December 2003 - cypherpunks-legacy

Re: second order homophonic substitution
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

You don't need to do a full table of 2^16 bytes to handle real data - you could use 4-bit nibbles if you wanted, so each byte of steganotext has 4 bits of real data (which is cyphertext) and 4 bits of fake data. The steganotext is still twice the size of the plaintext, though. However, your key doesn't need to contain the whole table - you can use a much shorter key to describe a tour through the table or other method of filling it, where the key is the seed to a PRNG, which doesn't even need to be cryptographically strong, just decently random. This approach lets you use either 4x4 tables for compactness or 8x8 tables for efficiency. One way to make the decryption algorithm not reveal its purpose is to have one of the key parameters be a bitmask showing which 4 or 8 bits to keep out of the 8 or 16 output bits from the table. The (fake) encryption algorithm should have some feature to generate random bits using a hard-to-reproduce PRNG (e.g. the middle 4 or 8 bits of a 64-bit-wide PRNG), or something else obfuscatory, allowing the real cyphertext to be patched in through a less visible program, or through an obvious-functionality program like a one-time-pad xor. (Perhaps the PRNG could have parameters that, given all-zero input, produces all-zero output, or something similar that lets you use the same program for real and fake.) Now, the Bad Guys, if they're any good, will notice the 2:1 compression, and may suspect something's up, since they're archiving this posting :-). You can also do ratios other than 2:1, if you're willing to waste space. However, the algorithm does look like something an amateur would come up with to be the latest "nobody can crack my new complicated cypher", and it's tough to prove otherwise, since the real cyphertext is just raw bits unless you have the keys... Its effectiveness depends on whether they know that I know that they know that... and on whether they ask you in court, under penalties of perjury, whether this is the only key to the cypher, and whether you're really obligated to tell the whole truth in addition to telling them the truth and nothing but the truth. But truth is pretty complicated stuff, and once you start explaining the mathematical details of the PRNGs you use and how you know they're good stuff, and how quantum mechanics relates to the ability to send keys without eavesdropping, and the effects of quantum on epistemology, and what Knuth was talking about on page N of volume 2, they'll probably give up and decide it's irrelevant technicalities... said Bill, increasingly verbosely

1 0

Newsgroup?
by Matthew B. Landry 17 Dec '03

17 Dec '03

I still think that people are looking at this idea wrong. If we made the list->news gateway work one-way, so that news traffic wouldn't end up on the list, all of the stated problems could be solved. Except, that is, for TC May's theory about archived postings being grepped by spooks. Personally, I think that this is a rather far-fetched idea. If the spooks thought we posed a real threat to them (they might; I don't know), they would have very little trouble grabbing every single character sent to the list now and archiving it all with the best dossier-style cross-indeces in the business. I just think that a newsgroup wouldn't affect that one way or another. On the other hand, if the Extropians software is as good as it sounds (and if we actually start using it here), we might not need to have newsreaders to get the same functionality. Sending an "ignore" message to the list software to be processed at the source is a kludge, but it seems to be a Politically Correct kludge, so we might as well use it. -- Matthew B. Landry ml7694a(a)american.edu (Finally!) mbl(a)ml7694a.leonard.american.edu

