December 2003 - cypherpunks-legacy

Seditious Cable!
by nobody＠replay.com 17 Dec '03

17 Dec '03

dlv(a)bwalk.dm.com wrote to All: d> Doug Barnes <cman(a)c2.net> writes: >> (Taiwan story warning...) This reminds me of the pirate cable >> TV wars, which hit their peak during my stay there -- [...] d> Now, what would the U.S. government (state or los federales) do in a d> similar situation? They'd probably fine any resident found with a d> cable TV thousands of dollars and if that didn't work, they'd start d> jailing people. Maybe even burn a few TV viewers, a la Waco. :-) And these are the folks you want to maintain your key escrow?

3 4

denial of service and government rights
by attila＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- read the last line. the usual rules of evidence which give the feds the right to anything they well please --constitutional or not! if seizure of a victims property can by obtained a search and sieze warrant for the victimized "object," a whole new mode of regulation has begun. all the government will do to suppress sites as they please, is to initiate a few attacks themselves --and they will. I got tired of paying Lexus $150 for idle months after dumping West for almost $500/month --otherwise I would run down the Feds kangaroo ruling which seems to grant them this absurd right. Several on the list are still maintaining accounts... ? ====== begin forwarded text ====== Computer Attacks Show New Patterns The major trends in computer break-ins involve denial of service and data-driven attacks, says a Department of Justice lawyer. Denial of service occurs when an attacker "bombs" an Internet service provider with so many e-mail messages that the server becomes overloaded and shuts down. Data-driven attacks occur when a virus program is disguised as a data-only file. The file can be hidden in a Java program on a Web page, and when a visitor clicks on the site, he or she unwittingly downloads the virus. A computer crime consultant with SAIC warns that these attacks can be launched on an innocent party's Web server, but once that happens, the server can become the subject of a wiretap and a search warrant. "The title of your computer vests with the government as soon as a hacker uses it to commit a crime," he says. [BNA Daily Report for Executives 25 Nov 96 A20] ====== end forwarded text ====== - -- "In nature, stupidity gets you killed. In the workplace, it gets you promoted. In politics, it gets you re-elected." --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMp83lr04kQrCC2kFAQFYuAP/bLbraU6rFFLQZpFfsvxiGrbm7W26p3t9 GffgoN/LA6OBqIEUpAdPxGoVqco7RDpHHprhObEV4MorR3BsK6pl5EVNbc3Xp7OC pxFThx0O08bscdmVBSYAUsU2hXMuW2AiuAkxBwCRdaG0bxswr97JQI9ye+pjKTPw cARrd7QLmz4= =vUe3 -----END PGP SIGNATURE-----

1 0

Punative Seizure was: Re: denial of service and ...
by Tim Scanlon 17 Dec '03

17 Dec '03

Tired.Fighter(a)dhp.com wrote: > > > This thread is probably already due for a change in > the Subject line, but I'll leave it untouched for > the moment. I changed it, because I'm very familiar with what's being discussed. I also snipped huge chunks, but tried to leave the salient stuff. > On 30 Nov 96 at 13:10, Black Unicorn wrote: > > On Fri, 29 Nov 1996, Greg Broiles wrote: > > > > > I don't see any reason why this wouldn't be true for a > > > computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure > > > (but seizure is not forfeiture) of "property that > > > constitutes evidence of the commission of a > > > criminal offense". > [....] > > Recall also that Ripco was never specifically charged > > (or the minor charges that they did try to pin didn't > > stick). > > Also recall that Ripco (now ripco.com) was raided with a > > -sealed- warrant. I dont think that the contents of that > > warrant have, even today, been released (though I could > > be mistaken). Certainly 5 years after they had not. > [....] Yes, it was & is sealed, the justification being that the investigation was "ongoing". The whole thig was weak & shameless, but it works for the feds. Never mind that it's total & utter bullshit. > > > But there's a big difference between "seizure" and > > > "forfeiture". Not really. Only technicly. The technique used by LEO's is one that is known as "Punative Seizure", and is well known in the Computer Underground. It's standard practice for LEO's to engage in seizure of computer equipment and just to keep it. Much of the time it is accompanied with an explicit and literal threat of prosecution if the unindited suspect asks for the equipment back. It's cheaper than prosecuting, easier to accomplish, and often achives the goal of "taking the bad guy off the street" without resort to such niceties as having a case that would hold the moisture of a drop of spit. It is such common practice, that most hackers who have been around for even short lengths of time are very familiar with the practice. In cases involving juviniles, it's a very effective technique. In those specific types of incidents the drill is as follows: Suspect "H", a 15 year old male, living at home with his parents, does something to bring him under suspicion that he is involved in computer fraud. Incidents are ongoing and seem to point to the suspect, local or federal agents become interested in the suspect due to information provided by a C.I. So they go fishing, and seize his equipment. Seizure is accompanied in concert with several other actions and goals, One of which is to explore the contents of the computer for further evidence of wrongdoing. Since aquiring search warrents for such actions are notoriously broad and relativly easy to come by, this is an effective technique. The seizure usualy is stratigicly done to minimize parental involvment and possible protections, in order to give investigators time alone with the juvinile suspect to question him without the intervention of his guardians. Basicly they want Mom or Pop out of the picture long enough to pump the kid for info before the parents can insist on legal counsel. Obviously they use whatever info they can get... Keep in mind a poorly socialized, but bright, teenager is likely to be a rather talkative target and an easy mark for interrogatory techniques. "We find they want to talk, and often brag about their exploits" is such a well worn quote, that I'd have to attribute it to about 7 sources if I tried... You can extrapolate on this. The next stage is threats to the parents of the juvinile, usualy big federal time, that sort of thing, to try to terroroize them into insisting on little Johnny's co-operation. Usualy this is done without the advice of counsel if the feds can pull it off. There's a tradition of inflating numbers far beyond anything rational, so the "damages" are insanely high, and markedly fictional to anyone who knows how to cost such stuff out. It's in the favor of everyone involved to 'play ball' on cost inflation, for a multitude of reasons. Again, you can extrapolate why. The E911 case is a great example of fictional cost inflation. At that point they have Johnny under the gun, the parents terrorized, and can either work that for further co-operation, or let the kid dangle for a few years & pretty much make sure he never sees a computer. What can I say, it works for them. Don't expect them to care any, they've accomplished their goals. Quite often, as I have said, they will explicitly say "Don't ask for your stuff back or we'll charge you". (And YES that is a direct quote given to me on more than one occasion by people who've had such encounters.) In the case of adult individuals, the setup is nearly the same, wether it is a consultant running a small buisness, or a college student. The only big differences are threats to reputation, either academicly, or in the community at large. After all, once branded an 'evil hacker' by the police or media, what company would do buisness with such a scoundrel. Never mind wether or not they have a thing to do with computer security, that part's utterly irrelivant. In the case of college students, usualy it's a threat of expusion & prosecution etc. Obviously techniques vary. But one thing is clear, there's plenty of "examples" that have been made to terrorize people. I'm sure you can think of a few, and probably will sit there and go 'yea but he deserved it...' Well, when you think that I suggest very strongly that you rethink it, and consider that perhaps you don't have all, or even any, facts that have not been spun and spoon fed to you. The nuber of such punative seizures that I am aware of runs into the hundreds. > > And it sums to a very bleak picture, indeed. > Bleak? heh, get used to it. Hell, this is so damned common that it's made it into comic books as a normal operative procedure. Look in "The Hacker Files" to find it. It's a comic book put out in 1993 by D.C. Comics, and in the Jan issue, Vol 6, Page 14-15 you can see exactly what I'm referencing. Obviously this is not something new. This is why the guidelines that were procured via FOIA by EPIC are so important. Hell, look at the 2600 pentagon-city case for some real chilling stuff. The Secret Service mounted what amounts to a covert operation against attendee's at a 2600 meeting at a mall in Northern Virginia. In any case, the search guidelines are pretty important, so is the Steve Jackson Games case when it comes to ISP/Web Site providers and the like. As is the ECPA, as it relates to individuals and service providers. There is substantive law on this stuff, you just have to dig a bit to find it. Some of these "high profile examples" didn't work out too damned well cause of organizations like the EFF & later on EPIC and the ACLU. Pardon me if I don't seem alarmed or appropriatly indignant, but I've long since gotten used to getting calls as 4 am from some poor fucking kid who's had his life ripped to shreds because he was doing something relativly innocuous but altogether stupid and disruprive enough to have him attract attention. Much less having similar calls from peoples counsels who have no freaking clue how to proceed in defending their clients. As for this type of activity from LEO's? Get used to it, this is how it's done in America. I'm totaly sure that there's going to soon be some poor freaking ISP out there who's going to be hit with very similar techniques, and in all probability prosecuted to provide an example or 2. They need a few good examples for ISP's really, there arn't enough right now. And, I am equaly sure that there's been some quiet seizures & returns with deals involving "co-operation" of ISP's for warez and the like. I sure as hell have a very hard time beliving that Sameer and everyone else who got hit with him by the SPA and their fucking goons were unique. I suspect they were to be an "example" however, as the SPA has a traditional role of both being stooges & goons for Federal Law Enforcment, and an appropriately one-step-removed publicity outlet. The SPA is much like what "railroad security" was in the 1800's, basicly a private police force that operates allmost outside the law. As to what anyone can do? Well not much, from what I've seen. It's just not trendy to defend individual civil liberties, the EFF tossed in the towel in favor of Telco donations. EPIC is doing a good job with the resources they have, they could use some serious donations, and it would be money well spent. Beyond that you have the ACLU, and that's pretty much it. Too many software and hardware corporations lost any moral compass at the end of the 80's and in the early 90's, and don't consider such things to be a neccesary part of their world. It's hard to compete with guys in black suits who wave the flag allot and mutter about secrecy and such things. They're the same damned bunch that want us all to have GAK too, so don't think you're somehow immune cause you arn't a "hacker". You may soon be a "pirate cryptographer", and find yourself in the company of child pornographers and terrorists. (What? Oh you've noticed you allready ARE?, well, get used to it, it's only gonna get louder. First they came for the hackers, now it's your turn.) Tim

