December 2003 - cypherpunks-legacy

Bet it's not encrypted...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[The following was snipped from EDUPAGE, the online summary service. Anyone have access to more information? --AW] AND OPTICAL FINGERPRINTS. The National Registry uses an optical scanning technology to create and compare digital maps of the finger surface. The map can be converted to a modified bar code for inclusion on a wallet ID card. The information can also be encoded on circuitry inside a credit or debit card. (Tampa Tribune 2/20/94 B&F1)

2 1

Re: Mac encryption
by Ron Davis 17 Dec '03

17 Dec '03

>> What is everyones opinion of the best encryption software forthe Mac? >> Frederic Halper >> fhalper(a)pilot.njin.net > >MacPGP, available by anonymous ftp from the soda.berkeley.edu site, is >the only one I know of using public key methods, and hence the only >one of real interest to Cypherpunks. I find this to be a strange statement. Do we have no interest in non-public key methods? Seems the Cypherpunks should have an interest in all forms of crypto. Most users don't currently use public key becuase they just want to keep thier boss from sitting down at thier computer and reading the resumes they wrote for other companies. This can be accomplished with symetrical crypto just as well, if not faster than PGP. >Commerical products (like the various "Kent Marsh" products) are >mostly DES-or-weaker and are oriented toward local file protection. >(MacPGP will do that, too, of course). Cryptomatic does come with Triple DES which is still a very strong method. Unfortunatly MacPGP's biggest draw back is that its interface is poor and it is hard to use. There is also MacRIPEM which is written by Raymond Lau, author of Stuffit, and is much easier to use, but weaker than PGP (but legal). > >About six or seven years ago I bought "Sentinel," from SuperMac, and >used it a few times. The problems were obvious: lack of other users >(so my friends couldn't receive or send), and the symmetric cipher >nature (we had to share keys for a message). Public key systems based >on PGP have solved both problems (though problems of convenience >remain). > Can't stop without mentioning that my company make a product called Citadel which does DES encryption. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

3 3

shame on the NSA!
by Carl Ellison 17 Dec '03

17 Dec '03

>From the Independent reposting by Banisar: > After nearly 50 years of electronic eavesdropping, the NSA is finding >that some widely available codes are impossible to crack. Time was when the NSA wouldn't allow such a claim to be made in the press much less make it themselves. What's happened to national pride here? Let's go back to the time when the NSA acted smug in the face of civilian encryption. Give me back my good old Amurrican Supermen! - Carl

1 0

Re: Blacknet worries
by Duncan Frissell 17 Dec '03

17 Dec '03

D.>With all due respect....the U.S Government has PLENTY D.>of tools to go after those deemed to be violators of D.>various rules and regs...with or without Blacknet, D.>with or without encryption. D.>What other tools can be used, well... D.> D.>1. Imputed income. Try to do this some time. It is very expensive to 'net worth' someone. The CIA didn't manage in their recent case. There are 114 million 'taxpayers' in the Naked City.. D.>2. Criminal conspiracy. Elements are D.> a. two or more people D.> b. a preparatory act If they can decrypt your conspiratorial communication. Conspiracy charges are rare in the absence of an overt act. D.>3. CCE (Continuing Criminal Enterprise). If they can find out something is happening and connect disparate encrypted activities to you. D.>4. IRS-1040, Schedule B, Part III, Foreign Accounts and Trusts. D.> Except for one relatively minor loophole, if you fail to D.> report a foreign bank account, it is considered prima D.> facie evidence of tax fraud. Sound like a really bad D.> day in the making? Prosecutions are rare and are dependent on linking you to the accounts, proving the balance of the accounts, and in any case only apply to US citizens/residents. D.>5. If you have more than $10,000 in US Dollar value in D.> an offshore account, you are required to fill out a D.> special form for the IRS giving your account numbers; D.> unless you want to declare that you have more than D.> 20 such accounts, aggregating to more than $10,000. Likewise. D.>6. RICO. They got Mike Miliken using this...indeed, Barron's D.> magazine did an interesting report on RICO, with the D.> conclusion that a determined Federal Prosecutor could D.> use the law to convict a ham sandwich. Mike was not convicted under RICO. He plead to two counts of stock parking and something else. D.>7. Did you know that Federal prosecutors have a better than D.> 90% conviction rate? In the several thousand annual prosecutions out of a US population of 256 million. D.>8. HOW does one spend "magic money"? If you have bunches of D.> cash offshore, and bring it in, records are created. If D.> you buy something, potential witnesses are created. Can D.> you really expect that the clerk in wire transfer at XYZ D.> bank (who makes $6.50/hr) won't tip off someone when you D.> wire in the $20,000 to buy ...whatever? Since much of future commerce will be online anyway, why not just spend it for telecoms time, software, living expenses in a VR environment, other non-physical services. Use it overseas. Expat yourself (see the current issue of Forbes for an article on expatriation as the ultimate tax shelter. Or just get cash from your local ATM. D.>9.. Spies, criminals, and others often get in trouble due to their D.> own and others' lack of discretion. Can we really expect D.> users of a hypothetical blacknet would never drink too much, D.> never wish to impress someone, never trust someone unwisely? Lost in the noise with millions of 'violators' extant. D.>I'm all for more of it; but, I really don't think it will D.>be anything more than a minor inconvenience for law enforcement D.>and prosecutors if people engage in wholesale criminal acts. Studies show that where the perceived risk is low, people are fairly willing to violate mere regulations. Most people can tell the difference between murder and tax evasion. The Common Law recognized this difference calling one malum in se (wrong in itself) and the other malum prohibitum (wrong because it has been prohibited). In any case, since US tax laws don't apply to non resident non citizens of the US but these sorts of people will be able to fully participate in the US economy over the nets, either US citizens and residents will have to fiddle their regulatory compliance or they will lose out in competition with foreigners who can undercut them or do things Americans are prohibited from doing. Sell strong crypto par example. DCF 1993 - Perhaps the first year in American history in which the Justice Department killed more people than the Defense/War Department. --- WinQwk 2.0b#1165

