy `C' May

1 0

RE: Counterproductive Dorothy Denning Flames
by blanc 17 Dec '03

17 Dec '03

From: Sir Galahad I agree. I hope that my own statements have influence in spite of my mouldy reputation. ........................................... Well, on the net nobody knows if you're mouldy, but only if your ideas are fresh. :>) You've presented some quite insightful explanations for why Ms. Denning's prestigious image would give one pause to consider her with reprehension, if not outright contempt. As they say, YMMV, depending on how educated you are on the subject of encryption, privacy, and crimes against humanity. .. Blanc

1 0

SAIC buying Bellcore - Spooks have your number.
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

The papers have been announcing recently that SAIC is buying Bellcore for ~$700M. SAIC is the spook-connected beltway bandit firm that recently bought the Network Solutions folks who run the Internet NIC. Bellcore is the Bell Labs spinoff that the RBOCs have jointly owned since the breakup of the Bell System a decade ago. One of the interesting things that Bellcore does is own and administer the North American Numbering Plan, which is the telephone numbering space for Country Code 1, including the US, Canada, and much of the Caribbean. (Mexico used to have a kluged subset of 1, but a few years ago decided to join with Latin America instead, gaining 5- prefixes.) So you want an Internet domain name? Ask SAIC. You want a phone number? Ask SAIC. It's nothing to get all paranoid about, probably, but it would be interesting to speculate what they can do with it, besides finding a post-Cold-War income stream. I wonder if the Ethernet address space or IPv4 or maybe IPv6 addresses are their next acquisition? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

Laptops and TEMPEST
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>Not to mention the point that an external attacker--say, the NSA van parked >across the street--will under no circumstances be able to measure "the" >spectrum: his antennas cannot possibly measure the signals (at the lower >bits) seen by the FM receiver, noise source local to the computer, whatever. Tim was talking about the Bad Guys setting your radio noise generator, but the other side of the coin is TEMPEST - making sure your computers don't emit enough radiation for Bad Guys to read it. CRTs are well known as emitters of easily decoded signal, but people have occasionally suggested on this list that laptop LCD screens are much quieter. I now have a data point on this one, and basically, it ain't so. Take a basic television with big rabbit-ear antennas. Tune to the football game on Channel 6. Take your AT&T Globalyst 250P (which is a gray NEC Versa with a Death Star), with the 16-million-color 640x480 screen in 65536-color mode, and pop up a DOS command window in white-on-black. Type a few lines of text, then look at the TV. The sync wasn't quite right, but there were about three copies of my DOS window. It may have been scrolling slowly vertically or horizontally, but it was relatively readable given the lack of resolution of the screen. A good receiver run by a Bad Guy ought to be able to set its scan rates correctly to pick up the screen at better resolution. There are obviously more variables to be explored, but other people who were present at the time considered the football game to be more important :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

3 2

Leaked Letter Reveals French Key-Escrow Scheme
by J. Thorel / Netpress 17 Dec '03

