December 2003 - cypherpunks-legacy

keystrokes and crooked judges
by bill payne 17 Dec '03

17 Dec '03

I am reading http://www.jya.com/gaks-de.htm Perhaps this e-mail may interest you Best bill http://www.apcatalog.com/cgi-bin/AP?ISBN=0125475705&LOCATION=US&FORM=FORM2 http://www-hto.usc.edu/software/seqaln/doc/html/gfsr.3.html Monday 6/8/98 7:53 AM John Young I am reading http://jya.com/sitesec.htm a bit more carefully. You have NEVER WRITTEN SO MUCH. Fishing was great. I used a $10 THE INSTANT CALLING CARD [TM] VOCALL COMMUNICATIONS CORP The World's Most advanced prepaid Calling Card which allows access with a pin of 718-2455-7091-xxx [my SECRET] in ENGLISH, SPANISH, ARABIC, URDU, KOREAN, JAPANESE, GERMAN, FRENCH, ITALIAN to call you TWICE on Saturday. At only $.14/min. I left one message about Xandi and spiking computer keyboards. Xandi MADE low-power transmitters, http://www.gernsback.com/HyperNews/get/forums/resource/226.html like the kind I MIGHT use IF I were going to spike a keyboard [most which use an 8051 http://www.apcatalog.com/cgi-bin/AP?ISBN=0125475705&LOCATION=US&FORM=FORM2] so that the keystrokes would be broadcast. This, of course, defeats crypto attempts to cipher keystrokes. But I DO NOT DO, or have to do, ILLEGAL THINGS for the FBI or any other government agency. I, as a DOE contractor employee, was protected under 10 CFR 708. http://av.yahoo.com/bin/query?p=10+cfr+708&hc=0&hs=0 But 10 CFR 708 does not appear to be working well in my case. Therefore, we had to try other remedies. VOCALL is getting real close to digital cash, one of Orlin Grabbe's interests. http://www.aci.net/kalliste/dcguide.htm I have to do mostly technical work on the digital FX this week but will try to get two notices of appeal to the Tenth circuit written. http://jya.com/whp043098.htm Morales and I, with all the publicity you and Orlin have given us, can go all the way to the Supreme Court with our genocide and crypto deficiency lawsuits. http://jya.com/whpfiles.htm Pro se, of course. Too bad NSA did not take my criticisms of its shift register work more constructively. http://jya.com/da/whpda.htm, click on Appendix S Perhaps NSA should have worked with some of us at Sandia to come-up with fixes to overcome deficiencies. This unpleasantness could have been avoided. I've had ideas to improve shift register algorithm operation before. http://www-hto.usc.edu/software/seqaln/doc/html/gfsr.3.html Let's all hope for settlement of this UNFORTUNATE matter before it gets worse. Later bill And this too. Subject: FBI agents and Junger Date: Tue, 07 Jul 1998 07:32:36 -0600 From: bill payne <billp(a)nmol.com> To: jy(a)jya.com CC: art morales <armoral(a)sandia.gov>, whitfield diffie <diffie(a)eng.sun.com>, tom carpenter - halcyon <tomcgap(a)halcyon.com>, marc rotenberg <rotenberg(a)epic.org>, national employee rights institute <neri(a)nerinet.org>, mab(a)research.att.com, mejudson(a)mail.wdn.com, lwirbel(a)aol.com, klayman <jwatch(a)erols.com>, john gilmore <gnu(a)toad.com>, jpcarson(a)mindspring.com, jdelia(a)gnn.com, jeff debonis <76554.133(a)compuserve.com>, jay coughlan <ccns(a)nets.com>, jason vest <vestj(a)aol.com>, j orlin grabbe <kalliste(a)aci.net>, david sobel <sobel(a)epic.org>, Cindy(a)McGlashan.com Tuesday 7/7/98 7:28 AM John Young I am reading http://www.jya.com/pdj10.htm FBI agents Perez, Rodrigues, and Silva warned us about the crooked judges at the appellate level. The FBI blackmailed Perez, Rodrigues, and Silva into a cheap settlement of their race discrimination lawsuit win in Lucius Bunton's West Texas court. They all lost money. And all got divorced. Perez is a buddy of Morales and Gonzales. Gonzales and Armenta are buddies of Silva. Hugo Rodrigues moved to Florida. This information is VERY VALUABLE to Morales and me. It shapes our response to the two letters from the Tenth I put in the mail to you yesterday. NO FUTURE IN ARGUING POINTS OF LAW WITH CROOKED JUDGES. bill Counterfeiting Wiegand Wire Access Credentials Bill Payne October 16,1996 Abstract Wiegand wire access credentials are easy and inexpensive to counterfeit. Access