1 0

Virtual City (tm) Network FAQ 1.0 (fwd)
by Arthur Chandler 17 Dec '03

17 Dec '03

Greetings. I hope that I'm not spamming the list with this monster forwarded FAQ. But since the author(s) are proposing, as one of the stated goals of Virtual City(tm): The Virtual City(tm) Network will also be a proving ground for privacy technologies such as public key cryptography, PGP, and Digital Cash(tm). I thought that folks here might be interested. Has anyone heard of this outfit? Is it for real or a huge slice of lemon meringue in the sky? ---------- Forwarded message ---------- Date: Fri, 8 Oct 1993 02:36:43 PDT From: Strata Rose <strata(a)apple.com> To: strata(a)virtual.net Subject: Virtual City (tm) Network FAQ 1.0 VIRTUAL CITY (TM) NETWORK FAQ, REV 1.0 SO WHAT EXACTLY IS THE VIRTUAL CITY (tm) NETWORK? The Virtual City(tm) Network is an ambitious Networked Virtual Reality Infrastructure which will link current Internet information technology with the emerging capabilities of on-line virtual reality environments. Using existing software which implements shared, interactive virtual spaces we will extend the paradigm of the FreeNet community into virtual reality by creating online cities and communities in which people may share text, graphics, and multimedia in a cooperative real-time environment. These online communities will be able to make use of cutting edge tools such as network conferencing, collaboration & visualization tools, multimedia electronic mail, online access to government data, networked library catalogs & facilities, electronic books online and Internet-accessible public data repositories. The Virtual City(tm) Network will also be a proving ground for privacy technologies such as public key cryptography, PGP, and Digital Cash(tm). DIDN'T YOU RUN AN AD IN _WIRED_ RECENTLY? NO. And again, No. The Virtual City (tm) Network is the brainchild of one M. Strata Rose, longtime net.lurker and sometime visionary, who has been developing the concept since roughly June 1992. I started serious feasibility exploration in December of '92 and have been on track on a timeline which formally started in May '93. The folks who put an ad in _WIRED_ are Objective Communications of Illinois. Virtual City (tm) is a trademark of M. Strata Rose and VirtualNet (currently undergoing formal incorporation). We are registered with the NIC as VIRTUAL.NET and VIRTUAL-CITY.COM. OH, COME ON-- TRADEMARKING THE PHRASE "VIRTUAL CITY"? The concept of creating virtual communities in a Mush/MUD/MOO environment has been kicking around for many years, and quite a bit of work has been done by a great many people. However, there is a particular on-line public access service concept which I call the Virtual City (tm) Network. As it says in the terrifying amount of paperwork required to file a trademark, "this application in no way attempts to restrict the usage of the terms 'virtual' or 'city', merely their usage in conjunction where applicable to services in this class". Or something highly similar but in stricter legalese, as per professional advice. WELL, HOW IS YOUR "VIRTUAL CITY (tm) NETWORK" DIFFERENT FROM THEIR "VIRTUAL CITY"? Obviously there is a limit to the extent to which I can comment, as both of our offerings seem to be in a pre-release state. However, a brief telephone conversation with an individual at Objective Communications indicated some important differences: 1) The Virtual City (tm) Network will be free for individuals to access; charges will only be levied on entities attempting to conduct profitable business activities. My understanding is that Objective plans to charge fees at all levels of participation in their service. 2) The Virtual City (tm) Network has been designed for multimedia and information service access from the ground up. My understanding is that Objective's service is text-only and the gentleman on the phone indicated that they had no current plans to expand it to multimedia. 3) VirtualNet incorporates both a for-profit corporation and a not-for-profit research arm. One of our primary goals for the Virtual City(tm) Network is to take the Cleveland FreeNet model into virtual space. The Virtual City (tm) Metropolitan Transit Authority, VCMTA, is being designed concurrently as an object transport model between instantiations of various Virtual City (tm) Sites. We will be offering templates for instantiations of our city model to be used by communities and organizations, with a true distributed model allowing users and information to flow freely throughout the Virtual City (tm) Network. We are attempting to build an expandable, scalable piece of Internet infrastructure that will support a rich model of growth and self-determination as well as support research on virtual communities and cyberspaces in general. Look for abstracts, research papers, RFC's and API's from us in the coming year. NO KIDDING. TELL ME MORE. One of my design goals in building the Virtual City(tm) Network is to challenge people's assumptions about "the real world" versus "the virtual world"; many if not most of people's interactions today take place in a virtual world which has been largely co-opted by the real world. Newspapers, television, and radio are all prime examples-- most of these rely on mental constructions based on primarily verbal input or on finely crafted presentations which have little to do with "reality", yet few people consider to what degree these omnipresent factors constitute much of their information flow. A wonderful example is the Android Sisters' "Money" (radioplay "Ruby", ZBS Productions). The Sisters hold up two items, described as two pieces of paper, to a "viewer" and ask for her description. Her reply, "well, one is a piece of paper, but the other is money" elicits the ruefully exasperated reply "two pieces of paper!". The well-made point is that people's cognitive mappings have become so rigidly codified that they view their world through highly constrained filters to the point of shutting out other options. In the Virtual City(tm) Network, the line between the real and the virtual has the inherent ability to be deliberately blurred. Information from "the real world" can be presented