December 2003 - cypherpunks-legacy

[frissell@panix.com: Re: CoS Raid on "Copyright Terrorist"]
by David Taffs 17 Dec '03

17 Dec '03

--RAK01412.808623897/portland.ebt.com Content-Type: message/rfc822 Return-Path: dat Received: from veronica.EBT.COM (veronica [198.112.112.3]) by portland.ebt.com (8.6.9/8.6.9) with SMTP id RAA13095 for <maryt(a)wv.mentorg.com>; Tue, 15 Aug 1995 17:52:35 -0700 From: David Taffs <dat> Received: by veronica.EBT.COM (5.0/CF5.1L) id AA10092; Tue, 15 Aug 1995 17:50:51 +0800 Date: Tue, 15 Aug 1995 17:50:51 +0800 Message-Id: <9508160050.AA10092(a)veronica.EBT.COM> To: maryt(a)wv.mentorg.com Subject: [frissell(a)panix.com: Re: CoS Raid on "Copyright Terrorist"] content-length: 1370 X-Sender: frissell(a)panix.com X-Mailer: Windows Eudora Version 2.1.1 Mime-Version: 1.0 Date: Tue, 15 Aug 1995 16:00:06 -0400 To: m5(a)dev.tivoli.com (Mike McNally) From: Duncan Frissell <frissell(a)panix.com> Subject: Re: CoS Raid on "Copyright Terrorist" Cc: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text/plain; charset="us-ascii" Content-Length: 975 At 01:17 PM 8/15/95 CDT, Mike McNally wrote: >Mailboxes Etc. insists on getting a picture ID; at least they did last >time I checked. Some smaller mom&pop places will take a business card >(time to break out your Jim Rockford Business Card Fabrication Kit). I always supply picture ID these days. It's really rough getting those cold lamination-Employee ID kits from Office Depot, taking the polaroid on a blue background, trimming the photo, and assembling the employment ID. I'm one of my best employees. Don't forget to include your EMP_NO. It gives the clerk something to write down. DCF "Governments are simply not fully sovereign in the world of information; their powers within it are strangely limited....This weakness of government control within computer nets--a product of strongly protected privacy, a lack of frontiers and confusions of jurisdiction--make them natural places for subversion." -- The Economist "Softwar--A Survey of Defence Technology" --RAK01412.808623897/portland.ebt.com--

