December 2003 - cypherpunks-legacy

Is this as insecure as it sounds (was FWD: Complete Fax Privacy Draws C
by abostick＠netcom.com 17 Dec '03

17 Dec '03

This turned up on alt.anonymous. One would need a technical specification or a working model to be sure, but it sounds like home-grown snake oil to me. My guess is that a nineteenth-century cryptanalyst could crack this, and that the TLAs would have a field day. What do other people think? > > Complete Fax Privacy Draws Closer > > > Individuals receiving faxes, be they of a business or > personal nature, will soon be able to encrypt the contents and > make them unreadable to people for whom the messages are not > intended. > The new fax encryption technology has been developed by the > University of Rochester in New York. The encryption program > would make all faxes unreadable to the naked eye. Only by > placing a customized transparent plastic sheet over the message > could it be made readable. Each individual, employee or manager > would be issued with his own plastic sheet and encryption key > ensuring messages are only read by those specified in the message > itself. The encryption software would not slow the transmission > and reception of fax messages and the cost of installing the > system on to existing machines would be minimal. > Such software would be indispensable to those whose > activities require the utmost confidentiality or privacy. Nosy > employees, rivals, those providing faxing services and anybody > else who has, until now, had a birds eye view of your fax > communications could be successfully abolished from the security > equation. > Though the software has yet to be refined into a marketable > commodity, it is set to be introduced for public consumption in > the very near future. > > > Adam Starchild > Asset Protection & Becoming Judgement Proof at > http://www.catalog.com/corner/taxhaven > > -- Alan Bostick | SWINDON: What will history say? Seeking opportunity to | BURGOYNE: History, sir, will tell lies as usual. develop multimedia content. | George Bernard Shaw, THE DEVIL'S DISCIPLE Finger abostick(a)netcom.com for more info and PGP public key

3 2

throwaway
by an201465＠anon.penet.fi 17 Dec '03

17 Dec '03

[from: WEIRDNUZ.410 (News of the Weird, Dec 15, 1995 by Chuck Shepherd)] LEAD STORY * A 62-year-old woman pleaded guilty in Roanoke, Va., in November to stealing about 500 pieces of mail from her neighbors' mailboxes--her third such offense in five years. She had been found sane and competent for trial but nonetheless diagnosed as having an "irresistible impulse" to steal other people's mail. The judge had kept her confined to her home since her arrest, allowing her full freedom only on Sundays, when there is no mail delivery. [Roanoke Times, 11-21-95] --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

first germany, now china
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

BEIJING (AP) _ China is planning measures to stop obscene or harmful material from entering the country via the Internet, its official news agency reported Sunday. The Communist Party and the State Council, China's cabinet, recently ordered such measures after learning that ``pornographic and detrimental information'' had been disseminated electronically in China, the Xinhua News Agency said. The report said China intended to use the Internet to promote the exchange and transfer of technology and scientific information, while at the same time blocking what it sees as negative influences. It did not provide further details.

1 0

Re: Is this as insecure... (really "Fax crypto")
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Shamir did a talk on fax crypto in May, 1994. There is no reason that this can't be completely secure, the overlays could be one-time pads. Bill Sommerfeld posted a description of the technique to the list after he went to a presentation on the technique, I'll forward it to anybody that needs a copy. Using the same overlay multiple times, though, would make it completely insecure. I can't believe that they are recommending that that could be a possibility. thad -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

Re: Australian "calculatorcard"
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: vin(a)shore.net (Vin McLellan) > Could be one of seven or 8 vendors of so-called "challenge/response" tokens or calculators. Most of those sold in the US and Australia use straight DES (and a token-specific key) to encrypt the "random" challenge number in the token -- but it could be any secret-key algorithm. ----------- This is actually something cryptographic which I know a bit about, so I'll tell you what I know. I had a suitemate a bit back who was working for a local high-tech company as a computer programmer. He used a system somewhat like this, but with some interesting permutations. The main difference was that it didn't use one algorithm. It used quite a few, determined by a hashing of the challenge code. There were a considerable number of challenge codes with distinct hash results that were never used. If the card got too many of those (or too many wrong PINs), it switched to an entirely different set of hashings and encryptions, all of which would warn the server (thanks to their turning out something different in a hash function on the server) that the card had been compromised. I suspect it would also wipe a EEPROM that was storing the valid hash function and algorithms, but he wasn't sure about that. It was all sealed in a plastic block to make sure it was physically hard to reverse-engineer, anyway. -Allen