as often as possible in a matter of fact way. I hope to feature several space station designs from the cutting edge of the aerospace industry, and the reported weather in the outdoor sections of the city will come from weather data live from local feeds, updated to the San Mateo Bridge area, the putative location of the site. Our virtual coffeehouses will tie into Internet game servers of various sorts and we are investigating links to real-world coffeehouses via terminals in the field. Imagine chatting on a virtual terminal via the Internet to folks on real terminals in coffeehouses. Now who's real and who's virtual? OKAY, WHAT'S YOUR TECHNOLOGY BASE? We are currently using LambdaMOO, an object-oriented virtual environment designed at Xerox PARC. Instantiations of LambdaMOO are already being used to provide virtual spaces in which researchers, educators, and interested folks can meet and interact online, such as MIT Media Lab's "MediaMOO", "JaysHouseMOO". the original "LambdaMOO" and a growing plethora of others. Various university and individual projects are adding the capability to access certain Internet information resources such as the "archie" FTP search engine and University of Minnesota's Internet Gopher browser [JaysHouse MOO]. Xerox PARC is working on a project called "AstroVR" in which extensions to the text-based MOO software allow astrophysicists to share graphical images and data. The PARC team is also working on MBONE extensions to LambdaMOO; these extensions will allow LambdaMOO users to use the Multicast Backbone to do real-time audio and video conferencing using tools which are being developed concurrently by the greater networking community. We are working on extensions which will combine the functionality of NCSA's Mosaic information browser with the virtual environment capabilities of LambdaMOO. Mosaic is a hypertext browser through which individuals may access various Internet services such as World Wide Web, Gopher, WAIS, and archie. The World Wide Web in particular uses a format called HTML (HyperText Markup Language) to create documents which can access other documents with a single mouse click from the browser. We are adding the ability for SGML or HTML documents to be valid MOO objects; this single extension opens up a significant range of possibilities which represent needed interconnectivity between the MOO environment and the wider world of Internet information. Virtual spaces in the MOO can then lead directly to an information cache, and information browsers on the Internet can interact with MOO spaces as well. This is just the beginning. In particular, the Virtual City (tm) Network is being designed to allow encapsulation of other information formats and explicit handoff to both public and proprietary information servers. Our model is very similar to the one which NCSA developed with Mosaic. You interact with our virtual spaces using custom clients or browsers which can invoke various service handlers or interaction programs on your host machine. Just as Mosaic will bring up a GIF viewer when you reference a GIF file, the Virtual City (tm) browser could invoke Virtus Walkthrough (tm Virtus) or the BRL-CAD environment on a virtual space. You might enter a virtual space with encapsulated or referenced data available in several formats that your client or browser could handle. WHY IS THIS IMPORTANT? Ah, this is one of the really great parts-- if we can hand you off to some other viewer or program or even another server, then the Virtual City (tm) Network is truly expandable and extensible. We will be able to offer services that no one has even thought of yet as long as they run over the Internet infrastructure (ie, TCP/IP or something that can encapsulate itself in it). The Virtual City (tm) Network will grow along with virtual reality and internet information technology, since new services can be accessed in a plug-and-play fashion. What we're trying to do here is essentially spawn a meta-infrastructure context in which to tie together highly varied services. This is also where VCMTA comes in. WHAT'S VCMTA? VCMTA, the Virtual City(tm) Metropolitan Transit Authority, will be developed concurrently. This facility will provide authentication services for moving database objects between servers on different hosts, as well as implementing state-of-the-art privacy enhancements for secure communication & transactions. VCMTA will allow us to network instances of the Virtual City (tm) Template together and allow people to "move" between them in one ever-growing virtual space. We realize that there are hard problems to solve in building any sort of object transport facility; however, our philosophy is that we can't work miracles but can make something that works, is customizable and configurable, and will make most people happy. Obviously you can't "move" objects, however you can build objects which rely on a core object library, are "registered" with VCMTA, and follow certain rules as to their behavior on other servers and in other conditions. The nature of our distributed architecture already means that resources you access are not necessarily on the VC server, this is the logical next step. WELL THIS IS ALL VERY NICE, BUT I DON'T PROGRAM AT ALL SO I PROBABLY WON'T BE ABLE TO USE IT MUCH. Current implementations of MOOs and MUDS require that users be able to program at a fairly sophisticated level in order to enjoy the full power of MOO/MUD environments, especially in constructing new objects. We feel that this encourages "second-class citizen" status for those virtual citizens who cannot or will not learn to program proficiently. Accordingly, the Virtual City(tm) Network is being designed with virtual storehouses of objects which can be drawn from and user friendly front-ends with which to customize those objects to create personalized and useful virtual spaces. The full power of the MOO internal programming language will still be available to those who care to use it, but those who have neither the time nor desire to do so will be able to interact as fully as the programming hoi-polloi. As part of this effort, we are designing interactive front-ends to interface with