December 2003 - cypherpunks-legacy

C.I.D.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

How can we defeat caller I.D.? It used to be that if you wanted to have anonymous e-mail, you could sign on to a BBS. But I am scared by the new modems that are equipped to log caller I.D. The general public believes that if they want to remain anonymous, they can defeat caller ID by dialling *67 before making a call, that way making sure that their number is not revealed. Ha! This is true, but not the full truth ... because Big Brother still has the number: The calling number is sent between switches always, regardless of whether or not *67 (Caller ID Block) is dialed. It just sends along a privacy indicator if you dial *67, and then the final switch in the path will send a "P" instead of the calling number to the Caller ID box. (But it will still store the actual number - *69 will work whether or not the caller dialed *67). What the final switch along the path does with the calling number depends on how the switch is configured. If you are not paying for Caller ID service, the switch is configured so that it will not transmit the Caller ID data. Before this, if you wanted to make sure a system didn't trace you back, you could call through a few diverters, PABXs, etc. However, today with Caller ID, your call information will be routed from diverter to PABX to system instead of stopping at the first diverter. The effect call forwarding has on the various services is interesting... Say I have my home telephone forwarded to Lunatic Labs, and it has Caller ID. If you call me, the call will forward to Lunatic Labs, and its Caller ID box will show YOUR number, not mine (since your line is the actual one making the call). Does this get you thinking? Anybody knows of a way to *really* defeat caller I.D.? Or, absent that, a more appropriate mailing list than this for such questions? |[]|[]|[]|[]|[]| "The Happy Fool"© []|[]|[]|[]|[]|[ PS: I did not want to participate in the great logo debate a while back, but if you want my 2C's, I think a simple padlock would be a great symbol, especially for an icon to do unbreakable encryption: Click it and seal. Elaborate? Then just put it on a red wax-seal.

1 0

Re: Admiral Inman
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Peter Wayner writes: > I've always assumed that the excitement behind the Digital Telephony > bill was to go after VoicePGP. Not really - Digital Telephony goes after the phone companies, not the end users, which makes it easier for the government to impose. Among other people it *is* going after are cellphone companies which are getting a lot of pressure to include encryption on their radio links (some people are pressuring them to use *real* encryption, the NSA has been pressuring them to use at most wimpy encryption, and some people have been pressuring them to put in _anything_, even rot-13, just so there's _some_ vague privacy protection out there.) It's also, of course, going after carriers who have the _gall_ to use more powerful telephone systems than the FBI can afford to crack :-) Now, VoicePGP may be the next step in banning things - after all, they could declare use of cryptography to be Probable Cause that you're conspiring about something, which would let them confiscate your computer equipment and make you sue to get it back. Bill

1 0

(Fwd) news spoke
by John Young 17 Dec '03

17 Dec '03

Forwarding Design-L mail by: <carr0023(a)GOLD.TC.UMN.EDU> () on Nov 23 ------------------- This message revealed itself yesterday on my shell account. This could be some arbitrary law going down in the present, even worse than the McCarthy era witchunt. So much silence, even for academic concerns, and system administrators decide whom to prosecute for relevance. _________________________________________________________________ ___________ UNIX(r) System V Release 4.0 (gold.tc.umn.edu) This system is for the use of authorized account holders only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel. In the course of monitoring individuals improperly using this system, or in the course of routine system maintenance, the activities of authorized account holders may also be monitored. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity, system personnel may provide the evidence gathered to law enforcement officials.

2 1

Re: New Opportunity for Anonymous Reamilers
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- alex <cp(a)omaha.com> writes: > > I guess this should mean some more business to my friends at > > Pagesat, which broadcasts a completely uncensored real time feed of the > > USENET over a small dish Ku band satellite link to all of North America. > > And they are a real licensed common carrier (their principle business is > > wide area paging services) so they can't be held responsible for the > > contents of the traffic either. > > Do you need to be licensed to be a common carrier? If so, who grants the > licenses, and what qualifications does a business need to meet in order > to qualify? The FCC regulates interstate common carriers (plus radio licensing of the microwave/satellite uplinks). State public utility commissions also control certain aspects of intrastate service. I don't know if they have any say in satellite service to intrastate customers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtFJgd74r4kaz3mVAQGmbQQAhitU7vGX9OAsEm/grTDWciBf1MlEhV2L +sBf3OcB/GjYuiIuWftH+Qn7E46nzIRC4gTNz+Ibo5ouwkjyggcuVtNyXhFgvXZm hJH+EHz0X1MqqwTkF7fQPv7QPxGwqHI4vbQANeCBnM0eKDAe+r9/wnGPIn2ODdu8 gzLHBQuQlVo= =zac0 -----END PGP SIGNATURE----- ... "The greatest dangers to liberty lurk in the insidious encroachment of men of zeal, well meaning but without understanding." - Justice Louis Brandeis -- jgrubs(a)voxbox.norden1.com (James C. Grubs, W8GRT) Voxbox Enterprises, 6817 Maplewood Ave., Sylvania, Ohio 43560-1956 Tel.: 419/882-2697