Control & Security Systems Integration magazine, October 1996 [http://www/securitysolutions.com] published the article, Wiegand technology stands the test of time by PAUL J. BODELL, page 12 Many card and reader manufacturers offer Wiegand (pronounced wee-gand) output. However, only three companies in the world make Wiegand readers. Sensor Engineering of Hamden Conn., holds the patent for Wiegand, and Sensor has licensed Cardkey of Simi Valley, Calif., and Doduco of Pforzheim, Germany, to manufacture Wiegand cards and readers. ... A Wiegand output reader is not the same thing as a Wiegand reader, and it is important to understand the differences. In brief, Wiegand reader use the Wiegand effect to translate card information around the patented Wiegand effect in which a segment of a specially treated wire generates an electronic pulse when subjected to a specific magnetic field. If the pulse is generated when the wire is near a pick-up coil, the pulse can be detected by a circuit. Lining up several rows of wires and passing them by a cold would generate a series of pulses. Lining up two rows of wires - calling on row "zero bits" and the other "one bits" - and passing them by two different coils would generate two series of pulses, or data bits. These data bits can then be interpreted as binary data and used to control other devices. If you seal the coils in a rugged housing with properly placed magnets, and LED and some simple circuitry, you have a Wiegand reader. Carefully laminate the special wires in vinyl, and artwork, and hot-stamp a number on the vinyl, and you have a Wiegand card. IN THE BEGINNING Wiegand was first to introduce to the access control market in the late 1970s. It was immediately successful because it filled the need for durable, secure card and reader technology. Embedded in the cards, Wiegand wires cannot be altered or duplicated. ... Bodell's Last statement is incorrect. Tasks for EASILY counterfeiting Wiegand wire cards are 1 Locate the wires inside the card to read the 0s and 1s. 2 Build an ACCEPTABLE copy of the card. Bodell's clear explanation of the working of a Wiegand card can be visualized zero row | | | one row | | binary 0 1 0 0 1 representation Solutions to Task 1 A X-ray the card B MAGNI VIEW FILM, Mylar film reads magnetic fields ... Edmunds Scientific Company, catalog 16N1, page 205, C33,447 $11.75 is placed over the top of the Wiegand card. COW MAGNET, Cow magnetics allow farmers to trap metal in the stomachs of their cows. Edmunds, page 204, C31,101 $10.75 is placed under the card. Location of the wires is easily seen on the green film. Mark the position of the wires with a pen. Next chop the card vertically using a shear into about 80/1000s paper-match-sized strips. Don't worry about cutting a wire or two. Note that a 0 has the pen mark to the top. A 1 has the pen mark at the bottom. Take a business card and layout the "paper match"-like strips to counterfeit the card number desired. Don't worry about spacing. Wiegand output is self-clocking! Tape the "paper-match - like" strips to the business card. Only the FUNCTION of the card needs to be reproduced! History Breaking electronic locks was done as "work for others" at Sandia National Laboratories beginning in 1992 funded by the Federal Bureau of Investigation/Engineering Research Facility, Quantico, VA. The FBI opined that this work was SECRET/NATIONAL SECURITY INFORMATION. Details of the consequences of this work are covered in Fired Worker File Lawsuit Against Sandia Specialist Says He Balked When Lab Sought Electronic Picklock Software, Albuquer Journal, Sunday April 25, 1993 State-sanctioned paranoia, EE Times, January 22, 1996 One man's battle, EE Times, March 22, 1994 Damn the torpedoes, EE Times, June 6, 1994 Protecting properly classified info, EE Times, April 11, 1994 DOE to scrutinize fairness in old whistle-blower cases, Albuquerque Tribune, Nov 7 1995 DOE boss accelerates whistle-blower protection, Albuquerque Tribune, March 27, 1996 DOE doesn't plan to compensate 'old' whistle-blowers with money, Albuquerque Tribune September 27, 199