17 Dec '03

lambda 2.12 * * * * * For several months French authorities have quietly begun to build the world's first "key recovery" encryption scheme, scheduled to take effect early in 1997. But a leaked letter sent to the official security agency, the SCSSI, reveals that the so-called "trust" has some limitation in the draft project. The proposal, called a "decret d'application," is a prime ministerial decree scheduled to be issued after the Telecommunications Reform Act of July 27, 1996 (http://www.telecom.gouv.fr/francais/activ/telecom/lrt96.htm) In France, a law only takes effect after the government signs it as a decree. The decree will define the business conditions of future "trusted third party" (TTP) systems -- in French referred to as "tiers de confidentialite," or a "privacy third party" -- and stresses the difference between the two basic encryption applications: digital signature and privacy. These agents will have the role of electronic notaries, keeping crypto keys in custody for law enforcement or national intelligence purposes. Lambda Bulletin has also learned that French authorities won't impose the "key recovery" scheme as a "mandatory" one. Yet it seems clear that a company will not be able to do business-as-usual if its encryption systems aren't certified by TTPs. Is this good news for individual users? It's not certain: The law says that crypto is legal *only* if keys are kept in custody. It won't be mandatory -- however if you get caught using PGP, it could be considered as a criminal offense. The letter obtained by the press is signed by Jean-Claude Jouas, president of the computer security think tank CLUSIF, and addressed to General Jean-Louis Desvignes, head of the SCSSI. The CLUSIF represents security-related executives from large French companies (some of which are state-owned, such as Bull and Thomson) and also from private consultancies. The SCSSI decided, after intense lobbying, to meet the industry think tank -- which highly suggests that the CLUSIF saw the close-doors draft decree. * Point 1: The letter emphasizes the lack of resolving important questions such as "international exchanges." The letter says: "It shall be possible for [future TTPs] to search partners in foreign countries in order to make these international exchanges a reality, if these partners are ready to respect French national legislation...." The letter goes on to say: "section 5 [of the draft decree] presents a 'franco-francais' project," which could undermine the basic purposes of TTPs. This national approach could create a blow for the OECD initiatives to reach a worldwide consensus for encryption policies (as described in previous bulletins). Stephane Bortzmeyer, speaking for the French Internet Users Association, says: "We'll need more than these suggestions for allowing a reasonable use of crypto. For instance, the international exchanges case is simple: either PGP or SSH use are legal, or people [in France] won't be able to subscribe to CERT mailing lists." This is because CERT urges its participants to encrypt their communications (for integrity reasons). * Point 2: The so-called "certification" procedures. The CLUSIF says "concerning the users' point of view, the most critical point [is] the certification of encryption means and technologies which will be offered by the [TTP], especially concerning the trust level the users will have to afford. [Evaluation and certification] is the key point to establish a trusted relationship, and we consider it as fundamental to include [this point] in the decree". In terms of certification, people can understand that this will protect the user from possible illegal duplication of encryption private keys, thus helping to prevent illegal interception of communications. If these certification procedures are not scheduled in the draft, people could consider it as a reason for an additional lack of trust. * Point 3: The think tank severely notes that "there is nothing scheduled in the draft in the case of legal disputes ... between the user and the third party." The litigation could erupt if the TTP gives up a users' private keys to unauthorized parties (i.e., a competitor or a curious, wiretapping official...). Epilogue: The SCSSI says the final decree could be published by the end of this month. Lambda personal bet: It might be published on Friday, December 27th. (The previous crypto legislation, in 1990, was passed as law on December 29 -- and the decrees for it were officially signed in 1992, on December 28.) P.S.: The whole CLUSIF letter will be published in the French version of this bulletin (check the Web site: http://www.freenix.fr/netizen) * * * * * Short Notes * * * * * * OECD update: The OECD draft guidelines of the crypto expert group have been revealed in Austria. Check: ftp://ftp.netsphere.co.at/Public/OECD/oecd.doc This is the document that was amended during the September 26-27 meeting in Paris, thus there have been changes since then. * EPIC conference proceedings: It's a long after the event, but you can read the English version of a report on the crypto conference EPIC organized in Paris on Sept. 25, on the eve of the OECD meeting. Check the Planete Internet Web site (English translation by K. N. Cukier): http://194.51.213.12:80/interface/SendPage.exe?ID=389 * EF-Sverige: One Lambda subscriber advises people interesting in cyber-rights in Sweden to check EF Sverige, independent from the US-based organization (although, as for EF France and others, the EFF has given them the right to use the name EF-Sverige. Check their web page at: http://connectum.skurup.se/~annami/ EF-Sveridge was founded by two journalists: Anna-Mi Wendel <annami(a)connectum.skurup.se>, the chairman, and Peppe Arninge <journalist(a)peppe.pp.se>, a member of the board. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Jerome Thorel Planete Internet Journalist, Paris Editor / Redac chef thorel(a)netpress.fr 191 av A. Briand, 94230 Cachan Tel: 33 1 49085833 - fax-31 www.planete-internet.com

1 0

Travelling With Laptops/PGP
by Evil se7en 17 Dec '03

17 Dec '03

Problem: I will be spending a couple of months chilling out in Barcelona, Spain. I will have a local Internet account/dial-up in that city, and will use it to telnet into my various US-based accounts. This is how I plan to keep in touch with various people while I am gone. Questions: 1 - Is the importation of two laptops and it's various peripheral devices by a US citizen into Spain going to be a problem? I know it is in some European countries. 2 - Will having PGP 2.6.2, with 2048-bit keys, or any key length for this matter, installed on these two machines, cause a problem? 3 - What about having SSH and ESM installed on the laptops? Will this set off red flags as well? Now, I see a work around if this is a problem, but would like advice on this also: If I generate a temporary PGP key, and distribute it prior to my departure, and then store it on the US-based server (not a good idea, but it is a temporary key, and if it is not a problem in Spain, SSH and ESM would be in use) then bouncing out of Spain via telnet into US-based computers to process encryption/decryption, key management, etc, any encryption would never actually take place on servers outside of the US. Would this be a viable workaround? Or should I just say fuck it, and just disavow myself of any reason/need for PGP for the duration of my stay? If this is gonna be a problem, I'll just forego anything requiring encryption while I am in Spain. I have no interest in smuggling crypto in, or defying international law just to use PGP for personal use. If it's not allowed, I simply won't use it. But, I MUST be able to bring my laptops into the country. That HAS to happen. My Research: I tried to find these answers myself via conventioanl methods, and either there was no information available, or the embassy people I spoke to weren't sure. (Go figure!) So now I ask for your opinions. se7en

3 2

Addendum
by Evil se7en 17 Dec '03

17 Dec '03

For those who may bring this up, my questions are in relation to Spain's view of my problems, not the US view, as I can bring PGP out of the US legally. In February 1996, the ITAR rules were amended as regards personal use of cryptography. Temporary export of products for personal use is exempted from the need of a license, provided the exporter takes normal precautions to ensure the security of the product, including locking the product in a hotel room or safe. The product must not be intended for copying, demonstratrion, marketing, sale, re-export, or transfer of ownership or control. In transit, the product must remain with the exporter's accompanying baggage. The exporter must keep records of each export for five years. Export to certain "dangerous" countries (e.g., Cuba, Libya, Syria) is prohibited. See the text of the amendment. se7en