1 0

PGP 2.63ui support for the MAC
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: PGP 2.63ui support for the MAC I have received a few inquiries about support for the Macintosh. Unfortunately, the small team working on PGP 2.63ui does not have the expertise or tools to support the MAC or platforms other than MSDOS. However, since we have published our source code, we welcome participation by people who want to add support for the MAC or other platforms. All we ask is that any changes be controlled by conditional compile statements so that we can maintain a unified source code for all platforms. American friends who are concerned about legal difficulties may contact me via encrypted Email in strictest confidence. Finally, I understand that Stale's MIT-based version of PGP does have a good selection of support for the MAC and various other platforms. We are not going to object strenuously if some of our enhancements, now unique to 2.63ui, find their way into a future release of Stale's version. Steve Crompton 100645.1716(a)compuserve.com (preferred) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp9MIhRHWQsRmI2RAQGD/wgAuuBRclY2ovL7uZ7nukcR9maz85GSCYS7 gbYcToxWhZMA3YMMDmV8260qG9BmF0dHoNt39HfEjcordiTU2gLOTmyWqTIWXyA3 uRuKwZQiGPc2bxf+p62G0KdXEdEPcJ98vZWAxVkZwNDlkTg8FZ+O0NsQOPkBMSCO cE+kiJDk/71CEMwBhu4Q2QN9KBtX+MpcOvT6v1M5vIFAtO31OHaiz/0/tBCitpDP ukNX8Ntmht+/Izmma3lQaiuFo3i6pXH7qPxKBE38ZNU+w/CtiEPoy/uWN69L3l2D 6RIBbtdvbIkE6ZWotuPcsy/TxqJNsDdnztksfP2EpoKCG9vnHoaU3w== =8vJt -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. mQCNAy+FS/kAAAEEAKsKQxcaOw8GQpGXEm4hCfqWyeVlh2Ai9AYvXxPy1VrWYNUu NDafHwhfoAjM1apHT6CcISw9D4NNeJtXWutv8mKQjumsITzGZ/mSRlOLzxTbdOtD qyuXjSWt2TIm+ffttbZLsurP8genv4LFDHxGiVeKaAA64CnI4wc2DukbwCfhAAUR tC1TdGVwaGVuIENyb21wdG9uIDwxMDA2NDUuMTcxNkBjb21wdXNlcnZlLmNvbT6J AJUDBRAw062s3ic1/dqHwMcBATFuA/9HeAnZWL8MVHSx3/Ux5vRKxpAqrKs9llgN 5RmaGX+lBW6GASnSdpyrBXTG7+li/X57Jmgq04X3rWZm34Qdo6D2266aKkXc9PkM njuMpmw29Ejza5VYUlz8jMm5vUDEgaPtA5a4JL9+HLhCPCv298177kFZrZBvUgll 1/PO1bpTaokAlQMFEC/tv3UuGDEtkMU5FQEBxYAD/Rsbr7PlHSOns3WsULqmdU9Z 1vKrlmp/sma950jMRC75tJNE1R0eBcE+1eHWkpDhcQ2rlpVTiEcO3IcOBv4ycAjG ZeVcv7hEmMd+Rf+75L/Y0DAZEB9SjX46TTagEYAURK/qWMl47nZpQiyo2VyM/5Br 3fGzuUH/ZE8gjhdYVTQE =WBzQ -----END PGP PUBLIC KEY BLOCK-----

1 0

A URL for Dimitri
by Slothrop 17 Dec '03

17 Dec '03

http://www.torah.org/learning/halashon/ jd -- Jason Durbin Stop Reading Here<--

1 0

LON_ely
by John Young 17 Dec '03

17 Dec '03

11-25-96: "Intel Enters Encryption Market With HP For PCMCIA Card " So far, HP is the only computer company offering the combination PCMCIA and smart card encryption hardware. VLSI and Tandem are developing an encryption chip for use on a PCMCIA card. VLSI built the infamous Clipper chip developed by the NSA that was shot down as a proposed government standard after overwhelming industry opposition. In a separate development, National Semi, one of two suppliers of the Fortessa encryption card, scaled back its government encryption operations. Program delays, slim margins, and contract disputes with the NSA disillusioned the chip maker. ----- LON_ely (5 kb)

1 0

Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

I have written an encryption program called Very Good Privacy for Windows 95/NT. It supports drag-and-drop encryption using the following algorithms: ASCII (Caesar), BlowFish, DES, IDEA, NewDES, RC4, Safer SK-128, and Vigenere. After the files are encrypted, the user has the option of securely deleting the source files using a stream of random text. Very Good Privacy is shareware with a $5-$10 registration fee. Please note: Pretty Good Privacy is only "pretty good" but Very Good Privacy is "very good." :-) VGP can be downloaded at: http://www.geocities.com/SiliconValley/Pines/2690 If you have any questions, please e-mail vgp(a)cryogen.com

3 4

Programming Errors
by Weissman, Gregg 17 Dec '03

17 Dec '03

______________________________ Forward Header __________________________________ Subject: Programming Errors Author: Alan Arndt <aga(a)intertrust.com> at internet Date: 11/19/96 1:50 PM >From New Scientist, 28 August 93, Feedback column: "The National Westminster Bank admitted last month that it keeps personal information about its customers, such as their political affiliation on computer. But now Computer Weekly reveals that a financial institution, sadly unnamed, has gone one better and moved into the realm of personal abuse. The institution decided to mailshot 2000 of its richest customers, inviting them to buy extra services. One of its computer programmers wrote a program to search through its databases and select its customers automatically. He tested the program with an imaginary customer called Rich Bastard. Unfortunately, an error resulted in all 2000 letters being addressed "Dear Rich Bastard". The luckless programmer was subsequently sacked."

