December 2003 - cypherpunks-legacy

Re: Interesting news note.
by Pierre Omidyar 17 Dec '03

17 Dec '03

Reply to: RE>>Interesting news note. Actually, someone asked about Clipper at the CommerceNet launch yesterday. The question was (paraphrasing): "I noticed you've decided to go with RSA for cryptography. How does Clipper fit into this? [as in, what's your position on Clipper?]" To which Allan Schiffman, CTO of EIT (the main technical architects of the CommerceNet system), replied (paraphrasing): "Apparently, Clipper is only for voice-encryption, so it has absolutely no relevance to this system [secure Mosaic]." This response received a nice smattering of applause from the participants. Pierre -------------------------------------- Date: 4/13/94 12:53 PM To: Pierre Omidyar From: Timothy C. May > > Dear Colleagues; > This came off the business wire yesterday. I wonder if they truly understand > how vulnerable they really are without strong crypto for their transactions? > > -THE INTERNET SHOPPING Network, the nation's first electronic superstore > -available on the worldwide Internet, was formally announced Tuesday at an > -event at Techmart in conjunction with the launch of CommerceNet, the > -first large-scale trial of electronic commerce on the Internet. > -[Business Wire, 516 words, 450813#] Except that the full version of this announcement--which has been posted several places, possibly even here in Cypherpunks--explicitly mentions the use of RSA via a business relationship with RSA Data Security Inc. Though many Cypherpunks have various problems with RSADSI and the RSA patents, a topic I'll not go into further, it is a hopeful sign for Internet commerce that a strong crypto system is being built in from the git go. Remember, the alternative is Crippler! (Actually, what with the announcement of Crippler being built in to some television-top boxes--cf. the Harry Hawk posts--I would guess these Internet Commerce folks will soon be "visited" by Crippler advocates and "suitably incentivized" to replace RSA with EES technology.) --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." ------------------ RFC822 Header Follows ------------------

1 0

uses for PGP
by Ed Carp 17 Dec '03

17 Dec '03

khijol (formerly khijol.yggdrasil.com) is a 486/25 running the Linux operating system. Until March 1 of this year, khijol was used almost exclusively as a place where subscribers to the newsgroup alt.sexual.abuse.recovery could meet electronically and discuss abuse issues. Anonymous accounts were freely given, and site names, etc. were not tracked, allowing the users complete anonymity. Several UNIX utilities were modified so as to obfuscate site names and user names (in the case of rlogin), so that people could have a sense that their privacy was ensured. Many of the people who used khijol were survivors of sexual abuse, often from within their own families. Many were still being abused, and were frightened for their safety, and their lives. It was not uncommon to join a group of survivors and discover that one of the group was actively suicidal and the rest of the group was trying to help get them "over the hump". In the 5 months of its operation, khijol had over 500 anonymous users. The system was available (and used) 24 hours a day, 7 days a week. As it was directly on the Internet, survivors from all over the world used khijol, and it was not uncommon to find 20 or 30 users on the system at any one time. Anonymity and security were a primary concern for most users, and I tried to make khijol as secure as possible. Many custom utilities were written for khijol, including an interactive multi- user "talk" facility that is similar to IRC, but did not allow for non-local connections. To facilitate the completely anonymous exchange of email, and to ensure the privacy of the users, PGP was pressed into service. Users could, from an easy-to-use full screen curses-driven menu, generate a key (their public key was automatically added to a public list) and select user(s) to send encrypted email to. "pgp -m" was added to ELM's configuration, so that decryption would be automatic - one only had to type their password. It was emphasized to the users that no one could read their encrypted email except the person for whom it was intended. ASs it turned out, PGP was a very welcome addition - many felt that their communications were being monitored and their email read (by curious system administrators), and so most users welcomed the addition. At the moment, khijol is connected to the net via UUCP only - I am looking for a new home for it. When it comes back, it will be announced on alt.sexual.abuse.recovery. -- Ed Carp, N7EKG/VE3 ecarp(a)netcom.com 519/824-3307 an88744(a)anon.penet.fi If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0

alias in phone book
by Gary Jeffers 17 Dec '03

17 Dec '03

* Gun control is people control. - Gary Jeffers Why hasn't anyone discussed the utility of phony names in the phone books for fooling state investigators? If you have an unlisted phone number & a state snoop asks for your listing, the phone company will also check the unlisted numbers. What would happen if you had a phony name that the phone company agreed to use. Would the snoops be thrown for a loss? Could phony names be even better than unlisted? The phone company would probably demand your real name for billing purposes. Yours Truly, Gary Jeffers PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCKKKK! BBBEEEAAATTTT STATE!