1 0

Re: Travelling With Laptops/PGP
by Pyro Teknik 17 Dec '03

17 Dec '03

> Problem: > > I will be spending a couple of months chilling out in Barcelona, Spain. > I will have a local Internet account/dial-up in that city, and will use > it to telnet into my various US-based accounts. This is how I plan to > keep in touch with various people while I am gone. > > Questions: > > 1 - Is the importation of two laptops and it's various peripheral devices > by a US citizen into Spain going to be a problem? I know it is in some > European countries. > > 2 - Will having PGP 2.6.2, with 2048-bit keys, or any key length for this > matter, installed on these two machines, cause a problem? > > Would this be a viable workaround? Or should I just say fuck it, and just > disavow myself of any reason/need for PGP for the duration of my stay? If > this is gonna be a problem, I'll just forego anything requiring > encryption while I am in Spain. I walked straight through British, Dutch and Maltese Customs at the respective airports and they didn't even ask what was in the bag, let alone what software. I had PGP and a huge keyring stored on my hard drive and they were known the wiser. > I have no interest in smuggling crypto in, or defying international law > just to use PGP for personal use. If it's not allowed, I simply won't use > it. But, I MUST be able to bring my laptops into the country. That HAS to > happen. I'd suggest to lugging them through as hand luggage. If you are worred, zip up pgp and so on with a password - if customs do check, they aren't gonna waste breaking the zip password (even though it can be done quickly) Also, I think the law may different, as you are an American Citizen using your own equipment... [*]-------------------------------------------[*]----------------[*] [*] Pyro Teknik - <pyro-teknik(a)geocities.com> [*] Linux Guru [*] [*] www.geocities.com/SunsetStrip/Alley/7705/ [*] Phone Phreaker [*] [*]-------------------------------------------[*]----------------[*]

1 0

Encryption policy challenged
by C Matthew Curtin 17 Dec '03

17 Dec '03

http://www.news.com/News/Item/0,4,5909,00.html?dtn.head "The Business Software Alliance, a powerful Washington trade organization, warned the White House that its encryption policy will fail if the government does not turn to the industry for guidance." blah blah blah ... Interesting how these polite requests from the SBA, et al, are going for such ridiculously low goals. Being able to export 56-bit symmetric cipher products... Why in the world go for such a low number when that is the absolute *best* that you can possibly get? And with such a small difference between 56 and 40 bits, there isn't really any room to haggle. Duh. -- Matt Curtin cmcurtin(a)research.megasoft.com Megasoft, Inc Chief Scientist http://www.research.megasoft.com/people/cmcurtin/ I speak only for myself. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

1 0

Fan mail from John Gilmore and his cronies
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Apparently I'm not the only one not believing that "Logos" did not misspell both my first name and my last name just "accidentally". >Received: (from bin@localhost) by zifi.genetics.utah.edu (8.8.3/8.6.9) id AAA02080 for dlv(a)bwalk.dm.com; Thu, 5 Dec 1996 00:04:58 -0700 >Date: Thu, 5 Dec 1996 00:04:58 -0700 >Message-Id: <199612050704.AAA02080(a)zifi.genetics.utah.edu> >To: dlv(a)bwalk.dm.com >From: nobody(a)zifi.genetics.utah.edu (Anonymous) >Comments: Please report misuse of this automated remailing service to <complaints(a)zifi.genetics.utah.edu> > >You wrote: > >>logos <logos(a)c2.net> writes: >>> I have been unfailingly polite to you. Do you have it >>> within your character to respond to me in kind? >> >>Do you think spelling my last name "Vilus" is polite? > >Polite, no. Accurate, and perhaps a "freudian typo"? YES. > >Let me guess, O proud (if irony impaired) kook: > >You're now an authority on on-line manners? > > > No. Logos thinks s/he is. :-)

1 0

No Subject
by Clark E. Satter 17 Dec '03

17 Dec '03

unsuscribe cypherpunks >X48186 >NC-ITG When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

PGP in Russia
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

Hi there, it's been asked before but I don't know the current answer: Is the use of PGP legal in Russia? And if it's not, how are the chances of a foreigner in Russia using it anyway to get away with it? Please reply privately as I am currently not subscribed to the list... Thanks in advance, Harka(a)nycmetro.com

4 3

FW: Intellectual dishonesty
by Butler, Scott 17 Dec '03

17 Dec '03

>Timmy May wrote: > >>P.S. I certainly hope this "Logos" nym is not who I suspect it is, as this >>will surely end our Real World friendship. A fucking bozo. > ^^^^^^^^^^^^^^^^ >^^^ > >Now ... now Timothy. If there is anyone reading this message in the U.K..... Can you remember a television series featuring Ronnie Corbet.. "SORRY" TIMOTHY ! Cheers Scott :-D > > > >