2 1

Re: denial of service and government rights
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I see two general arguments that go in the direction of the SAIC consultant's comments: 1. Seizure & retention as evidence or instrumentality of a crime - e.g., if someone breaks into my house, steals my gun, and uses it to shoot someone, it'll be a long damn time before I get my gun back. The prosecution will likely want to do various forensic tests, the defense may want to do its own, the prosecutor will want to wave it around at trial, it may even go back to the jury room to pass around while they deliberate - and if there's a mistrial/new trial granted, the cycle starts again. (Off of the top of my head, I can't remember what happens to physical evidence after trial but during appeal.) Generally, people who are unfortunate enough to have property which gets sucked into a criminal investigation/trial are just out of luck. Bummer. I don't see any reason why this wouldn't be true for a computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure (but seizure is not forfeiture) of "property that constitutes evidence of the commission of a criminal offense". 2. Forfeiture of the instrumentality of a crime, or of a nuisance - cf. _Bennis v. Michigan_ <http://www.law.cornell.edu/supct/cases/94-8729.html>, the recent Supreme Court case where the "Justices" (cough cough) upheld the forfeiture of a wife's half interest in a car which was used (without her knowledge/consent) by her husband to facilitate the crime of prostitution. The Supreme Court rejected the idea that the Fifth Amendment's takings clause or the Fourteenth Amendment's due process clause prevents the forfeiture of the instrumentality of a crime without a showing of culpability on the part of the owners. Some forfeiture statues (e.g., 21 USC 881, 1989 Oregon Laws Chapter 791, both re drug-related forfeitures) provide for an "innocent owner" defense to forfeiture, but the Supreme Court doesn't seem to think that's required as a matter of constitutional law. Fed.Rul.Crim.Pro 41(b)(3) allows the seizure of "property designed or intended for use or which is or has been used as the means of committing a criminal offense". There's an excellent resource available re computer search & seizure at <http://www.epic.org/security/computer_search_guidelines.txt> - it's the US DOJ's "Guidelines for Searching & Seizing Computers", pried loose by an EPIC FOIA request and scanned. But there's a big difference between "seizure" and "forfeiture". It's possible that recent legislation has done for computer crime what the drug forfeiture laws have done with respect to title in property - 21 USC 881(h) indicates that "All right, title, and interest in property described in subsection (a) of this section [e.g., property used in connection with a drug crime] shall vest in the United States upon commission of the act giving rise to forfeiture under this section." Given the innocent owner defenses available in an 881 forfeiture, (h) sounds scarier than it works out to be. So yes, there may be a statute which gives title to the government in computers used to commit crimes, and no, the Supreme Court won't necessarily care about an "innocent owner". (Then again, it may make a difference if we're talking about a computer owned by a corporation with political clout, instead of the half-owner of a $600 car used for surreptitious blow jobs. Your cynicism may vary.) I can't seem to find any such statute, but like Ben Laurie pointed out w.r.t. security reviews, there's a line between what folks are willing to do for free, and what feels like work. Digging through a lot of teeny type in the Federal Register/Congressional Record isn't my idea of a good time, so I'll leave the "is there a statute?" question for someone else. I poked around on EPIC's web site and thomas.loc.gov and in 18 USC without finding a computer crime seizure statute, but I may just be too tired. :( At 07:26 PM 11/29/96 +0000, Attila wrote: > I got tired of paying Lexus $150 for idle months after dumping > West for almost $500/month --otherwise I would run down the Feds > kangaroo ruling which seems to grant them this absurd right. > Several on the list are still maintaining accounts... ? > > ====== begin forwarded text ====== > >Computer Attacks Show New Patterns > >The major trends in computer break-ins involve denial of service >and data-driven attacks, says a Department of Justice lawyer. >Denial of service occurs when an attacker "bombs" an Internet >service provider with so many e-mail messages that the server >becomes overloaded and shuts down. Data-driven attacks occur when >a virus program is disguised as a data-only file. The file can be >hidden in a Java program on a Web page, and when a visitor clicks >on the site, he or she unwittingly downloads the virus. A computer >crime consultant with SAIC warns that these attacks can be launched >on an innocent party's Web server, but once that happens, the server >can become the subject of a wiretap and a search warrant. "The title >of your computer vests with the government as soon as a hacker uses >it to commit a crime," he says. > >[BNA Daily Report for Executives 25 Nov 96 A20] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMp+GSv37pMWUJFlhAQHEmgf+IfYnc0w47Ja/ETFlt08uHA7OWV9NJetd l3gA4av00CwST1FRtdizAC0C4t2MHT6kzHb1j8NzncazAvgjdTEa9Vd31UTR0HgU 4dYbu9e+YtYT6NcaD4HszewxVo/gfpUKBobOA2lVe1QLR1Dzqbx2cbsmxKgDsdzE Y/TATalZ7c7BkAXJBBgmXs8QYpsBWGUpmf8PUB3731MpGyF6H4gpmssxefjvGghE eQ27k3hkPlZiKGI5MeZrFhUZXJj3VPu4B3/gC+ZFm2M8Jh4z5Wo4r7w690eb9hky dGkUzQOb6sdh3ee1oJzwNWXE7R6DCL+3uiGA8Slt0hPOSBo2LBY2Zg== =dQn5 -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: More anonymous hate mail from John Gilmore, Timmy May, and
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Ross Wright" <rwright(a)adnetsol.com> writes: > On or About 28 Nov 96 at 15:21, Dr.Dimitri Vulis KOTM wrote: > > > because Americans are so stupid. > > Come on, doc. That's a bit of a generalization. You don't want to > piss off people who like you, now, do you? Hi Ross - well, generally, I think most people are stupid, irrespective of their ethnicity. I'm just trying to piss off some more c-punks. :-) OK, OK, point taken, I'll desist. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

No Subject
by Juan Manuel 17 Dec '03

17 Dec '03

sign-off -- JUAN MANUEL RICO CIUDAD DE PANAMA - PANAMA HTTP://www.paramar.com/index.html mailto:jmro@paramar.com mailto:info@paramar.com PARAMAR IMPORT & EXPORT, LTDA. SERVICIO DE PRIMERA CLASE A SU CARGA TEL: 507 2239836 - FAX: 507 2239837 --

1 0

Re: Re[2]: Sound card as a random number source ??
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> And what if I will use FM receiver, tuned on some channel where is the noise. > If the potentional attacker don't know the what channel was tuned, he is not > able to reproduce this IMHO. Of course, maybe it is possible to record the whole > spectrum to tapes, but I think that the noise will change when recorded and > played back from tape. It might possibly be random enough, especially if you use a tape recorder of a reasonably poor quality, thus inducing wow and flutter noise to the recording before it is sampled. anyone else care to comment? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Announcement: Very Good Privacy
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear Sir, > I'm not sure how an encryption product that uses encryption > algorithms weaker than Pretty Good Privacy can be described > as being better than PGP. > > Especially when all the algorithms listed have known problems > of one kind, or another. << And yes, I know that the known > problems -- in some instances --- are entirely theoretical in > nature. >> What puzzles me is that he included two cyphers that are _extremely_ easy to break, the vignere cypher and the ascii cypher. Why include these? And what is his new permutation of RC4 and DES? Yours Sincerely, Benjamin Grosman

1 0

Strong-crypto smart cards in Singapore and Germany
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Wednesday's "Straits Times" contains two front-page articles on the introduction of a CashCard which acts as an electronic wallet capable of storing from $10-$200 ("Dr Hu launches cash-in-a-card payment system"), and an identity card capable of Internet electronic transactions with (presumably RSA) 1024-bit encryption ("50,000 to take part in electronic ID trials"). The ID card can also be implemented as software on disk. It appears to be purely a form of storing an ID which is then transmitted in encrypted form. The CashCard, on the other hard, is an electronic wallet developed by a group of Singapore banks. There are no details on how it works, except that it doesn't have any sort of protection - it's up to you to make sure the card isn't stolen. The standardisation committee of the German banks have also produced an electronic wallet which should have 25 million (yes, 25M) users by January of next year. Again, this is a pure electronic wallet, with 2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. The relevant standards are still in the process of being translated, but should be available Real Soon Now (the complete specification will be made public). This looks like a very nice system, and unlike Mondex doesn't rely entirely on the hope that criminals can't get at the data on the card. Peter.