1 0

The Clipper *CAN* be Thwarted.
by Irdial-Discs 17 Dec '03

17 Dec '03

The Clinton administration is artificially forcing the usa/world to adopt the Clipper Chip as the standard for data/voice encryption, by using us government funded economies of scale to create a large pool of cheap devices that would be hard to resist by the communications using/manufacturin g community. In order to stop this obviously undesireable situation from becoming the only option, a similar counter-strategy must be employed to offset the saturation effects of the flood of clipper chips that is to come. How to do it. ------------- 1/ A massive public awareness operation must be started. 2/ A crypographically strong alternative chip must be created. 3/ In the same way that SETI was kept alive by contributions, the creation of this alternative 'Zipper' chip must be funded by the public, and then manufactured in the millions, to take the same advantage of economies of scale that the clipper will. 4/ The zipper chip should then be distributed and publicized to completely discredit the clipper chip. This is a very simplified outline of the kind of plan that needs to be implemented. If we are going to save privacy for everyone, economic warfare tactics must be used to counter the warfare that is being waged against us all. PC based phone scrambling systems will not have the necessary impact that will be needed to kill the clipper chip and all of the nefarious uses it can and will be put to. We must provide a strong, backdoorless, alternative chip that will be attractive to every telephone user and communications device manufacturer, who will reason that it is better to have a device that no one can tap than it is to have a device that even _one_ person can tap. This situation _can_ be turned around.

1 0

what gtoal wrote about something
by Erich von Hollander 17 Dec '03

17 Dec '03

somebody (was it gtoal?) said something yesterday about how you could have the remailer encrypt the address of the person sending it and put that encrypted address in a block at the end of the message. this would be a good way to do it because the remailer operator cannot reveal a database of aliases and also not having a database makes the remailer easier to maitain and operate, resulting in a remailer with response capabilities, and yet as easy to use as the traditional cypherpunks remailer. i thought that was a cool idea, so i implemented that on the soda remailer (remailer(a)soda.berkeley.edu) give it a shot. just use it as you normally would and you will see how the response feature works. or finger remailer@soda or send mail to remailer@soda with Subject: remailer-info. e

1 0

Re: New anon mailer idea?
by Hal 17 Dec '03

17 Dec '03

Graham Toal's suggestion for automatic insertion of an encrypted return address block is interesting. We had some discussion here last year of a similar approach, although Graham's twist of using a symmetric rather than PK cypher for the return address is new. A few thoughts: - You'd want this feature to be optional. Some people might not want their anonymity limited by having their return address recorded, even in encrypted form. - Graham is right about the advantages of use-once (or use-only-a-few-times) return addresses. Chaum discusses how multiple use of return addresses allows these systems to be broken, similar to the way Graham describes. - The use of a symmetric cypher is a very nice way of getting the use-once capability, along with the "burn after reading" effect of a remailer chain which destroys itself as it goes. But it could be a considerable burden on the remailer operator to maintain the database. One possibility would be to fix a maximum time limit on how long the return addresses are kept "alive" and require some real money to keep them longer. - What we would really like is for the recipient to hit the "reply" button and be able to send his mail back. It sounds like this system would still require some cut-and-paste. We already have programs to create encrypted remailer chain addresses fairly automatically. It would be nice to automate this last little bit. Unfortunately, there seems to be no easy way to make this work under Graham's scheme. - It doesn't look like this would be an easy drop-in to the current remailers, unfortunately. The syntax for how the address would be built up as it passes through a chain of remailers is a little unclear as well. The idea does have a lot of promise, though, and I think it is definately worth keeping in mind for the next generation of remailers. Hal

1 0

Soldier of Fortune magazine.
by Gary Jeffers 17 Dec '03

17 Dec '03

Gun control is people control. The War on Drugs is the War on Citizens. I would like to suggest that some of our more knowledgeable & eloquent Ccypherpunks such as May, Hughes, Frissell or others consider approaching Soldier of Fortune magazine about a series of articles or a regular column on encryption & privacy. SOF may seem to be a childish publication to some of us but it has a readership many times that of Ccypherpunks & we would not be preaching to the converted (I know there are other purposes to cypherpunks as well). I've read some of their writing on the Waco affair & was impressed by their anti-government stance & the heavy detail (much better than the high production value/low content stuff from the mass media). I'm not a regular reader of SOF but they seem to be old fashioned patriots & might be warm to the Cypherpunk cause. We might have a series or a regular column titled CRYPTO - THE COMING GREAT WAR or COMMUNICATIONS - THE NEXT GREAT BATTLEFIELD. We already have a library of articles & copy. Our views would be a bit novel & just might fit right in with SOF. We could make a deal with them so that we could reprint the articles on the Internet. A number of Cypherpunks regularly write good articles. We should make better use of them. Yours Truly, Gary Jeffers PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCKKK! BBBEEEAAATTTT STATE! P. S. Another name for a chip that subverts the Clipper chip. - THE CLIPPER CRIPPLER.