1 0

Re: [crypto] Avatar Protection?
by AJ Barrett 17 Dec '03

17 Dec '03

At 09:13 PM 12/4/96 -0500, e$pam wrote: <snip> This sounds like a good argument for the crypto "watermark" idea that was discussed a few times earlier on the list. I think it goes something like this: The document/avatar/code/whatever has a crypto identifier embedded in it that can be extracted to verify ownership. Perhaps a good analogy might be a steganographic application. > The problem is this: Is there a way for a user to "view" the client's > avatar (and in this sense, the user usually has to receive a copy > of the code to render the avatar and render it on the local machine) > but not save a copy? Assume that a client with no save feature > is not a viable option...too easy to work around. Yep. Even the "eyes only" setting in PGP is no good if the recipient is savvy enough to cut and paste the plaintext to the clipboard. -- Sincerely, AJ Barrett <abarrett(a)checkfree.com> Product Analyst CheckFree Corporation: The Way Money Moves http://www.checkfree.com

1 0

Bank Of America To Launch Internet Banking System 12/02/96
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

TOKYO, JAPAN, 1996 DEC 2 (NB) -- By Martyn Williams. Bank of America is due to offer its credit card customers the ability to perform basic account transactions via the Internet next year. The bank will be using a system currently under development by Hitachi Ltd. and Bank of America subsidiary Concorde Solutions, a Hitachi spokeswoman confirmed to Newsbytes today. "The new system will enable credit card transactions via the Internet," said Hitachi's Emi Takase. "Bank of America is aiming to market the system from August, 1997." Customers should be able to check credit card balances and account details, apply for credit limit increases, and many of the other actions that a telephone is currently used for. Concorde Solutions, a company 70 percent owned by Bank of America, will develop the application for users with Hitachi. It will run on top of the Japanese company's TP Broker system, an object request broker that was developed with Visigenic Software Inc. Launch customer for the system will be Concorde parent Bank of America, but plans are for the system to be marketed to other banks. "The product will be sold by both companies afterwards," said Takase. (19961202/Press contact: Emi Takase, Hitachi Ltd., +81-3-3258-2055, fax +81-3-3258-5480, e-mail emi(a)cm.head.hitachi.co.jp; Reported By Newsbytes News Network: http://www.newsbytes.com) -- C O P Y R I G H T * R E M I N D E R This article is Copyright 1996 by Newsbytes News Network. All articles in the clari.* news hierarchy are Copyrighted and licensed to ClariNet Communications Corp. for distribution. Except for articles in the biz.clarinet.sample newsgroup, only paid subscribers may access these articles. Any unauthorized access, reproduction or transmission is strictly prohibited. We offer a reward to the person who first provides us with information that helps stop those who distribute or receive our news feeds without authorization. Please send reports to reward(a)clari.net. [Use info(a)clari.net for sales or other inquiries.] Details on use of ClariNet material and other info can be found in the user documentation section of our web page: <http://www.clari.net>. You can also read ClariNet news from your Web browser.

1 0

Re: [crypto] Avatar Protection?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

Even with a custom client, I suppose there's always a chance of pulling things out of RAM. How about a slightly different question: Is there a way to sign it such that it wouldn't work if the signature was removed, so there would be no question of who created it? I suppose this is analogous to: Is there a way to sign plaintext such that the plaintext can't be seen without the signature attached? I suppose not.. Is there a way to embed the signature as part of the code so it can't be removed? Ryan ---------- Previous Message ---------- To: Ryan.Russell cc: cypherpunks From: deviant @ pooh-corner.com (The Deviant) @ smtp Date: 12/05/96 04:24:15 AM Subject: Re: [crypto] Avatar Protection? -----BEGIN PGP SIGNED MESSAGE----- On 4 Dec 1996, Ryan Russell/SYBASE wrote: > A graphic-designer friend of mine and I were talking > about VRML avatars, and custom design work, and > could he offer a service designing them etc... > > His worry is that since everyone in the same virtual > environment as his customer would see the designer > avatar, wouldn't they also be able to easily rip off > his work? (or his customer's property, take your pick.) > > I wasn't sure...it seems to me that I read something vaguely > along these lines for a cryptography protocol of some sort.. > The problem is this: Is there a way for a user to "view" the client's > avatar (and in this sense, the user usually has to receive a copy > of the code to render the avatar and render it on the local machine) > but not save a copy? Assume that a client with no save feature > is not a viable option...too easy to work around. Well, its concievable to write your own client, and make the code such that it only works with that client... I know, it kindof sucks, doesn't it? > > I suppose an analogy would be: Is there a way for a person to > see the plaintext, but not record it? I think that question really > answers itself - no. How about alternatives? If the server > of the environment only renders "views" (say, certain angles, or > a bitmap) of the avatar, rather than sending the description file? > > Any other thoughts? > > Ryan > --Deviant PGP KeyID = E820F015 Fingerprint = 3D6AAB628E3DFAA9 F7D35736ABC56D39 "First things first -- but not necessarily in that order" -- The Doctor, "Doctor Who" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqZOczCdEh3oIPAVAQHEAwf+IZ4KzMjcmb8t/HTMBvp83ChZ0VLS6xa3 +OwtpvkVGnuD4AJ+ayvDS10u4oAx78OillYDPolz6Gpnv0L+KDseo0sz7Yhgvepp HwUw4UqMDBu9BMfkITFs6IS773EIgC8JmIf8/u6xEH/tvUjl44RQlgX+YE1Ybhvq cGo3dF60fdiYzmoYvYESrMo9ldr97bImSjUE46bd4ZrtHjVTqDB75r9Uhb38SPWD SdEi6rdC4sX1dY9zdJHIruhIM5BBpZcHX9Vo8cOSvzZY1s7rHXVQgb34rIcUcx7T 2GJTeJsTS2boi9O0urkKW8FIZtq82AnBk5WsavRtEIw0O5pC0jhR2g== =aWWo -----END PGP SIGNATURE-----