the storehouses of objects and handle simple customization. Certain "city services" such as phones, chat lines, radios, gopher slates, etc will be available as well as common objects (and unusual ones!) from various individuals. By the way, if you register an object for public use and it passes the Virtual City (tm) Architectural Board (no Trojan horses or duds, please!), it no longer counts against your quota. Keen, eh? THIS IS STARTING TO SOUND PRETTY COOL. ARE YOU SURE IT'S FREE? There will be no charge for private individuals to access the Network and to engage in building and programming activities (up to a generous initial quota, as in most other MOOs or MUDs). Non- profit and government organizations will be allocated space at no charge in the Virtual City(tm) Marketplace, Business District, and other public areas. Cultural attractions such as art galleries, museums, and music halls are placed throughout the Virtual City(tm) Network; space in these attractions will be donated to artists and community projects to publicize their work. The several museums will feature examples of the growing number of online exhibits such as the Library of Congress' current Vatican Project. Corporations and other for-profit entities may be charged membership fees on a monthly basis, as well as rent for virtual spaces in which to transact business. Our basic paradigm is that if you're in the Virtual City (tm) Network to generate professional profitable activity then you should pay a fee to do so. Ie., the customary net.forsale or net.jobs type of stuff is just fine, whereas setting up a virtual office in which to run a real-time on-line consulting business would require paying rent. Arrangements can be made on a rental or percentage basis, or both. We are very interested in supporting subscription-based services where subscribers are allowed access to custom objects or facilities. This can be a very economical way to do rich text or multimedia electronic publishing in a small-press model, or provide specialized databases or services at a modest cost to subscribers. WHAT SORT OF FACILITIES ARE YOU PLANNING? In addition to those mentioned above, we will have all the standard amenities-- Alexandria, the Virtual Library, a business district, arcade and game areas, residential streets, a campus area where several interesting projects are being designed, transit facilities, and so on. We're choosing to leave MBONE facilities out on this pass due to bandwidth considerations; however, we plan on supporting such diverse applications and protocols as Netjam MIDI, CUSeeMe network video conferencing, various whiteboard tools, IRC with local client enhancements, connections to other MOOs/MUDS, NCSA & BRL-CAD visualization environments, group collaboration tools, interactive game servers, Internet Talk Radio, etc. We're exploring support for proprietary and vendor environments as well, such as Autodesk, Virtus, SGI, and other virtual reality software interfaces. We also have several original-design projects up our virtual sleeves such as the Virtual Coffeehouses, the Twilight Lands where storytellers roam the campfires, the UpAbove and DownBelow space and marine research station simulators, a Virtual Physics Lab, and so on. Not to mention the Virtual City (tm) Marketplace, Information Center, and On-Line Technical Support Center where you can sell your products or services with minimal overhead and rely on our expertise to deliver your information to the Internet community. WOW, I'M CONVINCED. HOW DO I LOG ON? We're terribly sorry, but you can't log in quite yet. We will be opening the database to key implementors once we finish the C modifications to the LambdaMOO server and to the LambdaCore. We had planned a general announcement in mid to late November, but circumstances required otherwise. We are taking lists of pre- registrants, though. Send email to "vcreg(a)virtual.net" with pertinent info: your name, your requested character name, and a short blurb which will become your initial description. Oh yes, and your Public Key. Don't have one? Tsk, tsk, they're a good thing to have in general; go out and connect to a public key server and get yourself a key-- we'll send out your initial password encrypted to you, and you can decipher it with our public key. Fun, eh? If you're a sufficiently enthusiastic cyberspace denizen to pre-reg, you probably already have a public key... We are planning a Virtual New Year's Party at the very least, even if all net services are not on-line yet. The HTML/SGML capability is really the critical factor-- we will open as soon as that is reliably running and add other services as our range of interfaces expands. Even if our (free) custom browser is not finished by then you will still be able to use standard MUD/MOO clients in conjunction with Mosaic or similar HTML browsers to enjoy the multimedia capabilities. WELL, DO YOU NEED ANY HELP? HOW DO I GET INVOLVED? I'm glad you asked that question. :-) Since a critical aspect of our project is free public access, we need volunteers! Our schedule has been accelerated fairly rapidly at this point and we could use a hand fairly soon. Send email to "vcbuild(a)virtual.net" with some brief notes about what you're interested in implementing and your level of familiarity with MOO coding. If you have experience with server and core-level mods, there may be funding in it as well, though we are primarily looking for volunteers at this time. ISN'T THIS GETTING PRETTY LONG FOR A "FAQ" FOR SOMETHING NEW THAT NOT MANY FOLKS OUTSIDE OF THE BAY AREA HAVE EVEN HEARD OF? Totally correct. Send questions, suggestions, pointers, flames, and so on to "vc(a)virtual.net". If you'd like to be on a mailing list for discussion of virtual communities, network services, and other Virtual City (tm) Network related themes, send mail to "virtual-citizens(a)virtual.net". There's plenty more where this came from, look for technology updates, facility updates, and GIF & Postscript (tm Adobe) maps. See you in cyberspace! Virtual City (tm) Network FAQ 1.0 copyright 1993 M. Strata Rose & VirtualNet; permission to distribute in its entirety, including this notice, freely granted.