1 0

usenet -> mail gateway
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In view of the situation at CMU and McGill a stray idea crossed my mind. If someone were to set up some mailing lists which routed the content of the particular usenet group to the subscribers, this would stymie big brother to a certain extent. The problem would be that they could possibly block certain domains from incoming e-mail to thwart this. A solution would be to dummy up the from address. Daily the address would or could change, thus frustrating the powers that be. An additional solution would be to throw encryption into the list software so that each message would be encrypted to it's recipient, further frustrating the powers. Another concept would be to daily blast an encrypted packet (SOUP or whatever) to the subscribers of the list. They could then post replies or follow ups through a mail -> usenet gateway. ============================================================================== Doing easily what others find difficult is talent; doing what is impossible for talent is genius. - Henri-Frdric Amiel, "Journal", 1883 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtFh7gpnimeWAf3FAQFXdAP7ByfEkiuGGzcBYiu7zyT63l4sHYKjiQkl 2Xv4yD0cEh/84QqPZzFayhCBCaSi7prrUWP19QjmJfZPqwIIE2t9mU0QGOvelID2 Qxeg9rYEJtTFRroFDfS6at0GbkfBeNwqyI61St1sZucFXfJx/LJxsC1Z2oylzJMO 7/OAdSG5Xqo= =AXTD -----END PGP SIGNATURE-----

1 0

(Fwd) electronic signatures for CAD
by John Young 17 Dec '03

17 Dec '03

Forwarding <alt.architecture> message by tommy(a)Fateepee.CAM.ORG -------------------- From: tommy(a)Fateepee.CAM.ORG (Tommy Petrogiannis) Subject: Re: electronic signatures Date: Mon, 21 Nov 94 17:08:06 -0500 Organization: SILANIS TECHNOLOGY >On 5 Nov 1994 18:44:14 GMT, >Aaron Rumple, AIA <rcet035.slvaxa.umsl.edu> wrote: >Electronic signatures will not make for a paperless environment. They will >add to the lawyers generation of paper when you have to defend yourself >because your file became the basis of another project in which you were >not involved. Once you send a electronic/magnetic form of a document you >lose all control over who has access and what they do to your files. You >can protect yourself in your contract with your client and by making >hardcopy (more paper) the drawing of record. However, anybody can and will >sue if your title block, signature, etc. is found when something goes >wrong. It has happened. >In short, an electonic signature is nice to protect what you sent >electronically, but I would not want it to replace my seal on a paper copy >that could be kept as a record. Forensics can detect changes on paper but >not on electronic files that have been transmitted around. I have to voice the comments that our customers are saying about our electronic approval software for AutoCAD. Many of our customers are still archiving a paper copy of the electronically signed original, however because ERA allows them to sign in the same environment as where the drawing was created (i.e. the electronic environment) it becomes a very simple matter to know if the drawing that you are looking at on your computer screen is the latest electronic approved original. Most companies today create their drawing on a CAD system, plot those drawings for visual verification and sign those drawings in the paper world. The minute those drawings are signed in the paper world they become "originals" that must now be archived and stored in some form of filing cabinet. If we did not need to refer to those archived drawings life would be fine, but unfortunately we do. Today you pull up a drawing on your computer and hope that everyone followed proper procedures and you are looking at the latest copy of the paper signed "original" - you can never be sure because the drawing was approved in a different domain than where it was created, and the only thing linking the two domains (paper and electronic) is procedures. Our ERA system was first designed to be used by a large nuclear generating facility and is now available to the public. What we did was mimick the paper world as much as possible when it came to approving a drawing. With ERA you now approve and sign a document from right inside AutoCAD using a ball point pen and a pressure sensitive digitizer. The key thing here is to allow the approval of the drawing to take place in the same domain as where the drawing was created (i.e. the electronic domain) but still offer all the security expected in the paper world (if not more), and still maintain the ability to generate a signed drawing that can be used in the field or be archived. This is achieved by doing the following: The persons' signatures are not AutoCAD entities and therefore cannot be cut and pasted. The signatures are DES encrypted along with time stamp info and information that uniquely describes the current state of the drawing being approved. The signatures will not be printed on a drawing that has been altered after the drawing was signed. All of the above plus a whole lot more are meant to facilitate the creation of paper, but eliminate the need to go find that paper afterwards - sort of producing a photocopy. The original is in the electronic domain, while the paper becomes a redundant copy. The benefits are HUGE. A drawing can now be sent electronically from desk to desk to be approved. A drawing can be retrieved electronically and by simply clicking on VERIFY our customers can check to see if they are looking at the drawing that was approved or if someone has accidentally or maliciously altered an original rev. We have had such great response to ERA product for AutoCAD that we just announced at COMDEX our ERA product for MS Word so that any wordprocessor type document can be approved in the same fashion. I apologize for rambling on, but I believe that we have really solved the last issue required to achieve the ability of creating, revising, and approving in an electronic domain. One customer went from a 7 week typical approval cycle down to 8 days using this technology - how much is that worth don't really know, but it makes a lot of sense. People don't realize that they are performing electronic approvals every day. When you walk up to an ATM machine and withdraw $100, by entering your PIN you are authorizing the withdrawl to take place. The question every company must ask, is how secure do I feel with the technology. Can someone take my bank card and figure out my PIN to forge my electronic authorization? Yes but it is difficult - not impossible. Can someone forge my handwritten signature? Yes but it is difficult - not impossible. What I tell our customers is to use the electronic approval for the projects where they feel comfortable - for many of them it is the internal based procedures and projects that requires 80% of the time and money and still use traditional methods for high-risk projects. It seems to work for them quite well. -- Tommy Petrogiannis tommy(a)Fateepee.CAM.ORG _ __o ______ `\<, Going slow just hurts too much. -- O/ O Going fast gets me there sooner - so I can... recover from the pain quicker ------------------- End Forward