1 0

HP
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

> HP UNVEILS NEW CRYPTO CONTROL FRAMEWORK > > Hewlett-Packard announced a new framework technology designed to let > governments enable and disable strong cryptography products. The > framework is independent of the method used in a given product. The > heart of the system is a small, tamper-resistant module with the > cryptographic algorithms that remain dormant until activated. A policy > activation token (basically some key bits) can be used to choose > between the various crypto algorithms stored on the module. The HP > press release makes this sound like the greatest thing since public > key encryption, but in reality it appears to be just another attempt > to insert government control into private data exchanges. Look for > legislative attempts to make this technology mandatory on all > encryption products. Technology details are at the site. > <URL:http://www.dmo.hp.com/gsy/security/icf/main.html> > > > > NETSURFER DIGEST (c)1996 Netsurfer Communications, Inc. > All rights reserved. > > NETSURFER DIGEST is a trademark of Netsurfer Communications, Inc. > -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2233328 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

Nice use of crypto...
by Adam philipp 17 Dec '03

17 Dec '03

While browsing for some JAVA material I can across the following article that seems like a real nice application of crypto. What is it? Oh, you can just click on the URL and find out... its 4am and I'm too tired to give a precis. http://www.javaworld.com/javaworld/jw-12-1996/jw-12-int.property.html Adam, Esq. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ | My PGP key is available on my |Unauthorized interception violates | | home page: http://www.rosa.com |federal law (18 USC Section 2700 et| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA...see home page... |communications are preferred for | | -=[ FUCK THE CDA]=- |sensitive materials. | \=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/ If A is a success in life, then A = x + y + z. Work is x; y is play; and z is keeping your mouth shut. Albert Einstein (1879-1955)

1 0

Dimitri IS Detweiler
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Dimitri Vulis wrote: | He he he what is sauce for the goose is sauce for the gander blah blah ^^^^^^^^ | blah intellectual dishonesty blah blah blah typical logorrhetic "cypher | punk" can't spell his own nym politely. There we have it! PROOF that Dimitri is a tentacle of Detweiler. Own up Dimitri! (sorry for the previous accusation Dale)

2 1

Re: Laptops and TEMPEST
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:44 AM 12/5/96 -0800, stewarts(a)ix.netcom.com wrote: >Take a basic television with big rabbit-ear antennas. >Tune to the football game on Channel 6. >Take your AT&T Globalyst 250P (which is a gray NEC Versa with a Death Star), >with the 16-million-color 640x480 screen in 65536-color mode, >and pop up a DOS command window in white-on-black. >Type a few lines of text, then look at the TV. > >The sync wasn't quite right, but there were about three copies of >my DOS window. It may have been scrolling slowly vertically or horizontally, >but it was relatively readable given the lack of resolution of the screen. >A good receiver run by a Bad Guy ought to be able to set its scan rates >correctly to pick up the screen at better resolution. >There are obviously more variables to be explored, but other people >who were present at the time considered the football game to be >more important :-) Wow! I am amazed the FCC has not come down hard on AT&T for something that noisy. (I have run my system with an open case and never gotten interference that bad.) <paranoia> Or maybe it is a plot to keep an eye on Matt Blaze. ("Here... Have this free company laptop!") </paranoia> Now the truly paranoia will not only cover their heads with tinfoil, they will cover their laptops as well. But seriously, it does not sound good. I know there is specialized equiptment used by ham radio operators to locate leakage of radio frequencies. Maybe someone could use it to find who the worst offenders are and how bad the problem is. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqb8n+QCP3v30CeZAQEe5gf/WWxP6BSq17o9OPUXu2bu4DNPldb42CpB 2QHFs2N3VKymiOa1wQH7E4XyeKZzsZQdt8d6fpl12t+jMS9XqMi+2uaQNQ9IeMDG UVAc04La/MTVCeL+SkxZUfHSp618cB/QNRT9l7MpcplfCmnhODNx06i9De7MDfnc 4zSRLMZ0mXzoOl0tKunRGSGKDVn5Yh/3Lxdk2KwR3ITUrhiENowEvBaLithv5jYG GXdUzQwoMfEZ+rHhHJuXB0TQT4KtyrsnpNLrkH2h16j2kIp9fO05+mh9Ef2UYWgo TeIiHal3BjZ537hmF2JpUd7ShJYhooDrKOHRXAoaMhg5ny87FTtq4g== =Las6 -----END PGP SIGNATURE----- --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Re: Laptops, TEMPEST, chewing gum, and baling wire
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:18 PM 12/5/96 -0800, Timothy C. May wrote: >At 11:52 AM -0800 12/5/96, Alan Olsen wrote: > >>Now the truly paranoia will not only cover their heads with tinfoil, they >>will cover their laptops as well. > >Just be careful to remove the tinfoil prior to leaving the country. As you >know, tinfoil is an ITAR-controlled item. "Curses! Foiled again!" --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