1 0

CPAC, XtatiX, and the Censor-State
by Mike Duvos 17 Dec '03

17 Dec '03

The self-proclaimed "child protectors" are at it again. This time, an ex-police officer with far too much time on his hands has declared war on all so-called "boylover" web sites on the Internet. This includes not only sites where legal issues surrounding youthful sexuality are discussed, but virtually every site in which the word "boy" appears, including photography web sites, young celebrity sites, and any sites such sites link to. We're not talking about porn here, but material which is perfectly legal, the vast majority of which would attract little attention aside from the fact that a bunch of Christian wankers have unilaterally decided for all of us that they do not want it on the Net. They have sworn to harrass each and every ISP carrying material on their "hit list," until the material is removed. Tactics include intimidating snail mail spams and phone calls by people claiming to be associated with law enforcement, as well as late night phone calls threatening bodily harm to ISP management and their families. The rantings of this individual and his similarly minded friends can be found at... http://mavrick-bbs.com/cyranch/sewer2.htm and http://www.thecpac.com/net-safety.html The latest organization to be attacked by Officer Friendly and his contingent of jackbooted thugs is XtatiX.com, a small provider which until recently had hosted a number of web resources which CPAC didn't like. The nature and content of these web sites were clearly discussed with XtatiX before they were chosen to host them, and assurances were given that no problem existed. XtatiX.com states explicitly on their home page, and I quote... "XtatiX supports the concept of an open Internet. Xtatix does not censor accounts or content in any form. We encourage our users to exercise sound and responsible judgement when creating their web pages." "We also understand that some internet sites may have content that some find objectionable. Software products exist which give the individual the ability to limit unwanted material. This software does not interfere with the rights of others to surf as they wish." So one might think that anything legal and resonably tasteful goes at XtatiX, right? Well, that's the way it was until the CPAC contingent hurled a few threats in their direction. In response to the harrassment, XtatiX is now sending a letter to web customers whose pages are, according to XtatiX, "too controversial." XtatiX says in part... "We regret to inform you that we can no longer host your website, due to many local and national pressures on us, to get rid" of sites of the nature of yours, and also a few more sites with other natures that could be considered controversial." "We sincerely apologize, because we _DO NOT_ like censorship, nor do we endorse its use. We have had to practice it of late, though, because of many law enforcement and other officials emailing us, and or calling us in regards to some of the sites we are now hosting." "Again, if it were based soley upon our choice, then we would not change our censorship policies, and would not have to do things such as these, which pain us very much. We would appreciate it very much if you would please copy the files you need to host your site off the server within 48 hours, and delete the copies on the server." "This does not mean that we do not still want you on as an XtatiX customer, but we can no longer deal with as many hate mails, phone calls, and emails from law enforcement officials and users on other systems. Please bear with us." Now XtatiX is certainly welcome to accept or turn away business as they see fit, although it seems somewhat disingenuous of them to loudly advertise their service as one that "does not censor accounts or content in any form," while at the same time, crawling all over themselves to get rid of customers they consider "too controversial," based on harrassment orchestrated by a single pressure group. Now to some Cypherpunk issues this case illustrates... "Information Wants To Be Free" Our working model of information services has always been comprised of three things. First, a dynamic collection of information service providers with complete discretion as to whom they choose to do business with. Second, a Net which regards censorship as damage and routes around it. And third, market forces that ensure that any legal information has a home where others may access it. Providers that censor lose customers, who give their money to providers who don't. The CPAC/XtatiX case study demonstrates another reality. First, a dynamic collection of information service providers in a mad race to see who can come in second to last when the awards for "Enemy of the State" are handed out. Second, a Net in which almost nothing is multi-homed which cannot even regard damage as damage and route around it. And third, market forces which ensure that censorship is frequent, silent, and never publicly spoken of in policy statements. Whether it's CPAC wanting to nuke all web sites containing the word "boy," Sen. Swinestein wanting to nuke all web sites containing the word "bomb," or Sen. Hatch wanting to nuke all web sites containing the word "sex," the optimal strategy for service providers has turned out to be to quietly remove any material some squeeky wheel is uncomfortable with, keep proclaiming themselves to be the strongest supporters of free speech in the entire Net community, and stonewall when asked questions which might suggest anything to the contrary. This behavior of the Net mirrors the behavior of the other so-called "free" market-driven media. There are issues and points of view you will never see discussed on the evening news, or in Time and Newsweek. There are books that disappear from your local library and bookstores and are not replaced. The Net is starting to look a lot more like just another "self-regulated" media outlet, where the individual citizen has access only through a company whose principals are well versed in whose feathers must not be ruffled. The CPAC/XtatiX dance is being repeated each and every day, with providers like Tripod and Geocities, and with search engines quietly removing Horsemen-related articles from their databases, all while proudly displaying their Blue Ribbon Campaign icons for Free Speech on the Net. What's happening now is that a lot of sites are moving offshore, but it probably won't be long before "The Attorney General's List of Horseman-Related Offshore IPs" is dutifully prepared for Congress each year, and Router-Blocked at our borders under threat of criminal penalties. "Information Laundering" will undoubtedly become the Fifth Horseman shortly thereafter. All of this represents a big shoe in the clockwork of Crypto-Anarchy, and a problem needing a technological solution post haste. Suggestions and discussion are welcome. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

1 0

Re: Netscape security
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

At 11:08 AM 8/18/95 -0400, Alex Tang wrote: >On Fri Aug 18 10:11:07 1995: you scribbled... >> >> On the subject of Netscape: >> Now that Netscape is making the Commerce Server available >> for free to students, faculty, libraries, etc. (i.e., groups >> with limited ability to cough-up $290 to RSA to get the >> 1-year digitially-signed certificate needed to make it operate >> in "secure mode"), does anyone know of alternative methods for >> producing such certificates? > >are you sure that this is a commerce server? Last I saw, It was only the >Communications server (doesn't have SSL). I could be wrong though. > >...alex... > Yes, I got an email on it this morning. Check-out: http://home.netscape.com/comprod/server_central/index.html. rj ------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW site for job analysis & personality research: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