1 0

Re: brin on privacy
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

peter writes > david brin spoke in ann arbor recently [...] > > privacy laws will be used as a weapon by the Rich and Powerful to > restrict the free flow of information. > > brin feels that privacy laws will be ineffective against the RaP, will > be sold to the rest of us through effective propaganda, and that they > will be used by the RaP as a means to cement their power base. He's probably right. (Of course, *most* laws made by the Rich and Powerful will be used to cement their power base, so this is just a special case....) Some examples that have been discussed on the net include the British data privacy laws that limit the personal-information databases that you can keep without formal notification to the people contained in them (and to the government.) The fact that you've got a computer and are using it in ways that indicate you have *some* database capability but haven't registered has been used as an excuse to search people's computers. Of course, if you *have* registered, then they can search to be sure you don't have any data you've forgotten to mention.... > brin's message was basically a populist one. he is concerned that the > moguls of data will have the opportunity to control what we see and > hear. what i found most fascinating about his talk was that while i > generally agree with the social objectives he backs, i am in 180 degree > disagreement on how to accomplish these ends. It's not an uncommon thing to find among people who believe in things but don't think about the implications of implementing those beliefs, as well as with people who are messing with really complicated technology. Bill

2 1

Re: POISON PILL
by gtoal＠gtoal.com 17 Dec '03

17 Dec '03

Stuart mailed this to me by accident and asked me to forward it to the list. G :From: "Stuart W. Card" <swc(a)uc1.ucsu.edu> :How's this as a dead man encryption protocol: :1) don't keep any sensitive stuff of your own on your own hardware, :put it on other peoples' machines (and let them put their stuff :on yours); :2) encrypt all of your stuff before transferring it to other peoples' :boxes; :3) send the keys that you used to do the encryption to other folks' :boxes as well (not the same ones on which you stored the files); :4) if you are really paranoid, Shamir share the keys; :5) don't keep any local copies of the plaintext, cyphertext or keys; :6) periodically send messages to the boxes where you have stashed :your files, saying "Everything is still cool, don't wipe my files :or my keys."; :7) if/when it hits the fan and you are pressured to reveal your stuff, :stop sending those messages -- the dead man switch goes off and your :files/keys are wiped. :There are countless variations on this theme, each offering a :different compromise between security against prying versus :overhead and the chance of unintended deletion. :------------------------------------------------------------------------ :Stuart W. Card, Consultant, Card & Associates -- Research & Development :Box 153 RR 1 Newport Rd Utica NY 13502 315-735-1717 / FAX -8469 :swc@uc1.ucsu.edu or cards(a)top.cis.syr.edu "Who is John Galt?"

