December 2003 - cypherpunks-legacy

Re: JP vs Homer
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> We are capable of controlling mail bombs, for instance, in the >following way: > > Take an incoming message, capture From: line. Strip header. MD5 body. >Add to sorted table [From: MD5(message) date]. Check for repetition of >first two fields. If reps = 1, forward message. If reps = 2, send message >to From: "Possible error. Two copies of message <message> received." If >reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or >spam. <reps> copies of <message> received from <From:> at your site in the >past week." Clear table of entries more than a week old every midnight. > > > If all remailers did this, then no matter where the net was entered, >the messages would be rejected. And spammers/bombers would be spamming/ >bombing their own postmaster. Probably a bad idea. If not all did it, >then add special handling to hit remailer-operator@. This would encourage >the operator to auto-magically handle the spam-bomb himself. This works only if one assumes that the exact same message is posted using the exact same path. Granted, it would probably be effective for novice spammers. Consider a premail/chain type script and a cleartext spam message. The script is executed once every five minutes, say. When it runs, it creates a new random path through the remailers, adding encryption wrappers for each hop. Your spam detector would miss this one completely unless your remailer was used as the terminal remailer for a significant number of spams. More significantly, the MD5 hashes of each message would be different even if the same path were used more than once because the PGP session key would be different (again, unless your remailer would be the terminal remailer in the particular path that repeated).