1 0

Re: Blacknet worries
by Duncan Frissell 17 Dec '03

17 Dec '03

D.>With all due respect....the U.S Government has PLENTY D.>of tools to go after those deemed to be violators of D.>various rules and regs...with or without Blacknet, D.>with or without encryption. D.>What other tools can be used, well... D.> D.>1. Imputed income. Try to do this some time. It is very expensive to 'net worth' someone. The CIA didn't manage in their recent case. There are 114 million 'taxpayers' in the Naked City.. D.>2. Criminal conspiracy. Elements are D.> a. two or more people D.> b. a preparatory act If they can decrypt your conspiratorial communication. Conspiracy charges are rare in the absence of an overt act. D.>3. CCE (Continuing Criminal Enterprise). If they can find out something is happening and connect disparate encrypted activities to you. D.>4. IRS-1040, Schedule B, Part III, Foreign Accounts and Trusts. D.> Except for one relatively minor loophole, if you fail to D.> report a foreign bank account, it is considered prima D.> facie evidence of tax fraud. Sound like a really bad D.> day in the making? Prosecutions are rare and are dependent on linking you to the accounts, proving the balance of the accounts, and in any case only apply to US citizens/residents. D.>5. If you have more than $10,000 in US Dollar value in D.> an offshore account, you are required to fill out a D.> special form for the IRS giving your account numbers; D.> unless you want to declare that you have more than D.> 20 such accounts, aggregating to more than $10,000. Likewise. D.>6. RICO. They got Mike Miliken using this...indeed, Barron's D.> magazine did an interesting report on RICO, with the D.> conclusion that a determined Federal Prosecutor could D.> use the law to convict a ham sandwich. Mike was not convicted under RICO. He plead to two counts of stock parking and something else. D.>7. Did you know that Federal prosecutors have a better than D.> 90% conviction rate? In the several thousand annual prosecutions out of a US population of 256 million. D.>8. HOW does one spend "magic money"? If you have bunches of D.> cash offshore, and bring it in, records are created. If D.> you buy something, potential witnesses are created. Can D.> you really expect that the clerk in wire transfer at XYZ D.> bank (who makes $6.50/hr) won't tip off someone when you D.> wire in the $20,000 to buy ...whatever? Since much of future commerce will be online anyway, why not just spend it for telecoms time, software, living expenses in a VR environment, other non-physical services. Use it overseas. Expat yourself (see the current issue of Forbes for an article on expatriation as the ultimate tax shelter. Or just get cash from your local ATM. D.>9.. Spies, criminals, and others often get in trouble due to their D.> own and others' lack of discretion. Can we really expect D.> users of a hypothetical blacknet would never drink too much, D.> never wish to impress someone, never trust someone unwisely? Lost in the noise with millions of 'violators' extant. D.>I'm all for more of it; but, I really don't think it will D.>be anything more than a minor inconvenience for law enforcement D.>and prosecutors if people engage in wholesale criminal acts. Studies show that where the perceived risk is low, people are fairly willing to violate mere regulations. Most people can tell the difference between murder and tax evasion. The Common Law recognized this difference calling one malum in se (wrong in itself) and the other malum prohibitum (wrong because it has been prohibited). In any case, since US tax laws don't apply to non resident non citizens of the US but these sorts of people will be able to fully participate in the US economy over the nets, either US citizens and residents will have to fiddle their regulatory compliance or they will lose out in competition with foreigners who can undercut them or do things Americans are prohibited from doing. Sell strong crypto par example. DCF 1993 - Perhaps the first year in American history in which the Justice Department killed more people than the Defense/War Department. --- WinQwk 2.0b#1165