2 1

PHONE PRIVACY
by Forrest Aldrich 17 Dec '03

17 Dec '03

Through e-mail, charliemerritt(a)BIX.com writes: | | > A 1-900 number to ensure non-tracibility. Does anyone have this number? | | I would not trust this for hiding from law enforcement. [ ... ] I wouldn't either. Anybody with a bit of sense shouldn't trust something like that. If anything, it's likely a setup to attract certain types of callers anyways. | If not law enforcement, then who do you need this to hide from? | You can use a pay fone to fool caller-id boxes. Well, I guess | they dont hide the city. [ ... ] Well, let's not assume someone wants to hide, but what about assuring the privacy of the phone call? Afterall, this is what we use PGP for: for email privacy... though there has been speculation about just how secure this is. I correspond with people all over the world. If the government is keeping a tab on people that correspond and is watching their email, then they must know me pretty well. They can't be too concerned that I'm using PGP to correspond with someone in Moscow. It's been over a year, and noone's came knocking on my door. ;) Back to the subject: What about phone privacy? In this day and age, how can we absolutely guarantee a private phone call? Even if we are using voice-encryption tech, the call can still be traced. I think even more quickly than we are lead to believe. For example, I never bought the notion that they had to keep the call on for a certain amount of time before an actual trace could be performed. Maybe in the stone-age of Ma Bell, but not today. I suppose if one were able to use a setup like a remailer only on a phone network, whereby you got your call forwarded through different places to prevent a trace (doubt that's reasonably accomplished), it might make the trace a bit more difficult. There doesn't appear to be anything even cryptographically that we can do other than encrypting the voice and selectively using pay fones. It would be neat if there were some way to interfere with Ma Bell's computer, in a non-destructive way, to alter what information they get when we dial out. For instance,

1 0

who you callin a homo, and a few other random thoughts
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> From: hfinney(a)shell.portal.com (Hal Finney) > This homophonic cypher sounds interesting. If the authorities demand > your keys, you could scramble each row of the matrix (scrambling each > row separately), so that only the dummy message can be recovered. hmm.. how about rendering the document as a bitmap (or other picture format), uuencode it ( or something similar with encryption of its own ) and then interleaving the ascii dummy message with the ascii of the uuencoded picture before applying this scheme. > Real ascii messages have a character set of about 2^6, so the actual > size of the key matrix will be 2^12, and that means that each entry will > be about 12 bits. For full generality in handling binary data the > character set would be 2^8, meaning a matrix of size 2^16 entries with > each entry being 16 bits. This is a 128K byte key, which is pretty > cumbersome. Also, the cyphertext is twice as big as the plaintext, > which will stand out too. right, so some kind of squeezing it down one more time maybe ? :-) > Plus, once the authorities see your decryption algorithm it may be > pretty obvious that it was designed for this specific purpose, and > whatever pressures they applied to make you reveal the key may now > be redoubled until you reveal the "real" key. In all seriousness, we are rapidly approaching enough multimedia saturation that we will also have sound file formats, picture file formats, animation and video formats which can all be used as vehicles for homowhatever schemes. Have a text to speach application record your words into a sound file format, and apply some of your crypto wizardry to make it into weird music, use rhythym tracks mixed in as convincing cover and maybe some harmonic riffs as a red herring to keep snoops from realising that the file might not be what it seems to be. how about encoding real time video signals used in desktop vid-conferencing. and slip encoded documents into the picture as colorful border graphics. Govt snoops tend to act out their information gathering rituals like squirels that have eating disorder, they can't find enough empty holes to fill with nuts (ie: important data ) that they might need to analyse later. so instead of trying to be elegant, be pigs. Bloat your content with obfuscated bric a brac, and banal tracts on technical issues that put hard core nerds to sleep. Our net-universe has vast resources to tap for source material to be used this way. Solid Engineering technique and clever hacks applied to your method, will probably leave trails and artifacts that another crypto engineer can smell! Apply art, and be eratic in order to facilitate keeping your adversary off the track he expects to find. ----- ------ ----- In a previous incarnation, I lived in a house on the same piece of land as an individual who was suspected of engaging in illicit horticultural activities. It soon became evident that my phone was also being monitered. Silly bastards couldn't get anything straight! I actually got a call inquiring about a person with his first name and my last name. :-) and then a day or so later my phone rang and when I picked up the receiver before I said anything I heard the sounds of a dispatch center, and then a womans voice chirped. "operations- may I help you" I replied... *uh... you called me*. she hung up abruptly. It would almost be humorous if they weren't so clueless as they waste our tax dollars in their characteristicly inept fashion! anyway, I gathered that their recorders operated automaticaly, so I took up the habit of dialing into my VAX at work, and playing rogue for hours and hours. Bet somebody made overtime while they assaulted their eardrums with the modulated hiss representing my little ascii hero getting lost in the maze of twisty little passages that all look the same. > A one-time-pad has the advantage that the key is the same size as the > file, and there is no size expansion in encryption, plus it's a plausible > approach to use for high-security encryption. It will take less space > and still allows for multiple decryption. so .. the dummy file you pad with, you'd just have one? or do you mean you'd make a new one each time? it would get pretty obvious if the same file kept popping up . I guess you could claim to have obsessive compulsive disorder and that this file is your obsession? If you really want to buffalo them you would need an intelligent agent application to compose dummy text for padding that would be reasonably unique each time. I would think that if you could write such an agent it wouldn't be much more work to have it encode whole words with other whole words and apply some linguistic formula, leaving the encrypted file looking like an ordinary, and uninteresting file. It might even be fairly simple to apply a word exchange scheme similar to the classic mentalists routines before encrypting the file, thus obscuring the meaning while still allowing the gestapo to feel that you've complied satisfactorally with giving them access. I find that left brain analytical types tend to only apply left brain methodology and thinking in their designs. Throwing right brain methodology into the equation could add just enough incongruence to the process that it might serve to confuse the shit out of the cryptographer trying to make sense of it through left brain analysis. In fact it might serve to heighten the incongruence factor when the crypt-breaker is a two-left-brain type.. present company who relate to that chosen lifestyle, please take no offense BTW ! :-) So, anyway, my humble apologys to those who may think my flights of fancy are malicious fluff, or an annoyingly gross abuse of S/N here. My mind actually does work this way, I don't know what I can't do. LUX ./. owen By the way, Monday - Oct 11th is National Coming Out of the Closet Day. write an encryption scheme that encodes man pages as homo-erotic sonnets, and send the output to your congress-critter(TM), sign them with Sam Nunns name for bonus points.