1 0

US calls for measures against Internet porn
by nobody＠tjava.com 17 Dec '03

17 Dec '03

Apologies if you've seen this before: WASHINGTON DC (Reuter) - The US called Sunday for improved management of the Internet to prevent people seeing pornographic material on the world computer network. A joint statement from the Clinton administration's State Council (Cabinet) and the office of the Republican Party's Planning Committee said there were increasing links between domestic computer systems and the Internet. ``Good use of the Internet is of great importance to increase global information exchanges, promote economic construction and develop science,'' the Associated Press quoted the statement as saying. But because of weak management and lack of control over what enters the Internet, some pornographic and other harmful materials have come onto the system, it said. ``We must take effective measures to deal with this,'' it said. German prosecutors said Friday they had launched an investigation into the U.S.-based online service CompuServe Inc on suspicion that members had sent child pornography over its worldwide computer network. The inquiry prompted the service to block access to 200 sexually-explicit Internet discussion groups and sites where pornographic pictures are available. An explosion in use and ownership of modems in the US is giving an increasingly large number of people access to the Internet. [The amazing thing is how _little_ editing was necessary.]

2 1

Starting an e-cash bank
by Ryan Lackey 17 Dec '03

17 Dec '03

_Money_ is at the root of control of cyberspace. If states control the banks issuing the currency, states will control cyberspace. If the banks/issuers of coins are beyond the reach of statist governments, cyberspace will remain free. Crytpo of course will allow the banks to issue coins, but if they have to follow statist laws, crypto won't really help them all that much -- I don't know many bank execs willing to face down the US Government with nothing to back them up but ~unbreakable codes. What would it take to start an anonymous, private, secure, etc. etc. bank issuing e-cash, located in a country without taxes/etc.? I assume a tax haven like the Cayman Islands or a small third world country somewhere would have plenty of nice tax-shelter banks interested in such a venture. Of course, it would be quite illegal to transfer money to such a bank, but once it's there, wouldn't coins be perfectly legitimate currency? The bank could even make money by issuing coins for $US held in vaults, $US invested in different mutual-fund type things or other currencies, and perhaps even coins backed only by the bank's profits (sounds like stock). A cypherpunk? me?, Ryan <ryan(a)pobox.com>

5 4

Ah, the future...
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 12 31 95 Associated Press reports: Ah, the future ... At least part of what will happen in the coming year seems clear. Cyberspace will be regulated -- kicking and screaming -- and the court battles over free speech will begin. "It's going to throw the Internet into a state of uncertainty for several years," said [Bob] Smith [of Interactive Services Association]. You may recall the question I asked in an earlier message: And when the State DECIDES...? But that's all right... Despite that, business growth on the net will begin to catch up with the phenomenal increase in accounts. Cordially, Jim NOTE. The newsstory's headline? YEAR OF THE INTERNET: What a tangled web we weave. Its dateline? (Dec 31, 1995 - 00:23 EST). Accessed at? Nando News (www.nando.net) Online filename? info306_3.html That message? Date: Wed, 22 Nov 1995 04:16:50 -0500 (EST) From: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> To: cypherpunks(a)toad.com Subject: Secrets of the Internet This critical essay, "Ah, the future..." was composed 12 31 95.