New DCSB list for announcements
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 5 Dec 1996 15:38:01 -0500 (EST) From: Rich Lethin <lethin(a)ai.mit.edu> To: dcsb(a)ai.mit.edu Subject: New DCSB list for announcements Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Rich Lethin <lethin(a)ai.mit.edu> By request, I've created a new DCSB mailing list, dcsb-announce(a)ai.mit.edu which will be for DCSB-related announcements, only. The ability to post to the list will be restricted by Majordomo. Subscriptions are for folks who can't/don't/won't paw through the talk on the normal DCSB mailing list and digest, but would like to hear about upcoming lunches. Because the lunch announcements will be sent to both the dcsb-announce and dcsb lists, there's no need to be on both. To subscribe, send an email To: dcsb-announce-request(a)ai.mit.edu Subject: irrelevant subscribe Rich ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Laptops and TEMPEST
by Joel McNamara 17 Dec '03

17 Dec '03

Thinking that LCD screens reduce the risks of emanation monitoring is a dangerous misconception (at least under a high threat model). LCDs' current requirements are pretty small, and they only emanate a low magentic and electrical field. However, the gotcha with current laptops is their backlighting. Electric and magnetic fields are considerably higher compared with a low-res/contrast device. There are documents that circulate within certain security circles that list just how noisy (and therefore easy to monitor) various off-the-shelf machines are. It would be an interesting project for some ham radio type Cypherpunks to measure their machines, and publish the results. Or, for some well connected person just to scan and anonymously post such a document to the list. Of course, I'd never encourage anyone to do something illegal. Joel

1 0

RE: Silence is not assent (re the Vulis nonsense)
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn ... I believe that my idea above [asking John Gilmore to speak up, and if he doesn't, say to the list that he has declined to do so] is still a great idea (if the subscribers are not afraid of confrontation), as it would tend to force the issue more into the open. I don't know what you mean by "forcing the issue more into the open". Do you mean the issue of John' s not replying, or of censorship per se? If you mean "forcing the issue of John not defending himself on the list", I don't see where the issue needs to be forced. John has rarely posted to the list since it started, and typically only announcements of events or crypto papers/conferences, etc.; he does not engage in the discussions at all. I personally have no argument with his decision over when he posts or what he cares to post about, or how much or how little. My own interest in the list has nothing to do with whether the list owner is moved to defend himself or not. I'm free to roam at will, read or delete, post or unsubscribe, publicly and loudly or privately & quietly. I don't feel constrained in any way, shape or form to stay or go or speak or stay quiet. I make all my own decisions about this and John never knows nor, I expect, suffers any concern over it. And vice-versa. I (and apparently many others) do not feel the need to discuss John's decisions. I, and others, are not bound, like geese flying in formation, to follow his lead, nor are we going to fall apart at a loss for direction if he fails to "show up". You mention what "others had overlooked". How about this: Tim May sent a message the other day stating (in essence) that the whole "censorship" thing was pretty much a size (rather than content) problem. I posted that notion twice, and there has been *no* discussion of it, as far as I know. Too bad Tim didn't post that at the beginning of the affair, since everyone apparently reads *his* mail. What I meant by what "others had overlooked" was in regard of the content of posted messages which I have read, not in regard of *which* poster's messages are overlooked/not read by others. Tim can have whatever opinion he likes about censorship or size or content, and none of us are under any obligation to either agree or disagree with him. On a libertarian/anarcho-capitalistic list like this, the individuals who have elected to join and lurk or post are not expected to do anything but follow their interest. There are more than 1200 subscribers to the list; if each and everyone of them had decided they had something to say to each other about the concept of the rights of the person whose computer these messages are all flowing through, that would have been their fortunate privilege to do, as no one has put any limit to the number of messages allowed, from any one, during any particular period of time. (Of course they would all be expecting not only that their particular message would be read, but that everyone would absorb their wisdom, right. Not!) >Frankly, most of the long-time members of the list would not need any > such statements of defense from John in order to appreciate the nature > of the circumstance and the reasoning for his symbolic 'censorship'. I apologize in advance for this one, but I honestly think that statement says more about acceptance of the Iron Boot principle than it says about what really happened. I for one am not an insider in any of the various cliques that surround this list, so perhaps I missed something that would explain it better to me. I suppose you are referring to an unspoken understanding, but again, and for future reference, you might want to consider the non-long-time members and speak the unspoken, as it were. What really happened is that, upon weighing the relative merits of John's action vs Vulis' contributions, what John did was seen as more of a benefit than a detriment, and this dimmed any arguments which might have been raised against it. It's not like everyone was clammoring for the privilege of reading what Vulis had to say or there aren't any other avenues to getting his literary works. The "unspoken" understanding on the list is that it was started by a couple of guys who happen to be very libertarian/cryptoanarchist in their philosophy of life (not simply as it applies to cryptography, but rather as cryptography relates to that philosophy). I put "unspoken" in quotes because there have been no end of discussion and comments and replies and retorts and flames on this very subject in the past years since I've been on the list (Oct '93, and it is actually what attracted me to subscribing), so it has hardly gone unmentioned and to many is no surprise, although is often difficult to for them to see or agree with. I recommend that you go through the archives and do a little light reading. Your mind will soon be saturated with the flavor of the underlying theme, and you will Understand. .. Blanc