1 0

Re: Safe and fun environment?
by tcmay 17 Dec '03

17 Dec '03

Matthew, I think you're taking the stuff here too personally. Not all the feedback to you has been negative--I recall congratulating you on a nice political piece. But you have raised issues about elitism and unwillingness to teach newcomers that others have raised. And you ought to see some of the abusive e-mail I get! Whew! Whenever I disagree with some of the paranoids and ranters, I am called a traitor, a hypocrite, a lackey of Eric Hughes, a member of the "Clique," and on and on. Let me comment on a few of your points: > a "safe and fun environment" to introduce new people to anything. At the > moment, in order to get anything out of it, one has to devote large quantities > of queue space and time to the subscription, and sift through the flames and > other noise to locate the rare bit of truly valuable info. There are very few > people on this list who routinely post things worth reading, and many who > _never_ post things worth reading, and seem to be only around for the flame > wars. I'm sorry to hear you're getting so little new stuff here. Many of us have spent many hour typing in (or scanning and OCRing, in my case) papers and articles, from Chaum's "Dining Cryptographers" paper (every bloody word of it!) to Shamir's "How to Share a Secret" to scads of shorter articles and whatnot. And the debate ranges from random number generators to Perl scripts and TCL to digital money to ECPA to .... well, to about 20 major topics, by my estimate. > And god forbid that a newcomer should ask a QUESTION! Dear lord no. > That newcomer will be flamed so totally that no burn unit around will be able > to save them. This is simply not true. I have answered--when I could--the questions of many people over the past 12 months. And I've repeatedly posted reading lists, pointers to the Glossary at the soda site, and so on. It is true that I sometimes am exasperated by people who have clearly not been reading the list who ask "Can anyone tell me about digital money?" when the topic has just been discussed! (A FAQ would be nice. I was about to agree to do it a year ago, when ...comments on status of the FAQ elided to reduce flamage and angry feelings.... Fortunately, there are many other newsgroups that beginners can read ot learn crypto....Cypherpunks was not set up to compete with sci.crypt and all the other sources. > The vast majority of people who post on this list and respond to other > people's posts are obnoxious idiots who are willing to flame at the slightest > provocation, and will do so until the person they attack backs down or simply > gives up. I think this is uncalled for. I haven't seen this kind of flaming, except in the XXXXX case, and that has its own dynamic. (And please, Matthew, try to find a post where I have flamed XXXXX in public...I don't believe you can easily find one.) > No one on this list is entirely to blame, nor is anyone entirely > blameless for this. Several of the top figures on the list (TC May and Eric > Hughes to name two) have recently adopted an inappropriately elitist attitude The mailing list cannot be run by "democratic means." Nor can "teaching assigments" be handed out. The list is like a party at someone's home. The will of the herd is not the will of the organizers. Nor is the Cypherpunks agenda all that clear. I, for example, want to see strong crypto deployed in ways very different than what others favor. Are we to take a majority vote on an agenda, a charter? It's better to just leave the agenda loose and unwritten, so as not to have to grapple with this collision of goals. We can all pretend the agenda is what we favor. > running the _list_ however he wants, but the _movement_ belongs to all of us, > thank you. Even though I respect the crypto-political opinions that they The _movement_ belongs to what gets written and what gets responded to. In other words, if you want to be listened to, you have to get people's attention by the quality of your arguments. You can't rail against "leaders" (an ironic choice of words you used) like Hal Finney or Duncan Frissell just because their posts get reaction. You can't argue that the "herd" didn't have a chance to vote. In fact, people vote with their own posts. Market democracy. > express a great deal, I think that they and their supporters have taken this > too far. And worse, they have not taken a firm stand