5 4

Re: Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

> What puzzles me is that he included two cyphers that are _extremely_ easy to > break, the vignere cypher and the ascii cypher. Why include these? And what > is his new permutation of RC4 and DES? The reason I included ASCII and Vigenere was because they are very fast; on a friend's machine, I can get 1.7mb/s with ASCII but only around 600k/s with NewDES, the fastest "secure" cipher. I do agree that it is kind of redundant to include both ASCII and Vigenere, as from a cracking standpoint, they are both identical. As for Psuedo-RC4, that is just to try to avoid a lawsuit from RSADSI; RC4 is a trademark. NewDES is an actual algorithm; it's even mentioned in Applied Cryptography. It does have some holes and is in fact less secure than DES (refer to Applied Cryptography for details on this); I included that because it is fast and provides much, much more security than ASCII or Vigenere, even if it is less secure than DES. Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

1 0

Re: Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

> > I have written an encryption program called Very Good Privacy > > Trademark violation here. Probably not a good thing. Is PGP trademarked? Are you sure? And if it is, is naming something Very Good Privacy a violation? Why? Legal people, please help! > I'm not sure how an encryption product that uses encryption > algorithms weaker than Pretty Good Privacy can be described > as being better than PGP. > > Especially when all the algorithms listed have known problems > of one kind, or another. << And yes, I know that the known > problems -- in some instances --- are entirely theoretical in > nature. >> In your quote, you deleted the smiley about VGP. It's a joke. Your claim that VGP is weaker than PGP is unfounded, as VGP uses IDEA, which is the symmetric algorithm used in PGP. ASCII and Vigenere are very weak, but they are fast and geared toward people who simply want to stop their brother or sister from getting into something. As for the security of other algorithms, BlowFish is used in PGPfone and RC4 is used in SSL -- since you control the key size in VGP, you can make RC4 virtually unbreakable (not to mention the problem of the attacker figuring out the key size in the first place). Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

1 0

WinSock Remailer Back Up
by Joey Grasty 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Y'all: Due to a misconfiguration on one of the two machines that operate the WinSock Remailer, messages were lost from about Wednesday, 27 November, to Sunday, 1 December. We apologize for the lost messages. Regards, Joey Grasty Jim Ray WinSock Remailer Operators -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMqJvkg6sYKeTQAOtAQGrNwMA2MYpRHLtkeksVcoyx6T9+V+36fey8FXM sdbxI3DjN8Xq8Se81R7+qXNWxgVx2/HxQtu4w9Ea1GQz4B8cjYdlMVLXNIgdGrHy 3We8saHtvVIzCTFnvFIEn6MStNAZb+gw =9Vso -----END PGP SIGNATURE-----

1 0

NEWS.COM DAILY DISPATCH
by The CNET newsletter 17 Dec '03

17 Dec '03

*************************************** NEWS.COM DAILY DISPATCH Wednesday, November 27, 1996 San Francisco, California, USA *************************************** WELCOME! *************************************** The NEWS.COM DAILY DISPATCH highlights the up-to-the minute technology news presented by NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd *************************************** CONTENTS SCOOPS AND TOP STORIES Online rivals Gates and Case circle each other Attention Comdex survivors! Need someone to feel yur paynnne? AOL's prix fixe might cause another service delay Intel's multimedia chip: More suitable for fun & games than business? ANNOUNCEMENTS An easy way for you to customize NEWS.COM Late-breaking stories just a click away with Desk Top News Send us your questions, comments, flotsam, and jetsam *************************************** SCOOPS AND TOP STORIES ONLINE RIVALS GATES AND CASE CIRCLE EACH OTHER The online world has become a killing field. CompuServe pulls the plug on its consumer-based Wow service; Prodigy, at the bottom of the heap, transmogrifies Kafka-like into an ISP. Now, as the mighty Web threatens to consume all in its path, these two cyberbehemoths engage in a struggle for the whole enchilada. http://www.news.com/SpecialFeatures/0%2C5%2C5770%2C00.html?nd ATTENTION COMDEX SURVIVORS! NEED SOMEONE TO FEEL YUR PAYNNNE? Okay, you've been through a lot, granted...but speaking out about your Comdex trials and tribulations can help the all-important healing process begin. So please, send us your war stories. We will publish the five best, and the winners--picked on a totally subjective basis by our editorial staff-- will get supercool CNET T-shirts. Send your tales to suggestions(a)news.com, and include the words 'Comdex stories' in the subject of your message. P.S. Don't forget to check out our comprehensive coverage of the sublime and the ridiculous at Comdex '96. http://www.news.com/Comdex/?nd AOL'S PRIX FIXE OFFER MIGHT CAUSE ANOTHER SERVICE DELAY Just when you AOLers thought it was safe to go back online, the possibility of another service glitch rises up on the cyberhorizon. Starting on December 1, AOL's 7 million users have the option of switching to an all-you-can-eat pricing offer; the resultant "usage surge" may cause service delays, according to a recent AOL announcement. Wise users might consider getting their heavy surfing done this long weekend, once that turkey-induced coma sets in. http://www.news.com/News/Item/0%2C4%2C5783%2C00.html?nd INTEL'S MULTIMEDIA CHIP: MORE SUITABLE FOR FUN AND GAMES THAN BUSINESS Intel's latest technological achievement, the MMX Pentium processor, would certainly be ideal for running sophisticated business applications--that is, if there WERE sophisticated business applications for it to run. At this point, MMX seems more useful in entertainment and gaming settings than in the executive suite. The $64,000 question: will developers build for this flashy new kid on the block? http://www.news.com/News/Item/0%2C4%2C5782%2C00.html?nd *************************************** ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify the topics, keywords, or sections you're most interested in, and Custom News will a create a page of headlines and summaries for all stories that match your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 *************************************** LATE-BREAKING STORIES A CLICK AWAY WITH DESK TOP NEWS How would you like having split-second access to the very latest news on the Net? Our Desk Top News feature puts our 20 most recent stories right there on your desktop for you to review at any time. Here's how it works: 1. From any story, click Desk Top News in the top right. 2. A window will open showing our last 20 stories. 3. Click on a headline to display the story. 4. Desk Top News updates itself every 30 minutes. 5. You become known as Ms./Mr. Cyber-Info. It feels good. http://www.news.com/Help/Item/0%2C24%2C12%2C00.html?nd *************************************** SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com *************************************** CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Ignoramus Chewed-Off on IPG algorithm
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hi, I was sort of tired of endless talk that "IPG algorithm was not peer-reviewed, blah blah blah, so we won't even look at it, blah blah blah", and decided to look at what Don Wood writes and try to see how his program actually works. Of course, I am not an expert in cryptography, and will appreciate all corrections. The web page to look at is http://www.netprivacy.com/algo.html, and it describes IPG algorithm in some detail. First of all, the description of the algorithm is extremely unclear. I understand that this may be Don Wood's writing style, but it is certainly not the most efficient style for precise communications. I suggest that Don tries to rewrite his description to be more structured. Second, I seriously suspect that his algorithm of "trimming" is NOT going to work right. Just to remind everyone, he generates pseudo-random A(JV), B(JV), C(JV) such that 16384 < C < 20361 B < 12227 A arbitrary (at least the web page contains no restrictions on the value of A). and then goes on to "trimming" -- a process that obtains a new value of A that is LESS than 16384 through this algorithm: DO JV=JV+1 IF JV=53 THEN JV=0 A(JV)=(A(JV)+B(JV)) MOD C(JV) UNTIL A(JV)<16384 We shall first note that THERE ARE CASES WHEN THIS ALGORITHM WILL NEVER STOP! For example, if all A values are _initially_ 16385 and all C values are 16386 and all B's are 0, it is obvious that the pseudocode above will be stuck in endless loop. No good for IPG algorithm. in fact, if only some triplets of A, B, and C have B == 0 and 16384 < A < C, these triplets will always be ignored (skipped) by his trimming process. Second, IPG's claim that ``Of even greater importance is the second role of producing a distribution of the numbers 0 to 16383, so that the number of each of those numbers produce, asymptotically approach an even distribution, in the same way that theoretically a true random number generator produces a set of numbers whose frequency asymptotically approach an even distribution'' is FALSE: I do not see why the distribution of A's should necessarily contain all numbers from 0 to 16383, less to "approach" an even distribution. For example, if all initial A, B, and Cs are even numbers, we'll obviously never get an odd number for A(JV), no matter how many iterations. If, say, 40 out of 53 of triplets A, B, and C contain only even numbers (not a statistical impossibility!), then about 75% of resulting values of A(JV) will be even. No good for the keystream. There are many more imperfections than just related to all-even triplets. - - - - Let's go on, to the description of the "scrambling tables" and actual encryption. He uses three tables, DIFF, DISP, DETR, each containing 4096 elements. DISP is randomly generated (or so I understand his term "prescrambled"), DIFF is a random transposition of DISP (same values as in DISP, but in another order), and DETR, again, is filled with some random data. It does not really matter to my analysis how DISP and DETR are generated. Here's how he encrypts the data (in a loop for I from 0 to 4095): D1=(D1+A(JV)) AND 4095 D2=DISP((D2+D1) AND 4095) F=DETR(D2)<<8 D3=(D3+D2) AND 4095 BUF(DIFF(I))=BUF(DIFF(I)) XOR (F+(DETR(DISP(D3)))) I.e., D1, D2, and D3 are regenerated each pass of the loop and then are used to encrypt item DIFF[I] (i.e., 2-byte word with index DIFF[i], NOT I). That is very bad: what it means is that we are not guaranteed that all BUF[i] will be scrambled! It is fairly clear that about 1/(e*e) (e is the base of natural logs) will be left unscrambled!!! This follows from the fact that even with perfectly random numbers used as DIFF[i], the probability that a cell J will be scrambled is 2/4096 (it is 2 and not 1 since each hit covers two bytes and not one). Therefore, the probability that cell J will be left unscrambled is (1-2/4096) ** 4096 which is approximately equal exp(-2) == 1/(e*e). It means that 1 out of seven characters will be left unencrypted at all. No good for a stream cipher. I think that his cipher could have been made stronger if he actually did not use DIFF[i] as an index and used I instead. Still, of course, his algorithm has nothing to do with one time pads. Since this is clearly not a matter of high theories but a simple question of accepted definitions, there is little point to argue about it and I preferred to address details of his algorithm instead. There may be more problems with IPG algorithm that I simply missed. I would appreciate your corrections and notes. Thank you. - Igor.