2 1

(no subject)
by Andrew Fairbanks 17 Dec '03

17 Dec '03

unsuscribe cypherpunks

1 0

RE: [crypto] Avatar Protection?
by Mullen Patrick 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: Nelson Minar on Thu, Dec 5, 1996 19:00 >Ah, the age-old question. This is the same question as "is there a way >for me to show a web page to someone and not let them copy it?", As a sidelight to this thread which has already strewn far from the [crypto] heading, it *is* possible to show a web page to someone w/out letting them copy it. Some guy in California, who touts the fact he has "every foul word known to man" on his site (to generate more hits) has (I believe developed/worked to help develop) a product which does so. I don't know how he does it, and I know there are ways around it through sniffing, etc., but when you do the trivial act of "View Source" in Netscape, a filtered version is displayed in the source window. While it's really not possible (AFAIK) to eliminate unwanted copying by a person who knows what they're doing, this works against people who don't (like most people). If anyone's interested, I *might* be able to find the URL somewhere. PM

1 0

Crypto hits the mainstream
by Greg Broiles 17 Dec '03

17 Dec '03

PC Magazine's web site has a prominent article reviewing four PC-based crypto apps: they all seem to be oriented towards storage security not communications security (to adopt Tim's taxonomy). The apps are from Symantec, RSA, AT&T, and PGP; their "Editors' Choice" was Symantec's program, followed closely by RSA's. They seem more concerned with speed and user interface rather than the strength of the algorithms or their implementations. The article won't teach anyone who's read Applied Crypto anything new about crypto, but it's neat to see that security is becoming a mainstream concern. (It should have always been one.) There may very well be an associated dead-tree version of the article as well, but I've lost touch with the PC market. The article is located at <http://www.pcmag.com/features/crypto/_open.htm>. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

PGP Tools for Linux
by Mark Grant 17 Dec '03

17 Dec '03

Hi, Now that I'm back in Europe I've been able to do some more work on Privtool (PGP-aware mail-reader for X11 on SunOS/Solaris, Linux and FreeBSD) and should be releasing version 0.86 once I've fixed the last segmentation fault (see my Web site for details of the latest changes). In the meantime I've finally got around to fixing one of the early PGP Tools versions that escaped to Europe so that it works on Linux (and probably FreeBSD). I'm just about to upload pgptools.linux.1.0.tar.gz to utopia.hacktic.nl and idea.sec.dsi.unimi.it, so it should be available there shortly. I'm not back on the list yet, so send any mail to this address. Mark |-----------------------------------------------------------------------| |Mark Grant M.A., U.L.C. EMAIL: mark(a)unicorn.com | |WWW: http://www.c2.org/~mark MAILBOT: bot(a)unicorn.com | |-----------------------------------------------------------------------|

1 0

Welcome to cryptography
by Majordomo＠c2.net 17 Dec '03

17 Dec '03

-- Welcome to the cryptography mailing list! Please save this message for future reference. Thank you. If you ever want to remove yourself from this mailing list, you can send mail to <Majordomo(a)c2.net> with the following command in the body of your email message: unsubscribe cryptography cypherpunks(a)toad.com Here's the general information for the list you've subscribed to, in case you don't already have it: [Last updated on: Mon Dec 2 19:23:19 1996] "Cryptography" is a low-noise mailing list devoted to cryptographic technology and its political impact. WHAT TOPICS ARE APPROPRIATE: "On topic" discussion includes technical aspects of cryptosystems, social repercussions of cryptosystems, and the politics of cryptography such as export controls or laws restricting cryptography. Discussions unrelated to cryptography are considered "off topic". Please try to keep your postings "on topic". In order to assure that the quality of postings to the mailing list remains high, repeated postings "off topic" may result in action being taken by the list moderators. MODERATION POLICY: In order to keep the signal to noise ratio high, the mailing list will be moderated during its initial weeks of operation. This will be changed if it appears that the list will remain on topic without moderation. TO POST: send mail with your message to cryptography(a)c2.net TO UNSUBSCRIBE: send mail to majordomo(a)c2.net with the line unsubscribe cryptography in the body of your mail. IMPORTANT -- PLEASE READ: Please note that sending requests to unsubscribe to the mailing list itself is considered highly antisocial. If the software running the mailing list is not working and you cannot reach the moderator, the users of the mailing list will be utterly unable to help you, so sending requests to the list will only succeed in annoying them. If all else fails, send mail to postmaster, NOT to the mailing list. If you think you may have trouble remembering how to unsubscribe, then save this message forever -- do not simply try asking the mailing list for help.