1 0

WSJ on CIA Dump
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal January 18, 1995, p. A14. Get Smart -- Eliminate the CIA By Angelo Codevilla Over the past several years, U.S. intelligence agencies in general and the CIA in particular have proved themselves incompetent in peacetime and of little use in conflict. Stripped of their mystique and lacking the capacity to reform themselves, these organizations are virtually in receivership. The maladies ailing the intelligence community are numerous. Independent quality control was never more than a pretense, and competition among intelligence agencies was nonexistent. Producers of intelligence -- rather than the soldiers and diplomats who have to use it -- have also become its judges. All this has spawned a complex of habits, procedures, mentalities and people too entrenched to be repaired and too noxious for any part to form the nucleus of a new, healthy system. Hence, we should take Sen. Daniel Patrick Moynihan's advice, and rethink our intelligence from the ground up. A good place to start is with the fact that about half of the $28 billion U.S. intelligence budget pays for units directly controlled by military commanders, which routinely provide precise information for the armed forces' operations close to the front lines. The Treasury and State Departments also have their own intelligence units, which fit their needs quite well. So why do we need a national system headed by the CIA? The original justification for the creation of the CIA in 1947 was that intelligence would be best if its gathering and evaluation were divorced as much as possible from the operating departments of government -- State, Defense, etc. -- and placed under the president. This judgment has turned out to be wrong. Because presidents have relied on the CIA to run the system, the result has been a system dominated by the priorities of the producers -- not the users -- of intelligence. A basic failing is that the CIA has primary responsibility for intelligence and none at all for real world events. The CIA prefers to place its career employees in U.S. embassies, where they pretend to be employees of other parts of the government. Such "case officers" must acknowledge that they are gathering information for the U.S. Another disadvantage is that they don't speak foreign languages well. And unlike successful reporters, they virtually never know the substantive fields about which they are seeking information. Thus it is unsurprising that they are usually outdone in economic reporting by economic reporters, in military reporting by military reporters, and so forth. The Aldrich Ames case shows how much more highly the CIA values the smooth functioning of its system than what the system produces. Mr. Ames handed the KGB the capacity to shape the intelligence flowing to top U.S. officials during the endgame of the Cold War. Thus disinformation made presidents and secretaries of state more vulnerable to Gorbomania than the average citizen informed by newspaper accounts. How could the CIA fail to notice the fishiness of reports generated by a network controlled by the other side? The same way that, in the 1970s and 1980s, the agency had failed to notice that it was passing along reports from a network of agents in Cuba totally controlled by Castro's DGI, and from a network in East Germany all but a few of whose agents were working for the Stasi. In other words, while the Ames case was unusually destructive, it was a typical example of bureaucratic sclerosis. In the Gulf War, intelligence worsened the farther one got away from the front lines. The national system headed by the CIA misperceived the nature of Saddam Hussein's regime, failed to grasp the obvious signs of attack, and has yet to learn Saddam's military and political reasoning. Our imaging satellites failed to find mobile Scud launchers, and our communications intelligence antennas failed to shed light on the diplomatic intercourse between Saddam and the Soviets. National analysts misjudged Iraq's nuclear program, and were fooled by elementary camouflage. Gen. H. Norman Schwarzkopf's public belittling of CIA-run intelligence was matched by unprintable epithets from field commanders. What happened in the Gulf would have happened in any conflict because the intelligence community's cameras and antennas were conceived, and its people trained, on the CIA's assumption that cooperative competition with the Soviet Union would last forever and that the basic designs of weapons would not change. Thus cameras, for example, were optimized to take pictures of fixed installations rather than to keep track of attacking military forces or mobile missile launchers. Long before the Soviet collapse, however, it had become clear that the CIA made bad bets. The age of mobile missiles arrived long ago, and modern weapons are defined by the software they contain rather than by observable features. So what's the point of, for example, analyzing a radar signal that a computer can change in an instant? Divorce from operational responsibility also tends to make the reports that flow to top officials less valuable than the information used to compile them. (In any given subject, the CIA delivers a consensus of the system's several agencies. It takes far more time for a paper to go through the interagency process than for someone to write the paper. Considering the elementary errors and ignorance that often come out, it is clear that the conferees do not spend much time fact-checking. Intelligence analysts become spin doctors, concerned not with facts but with pushing policy makers in the direction of their parent agencies' prejudices. Hence the ultimate irony: A system whose ostensible reason for being was to eliminate from intelligence the parochial interests of tank drivers, diplomats, bomber pilots, etc. ended up aggregating the prejudices of the analysts -- prejudices unrelieved by the sobering prospect of having to carry out the policies they are pushing for. The CIA has maintained a monopoly on judging the quality of the system's operations and products. It does not heed presidents, much less their appointees. A decade ago, the agency ignored President Reagan's executive order to reorganize counterintelligence. Two decades ago, President Ford, shocked by how far intelligence estimates were diverging from reality, asked a group of distinguished outsiders (the B team) to see whether the intelligence community's data on Soviet nuclear forces could support conclusions different from those of the insider analysts. The B Team, despite resistance from the agency, came up with results far superior to the insider A Team's. A better intelligence system should be built on a model radically different from the 1947 original. Each of the major departments of the U.S. government (State, Defense, etc.) should be responsible for gathering and evaluating the information it needs to operate in the new world disorder. Intelligence, in short, should be franchised out to its consumers. There is reason to believe that the departments would do better without the ClA's tutelage than with it. In the past, the armed forces have asked to deploy officers who speak foreign languages, who could blend in with the local population, and who would be experts in the military fields on which they were reporting. U.S. military leaders have also clamored for satellites whose products they could use. Each time, the CIA made sure such requests were denied. If those requests had been granted, the country would be better informed. In all this there is a need for some central coordination. The several agencies have to mesh their quest for agents abroad, lest they stumble over each other. The information that any part of the government collects must be available to properly cleared people in all other parts, so that any and all analysis can be based on all the facts. Fortunately, maintaining a central registry nowadays requires computers, rather than the bureaucratic monster that arose a half century ago. Finally the president of the United States' own intelligence needs should be provided by his own staff. Among its duties should be to make sure that all the agencies get each others' estimates. The availability to the president and other top decision makers of contrasting estimates from through out the government would stimulate better performance all around. So, while there is a role for a central intelligence agency in a system based on consumer sovereignty, there is none for the CIA. Mr. Codevilla, a fellow at the Hoover Institution, is the author of "Informing Statecraft" (Free Press, 1992). End

1 0

BYTE on PGP WoT
by John Young 17 Dec '03

17 Dec '03

William Stallings writes in the BYTE February issue on "The PGP Web of Trust."