1 0

Re: Export policy change
by David K. Merriman 17 Dec '03

17 Dec '03

At 10:25 AM 8/18/95 -0500, you wrote: >On Fri, 18 Aug 1995, David K. Merriman wrote: > >> >Ok, let's escrow our keys with Julf :-) >> > >> >Seriously, there might be a market for somebody to become a professional >> >escrow agent.... >> > >> >(tongue partially in cheek) >> > >> >> I will cheerfully escrow keys for 1$ ecash/key. Please be advised, however, >> that key storage will be on an old 40M RLL drive on an 8088 machine, so >> retrieval may be a bit slow and unreliable....... > > >Same here -- I have an original Compaq "Sewing Machine" Portable with >a 40MB hard card. Of course the HD sticks and needs a good whacking >sometimes, and the last floppy came out of the drive smoking and >covered in grease. (You DO have a 5 1/4" 360K floppy don't you?) Yeah - it's my 'good' fdd. The other one is a 180K :-) Dave This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: SSL challenge -- broken !
by Pierre Uszynski 17 Dec '03

17 Dec '03

Jordan (jordan(a)Heuristicrat.COM) attempts to correct me ;-) > > From pierre(a)shell.portal.com Thu Aug 17 18:29:41 1995 > > > > Unfortunately, in this case, insecure credit cards are not an > > obstacle to banks making money, so why should they care? > > [...] if you think that the major card issuers "don't care" about > cutting (or eliminating) fraud, you're not talking to the right > people. Fraud eats away a big chunk of revenue [...] Creative quoting aside, the point of my post, if it needs further clarification, was that the cost of fraud is not only a burden to the banks as some people seem to think. It is not even only transmitted back to the customers in the form of higher fees and interest rates. Card issuers can, do, and should as long as they can get away with it, rely on methods against fraud that are less costly to them. That's because they answer to their bottom line, to their share holders. There are disincentives to fraud in the form of legal penalties and threat of same, even the impression that credit cards are insecure may help by limiting what (some) people dare to do with them. The costs of these methods of fighting fraud is carried in part even by us who don't even usually use credit cards! The highest the penalties and cost of enforcement, the lowest the direct burden on banks, but that does not necessarily mean that our (user's) bottom line will improve. For citizens and tax payers who are not significant share holders, it's not enough to ask the card issuers what the cost of card insecurity is to them. "Our cost is higher." By making some credit card fraud illegal, enforcing, etc... we actually allow card issuers to use less secure mechanisms and procedures (although I'll agree this does not apply to the 40 bit key nonsense, that's one case where banks and businesses would be happy to use longer keys.) (the equivalent mis-quote about politicians applies here :-) Pierre. pierre(a)shell.portal.com (And I will not contribute further to this side thread.)

1 0

Re: Where is the key cracking farming software?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Dan Bailey <dan(a)milliways.org> writes on cpunks: > There must be several versions of the code at this point. The > Cypherpunks release, Damien's release and whoever else wrote some code > to do the chore. If someone could pass me a pointer to the version > that's best-commented and most understandable (one man's C is another > man's crypto) I'd like to port it to Windows NT and write a simple > installation to install it as a service. Yep there's lots of versions of the brutessl software, ones I know of (in no particular order): - Damien Doligez wrote one - Andrew Roos wrote on (this is the one we're using for the challenge) - Eric Young wrote one - I wrote one More related softwares, specifications etc. - Piete Brookes, Andy Brown, and I wrote a protocol specification for a SMTP style key doler - SKSP (Simple Key Search Protocol) - draft RFC like document on brute (www url below). - Piete wrote a unix socket based key server and client for generic unix machines (in perl). - Andy Brown wrote a Windows NT client which talks the same protocol - David Byers did a MasPar port of the brutessl code > Perhaps a general-purpose OO bruteforcing library (addition to > Crypto++?) would be a good idea. Just pass a pointers to the > encrypt() and decrypt() functions to use for this session to the > Cracker object, which in turn takes a number of bits and starts > cracking.:) The socket based key distributer allows you to write clients which interact with the key server. Take a look at Andy's code. > The problem with this is the disparity among out-of-the-box encrypt > and decrypt functions. But I suppose it's nothing that couldn't be > overcome with wrapper functions. Just thinking out loud. :) Not sure how Andy addresses this in the NT code (I don't have NT), but for the unix client you'd just get another brute force program, compile it and update the client. Piete has a WWW URL for the software (the protocol spec is there too) at: http://www.brute.cl.cam.ac.uk/brute/ (Brute is a subsubdomain he set up for the purpose). Also this: ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ should work. And the socket server runs on: sksp.brute.cl.cam.ac.uk (port 19957). I think we're ready to start another challenge, this one a collaborative project like the brute rc4 one. Just need some challenges now (asked Hal about this). Adam