1 0

Re: Admiral Inman
by dwa＠mirage.svl.trw.com 17 Dec '03

17 Dec '03

> > From owner-cypherpunks(a)toad.com Mon Nov 21 17:49:07 1994 > Date: Mon, 21 Nov 94 20:17:47 EST > From: wcs(a)anchor.ho.att.com (bill.stewart(a)pleasantonca.ncr.com +1-510-484-6204) > To: pcw(a)access.digex.net > Subject: Re: Admiral Inman > Cc: cypherpunks(a)toad.com > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1071 > > Peter Wayner writes: > > I've always assumed that the excitement behind the Digital Telephony > > bill was to go after VoicePGP. > > Not really - Digital Telephony goes after the phone companies, > not the end users, which makes it easier for the government to impose. > Among other people it *is* going after are cellphone companies which > are getting a lot of pressure to include encryption on their radio links > (some people are pressuring them to use *real* encryption, the NSA has > been pressuring them to use at most wimpy encryption, and some people have > been pressuring them to put in _anything_, even rot-13, just so there's > _some_ vague privacy protection out there.) > It's also, of course, going after carriers who have the _gall_ to use > more powerful telephone systems than the FBI can afford to crack :-) > > Now, VoicePGP may be the next step in banning things - after all, > they could declare use of cryptography to be Probable Cause that > you're conspiring about something, which would let them confiscate your > computer equipment and make you sue to get it back. > > Bill > Check out: TIA/EIA Telecommunications System Bulletin Cellular Radiotelecommunications Intersystem Operations: Authentication, Signaling Message Encryption and Voice Privacy TSB51 Their idea of "Voice Privacy" is to repeatedly XOR a 260 bit session key with the data stream. I quote: 8.2.47 VoicePrivacyMask (VPMASK) This parameter contains a 528-bit field consisting of two 260-bit masks used for voice privacy on a digital traffic channel. One mask is for speech transferred in the inward direction (from the CSS toward the MSC) and one is for speech transferred in the outward direction (from the MSC toward the CSS). These masks are calculated using CAVE parameters in effect when the call is established and remain constant for the duration of the call. So, while analog calls are not encrypted, you can look forward to COMPLETELY SECURE (sarcasm) digital transmission. Wonder how much the Gov'mint bribed the phone companies for this stunt... Dana W. Albrecht dwa(a)mirage.svl.trw.com