3 2

Re: AP Wire Story on NSA Manual (fwd)
by Jeff Davis 17 Dec '03

17 Dec '03

Now NBC News is interested... > From: sfexaminer(a)aol.com > Date: Wed, 13 Apr 94 20:12:26 EDT > > Here's Keay's updated overnite story, which mentions your role. > AP has lots of different feeds. Not all the regional feeds run all the stuff > AP picks up. This was released to all the wire services this afternoon. > > NSA from A-1 > Semiconfidential > rules circulate > > By Keay Davidson > EXAMINER SCIENCE WRITER > It arrived mysteriously at an Austin, Texas, post office box by ""snail > mail'' - computerese for the Postal Service. > But once the National Security Agency's employee handbook was translated > into bits and bytes, it took only minutes to circulate across the country. > Thus did a computer hacker in Texas display his disdain for government > secrecy last week - by feeding into public computer networks the > semiconfidential document, which describes an agency that, during the darkest > days of the Cold War, didn't officially ""exist.'' > Now, anyone with a computer, telephone, modem and basic computer skills > can read the 36-page manual, which is stamped ""FOR OFFICIAL USE ONLY'' and > offers a glimpse of the shadowy world of U.S. intelligence - and the personal > price its inhabitants pay. > New NSA employees are warned: > ""Your home, car pool, and public places are not authorized areas to > conduct classified discussions - even if everyone involved in the discussion > possesses a proper clearance and "need-to-know.' The possibility that a > conversation could be overheard by unauthorized persons dictates the need to > guard against classified discussions in non-secure areas.'' > The manual includes a list of telephone numbers for NSA offices including > the cryptically named ""Agency Anonymity'' and ""Cipher Lock Repair,'' and > the not-so-cryptic ""Alcohol Rehabilitation Program'' and ""Disposal of > Classified Waste.'' > "Anal retentive and paranoid' > The manual is ""so anal retentive and paranoid. This gives you some > insight into how they think,'' said Chris Goggans, the Austin hacker who > unleashed it on the computer world. His on-line nom de plume is ""Erik > Bloodaxe'' because ""when I was about 11, I read a book on Vikings, and that > name really struck me.'' > NSA spokeswoman Judi Emmel said Tuesday that ""apparently this document is > an (NSA) employee handbook, and it is not classified.'' Rather, it is an > official NSA employee manual and falls into a twilight zone of secrecy. On > one hand, it's ""unclassified.'' On the other hand, it's ""FOR OFFICIAL USE > ONLY'' and can be obtained only by filing a formal request under the U.S. > Freedom of Information Act, Emmel said. > ""While you may take this handbook home for further study, remember that > it does contain "FOR OFFICIAL USE ONLY' information which should be > protected,'' the manual warns. Unauthorized release of such information could > result in ""appropriate administrative action ... (and) corrective and/or > disciplinary measures.'' > Goggans, 25, runs an on-line electronic ""magazine'' for computer hackers > called Phrack, which caters to what he calls the ""computer underground.'' He > is also a computer engineer at an Austin firm, which he refuses to name. > The manual recently arrived at Goggans' post office box in a white > envelope with no return address, save a postmark from a Silicon Valley > location, he says. Convinced it was authentic, he typed it into his computer, > then copied it into the latest issue of Phrack. > Private life not private > Other hackers, like Grady Ward of Arcata, Humboldt County, and Jeff > Leroy Davis of Laramie, Wyo., redistributed the electronic files to computer > users' groups. These included one run by the Cambridge, Mass.-based > Electronic Frontier Foundation, which fights to protect free speech on > computer networks. > Ward said he helped redistribute the NSA manual ""to embarrass the NSA'' > and prove that even the U.S. government's most covert agency can't keep > documents secret. > The action also was aimed at undermining a federal push for > data-encryption regulations that would let the government tap into computer > networks, Ward said. > In the NSA, one's private life ceases to be private: A ""waiver must be > granted in advance of a marriage to or cohabitation with a foreign national > in order to retain one's access to NSA information ...'' the manual says. > ""The marriage or intended marriage of an immediate family member (parents, > siblings, children) to a foreign national must also be reported. ... All > personnel, either employed by or assigned