1 0

Your Home Town Provides Everything You Need
by zida27＠aol.com 17 Dec '03

17 Dec '03

YOUR HOME TOWN WILL DO 100% OF THE WORK FOR YOU WE OFFER: You the chance to own your own Home Based Business. WE OFFER: To build your Home Based Business for you. WE OFFER You financial independence. WE OFFER: You life saving and life changing products. WE OFFER: You the easiest way we know to, improve your Health, your Wealth and your Happiness. For more information Call: Our toll free 24 hr message center at 888-771-9338 Our toll free 24 hr recorded message at 888-771-9340. Reference # 1007698 our research showed you would be interested in this subject. If this is not true and you would like to be removed from our data base please call 888-771-9338 and leave your e-mail address for removal. Thank You.

1 0

New Page!
by StanSqncrs＠aol.com 17 Dec '03

17 Dec '03

I made another page, which details what Capital records did to Dark Side of the Moon when they reissued on cd. Guess what they covered-up. :-) Check it out, Stan, The Desecration of 'The Dark Side of the Moon' http://members.tripod.com/StanSqncrs/DarkSide/darkside.html

1 0

US to Ease Crypto Export
by John Young 17 Dec '03

17 Dec '03

7 July 1998 Source: http://www.washingtonpost.com/wp-srv/WPlate/1998-07/07/064l-070798-idx.html Thanks to FT U.S. to Ease Limits on Export of Data-Scrambling Technology By Elizabeth Corcoran Washington Post Staff Writer Tuesday, July 7, 1998; Page E04 Commerce Secretary William Daley plans to announce today that the government will give U.S. software companies new freedom to export their most sophisticated data-scrambling technology to financial institutions chartered in 45 countries, according to Clinton administration sources. Under the new rules, which officials said are likely to take effect in late summer, eligible banks, securities firms, brokerage houses and credit-card companies will need to receive approval only once from the Commerce Department before they can license the most sophisticated "encryption," or data-scrambling, technology. Once they receive approval, those institutions will be permitted to share the technology with any of their branch offices, except for those located in terrorist states. Government sources estimate that the new rules will include about 70 percent of the world's banks, including the 100 largest (ranked by assets). For years, the government has closely regulated export of encryption software, on the grounds that terrorists or hostile governments might use it to cloak their communications. The software industry argues that the rules are unworkable and unfairly block foreign sales. Unfriendly parties wanting to use encryption already can obtain it overseas, industry executives said. The new rules on banks are "a move in the right direction," said one industry executive familiar with the regulations. "But we're still leaving some groups out. Basically, we need to keep spreading the circle wider," to include the growing number of businesses offering financial services, such as insurance companies. "What we've heard sounds great," said Kawika Daguio, a lobbyist for the American Bankers Association. "We've been arguing [for several years] that the regulatory structure we have guarantees we're good citizens" who wouldn't make illicit use of the technology, he said. Now the government appears to have agreed. Current regulations require that U.S. companies apply for permits before exporting anything but the simplest versions of encryption products. To export more sophisticated technology, organizations must have a plan for creating so-called "spare keys." That way, law enforcement officials who have obtained a court order would be able to unlock the information. In May 1997, the Commerce Department said it would not restrict the sophistication of the data-encryption technology sold to financial institutions. But it required spare keys and case-by-case licensing. Approvals have been slow. Now the government is doing away with the key requirement, defining more precisely which financial institutions qualify and pledging to end case-by-case approval. Because of concerns about money laundering, the government will grant the new permission only to financial institutions chartered in countries that have agreed to take steps against money-laundering. If U.S. companies want to sell to financial institutions chartered in other countries, they will have to apply for licenses from the Commerce Department. Such provisions still fall short of the demands of U.S. companies. "To take a piecemeal approach [to loosening encryption restrictions] is the wrong direction," said Ed Gillespie, executive director of Americans for Computer Privacy, a lobbying group. "We need a blanket lifting of restrictions with individual prohibitions," such as bans on sending such technology to terrorist states, he said. In a related development, a federal court in Ohio ruled on Friday that posting the text of an encryption program on the Internet, where people all over the world could see it, was not protected by the constitutional right to free speech. The ruling, made late Friday, contradicts a ruling made by a California district court last August. Privacy advocates predict that the issue will be taken up by the U.S. Supreme Court. © Copyright 1998 The Washington Post Company