1 0

Re: The Difference Between The Right And Left
by Murray Hayes 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996 22:47:06 -0800, Troy Varange wrote: > The French Revolution perhaps provided the best > definition as the origional coiners of the terms. > > The Left is for radical change and the Right is for > evolutionary change. The Jacobin (sp) sat on the left side while the other guys (I forget their names) sat on the right. Of course both used to be on the left before they klled everyone on the right after which an expansion of sorts happened to fill the seats. I think the event was called the night of the long knives? > > That would put mainstream politics decidedly on the right > wing side of the political spectrum. I would have thought main stream would have been in the middle. > The left wing is a rather motly collection including many > anarchists, communists and nazis, yet many of the same > types are decidedly right wing. mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

1 0

Re: Ignoramus Chewed-Off on IPG algorithm
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Igor Chudov @ home wrote: > > Hi, > > I was sort of tired of endless talk that "IPG algorithm was not > peer-reviewed, blah blah blah, so we won't even look at it, > blah blah blah", and decided to look at what Don Wood writes and > try to see how his program actually works. > > Of course, I am not an expert in cryptography, and will appreciate all > corrections. The web page to look at is http://www.netprivacy.com/algo.html, > and it describes IPG algorithm in some detail. > > First of all, the description of the algorithm is extremely unclear. I > understand that this may be Don Wood's writing style, but it is certainly > not the most efficient style for precise communications. I suggest that > Don tries to rewrite his description to be more structured. > > Second, I seriously suspect that his algorithm of "trimming" is NOT > going to work right. Just to remind everyone, he generates pseudo-random > A(JV), B(JV), C(JV) such that > > 16384 < C < 20361 > B < 12227 > A arbitrary (at least the web page contains no restrictions > on the value of A). > > and then goes on to "trimming" -- a process that obtains a new value > of A that is LESS than 16384 through this algorithm: > > DO > JV=JV+1 > IF JV=53 THEN JV=0 > A(JV)=(A(JV)+B(JV)) MOD C(JV) > UNTIL A(JV)<16384 > > We shall first note that THERE ARE CASES WHEN THIS ALGORITHM WILL NEVER > STOP! For example, if all A values are _initially_ 16385 and all C > values are 16386 and all B's are 0, it is obvious that the pseudocode > above will be stuck in endless loop. > > No good for IPG algorithm. > > in fact, if only some triplets of A, B, and C have B == 0 and 16384 < A < C, > these triplets will always be ignored (skipped) by his trimming process. Note also that if B(K) == 1, his algorithm will need to make C passes through the loop for JV == k, in order to generate a new value of A(JV). This is very inefficient and results in a bias for triplets with high Bs -- because they will generate good A(JV) more frequently. - Igor.

2 2

Re: Ignoramus Chewed-Off on IPG algorithm
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Igor Chudov @ home wrote: > > Let's go on, to the description of the "scrambling tables" and > actual encryption. > > He uses three tables, DIFF, DISP, DETR, each containing 4096 elements. > DISP is randomly generated (or so I understand his term "prescrambled"), > DIFF is a random transposition of DISP (same values as in DISP, but in > another order), and DETR, again, is filled with some random data. > Correction: by "scrambling" Don means transposing elements of the table containing 4096 numbers 1-4096. - Igor.

4 17

Re: Building a DC-NET
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Black Unicorn <unicorn(a)schloss.li> writes: > On Sat, 30 Nov 1996, Simon Spero wrote: > > > (what's the Alice/Bob name for someone trying a denial of service attack?) > > Louis? John the petty small-time bitch? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

"CypherPunks" and The Pink Swastika
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Slothrop" <slothrop(a)poisson.com> writes: <anti-semitic spam> Read the _Pink Swastika_ to learn more about the role the likes of Jason Durbin and John Gilmore played in Hitler's rise to power. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Detweiller spotted?
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Dale Thorn said: >Now that's what I call amazing. Maybe I could rewrite PGP >tomorrow (hee hee). Is anyone else hearing a familiar (and again, constant) voice from the past? Maybe I'm wrong, but has anyone met him in person? Just asking.

2 1

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Some of these bullies, like Paul Bradley, realize that they don't know > the meanings of the words they use. Paul Bradley not only posts nonsense > about brute force attacks on OTP, but also harrasses anyone who exposes > his utter ignorance, in en effort to intimidate them into shutting up. You don`t seem to realise that not only is my reputation unnafected by your worthless drivel about "brute force attacks on one time pads", which everyone else apart from you and Don immediately accepted as a simple misunderstanding of the topic of the message (I was talking about stream ciphers), but I am finding it rather amusing to watch the level of your rants deteriorate to the point where you now label anyone who actually posts about cryptography on this list as a "k00l hAcKiNg D00d" who knows nothing of what he is talking about. And as for harrasing people to shut up if you had been watching the traffic on the list you would have noticed that I disagreed with John over throwing you off the list. I simply wonder if the reason you appear to be so calm offline but a foaming at the mouth lunatic online is that you are scared someone is going to give you the good kicking you so rightly deserve. > "Cypherpunks'" opinion of any proposed new cryptosystem is worthless and > irrelevant. And I suppose the opinion of a man who cannot control his urges to post rants about "sovok jews" and armenian refugees is of great value to the learned and worthy??? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Copyright violations
by varange＠crl.com 17 Dec '03

17 Dec '03

But software wants to be free! -- Cheers!