to NSA, must advise the Office of > Security of any changes in their marital status (either marriage or divorce), > cohabitation arrangements, or legal name changes.'' > There's nothing wrong with ""casual social associations with foreign > nationals,'' but during such associations ""you are encouraged to extend the > usual social amenities. Do not act mysteriously or draw attention to yourself > (and possibly to NSA) by displaying an unusually wary attitude.'' > None of the hackers thought he or she had done anything unpatriotic. > ""The cloak of secrecy that the intelligence communities operate behind is > an archaic paradigm of global warfare,'' said Davis, whose business card > identifies him as an ""Outlaw Transcendentalist.'' > ""The Cold War's over ...'' Davis said. ""What, is a terrorist group going > to call the National Security Agency alcoholism hot line and say, "Hey, I > have a drinking problem, can I come in?''' -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Lock Out
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well, I must say I was jarred from dozing this morning by Tim's post that the Clipper proposal is a done deal. I suppose I have always realized this but never allowed it to percolate up into my conscious. Executive fiat does have it's disadvantages doesn't it. Then irdial-discs (what the hell are irdail- discs?) wrote about battling Clipper on the economic front. On the face of it this would seem to be impossible. A gov't subsidized technology has too many advantages due to subsidy, mandates etc., right? Kind of. We all know that the U.S. Gov't has backed all manner of winning projects in the past. Take synthetic fuels for example, truly a master stroke in economic development of a technology. The problem? The market although artificially inflated at the time couldn't sustain a price needed to allow cost effective synth-fuel development, Gov't or not. The Gov't will pay for expensive chips, maybe even big Corporations can be forced to at first. But, if a cheaper, easier alternative is available, well then, we'll see how long VLSI & Mycotronix will make chips while bleeding red ink. Gov't absorbing development costs, yes, but direct subsidy, I don't think so. How can we make them bleed, then? Let's take Microsoft's strategy to them. Here I differ in opinion with irdial. The way Microsoft dominates the market (while putting out a sub-standard operating system to boot, sorry couldn't help it) is to package it's software as a bundle with the purchase of a piece of hardware. You get the computer, you get DOS-Windows, FREE (sort of). What are you gonna use? The hardware manufacturer pays a fee per computer, Microsoft makes money, the computer seller gets to offer "free" software and everybody's happy. Except the purveyors of good operating systems because they are locked out. What if a software version of PGP was bundled with modems and soundblaster cards? I know I got a modem communications program with my modem, still use it too. The software version of voicePGP (The Voice of Freedom!) would still make money for it's designer (presumably prz) and lock out clipper (alot more expensive). Anyone with a computer and modem can use PGP thru their phone! One could even market it as the guerilla product on the NET, now available when you buy your modem from us, VoicePGP. Just hook your phone thru the computer and speak without Gov't interfence or fear of intrusion. I think using sharp market principles crushes tawdry Gov't "programs". Microsoft has a great strategy, let's use it on Crippler. I also think software is the way to go, easier, cheaper and more dynamic. Hopefully, the Gov't won't be able to outlaw other crypto fast enough. Speed is crucial, Phil. If modem and soundcard manufacturers can be persuaded to bundle voicePGP with their hardware, the Gov't could well be LOCKED OUT. That's nice. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLaoU6z2paOMjHHAhAQGOpwQAvOM79JakqkduFKPWhFeoEllhefUCNf9N oHAFN4PvxwrruYzyDzcWV3DIYbZ2gX0ggtLzSHNE/Cp4bl70cl95pilSy1J3p0o5 OO8rhX7ze7F9MgAHztfOkmuh1A78gvy+drK/RfMhuXT+EpJpl1cDITfLNZ5XUWdR 1sbX1f+2G70= =N0J7 -----END PGP SIGNATURE-----

1 0

Re: Soldier of Fortune magazine.
by m＠BlueRose.com 17 Dec '03

17 Dec '03

Sandy Sandfort writes: >I'll talk to my SOF friend and see if we can come up with an angle. >As of right now, I think we might be able to get one article. If >so, I think the best approach would be to tie it to strong crypto >like PGP as a tool for mercs and wannabees. This seems counterproductive. PGP should not be portrayed as a tool for those that most Americans consider antisocial. M Carling

2 1