1 1

CTIA Daily News from WOW-COM - July 7, 1998
by CTIA Daily News 17 Dec '03

17 Dec '03

============================================= Welcome to today's edition of the CTIA Daily News from WOW-COM. Please click on the icon / attachment for the most important news in wireless communications today. =============================================

1 0

Private-enterprise wiretapping
by bill.stewart＠pobox.com 17 Dec '03

17 Dec '03

STOLEN NUMBERS -- [New York Times, p. 31, 7/5.] Federal investigators said the scam was ingenious in its simplicity: Five people in New York City would tap into public pay phones at major airports across the country, then steal calling-card numbers punched in by unsuspecting travelers. The scheme ended last month with the arrests of four men and one woman. But the case is only the latest machination in a $4-billion-a-year telephone fraud industry that keeps reinventing itself. "This is something we have not seen before," said Boyd Jackson [of] network security at AT&T, one of the industry experts who helped Federal investigators on the case. "And there is nothing I am aware of that customers can do to fully protect themselves." The Secret Service was tipped off by AT&T, Bell Atlantic and MCI after they received an unusually high number of complaints from customers who had recently used their calling cards in airports. [Also San Jose Mercury News, 1C; Rocky Mountain News, 33A; Sun-Sentinel, 3A, 7/4.]

1 0

Junger decision
by Cindy Cohn 17 Dec '03

17 Dec '03

For those who haven't yet heard, Judge Gwin in the District Court in Ohio has granted the government summary judgment in the Junger case. Judge Gwin apparently agreed with the government that the "functionality" of encryption source code, and the government's claims that it only intends to regulate that "functionality" mean that the regulations are not "narrowly and directed at expressive conduct" and so do not merit prior restraint analysis. The Judge then held that the regulations were content neutral, applied the intermediate scrutiny tests and found that the export restrictions meet those tests. I haven't had the opportunity to review the decision yet. As soon as I have, I will post some brief comments. Still no decision from the 9th Circuit in Bernstein. Cindy ****************************** Cindy A. Cohn, Cindy(a)McGlashan.com McGlashan & Sarrail, P.C. 177 Bovet Road, 6th Floor San Mateo, CA 94402 (650) 341-2585 (tel) (650) 341-1395 (fax)