1 0

Re: Key backup (was: How do I know . ..)
by Dr. D.C. Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 'Adam Shostack' was reported to have written: > Putting the UPC's on things other than cards (such as books) > makes it easier to hide in the open. `UPC' stickers on, say, a few > books are easier to miss than UPC stickers on index cards. Exactly. If the intention is to keep them out in the open, then making labels which resemble UPCs is preferred. However, if I'm going to dig a hole in the ground at a secret location and bury my barcoded key in a special container, a different format might be indicated. > Invisible ink draws attention to the correct UPC's once they > know you're using it. See Kahn for a discussion of secret inks being > developed during the second world war. I'll do that, but I think you might be intermixing ideas. Pseudo-UPCs in invisible ink wouldn't be a good combination. Pseudo-UPCs should probably be printed exactly like normal UPCs. If you want the "invisible ink" process, it should probably blend into the ambient environment as much as possible. Even if "they" know you're using secret ink, don't "they" have to find the printed key first? How much work is required to check every page of every book and every sheet of paper you might have access to? You could mail your key anywhere in the world invisibly printed on the outside of an envelope. Better yet, send someone a special document (wedding announcement, legal document, 21st birthday card, whatever; the important part is to send something that the recipient will keep) with your keyring invisibly printed on it. Variations on this theme (there are many) are encouraged. Have a friend check out a library book and let you stamp your key somewhere inside. It's the number of possible variations that make this seemingly impossible to attack. Apologies if this "secret ink" stuff is way off base ;-) . Most people (myself included) would opt for the "split and disguise" or "hidden/buried" key schemes where secret ink wouldn't add much security. > If you want to hide bits, they > should be stripped of low entropy parts and hidden with a stego > program. The idea was to use something other than magnetic media. A new and different optical encoding method could be devised to hide a key in a halftone, but the barcode example was offered as one possibility using an existing standard. The basis for this thread was the perceived need for a relatively simple key backup system that didn't require the active participation of a whole hoard of people. =D.C. Williams <dcwill(a)ee.unr.edu> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLx2rEyoZzwIn1bdtAQEBVAGAzJc1fOAchLGEIlnbQBiJXV2cICE2WK8e 8FnXnP8ztcWEdUCYY0vjDewiLI2iW4bt =tUR2 -----END PGP SIGNATURE-----

4 3

Re: (none)
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

Mats Bergstrom wrote: >On Tue, 17 Jan 1995, Name withheld on request wrote: > >> wonders to what end remailers are being put by people who are worried >> about being "sold out". > >The fundamental principle here is that an e-mail message is just so >many bits of 1's and 0's. It can never, in it's own capacity, steal, >molest or kill. It is therefore not unethical to run a no-log 'fortress >remailer' and auto-delete ALL complaints, without exception. It might >not be feasible to do so if one wants to stay out of jail, but hope- >fully this will change with the rapid increase in country domains >and the soon-to-come digicash market. Discussions of programming to >make fortress remailers work and to make them easily exportable to >African Linux-boxes are interesting. So are discussions of expected >repercussions on society. Ethical discussions of what is abuse or not >are better left to the clergy. Here comes the clergy! :-) I'm sure that when your hypothetical remailer comes up and I decide to spam you with your own words (now I wouldn't do that, now would I? ;-), your sysadmin will be comforted by knowing that it's only ones and zeros filling his hard disk. He would be especially comforted if I spammed postmaster(a)wherever.you.are rather than your own account in a move to protect your own anonymity. Advocating a remailer such as you describe is only possible in a world where anonymity is considered the supreme good, a goal to achieve no matter how many other ethical rules we break. In the real world, however, there will always be problems with "acceptable use" and "abuse", along with the additional problems with establishing policy and so on.