1 0

I have FOIA'd the Clipper Key Escrow databases
by hughes＠ah.com 17 Dec '03

17 Dec '03

Should John's FOIA request for the clipper key database work, it creates a wonderful hole in the entire key custody system. It would require a legislative act to plug the hole. This is extremely significant, since the whole clipper strategy is based on unchecked and unbalanced actions by the executive branch. No laws were passed to create clipper and no judicial review has taken place. John's request will be denied, no doubt, and will go to court. Should he prevail in court, the executive branch is bound by that decision. A key custody database which was public would make the system insecure and unusable. The executive branch could not change this. Only the legislature could. Now, how many legislators do you know that are going to make a public record by voting in favor of Big Brother? We are witnessing the genius of framers of the USA Constitution here, folks. Eric

1 0

SQUISH
by stutzmjj＠bigvax.alfred.edu 17 Dec '03

17 Dec '03

I just received a notice concerning your game. Please send me some more information on how to join/play as well as any rules. Thanks, Jeff Stutzman STUTZMJJ(a)BIGVAX.ALFRED.EDU

1 0

Re: Dorothy Denning
by smb＠research.att.com 17 Dec '03

17 Dec '03

Number 2. People on this list have said that she's an expert in cryptography. When I read that damned Newsday article posted on cypherpunks, I thought that she was just a whiny college bitch. The argument was just very, well, flimsy is the word I guess. I believe that Clipper is wrong, but someone could at least write a paper that would influence more by pointing out its merits, rather than just saying that the government should start spying on all of us to stop drug deals.... Anyone know: A) Is she an expert in cryptography? B) Is she a college graduate? Dr. Denning is the head of the computer science department at Georgetown. She's the author of ``Cryptography and Data Security'', a classic (though now somewhat-dated) work in the field. In sort -- though she may be politically naive, and she obviously puts a different weight on personal liberty than do most of the people on this list -- she can't be accused of technical incompetence. There is no doubt that she knows more -- and perhaps far more -- about cryptography per se than do most of the people on this list. And of course, you don't want to put cryptographic details in an Op-Ed column in a tabloid newspaper; most of the audience won't understand them.

1 0

A Push for Surveillance Software
by mikemck＠mrc.com 17 Dec '03

17 Dec '03

Here are some choice excerpts from the headline article of the NY Times Business section, 2/28. A Push for Surveillance Software by John Markoff In the age of computer communications and digital telephone calls, the American people must be willing to give up a degree of personal privacy in exchange for safety and security, the head of the Federal Bureau of Investigation said. In an interview on Friday, Louis J. Freeh (note: is it really pronounced Free?), the FBI director, defended proposed legislation that critics say would turn the nation's telephone network into a vast surveillance system. He said taxpayers would be asked to pay up to half a billion dollars to develop and deploy the necessary network software. The administration wants to impose new technology that would enable law-enforcement agents to gather a wealth of personal information by monitoring citizens' calling patterns and credit card transactions over the telephone network - and over the two-way cable television networks being planned by cable and phone companies. The system would go well beyond current wire- tapping technology, because much of the information could be gleaned without the police or FBI actually having to eavesdrop on specific voice or electronic-mail conversations. "The costs are high, but you have to do a cost-benefit analysis," said Mr. Freeh, who insisted that fighting terrorists and criminals was the governments intention - not playing Big Brother to the citizenry. ... The administration is trying to line up congressional support for the legislation, called Digital Telephony and Communications Privacy Improvement Act of 1994, before having it formally introduced. ... ____________________________________________________________ There's much more but I don't have a scanner handy. I can't believe how quickly this appalling threat has developed. The government always veils its expansion of powers as a need for increased security: the War on Drugs, criminals, terrorists. What I'm really surprised by is that they foresee the endpoint of freely available information technology, a diminishing need for centralized government. If the net contributes to the end of centralized control, it's easy to extrapolate who the target terrorists are going to be. mikemck(a)mrc.com

1 0

Need info on E-mail security
by KEPERRIER＠setpoint.com 17 Dec '03

17 Dec '03

I need a some help from all of you crypto-literate people out in Net.Land. The company currently employing me has recently opened several overseas offices. We have connected ourselves to the Internet to send e-mail between the Houston office (corperate HQ) the new overseas offices. As to be expected, the powers-that-be here gave no thought to security for e-mail. I have brought this to their attention about 6 weeks ago and nothing has been done yet. I know 6 weeks is a short period of time but this is still a relatively small company (400 people) so something should have happened by now if anything was going to happen. That's the history of the current situation. I believe I need to provide some proof as to how easy it is to read unencrypted Internet E-mail. Not being an experienced programmer and not knowing how a lot of things work on the Internet, I do not know how easy it is to scan in-transit e-mail for keywords. Could some kind person please inform me as to how easy it is to do this, and, if possible, please direct me to a place that papers and/or programs have been written on the subject. I belive I need to "shock" the higher-ups that this could be a very big problem if we don't do something now while use of the Internet is light. Thanks, Kent Perrier keperrier(a)setpoint.com (work) kperrier(a)neosoft.com (play) Corporations don't have opinions, people do. These are mine.

1 0