1 0

RE: Junger et al.
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Nevermind that source code is suppose to be "human readable" material that is _translated_ into function instructions of machine code. A play is normally considered 'protected' free speech under US law, but what if robot was created which acted out the play and Gwin's argument was extended to apply the situtation where a play performed. Would the play itself no longer be a protected form of free speech, because it is seen as "functional" instructions to the robot actor? Would the playwrite become responsible for the robot's actions, such as killing a character/actor? As a programmer, I have "acted out" source code myself, as part of the debugging process. It is normally called "a walkthrough," so the difference between source code and a play is not as broad as some people may view it. I have followed the source code like a script, acting out the instructions like stage directions in a play. Does it matter who might 'read' the material, in regards to the protection of free speech? Whether it is written so that Russians or computers might be able to read it? If source code is written on a napkin, it can be currently exported, but what if tomorrow a vendor announces a 'napkin computer' which can directly read from napkins akin to a super-low densiy floppy disc. At 07:20 PM 7/6/98 -0700, Ernest Hua wrote: >Did anyone demonstrate the "functionalness" of any arbitrary language >via a scanner and a compiler? > >Why doesn't Gwin understand that the moment one successfully claims that >a specific class of source code is not speech by the virtue of the fact >that a compiler can transform it automatically into executable code >which performs a function, then ANY speech of ANY sort is fundamentally >vulnerable to being classified as functional as soon as a compiler can >transform it into real machine code. > >Ern > > -----Original Message----- > From: jkthomson [SMTP:jkthomson@bigfoot.com] > Sent: Monday, July 06, 1998 7:12 PM > Reuters > >3:40pm 6.Jul.98.PDT WASHINGTON -- A district court has dismissed a law >professor's challenge to US regulations strictly limiting the export of >computer data-scrambling technology. > >Judge James Gwin ruled late Friday that the export limits, which prevented >Case Western Reserve University Law School professor Peter Junger from >posting the text of encryption programs on the Internet, did not violate >the constitutional right to free speech. > >The Ohio court's ruling contradicts a California district court ruling last >August that said source code -- the instructions a person writes telling >the computer what actions to perform -- constitutes a form of speech >subject to First Amendment protection. > >"Unlike instructions, a manual or a recipe, source code actually performs >the function it describes," Gwin wrote. "While a recipe provides >instructions to a cook, source code is a device, like embedded circuitry in >a telephone, that actually does the function of encryption."

3 2

A note on the latest randomness quarrel
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

* Never use "the lowest few bits" or (t1>t2)?1:0 for the actual random number generation. You only use things like that for estimating the amount of entropy in a source. The number of bits of entropy in a pile of bits is one more than the base-two logarithm of the average number of guesses required of a badguy knowing your condidtioning routine, observing what it can, and interfering with your generator to figure out the value of the bits in the pile, so if your studies and statistical analyses estimate that it requires 2^127 guesses to guess the output of your conditioning routine, good for you, you've estimated that somewhere in its input are 128 bits of entropy. Um, I digress...point is, don't use that output straight. Take twice as much unconditioned input, non-random-looking stuff and all, as you estimate your conditioning routine needs to produce a key's worth of entropy and _hash_it_. Your conditioning routine can introduce some little bias you didn't see or make some unnoticed mistake that lets through predictable bits. Hashing can, too, but we've studied the hash functions to make sure they're good a lot more than we've studied your conditioning procedure. * A badguy's introduction of extra events doesn't poison your randomness. A badguy could introduce a multitude of predictable-but-random-looking events to make your generator close shop before it has enough unpredictable events to get its entropy. However, that only works if extra events make your generator stop collecting earlier. The amount of time it spends collecting randomness shouldn't depend on _any_ output of the generator, because that needlessly leaks entropy. Also, a badguy could introduce two nearly-simultaneous events near the beginning of the process, when it can be fairly sure that the wait between its events and the previous event will make a zero or make the lowest few bits of the delay between the bits match a certain value. (Interpreting that sentence is left as an exercise to the reader :) However, you can only do this in a system where your conditioning routine allows extra events to cause the routine to output bad bets. However, if you hash your raw data rather than using one of those conditioning routines, it's nearly -- nearly, that's your cue to say it has to be always -- impossible to weaken the output without knowing the other data hashed. Third, el badguy could introduce so many events that the gap between events was always less than the measurement threshhold. However, note that the Geiger counter, the computer, and the operator would all fail under these circumstances. Therefore, pretty much any strategy allowing extra events to kill entropy is flawed. ================================================================================ /// anonymous : nobody(a)replay.com : http://replay.com /// ================================================================================

1 0

Kings & Queens/George Michael/Knocked up with NyQuil
by STUFFED/EUREKA! 17 Dec '03

17 Dec '03

1 0