1 0

How long do you want to live?
by All＠Internet.Users 17 Dec '03

17 Dec '03

HELLO IS ANYONE OUT THERE? HOW LONG DO YOU WANT TO LIVE? WHAT QUALITY OF LIFE? First, imagine this scene. Your daughter or son is on the phone with a 911 dispatcher. Why? You are lying on the floor in the kitchen, clutching your chest, panic stricken. You are 45 years old. In addition to fear, lots of things are racing through your mind. You want to see your children grow to adulthood. You want to travel. You want to enjoy life some more. Right now though, you don't know if tomorrow will come. FACT: According to the World Health Organization more than 12 million people die from heart attacks, strokes and other forms of cardiovascular disease. THESE DEATHS ARE LARGELY PREVENTABLE. FACT: In the U.S. there are 1500 heart attacks each day; 33% resulting in sudden and premature deaths. NO SECOND CHANCE!! FACT: Heart attacks and strokes are not diseases. They are caused by vitamin deficiencies. America's number one killer can be prevented by an optimum intake of essentials nutrients. FACT: A medical breakthrough has made an old dream of mankind come true. Heart attacks and other forms of cardiovascular disease can essentially become unknown during this generation and forthcoming generations. The division I am heading holds the rights to a patented, non prescription, non-surgical means to lower cholesterol, prevent and reverse heart disease. If you are interested in adding more life to your yearsnot just more years to your life, please call me at: 1-800-741-6240 and leave your name, address and phone number for more detailed information. I'd like to ensure you I am not looking for investors or salespeople. This may be one of the most important decisions of your life. Sincerely, Dr. George Tarryk, M.D. Internal Medicine Specialist 1-800-741-6240 Please Only Reply By Phone, Thank you.

1 0

Re: denial of service and government rights
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

This thread is probably already due for a change in the Subject line, but I'll leave it untouched for the moment. On 30 Nov 96 at 13:10, Black Unicorn wrote: > On Fri, 29 Nov 1996, Greg Broiles wrote: > [...] > > > I don't see any reason why this wouldn't be true for a > > computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure > > (but seizure is not forfeiture) of "property that > > constitutes evidence of the commission of a > > criminal offense". > > It is true of computers. > Take the case of Ripco (the Chicago BBS raided in the > SunDevil raids back when). > > I don't think "Dr. Ripco" has yet gotten his equipment > back. I don't know for sure, but what I do know is > that 5 years after the raid, he still had certainly > not gotten anything back. [....] > Recall also that Ripco was never specifically charged > (or the minor charges that they did try to pin didn't > stick). > > Also recall that Ripco (now ripco.com) was raided with a > -sealed- warrant. I dont think that the contents of that > warrant have, even today, been released (though I could > be mistaken). Certainly 5 years after they had not. [....] > > But there's a big difference between "seizure" and > > "forfeiture". > > I'd argue with computer hardware it is a distinction > without a difference. Seizing computer hardware (like > Ripco's stuff) for in excess of 5 years is tantamount > to forfeiture given depreciation and so forth. > > Add to this the very liberal rules about how long the > feds can take to even CHARGE you with a crime after > seizure.... And it sums to a very bleak picture, indeed. [....] > > So yes, there may be a statute which gives title to > > the government in computers used to commit crimes, > > and no, the Supreme Court won't necessarily care > > about an "innocent owner". > > Again, I would argue that such a statute needn't even > exist given the rules already well estlablished and > demonstrated in action with regard to indefinate > seizure of computer hardware even in the absence of > criminal claims against the owner. Please forgive my naivete, but are there no legal weapons available to the 'victims' in such cases? I'm passingly familiar with the Operation Sundevil fiasco -- i.e., with the outcome re the principal 'charges'. I'm appalled, however, at the apparent lack of remedies for return of such seized property. Are individuals who find themselves in such a predicament simply at the government's mercy (there's an oxymoron for ya)?? Tired Fighter

5 4

Re: denial of service and government rights
by Dale Thorn 17 Dec '03

17 Dec '03

Mail Delivery Subsystem wrote: > ----- The following addresses had delivery problems ----- > <Tired.Fighter(a)dhp.com> (unrecoverable error) > 550 <Tired.Fighter(a)dhp.com>... User unknown > ----- Original message follows ----- > Tired.Fighter(a)dhp.com wrote: > > On 30 Nov 96 at 13:10, Black Unicorn wrote: > > > On Fri, 29 Nov 1996, Greg Broiles wrote: > > > > I don't see any reason why this wouldn't be true for a > > > > computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure > > > > (but seizure is not forfeiture) of "property that > > > > constitutes evidence of the commission of a > > > > criminal offense". > > [snip] > > > Please forgive my naivete, but are there no legal > > weapons available to the 'victims' in such cases? > > I'm passingly familiar with the Operation Sundevil > > fiasco -- i.e., with the outcome re the principal > > 'charges'. I'm appalled, however, at the apparent > > lack of remedies for return of such seized property. > > Are individuals who find themselves in such a > > predicament simply at the government's mercy (there's > > an oxymoron for ya)?? > > Just in case someone replies saying "It's not all that bad", or "It can't > happen here", etc., you should know this: > > The United States government has not been responsive to the people for > a long time, but what's become evident in recent years is that they're > also no longer responsive to basic law and order. > > They do respond to extreme pressure, as was applied in the Weaver, Waco, > and other similar cases, but, as a general rule, they do whatever they > want all the way to the top of the Justice dept. with impunity. > > Example: George Bush's old pal at the Wash. DC P.R. firm hires the > niece(?) of a Kuwaiti official to testify in front of Congress in full > view of the American people on television, that the Iraquis were throwing > babies out of incubators in Kuwait, thereby securing the necessary votes > in Congress to prosecute the Gulf War. > > When it was discovered (after the "war") that the Incubator Baby Scandal > was a lie, nobody was prosecuted. Further, in blatant violation of the > U.S. Constitution, Bush and Schwartzkopf were knighted by Queen Elizabeth > II of England. > > There are also numerous examples of the Justice dept. being caught red- > handed forging documents to frame people for whom they had no evidence or > insufficient evidence to prosecute, and what happens in those cases? > Nothing.

5 12

Re: Building a DC-NET
by Gary Howland 17 Dec '03

17 Dec '03

Dimitri writes: > > Black Unicorn <unicorn(a)schloss.li> writes: > > > On Sat, 30 Nov 1996, Simon Spero wrote: > > > > > (what's the Alice/Bob name for someone trying a denial of service attack?) > > > > Louis? > > John the petty small-time bitch? How about William? (Can't use Bill, since 'B' is taken). Could refer to Clinton (since he denies services to Cuba etc.), or to Gates (the creator of 'denial of service', aka. DOS). Gary

2 1

ubject
by Gary Howland 17 Dec '03

17 Dec '03

Swastikas halt Corel sales By Reuters November 25, 1996, 12 p.m. PT MUNICH, Germany--Corel (COSFF) software company has temporarily halted sales of its top-selling Corel Draw graphics program in Germany because it includes four banned Nazi symbols, a company spokesman said today. The Canadian company will remove three drawings of Adolf Hitler and one swastika from future versions of its popular software, spokesman Thomas Layer said. It is also distributing warning labels to be placed on versions now being sold, Layer said. The label warns that the "improper use of digital images and symbols" found in the programs Corel Draw 4.0, 5.0, and 6.0 is prohibited in Germany, which bans public displays of Nazi symbols. Munich's state prosecutor launched an investigation into the software on October 2 after learning that someone had used the banned images to print business cards for a neo-Nazi group, Layer said. This is not the first time that the company has had complaints due to their clip art images. In 1992, pressure from US Black rights organisations forced drawings of the Ku Kux Klan to be removed from the collection. Consideration is also being given to the removal of other images from the collection, either due to legal restrictions in various countries, or due to complaints from organisations such as the Simon Wiesenthal Center. Images considered for removal include a burning US flag, Josef Stalin, the Star of David icon, a cannabis leaf, and a drawing of a woman in a bathing costume. Corel Draw provides more than 24,000 clip art drawings and symbols that computer users can copy. The company suspended the sales on November 19.