4 3

NSA leak magic
by Zooko Journeyman 17 Dec '03

17 Dec '03

A million monkeys operating under the pseudonym "Ian Goldberg" typed: > Uh-huh. Unless the Administration has granted a secret Executive Order > repealing the Laws of Physics for the NSA, the above statement, if true, > would imply one of the following things: > > 1. <snip> > 2. <snip> > 3. <snip> 4. It takes 33 minutes to view the satellite images, wiretaps, and TEMPEST recordings, and bribe, threaten, cajole or torture the subject's friends and business partners, and run the "stupid passphrase/weak random seed" cracker. I believe it. Z who is still trying to grok how the girl scouts figure in. "You're a thought criminal!"

1 0

SSL challenge and escrows
by fc＠all.net 17 Dec '03

17 Dec '03

I think a lot of people miss the distinction between automated message cracking and dumpster diving. Dumpster diving is not free. It costs at least a dollar each to get credit card slips by dumpster diving. Consider that in order to use the information, you have to get the slip, pull off the numbers, enter them into a computer (or even worse yet, create a phoney card or make a phone call) in order to use the information. The break-even point for an automated cracking and usage system is more than a dollar per stolen card. My parallel processor is actually more cost effective for crimilar theft via credit card fraud. What does this have to do with escrow? My escrow offer costs less than the cost of crimial attack. If it reduces attack, it is cost effective and should lower the overall cost of transaction processing. In fact, I have a friend who says he will escrow keys for free, but he is less trustworhty than I am, and I think he wants to get his dollar on the other side. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1

Perot and Scrap Cycles
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:31 AM 8/19/95, Michael Froomkin wrote: >Didn't Ross Perot make his fortune by running data processing tasks nights >and weekends on machines he leased to other people (all legal)? I hadn't heard this. And until I hear more details, I'm skeptical. (Trivia sidenote: I was in high school in 1970 and met Ross Perot at a shindig in Dallas--his wife picked me up at the airport and drove me to the hotel. He had just that spring lost a billion dollars in a single day, due to a glitch in EDS stock. A billion dollars in 1970 was a lot of money.) Now in 1970 EDS was indeed leasing lots of IBM mainframes to customers, and running them. Also, doing processing jobs. But how many IBM mainframes were idle at night? Not many. This was the day of multimillion dollar mainframes and programmers making $10,000 a year to keep them busy at all times. So, I doubt the machines were idle in the same way our workstations and PCs are largely idle (obviously, machines now cost less $2000-6000, and programmers make 10-20 times that...the tables have turned). I don't discount the possibilty that EDS made a deal on the lease rates. I haven't read up on EDS in this era. I just know that Perot wasn't using "scrap cycles" (to use Doug Barnes' term), because there probably weren't many of them. But I'd like to hear the details. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

House Committee Hearing on Money Laundering
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: jmuller(a)brobeck.com (John D. Muller) Mime-Version: 1.0 Precedence: Bulk Date: Sun, 27 Jul 1997 20:32:04 -0700 From: jmuller(a)brobeck.com (John D. Muller) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: House Committee Hearing on Money Laundering For those with a strong stomach for testimony on the need to strenghten money laundering laws and extend know-your-customer requirements to non-banks, material from last week's hearings on money laundering and the drug trade by the House Judiciary Committee's Subcommittee on Crime are now on-line at http://www.house.gov/judiciary/364.htm John Muller jmuller(a)brobeck.com ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0