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

At 3:28 PM 12/4/1996, Andrew Loewenstern wrote: >nobody writes: >> She is seen as "one of us" because she wrote a book on >> cryptography. As a consequence, she is seen as a traitor. >> I am not endorsing this view. > >She didn't just write a book on cryptography, but several books. She is also >the Chairperson (eek, PC titles...) of the CS department at Georgetown, a >very respectable institution, and has taught classes there on cryptology. She >has also done research on crytpographic access control to databases and other >stuff. So as far as being a cryptologist she is quite learned and should >deserve respect regardless of her political views. > >However, after reviewing the Skipjack algorithm (of course her being invited >to look at it was certainly due to her anti-strong-crypto-for-the-masses >views), she said something to the effect of "We looked at it over the weekend >and couldn't find anything wrong with it, so you should trust it." when she >knows damned well that you can't evaluate a cypher in three days. It is for >this that she no longer deserves respect as a cryptologist. She basically >cashed in her reputation-capital to help the U.S. Govt. dupe the American >people into buying Clipper. Fortunately, we didn't buy it. You make an excellent point. Didn't Denning claim that they just reviewed NSA's evaluation process? Regardless, the claim that SKIPJACK is therefore trustworthy is irresponsible. Sir Galahad

1 0

Re: Laptops and TEMPEST
by jim bell 17 Dec '03

17 Dec '03

At 02:18 PM 12/5/96 -0800, Joel McNamara wrote: >Thinking that LCD screens reduce the risks of emanation monitoring is a >dangerous misconception (at least under a high threat model). I disagree that it's a "dangerous misconception" to believe that "LCD screens reduce the risks of emanation." While it might be correct to say that it would be dangerous to believe that they ELIMINATE the risks, LCD displays would make it exceedingly difficult to read the screen remotely. The main reason is that the LCD segments are activated in parallel, which means that the electronic noise associated with a particular row is a smeared product of each portion of the display. This is quite unlike CRT's, in which individual pixel information is completely (well, except for color) demultiplexed by time. > However, the gotcha with current laptops is their >backlighting. Electric and magnetic fields are considerably higher >compared with a low-res/contrast device. What does the backlighting have to do with anything? The backlight and its noise is not modulated (at least, not in anything less than the optical band) by the imformation provided on the screen. Jim Bell jimbell(a)pacifier.com

1 0

Control E-Mail Advertising
by tuvak＠troi.iq-internet.com 17 Dec '03

17 Dec '03

We all love or hate advertising, it just depends on if it interests us ... Advertisers want to send YOU E-Mail ... BUT, will it interest you??? Reply to this message with the names of your favorite magazines to receive messages from firms who would advertise in those publications. Reply to this message with NO MAIL to prevent ANY commercial E-Mail from C.A.R.E. member firms. Thank You, The Red Pages and C.A.R.E. ( 1-800-257-7831 ) "Concientious Advertising thru Responsible E-Mail"

1 0

Re: The Science Generations
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 5 Dec 1996 22:10:04 -0800, Jamie Lawrence wrote: >> I'm not sure if Gilbert chemistry sets went off the market for liablity >> reasons, or for "lack of interest." The "4-banger" I had in 1961, >> supplemented with varius Bunsen burners, arc furnaces, Erlenmayer flasks, >> and whatnot, was amazing for its time. (And not terribly expensive, in case >> some of the "social democrats" on this list are thinking I lived a >I can provide a datapoint here. I started getting into chemistry >when I was about 8, which was in 1981. I can't remember the brand >name, but my first (and last, actually) 'value-added' kit was >designed to keep kids from doing anything that could be >dangerous, a fact tactfully explained on the packaging. Or how about those TrashShack kits everyone buys a science-oriented kid (until you warn them not to)? Geez. It's about as fun as one of those slide-show demo programs. >To solve that problem, my mother gave me an Edmund Scientific >catalog and a (severely limited, given my family background) >budget for whatever I wanted. >I ordered direct for supplies from then on. Gee, you too? I probably could have broke the $30k mark, though, if given the chance. Still could, easily, but it'd be Computer Shopper now. >computers as a daily part of their work. You can run, but you can't >hide. Hehe ... Person one: "And they [computer illiterates] will call us" Person two: "Secretaries" Bonus points if you get the reference. >> get the point. Being 44 years old, and almost 45, I claim no knowledge >> about what the "latest generation" is all about. Maybe it's the "Beavis and >> Butthead" generation...I don't know.) >Yes, many of us are devoted to the study of Brute Force Insect >Dissection. Many others are devoted to "the study of Chaotic systems involving realtime exothermic reactions with common household substances". (Pyromania might not be a bad sub title) Others still are most interested in Brute Force Wallet Extraction. Or, of course, the ever popular: Members of the Opposite Sex and How to Attract Them. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0