1 0

Re: Borenstein Speech
by Rich Salz 17 Dec '03

17 Dec '03

I know better then this. >Nat Borenstein is speaking nearby on Monday. What's the global definition of nearby? :( I'll be the one yelling "thief, thief" as he talks about safe-tcl... MITSUBISHI ELECTRIC RESEARCH LABORATORIES 201 Broadway Cambridge, MA 02139 617-621-7500 OPEN PROTOCOLS FOR INFORMATION COMMERCE Nathaniel Borenstein, Chief Scientist First Virtual Holdings Inc. Date: Monday, November 28, 1994 Time: 9:30 am Abstract: Traditional one-way payment mechanisms, such as cash, credit cards, and digital cash, presuppose the necessity of payment validation in advance of the completion of a transaction. In contrast, a "closed loop" protocol that verifies both payment information and customer satisfaction permits a far simpler payment engine in an open Internet environment, and is well-suited to a broad sub-class of Internet commerce applications. In this talk, I will present the underlying philosophy, design rationale, and specification overview for a recently-developed set of open protocols for information commerce. (Dr. Borenstein is well known for his work at Bellcore on the MIME standard for multimedia messaging; he is also the author of the Andrew Message System, ATOMICMAIL, Metamail, Safe-TCL, and _Programming as if People Mattered_.) Host: David B Anderson <anderson(a)merl.com> Directions to MERL can be found in ftp://ftp.merl.com/pub/directions.map

2 1

Re: A Chance Encounter with Brad Templeton, of ClariNet
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

Adam Shostack wrote: > There is an entire parasitic > class that does nothing useful, but makes money from the idea of > copyright. (Most entertainment industries operate like this. The > industry puts up seed money in exchange for the profits that an artist > generates.) Books, music, film to a lesser extent are all in the path > of a digital revolution which eliminates the need for a middleman. If > I can download music to DAT, I don't need Sony records. Neither does > Peter Gabriel, Robert Fripp or any other musician. The above is a key insight into what I see as one of the biggest issues of the next couple of decades, certainly one of the biggest issues affecting the networks. A battle is looming between public freedoms on the nets, and powerful copyright-based economic interests. Such a battle is very apt to turn the networks into a minefield of impossible laws, ubiquitous surveillance and unending litigation. Note that the Clinton/Gore administration, and its Information Infrastructure Task Force (IITF), have already taken the (in my opinion extreme and unrealistic) position that intellectual property laws must be not merely preserved but *strengthened* and *expanded* in the context of the National Information Infrastructure. (See the report of the IITF's Intellectual Property Working Group, as well as other relevant reports available at iitf.doc.gov.) And I see no reason to hope that Congress will take a different approach. Such a battle could have far-reaching implications. Taken to its logical conclusions, a "War on Piracy" could make the "War on Drugs" look benign (and inexpensive) by comparison. Averting this disaster may be one of the most important challenges facing the cypherpunks. Just my two cents' worth. --- mkj

1 0

Re: A Chance Encounter with Brad Templeton, of ClariNet
by adam.philipp＠ties.org 17 Dec '03

17 Dec '03

>> (For one thing, the ECPA protects the mail, and allows the machine >> owner to adopt a "hands off" stance. For another, an "abused account" >> can simply and quickly be killed, with new ones taking its place! >> Think of the benefits.) >> >I'm not sure the ECPA provides the protection you want here. I'll have >to look again, and do not assert this as certain, because I'm only >pulling of the top of my head what I remember from a quick scan of the >Steve Jackson Games opinion. > >Anyone want to repost it? I recall it limited the ECPA in some >interesting way, and I remember being offened, and not surprised at the >narrow reading. The ECPA offers two levels of protection to e-mail, transmitted e-mail and stored e-mail. The some mail on Illuminati (Steve Jackson's BBS) had been sent but had not been read by the intended recipients. The the first trial found that the there had been a violation of the ECPA with regard to the section on stored mail, but not on transmitted mail. It narrowly defined the transmitted section to include only interception contemporaneous with transmission with the e-mail. Sine the mail had been sitting around on the hard disk, the court refused to call it interception. If anyone really cannot find a copy of the ECPA I can go search for my ASCII edition, but right now I only have a hard copy lying around somewhere on this desk. Adam -- PGP Key available on the keyservers. Encrypted E-mail welcome. Sub rosa: Confidential, secret, not for publication. -Black's Law Dictionary

2 1