against the kind of flame > war that is continually erupting over individual posts on the list. For the > leaders to sit back and watch this go on is simply not the appropriate way to > handle things. The "leaders"? I have commented many times on issues of rancor and flames, even recently, and for this I am accused by some of being part of "the Clique" that "runs" Cypherpunks. Nonsense. > Until we fix the serious problems in this list, it will never be an > appropriate environment for newcomers to learn about crypto-privacy, just a > training ground for flame-throwers. About 70% of the flames would subside if XXXXX would cool his jets, and stop ranting and raving. As for "training newcomers," it's not easy. Lots of books exist, and many of the really solid contributors (Barrus, Honeyman, Collins, Stewart, etc.) learned their crypto in exactly this way. Many of us wrote _very long_ articles of a tutorial nature when the list was getting started. Newcomers who are unwilling to read some of the technical books on crypto should not expect us to write customized tutorials. > mountains of flame wars. Questions could be referred to qualified personnel, > instead of going to the list where they act like little flame magnets. May I ask which "qualified personnel" you have in mind? As per the earlier comment, not many of the crypto experts I know have any interest in hand-holding, not when at least a dozen good books on crypto are readily available. > This newsgroup would not replace the list, nor would it be more than > marginally connected (because of the selected cross-postings), but it would > provide the kind of environment that the list does not or cannot provide. How is this group you propose any different from sci.crypt, talk.politics.crypto, the various *.privacy groups, the *.clipper group, or the *.security groups? Seems to me sci.crypt is exactly what you're looking for. (But don't expect hand-holding for newcomers there, either!) > Oh, and for those of you that are tired of seeing me post, you can rest > assured that you will never see it again. Contributing to this list has brought > nothing but trouble to my life, and I have better things to do with my time > than wade through piles of flamage in my personal mail box. Matthew, threatening to leave is not going to have much effect. But if you have decided to leave, good luck in all your endeavours. -Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Agenda, Goals, Flames...Comments
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I wrote this reply to Matthew Landry, who raised some complaints about the direction of this list, the role of the "leaders," and so on. I sent it to him personally, so as not to add to the already heavy volume of stuff on this list, especially the complaints of the last few days. I think the term "leader" is inappropriate. Several of us got the group rolling a little over a year ago, but the anarchic nature of the mailing list (source of strengths as well as weaknesses). In Matthew's post he on the one hand blasts the elitist attitude of Eric Hughes and myself while in the next paragraph blasting the lack of action taken by the "leaders" to control flames and set up systems to help newcomers. Anyway, I enjoyed a political piece Matthew wrote a couple of weeks or so ago, and I told him this. So his piece tonight (2:30 a.m) merited a response. And though some of you are no doubt sick of seeing these issues debated, I've decided to forward my letter to him to all of you, as I think some points need to be made. I've removed one or two sentences from the version I mailed to Matthew. Forwarded message:

1 0

Re: Spread-spectrum net (vulnerability of)
by George A. Gleason 17 Dec '03

17 Dec '03

Re. wireless networks that know where you are without making that info available to anyone incl. net operators: I think I might have something for this. Ericsson wireless PBX; essentially similar to a cellular system. However, calls within the network are considered "intercom" calls and so the system's "call detail recorder" won't keep track of them. Ericsson is way hot in wireless voice and data networks; and we're their local distributor for PBX products. I haven't got prices on hand since we haven't gotten a request for something like this yet. However, if anyone's seriously interested, drop a line via email or phone me at 510-644.8085. -george gleason, gg(a)well.sf.ca.us

1 0