1 0

COREL TO CENSOR ALL CLIP ART WORLDWIDE
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Swastikas halt Corel sales By Reuters November 25, 1996, 12 p.m. PT MUNICH, Germany--Corel (COSFF) software company has temporarily halted sales of its top-selling Corel Draw graphics program in Germany because it includes four banned Nazi symbols, a company spokesman said today. The Canadian company will remove three drawings of Adolf Hitler and one swastika from future versions of its popular software, spokesman Thomas Layer said. It is also distributing warning labels to be placed on versions now being sold, Layer said. The label warns that the "improper use of digital images and symbols" found in the programs Corel Draw 4.0, 5.0, and 6.0 is prohibited in Germany, which bans public displays of Nazi symbols. Munich's state prosecutor launched an investigation into the software on October 2 after learning that someone had used the banned images to print business cards for a neo-Nazi group, Layer said. This is not the first time that the company has had complaints due to their clip art images. In 1992, pressure from US Black rights organisations forced drawings of the Ku Kux Klan to be removed from the collection. Consideration is also being given to the removal of other images from the collection, either due to legal restrictions in various countries, or due to complaints from organisations such as the Simon Wiesenthal Center. Images considered for removal include a burning US flag, Josef Stalin, the Star of David icon, a cannabis leaf, and a drawing of a woman in a bathing costume. Corel Draw provides more than 24,000 clip art drawings and symbols that computer users can copy. The company suspended the sales on November 19.

2 1

COREL TO CENSOR ALL CLIP ART WORLDWIDE
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Swastikas halt Corel sales By Reuters November 25, 1996, 12 p.m. PT MUNICH, Germany--Corel (COSFF) software company has temporarily halted sales of its top-selling Corel Draw graphics program in Germany because it includes four banned Nazi symbols, a company spokesman said today. The Canadian company will remove three drawings of Adolf Hitler and one swastika from future versions of its popular software, spokesman Thomas Layer said. It is also distributing warning labels to be placed on versions now being sold, Layer said. The label warns that the "improper use of digital images and symbols" found in the programs Corel Draw 4.0, 5.0, and 6.0 is prohibited in Germany, which bans public displays of Nazi symbols. Munich's state prosecutor launched an investigation into the software on October 2 after learning that someone had used the banned images to print business cards for a neo-Nazi group, Layer said. This is not the first time that the company has had complaints due to their clip art images. In 1992, pressure from US Black rights organisations forced drawings of the Ku Kux Klan to be removed from the collection. Consideration is also being given to the removal of other images from the collection, either due to legal restrictions in various countries, or due to complaints from organisations such as the Simon Wiesenthal Center. Images considered for removal include a burning US flag, Josef Stalin, the Star of David icon, a cannabis leaf, and a drawing of a woman in a bathing costume. Corel Draw provides more than 24,000 clip art drawings and symbols that computer users can copy. The company suspended the sales on November 19.

2 1

Ping!
by cypherpunks＠count04.mry.scruznet.com 17 Dec '03

17 Dec '03

--------

1 0

Ping! ((chain=(anon);1;(replay)))
by cypherpunks＠count04.mry.scruznet.com 17 Dec '03

17 Dec '03

-------- ping 5

1 0

Ping! ((chain=(anon);1;(replay)))
by cypherpunks＠count04.mry.scruznet.com 17 Dec '03

17 Dec '03

-------- ping 5

1 0

A quick discussion of Mersenne Numbers
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

I wake of the latest find announcement, some people maybe wondering what the heck is this?!! A mercenne number is of the type: M(p) = 2**p -1 results in a prime when p is a prime. Hopefully this will lead the way to see the pattern of prime numbers and being able to compute prime numbers in a far more efficient manner (after all a function that when given a prime number results in a prime number would be quite a kicker now wouldn't it!) The other Mersenne primes include: 2,3,5,7,13,17,19,31,127,61,89, and 107. The numbers 67 and 257 are not primes.... Have fun in them prime number databases....

4 5

Another problem with IPG algorithm
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Don and others, At the heart of IPG algorithm there is a pseudo-random number generator which generates values of A(JV). (see http://www.netprivacy.com/algo.html) DO JV=JV+1 IF JV=53 THEN JV=0 A(JV)=(A(JV)+B(JV)) MOD C(JV) UNTIL A(JV)<16384 Note that if B(JV) and C(JV) in a triplet (A(JV), B(JV), C(JV)) are not mutually prime, they will generate very few numbers and not a whole set 0-16383. For example, if C(JV) is 20000, and B(JV) is 10000, and initial A is (for example) 57, the only two numbers that this triplet will generate will be 57 and 10057. This refutes Don Wood's claim that the distribution of results approaches even. Even if only ONE triplet is such as I described (and it is VERY likely to happen statistically), the distribution will be skewed. Don, what do you think about it? igor

2 2

Re: denial of service and government rights
by jim bell 17 Dec '03

17 Dec '03

At 09:25 PM 11/30/96 -0500, Tired.Fighter(a)dhp.com wrote: >On 30 Nov 96 at 13:10, Black Unicorn wrote: > >> On Fri, 29 Nov 1996, Greg Broiles wrote: > >> [...] >> >> > I don't see any reason why this wouldn't be true for a >> > computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure >> > (but seizure is not forfeiture) of "property that >> > constitutes evidence of the commission of a >> > criminal offense". >> >> It is true of computers. >> Take the case of Ripco (the Chicago BBS raided in the >> SunDevil raids back when). >> >> I don't think "Dr. Ripco" has yet gotten his equipment >> back. I don't know for sure, but what I do know is >> that 5 years after the raid, he still had certainly >> not gotten anything back. Unicorn has a long history of reciting government abuses, but then failing to provide any sort of answer to them. My solution (AP: "Assassination Politics") would make such abuse fatal. Jim Bell jimbell(a)pacifier.com

2 1

Re: denial of service and government rights
by Greg Broiles 17 Dec '03

17 Dec '03

At 05:24 PM 12/1/96 -0800, Dale Thorn wrote: >So what you're saying is I (or we) can testify in front of Congress on >essentially any topic, telling a blatant lie (that we know is false, and >which they will subsequently prove is false), and totally get away with >it. You and I can do that, is that what you're saying? This is idiotic. I suspect it's deliberately idiotic, but I can't see what anyone gains by it. If you've got a point to make, would you please just say what you're thinking and move on? There's a big difference between something being punishable and someone being punished. The false testimony was given on behalf of a friendly government, and in favor of a cause which met with widespread national support and was the focus of much (literal) flag-waving and patriotic speechifying. In general, you face very few risks if you lie in a way which helps a very popular cause, and the people you're lying to want to do the thing that your lies are purportedly justifying. Your risks are much greater if you're saying something unpopular or if you are an unpopular person. I'm not talking about law, I'm talking about politics. And the fact that laws are sometimes enforced in a political matter shouldn't be news to anyone. (I'm not saying that's good, but I think it's attributable to and a result of to the general fallibility of human beings, myself included, so I'm skeptical about easy answers. Real-world solutions tend to fall short of theoretical perfection. Doh.) >If that is true, then my original contention that things are far worse >than the person I originally responded to was imagining, stands as >correct. Things are bad indeed. I'd sure appreciate it if you'd just say what you're thinking (if it's on-topic) instead of playing stupid "Is X true? Is Y true? Wow! I've just discovered something new!" games. Your comments suggest to me that what you're dancing around is, essentially, that the government is morally wrong because it (eliding distinctions between governments and branches of governments) enforces laws in an erratic or discriminatory or political fashion. That's what I'm extracting from your messages. If there's something more to what you're saying, I think I'd have a better chance of extracting it if you devoted less energy to tricky rhetorical strategies. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Phrack, where can i find it?
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

where can i find latest (and old) phrack issues?