3 2

Re: Cone of silence update
by Rich Salz 17 Dec '03

17 Dec '03

---------- Begin Forwarded Message ---------- Date: Wed, 18 Jan 95 21:03:02 -0500 From: burton(a)het.brown.edu (Joshua W. Burton) To: silent-tristero(a)world.std.com Subject: Cone of silence update I haven't been able to turn up the original New York Times article I saw, but our own Providence (RI) Journal today reprinted an article from the Washington Post, no date given, that tells substantially the same story, though without any mention of the cost of Intelink. Since a few people have asked me for details, I thought I'd better post this verbatim. Be sure to save a copy, in case this article disappears the way the first one I saw did.... GOVERNMENT'S SECRETS FLOW THROUGH AN INTERNET CLONE WASHINGTON - When the US intelligence community recently decided to modernize the way it communicates, it did what countless other government agencies, businesses and individuals have done over the last few years: it turned to the Internet. But the regular Internet wouldn't do. For spies and other government officials concerned about secrecy, that very public, very uncontrollable global mesh of computer networks was too risky a place to do business. So the intelligence community created its own Internet. Dubbed Intelink and based on the same technology used to run and navigate the original Internet, this new network for sharing supersecret information---including satellite imagery and video footage---officially began operating just a few weeks ago. When the bugs are worked out and a final system is in place, it will allow analysts, policy-makers, military officials and soldiers in the field to tap quickly and directly into classified information at the Central Intelligence Agency, the National Security Agency, the Pentagon and diverse other parts of the national security bureaucracy. Those familiar with Intelink say it could promote cooperation in a business characterized by internecine rivalry, and that at the very least it will centralize and speed up information retrieval. ``This is a major breakthrough,'' said Barry Horton, principal deputy assistant secretary of defense for command, control, communications and intelligence. ``Intelink for the first time, in a user-friendly environment, allows every element of the intelligence community and every element of the Department of Defense to reach into every other element,'' he said. As one might imagine, it's not for everybody. Horton said the system is now available only to people with ``Top Secret'' or higher security clearances. Moreover, those who run the system eventually will have to confront a major issue of how to make Intelink flexible enough to accommodate users with a variety of clearances. There are many levels of classification higher than Top Secret, and for Intelink to be useful to those working on the most secret programs, the officials responsible would have to be comfortable placing such information on the system. And, while Pentagon and CIA officials spoke of how Intelink promises to improve communication and cooperation among the agencies and reduce duplication of effort, others said there is good reason to be skeptical. The intelligence community has made innumerable attempts to eliminate redundancy and streamline information channels, but there has been little progress. ``It's gone like gangbusters since its inception, but any Internet-like thing grows overnight. The question is, is it going to mature well? And how will it operate in a time of crisis?'' said Ross Stapleton-Gray, who recently left the CIA to start a business providing Internet services to embassies in Washington. In a way it is fitting that what some call an Internet ``clone'' should come out of the national security bureaucracy. Internet itself was started under Department of Defense sponsorship in the 1960s, as an attack-proof communications link among military, corporate and university research centers. ``Remember, Internet is a DoD creation,'' said Neil Munro, a reporter for Washington_Technology, a local business newspaper, who recently broke the story about Intelink's start-up. ``This is the prodigal son....They created it and now it comes back in much stronger fashion.'' All those familiar with the system said it is totally walled off from the Internet, and designed never to be penetrated. But several experts familiar with Intelink noted that no system is ever totally secure. ``This would obviously be a Mount Everest for hackers,'' said John E. Pike of the Federation of American Scientists. But Pike, who said he thinks Intelink has the potential to ``revolutionize'' the intelligence community, added that it would be so difficult to crack he doubts many will try. The network now operates among several dozen intelligence agencies and centers. But it is the talk of the intelligence community, and its reach is expected to grow rapidly. Those who now have regular access to it number in the hundreds, estimated Martin C. Faga, general manager of the Center for Integrated Intelligence Systems at the Mitre Corp., the company that helped the intelligence agencies set up the system. ----------- End Forwarded Message -----------