1 0

A great time to be a cypherpunk
by Raph Levien 17 Dec '03

17 Dec '03

Amidst all the silliness, flames, and lunacy of this list, there's a tremendous amount of exciting stuff going on. I thought I'd take the opportunity to do one of those self-indulgent look back at the year postings. Cypherpunks write code. One of the best things about 1995 was the volume and quality of cpunk code that was released, and, perhaps equally importantly, existing cpunk programs that continue to be supported and improved. Here's a subjective top 5 list: 1. SSLeay, by Eric Young and Tim Hudson. Ordinarily, I wouldn't consider a crypto library to be all that newsworthy, but SSLeay is clearly an exception. SSLeay's real strength is its ability to be integrated easily into real applications, including Apache/SSL, Mosaic, telnet, etc. I'll go out on a limb and guess that one of the reasons why SSLeay is so good is that Eric has a lot of experience doing this kind of thing. His libdes code dates back at least to 1990, and (I think) even further. 2. Ssh, by Tatu Ylonen. There are a quite a few secure shells around. What sets ssh apart is its dedication to usability. It is one of the few crypto applications that is _more_ usable than the non-crypto version. The transparent X forwarding is fabulous. 3. Mixmaster, by Lance Cottrell. Finally, we have remailers that come close to real cryptographic security. The mixmasters are more reliable, in addition to more secure, than the type-1 remailers. The client is well written with a fairly easy interface. No wonder it's becoming so popular. 4. Alpha.c2.org, by Matt Ghio. The idea of pseudonyms incorporating strong cryptography has long been a cypherpunk dream. Thanks to Matt's work in writing and maintaining this nymserver, it's now reality. There are well over a thousand nyms registered on alpha.c2.org now, and that's likely to increase now that automated tools are becoming available. 5. Netscape, by Jeff Weinstein et al. Netscape Navigator is the first massively popular program to incorporate strong crypto. The email hasn't materialized yet, and there have been some scary statements by top management, but I'm hopeful that this program will become the primary vehicle for acheiving cypherpunk goals. Code, while important, is not the only useful cypherpunk activity. It's also been a great year for getting the word out there. The Net was _the_ hot story this year, and a lot of the coverage had a cypherpunk spin. Much of the credit goes to Sameer Parekh for his PR work. I know some cypherpunks dislike the "interview yourself" style of press release writing, but I'm very glad that we've got someone on our side who's good at it and is willing to put in the work. More broadly, we've found that our viewpoint and opinion matters. People are at a loss for how to think about the Net and its social implications. We've been thinking about that for a while, and have something to add to the discussion, and people are listening. 1995 will surely go down in history as the year that The Great Drive to Censor the Net began. The powers that be will continue pushing ahead with laws restricting speech, increasing liability for speech, and outlawing strong crypto. A short term effect will be to create some real differentiation between service providers. Up to now, the difference between one service provider and another has been an equation with bits on one side and dollars on the other. Starting soon, it will make a difference in what information can be easily accessed. A domain name of compuserve.com now clearly labels its account holder as a free speech inactivist. More cypherpunkish domain names are a sign of not being afraid of information. Over the long term, I agree with Lucky. The powers that be will have some success in censoring the Unwashed Massnet. However, cypherpunks will be able to create an infrastructure where freedom of speech thrives. A large part of this work is the development of censor-resistant protocols. My favorite such protocol is NNTP, even though it contains no crypto. HTTP is also a bit censor-resistant because it's so easy to set up a Web server. However, it still has grave weaknesses from this perspective, because of the need for a full time Internet connection _and_ storage in order to publish on the Web. The Web can become either more centralized or more decentralized, and there are strong forces pushing in both directions. I think the best hope for a cypherpunk Web is to emphasize dual-use techniques, those that advance mundane as well as cpunk goals. For example, distributed caching will make transfers go faster and make "unable to connect to server; try connecting again later" errors much less frequent. If done right, it can also make part-time Web servers feasible, and perhaps make it extremely difficult to delete documents that the publisher didn't want deleted (can anyone say "cryptographic authentication?"). Similarly, the same crypto-enabled filters that keep spam out of Joe Random's mailbox can drive a real public key infrastructure (Web relevance: the Web is the natural home for a pubkey infrastructure. Let's make sure to be there for the housewarming party). The way that the low-tech protocols of the Web have crushed and assimilated corporate Weblike networks is inspiring - it holds out real hope we can win, even against opponents as dedicated and powerful as governments. It will take hard work, tenacity, cooperation, and technical sophistication, though. Remember that Windows took about seven years to become successful. For dud of the year, I'd have to nominate Java. Don't get me wrong, this language shows a lot of potential. But, to a large extent, they've done the easy part, and the hard part remains. Given its existing security model, it's difficult or impossible to do anything really interesting with Java. Yet, fixing the security model _is_ the hard part. Best of luck to the Java people and all javapunks, but I think a strong case can be made that the hype machine went overboard. To all the cypherpunks who helped make 1995 such an exciting year, best holiday greetings and wishes for 1996. Raph

2 1

Re: Massey, CEO of Compuserve, on Internet
by Steve14571＠aol.com 17 Dec '03

17 Dec '03

In a message dated 95-12-30 21:34:12 EST, accessnt(a)ozemail.com.au (Mark Neely) wrote: I assume that C$ is only filtering the newsfeed as it hits German shores? Please tell me they aren't denying access to these "banned" newsgroups for all users worldwide! This is exactly what they are doing, Mr. Neely. I am not familiar with CompuServe, as I have never used it. However, based on my understanding of how Usenet operates, it would be possible to write software and incorporate it into CompuServe software that would block German readers from the "obscene" newsgroups. CompuServe would rather score points with the mostly ignorant general public by saying that they are becoming more "family-oriented." I get my access through America Online, and I am afraid that these monolith online services (AOL, Delphi, Prodigy) will follow C$'s lead so they may also say they are "family-oriented." I will no longer send mail to addresses that end with "compuserve.com." If AOL decides to become family oriented, I will look for other ways to connect to the net.

2 1