3 2

RSA key generation in 13 lines of Perl
by Steve Reid 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've completed my Perl/dc RSA key generation program. The compacted 13-line version is below. A commented version can be found at http://www.edmweb.com/steve/rsagen.txt #!/usr/local/bin/perl $k=768;$e=sprintf'%X',65537;print"Please enter a LOT of random junk.\n" ;$a=<STDIN>;print"Working. This may take a while.\n";for(1..(length($a)- 1)){$b[$_&31]^=unpack('C',substr($a,$_,1));$b[$_&31]=(($b[$_&31]<<5)|($b [$_&31]>>3))&255;}for(0..255){$c[$_]=$_;}$a=$d=$f=0;for(0..255){$a=($a+ $c[$_]+$b[$a&31])&255;($c[$_],$c[$a])=($c[$a],$c[$_]);}open(F,'|dc'); select F;print"16dio[$e+]sa";for(1..50){for(1..$k/32){printf'%02X',&g;} print"Sr";}for(1,2){printf'%02X',&g|128;for(2..$k/16){printf'%02X',&g;} print"d$e%-2+d2%0=aSP";}print"[d2%SA2/d0<X+d*LA1=ZlP%0]sX[lR*]sZ[1+Q]sQ[ la1+sa0sc]sA[lAxlb1+sb]sB[ld1+sdLrddSssR1lP1-2/lXx+1+lP%99scd0=A2=Bclcla +32>C]sC[LsSrld1-dsd0<D]sD[le1+se0ddsasbsdlCxlDxlP2 $e*+sPlc99=Elb32=ElP 2 $e*-led1>QQ]sE_1selExsq_1seLPlExsp[p=]Plpp[q=]Plqp[n=]P*p[e=]P$e p1-lp 1-lq1-**1+$e/[d=]Pp\n";close(F);sub g{$d=($d+1)&255;$f=($f+$c[$d])&255;( $c[$d],$c[$f])=($c[$f],$c[$d]);return($c[($c[$d]+$c[$f])&255]);} I'm sure this can be compacted further. I haven't put a lot of work into compacting it; I really just want to get it out. Run the program, type in a LOT of random gibberish (several lines at least) and press enter. Then wait. Eventually it will output your p, q, n, e and d in hexadecimal. p and q: Prime numbers, congruent to 2 mod e. They can usually be discarded, but they should never be revealed. n: Your public modulus e: Your public encryption exponent (usually 10001 hex) d: Your private decryption exponent By default the program generates a 768-bit public modulus and a public exponent of 10001 hex (65537 decimal). These can be changed by adjusting the numbers in the first line. A 1024-bit modulus would be better, but for some reason generation takes a LOT longer than a 768-bit modulus. Fortunately key generation doesn't need to be done very often. Timings on a 100 MHz Pentium running FreeBSD: Size of n Time 512-bit: 4-5 minutes 768-bit: 8-9 minutes 1024-bit: 35-80 minutes (ack!) I've had some difficulty generating 1024-bit keys, but it seems to be working now. Let me know if you see any problems generating large keys other than the obvious problem with the time spent. Disclaimer: This program seems to work, but your milage may vary. -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEVAwUBMqID5dtVWdufMXJpAQE14AgApqOI2MMPe0V74cKI0vc3bDw8hfDW723c QKqVleH0MTIv4F792bf7ItekM81RbQiaB+AhSigFFFb679ZgdCV7XpPOwhkE3SD4 vJy1xU4HdZ6TbSrfzzZn8Peqd5K5zZdY7CpXbxW30TZWFNX5lqdDAAbvM77h36QC h/jwK1nWMzrTDupbhBwemkpZKaFmk5uAms5Y94Ckezh66+sOcWmvf7smyn8RJg4q zad6OVrclso22NBp/Pa0nf2+IdgFnhEfHgHxsI0t+awSokfr6WlZ8WAScxv40kJO KfcdBX1DXg4spl8kXgoQOrrA3VIUJKWXFfpnTt2nAKr/P4XfbpyFQw== =CY5F -----END PGP SIGNATURE-----

1 0

Secure Memory Deletion
by Mark Rosen 17 Dec '03

17 Dec '03

Does anyone know any papers on secure deletion of things from memory? That is one thing that most people are oblivious to, though, if a program leaves your unencrypted passkey laying in memory or a buffer of your plaintext, then all the encryption in the world won't help. Should I overwrite the 32 times specified for hard drives, or are RAM chips easier to clear? Thanks.

2 1

No Subject
by vitamin＠best.com 17 Dec '03

17 Dec '03

I apologize if this is off topic. I received free one month trial in July from Netcom and in mid July I canceled my account with Netcom due to lousy customer service. When I called I was treated rudely because of canceling netcom. I called again the next day and the person who answered the phone apologized me for the behaviour of the previous employee and I was told my account will be canceled. Low and behold come July I got my credit card statement and netcom had billed me. I promtly called them and was assured that my account would be cancelled. Come September I was billed again for August and September. Once again I called and she assured me it would be cancelled. Again, it was not. Come October they still billed me. In my November statement they are still billing me. I prefer L.A. Better Business Bureau and District Attorney emails and physical addresses. Someone please help me!!!!! Thank You

2 1

Re: Strong-crypto smart cards in Singapore and Germany
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

whgiii(a)amaranth.com ("William H. Geiger III") writes: ><sigh> Big Brother comming to a bank near you. > >Does anyone understand the implications of a society moving to an >electroinc cash based system?? > >All trasactions will be recorded, moitored, tracked & analysed. This is >not just the government that one has to worry about but corporations also. Actually the German system contains some fairly elaborate safeguards to make it pretty challenging to automatically track transactions (Germans have historical reasons for being uneasy about government monitoring). However given other German laws like the Fernmeldeanlagenueberwachungsverordnung (yes, that's one word), which make the CALEA look like a picnic, I'm not sure how long these safeguards will remain in place. Given that the standard has been created by a collaboration of all German banks, who are big enough to tell the government to take a hike if they demand access to the data, it may be safe (certainly the people involved in the project that I've spoken to are confident that they can keep the data private, however I'm not so sure how it'll work out in the long run). As for the Singapore solution, the Singpore government knows whats best for you, so it isn't any of your business to question their judgement. Anyone thinking otherwise gets 25 strokes of the rattan. Peter.

1 0

Re: Phrack, where can i find it?
by Lyghte 17 Dec '03

17 Dec '03

>where can i find latest (and old) phrack issues? > You can browse the old ones online at the phrack homepage (http://freeside.com/phrack.html) _\ /_ / \ __ ___ __ | \ / | _ |_| | |_ THE |__ | |__| | | | |__ "It may roundly be asserted that human ingenuity cannot concoct a cipher which human ingenuity cannot resolve." Edgar Allan Poe

1 0

pseudonymous servers
by Bovine Remailer 17 Dec '03

17 Dec '03

Which pseudonymous servers are currently active?

1 0

Re: A quick discussion of Mersenne Numbers
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-01 16:17:01 EST, you write: > On Sun, 1 Dec 1996 Scottauge(a)aol.com wrote: > > > I wake of the latest find announcement, some people maybe wondering what > the > > heck is this?!! > > > > A mercenne number is of the type: > > > > M(p) = 2**p -1 results in a prime when p is a prime. > > > > Hopefully this will lead the way to see the pattern of prime numbers and > > being able to compute prime numbers in a far more efficient manner (after > all > > a function that when given a prime number results in a prime number would > be > > quite a kicker now wouldn't it!) > > It doesn't. If q is a Mercenne prime, then p is prime if q = 2^p-1. It > doesn't work the other way around. If it did, then it would be very easy to > find out if a number is a Mercenne prime: just add 1 and find the base 2 > logarithm and if the result is prime, then the original number is prime. It' > s > much more difficult than that. It would also be possible to find an > infinite > number of Mercenne primes using a deterministic algorithm. > > > Mark I agree, my discussion was toooooo quick and the statement: > > M(p) = 2**p -1 results in a prime when p is a prime. is misleading. I was thinking the second paragraph when I was writing the statement statement above. A case of the mind working faster than the fingers?

1 0

Re: denial of service and government rights
by Lucky Green 17 Dec '03

17 Dec '03

At 05:24 PM 12/1/96 -0800, Dale Thorn wrote: >So what you're saying is I (or we) can testify in front of Congress on >essentially any topic, telling a blatant lie (that we know is false, and >which they will subsequently prove is false), and totally get away with >it. You and I can do that, is that what you're saying? You and I can't. The government can. It is one thing to commit a crime (if a crime has even been committed in the case in question). It is another thing to find somebody willing to prosecute it. In today's day and age, the Constitution exists for historical purposes only. Much of it has long been abolished by the courts. The remainder is being mostly ignored. The "Kein Kläger, kein Richter" principle makes it irrelevant if doing so is illegal. A favorite saying of 2nd Amendment supporters is: "Which part of 'shall not be infringed' don't you understand?" If society doesn't care that the Constitution is being violated, the violations will continue. And society couldn't care less. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://ourworld.compuserve.com/homepages/justforfun/prime.htm

1 0