1 0

"Time" Magazine and "Future Shock" Author
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I'm into my daily "blackout" of toad mail to Netcom, so am posting blind, as usual. If this article has already been posted, my condolences.] The January 23rd issue of "Time," this week's issue, features a cover story on talk shows, Limbaugh, Gingrich, and "HyperDemocracy." I haven't seen the physical issue yet, but have skimmed the Web version at: http://www.timeinc.com/time/magazine/magazine.html Point your browser at it and have fun. Lots of folks are flaming the article, in the usual newsgroups (e.g., alt.data-highway). Me, I'm as scared as "Time" is about "direct, electronic democracy," though perhaps for different reasons. On a related note, the article and sidebars touch heavily on the "cybergurus" who are advising Newt Gingrich on his journey into cyberscpace, notably Alvin Toffler ("Future Shock," "The Third Wave," "Powershift," etc.) and George Gilder ("Beyond Wealth and Poverty," "Macrocosm," lots of essays on the Net). As it happens, I spent some time talking to Alvin and Heidi Toffler at an interview last Friday in L.A.--they were being interviewed before and after me. Not enough time to really get into issues, and of course they did most of the talking (Heidi is especially opinionated, and had just been in a highly publicized battle with newage guru Arianne Huffington, spacey wife of losing candiate in California, Michael H.). Anyway, we talked about John Brunner (as you all know, Brunner's seminal "The Shockwave Rider," was inspired by "Future Shock") and his ideas. (And we all agreed that "Stand on Zanzibar" was his crowning achievement...even Shalmaneser admitted "Christ, what an imagination he's got.") Tidbits: * on digital cash: Heidi: "Oh, we're for it! Did you hear what I just told the interviewer?" (I didn't, as I was in the adjacent room. Later comments lead me to believe that neither of the Tofflers has a clear idea of what's going to happen with digital cash and crypto anarchy.) * on the NSA and the t-shirt I showed them ("Cypherpunks: putting the NSA out of business"): "Oh, no, we need a strong NSA now more than ever!" (What else would I expect? They view the NSA as the main bastion against terrorists plotting to blow up the World Trade Center. Alvin was generally more reserved and thoughtful. When I pointed out that the very hotel room we were in could be used to plot crimes, even nuclear terrorism, and that the solution to stop this would have to be an Orwellian regime of continuous monitoring, Alvin nodded thoughtfully, but Heidi just sniffed. I mention this to give a flavor, just a whiff, of what senior advisors to the most influential man in America are thinking.) * I gave Alvin a copy of my "Crypto Anarchy and Virtual Communities" paper. * My interview was pretty disappointing, by the way. Lots of sitting around, delays in getting my laptop hooked up to Netcom (outside calls had to be unblocked). The interviewer wanted memorable, quotable stuff from me, but I felt constricted sitting around and being expected to spout on cue. Maybe they'll get a few minutes of usable stuff.... (Print media is so much better. An interviewer can let the tape recorder run for hours, can edit the containing material of a quote, and can thus produce clear, coherent quotes. A video interview is more constrained in lots of ways, and offending gestures or rambling interjections cannot be easily edited out. As one example, at one point I naturally (to me at least) said something about "As we just saw...." Well, this made this quote unusable. And so it goes.) I was generally unhappy with the whole thing. Four hours to get there, two hours spend waiting around, an hour to resolve problems, an hour under the camera lights (being told not to move, to "use the mouse," to "tell us why cryptography is important," etc.), and five hours to get home. All for a few minutes at most on a t.v. show. Oh, the show is the BBC's "Horizons" science series, which may also get sold to U.S. outlets, etc. I think the title will be "The Information Bomb," and features segments on information warfare, a la Winn Schwartau's views, the Tofflers, some military planners, and--maybe--me. I don't have high hopes for my segment. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

"Disclosing" private email
by Arthur Chandler 17 Dec '03

17 Dec '03

Greetings! I'd like to solicit your/our best thoughts on the following message. San Francisco State University is considering a policy of "disclosing" private email to outside agencies. I'm aware that such a policy is yet another argument for using crypto; and the last cypherpunks meeting gave some encouraging instances of "transparent" encryption schemes that are not a hassle or a fear-barrier for newbies. But if you could post or private email me your thoughts about the legal/ethical aspects of "disclosure," I'd be much obliged. I've put a few of my own concerns at the end of the enclosed quote. ---------- Forwarded message ---------- >From: "Deirdre C. Donovan" <deirdre(a)mercury.sfsu.edu> > >I am rewriting the information handouts which we here in San Francisco >give out to our students when they apply for Internet access accounts. >The issue with which I am struggling is one of privacy. I have heard of >universities (anecdotally only) where the administration reserves the >right to read E-mail. Here, we are leaning more toward something like the >paragraph below, which is taken verbatim from an Indiana University draft >document. > > IU computing centers will maintain the confidentiality of all > information stored on their computing resources. Requests for > disclosure of confidential information will be reviewed by the > administrator of the computer system involved. Such requests > will be honored only when approved by University officials > authorized by the [President] of the campus involved, or when > required by state or federal law. Except when inappropriate, > computer users will receive prior notice of such disclosures. > I'm uneasy about the chain of "prior notice": 1) Does this policy give university administrators the power to read private email before the decision is made to "disclose" it to outside persons or agencies? 2) Does this "prior notice" mean "We're going to do it" or "We plan to do it, and if you disagree, let's discuss it before we release it"? 3) What constitutes "inappropriate"?

1 0

Re: Electronic cash illegal?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Within the United States (and most other sovereign states) Hal Finney is > correct to point out that the power to print currency is reserved to the > government. I would think that e-cash is a currency and therefore illegal > TO ISSUE WITHIN the geographical (legal) domain of the US. He didn't say it was illegal to print private banknotes, just taxable. Anybody can issue paper or metal tokens or whatever - the difference with goverment-issue currency is that they can pass laws saying you must accept it as payment for debts, even though your contract specified repayment in real money instead of private bogons like green paper IOUs or lightweight impure-metal coins with politician's pictures on them. As far as I know, the legal definition of a "dollar" in the US is still a certain weight of silver, and payment in silver legally satisfies debts; under current silver prices, that probably costs more than a $1 US Federal Reserve Note, so nobody bothers. Bill

3 2

EE Times on PRZ
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Jan 16 issue of EE Times has an excellent article on the legal controversy surrounding Phil Zimmermann and PGP, positioned top-right front-cover for maximal exposure. It describes the aftermath of a meeting last week between Phil's attorney, Philip Dubois, and the government lawyer handling the case. "'We told the prosecutor our concerns,' Dubois said. 'He agreed to consider them. We might hear back in a month or two. He didn't make any promises.'" (Sometimes it seems like the gov't is dragging this case out intentionally. I believe the uncertainty does have a chilling effect on private development of strong crypto, which would be gone if the government announced it was not going to pursue the case, or if they did bring charges and lost.) Another interesting quote: "Zimmermann is not in danger of being indicted for willfully exporting PGP. Rather, the U.S. attorney's office, here, is considering charging him for making PGP available in such a manner that it could be exported by a third party." What the hell is this? Can anyone point to the statute they may be referring to here? This seems awfully broad. This, from a sidebar, is really surprising: "In contrast, public keys allow the overt publication of an encryption key, because decryption keys can only be derived through a mathematically difficult process, such as large prime-number factoring. Contrary to popular belief, the NSA can decrypt public keys of most practical key sizes." I wonder what this means? If it is a claim that the NSA can factor 1024 bit moduli that would certainly come as a big surprise. If they are saying that they can do 512 bits that would be more believable although of interest. It is strange that the author would include a statement like this without attribution or evidence. Generally, the article is very favorable towards Phil and an excellent overview of the case. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxytnBnMLJtOy9MBAQHGnAH/TAOr6TNchZjCyMESeDdOf1seXTkfMbMY 3qrL91OmjwxDIBDkzszrgizwadKwWYn65yOY3yJ4Wk/xUcNwKFnk1Q== =PoYj -----END PGP SIGNATURE-----

3 2