December 2003 - cypherpunks-legacy

Software vs Money Laundering
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:48 AM 9/13/95 -0400, John Young wrote: > Can artificial intelligence be used to combat crime by > ferreting out money laundering? Officials at law > enforcement, defense and intelligence agencies like to > think so. They have suggested creating a sophisticated > computer program to screen records of the more than > 700,000 electronic money transfers involving U.S. > institutions each day and to flag suspicious ones for > further investigation. By using AI, they hope to stop > some of the $300 billion in profits from drug deals and > other illegal activities that they estimate is laundered > world-wide each year. But in a report issued yesterday, > the congressional Office of Technology Assessment says > any such plan would face considerable obstacles. > [Cyberian Joel Reidenberg, an OTA advisor, is quoted.] > Not the least of which is that money launderers can use "AI Software" to generate a stream of real and dummy money transfers that emulates "normal" money transfers. Not to mention the fact that monopoly money transfer networks that can be surveilled by the Feds (FEDWIRE and SWIFT) are not long for this world. They will be replaced by encrypted, open, net-based systems. DCF "Yes Virginia, one *can* have an encrypted, open system. In fact, that's the best way to have an open system."

2 1

Re: GAK/weak crypto rationale?
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Brain Davis writes: [...snip...] > Particularly effective were the court-approved video and audio > tapes of the Speaker taking a bribe in exchange for certain action > on legislation [...snip...] > Wiretaps, hidden microphones, and hidden cameras put corrupt > politicians (I know - redundant) out of business. Encryption does little to protect you from hidden cameras and microphones (or informants!). If you already know your target then you can probably get around encryption (sure it's not as simple as a wiretap, but hey, nobody said it had to be easy). Encryption prevents 'fishing expeditions' and unauthorized monitoring; this is what the LEAs don't want to admit. andrew

1 0

Can GAK be made "not interoperable" with PGP?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:34 PM 9/13/95, Hal wrote: >I think this is setting up the rationale for software key escrow. One of >the big loopholes in this idea has always been that it would be easy for >bad guys to superencrypt or otherwise bypass the legal encryption. The >response has been that the systems will be designed so that compliant >systems will not interoperate with rogue systems. And the counter-response ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >to that was that criminals (and privacy advocates) would use software >which would operate compliantly with conventional programs and maintain >privacy when talking to other rogue programs. But is this even possible, to make a GAK system "not interoperable" with, say, PGP? Unless the GAK system has some sort of entropy analyzer, and can recognize high-entropy sources which it presumes to be encrypted data (*), one can of course PGP-encrypt a text file and then GAK the resulting file. Many of us are already using PGP mostly in this way, i.e., writing files in text editors, PGP-encryting and getting an ASCII file back, and then sending. GAK will still have to deal with this mode. (* On the idea of entropy analyzers. This is implausible, for many reasons. Any high-entropy file could have the entropy reduced by padding with low-entropy sources. And there would be "false positives." Some ostensibly plaintext posts are so incoherent (;-}) they might be "rejected" by such a GAKalyzer.) So, is any conceivable GAK escrow system possible that cannot be used with other crypto programs? Text is text, unless the GAK program purports to accept or reject the text based on entropy considerations. And I can't imagine that part of the GAK program would be robust against hacking. >This new line will be used to respond to this argument, I think. Even if >it is admitted that there is no way for the government to be able to tell >what the criminals say amongst themselves, it will still be useful to be >able to tell what they say to other people. Therefore software key >escrow will be argued to still be useful even though it can be defeated. But such traffic analyis is made moot by remailers, as we all know. What I think we may be facing, if the folks pushing GAK are really serious about all this, are restrictions on *who we may mail to*!!! For if Alice is "allowed" to send a message, GAKked or not, to a remailer.... (I can speculate about laws saying only "internationally registered" sites can use e-mail, but this seems impractical in the extreme...lots of issues.) The GAK advocates need to realize that superencryption will be as easy as it is today to use PGP, and that even traffic analysis will be defeated if remailers are used. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Scientology tries to break PGP - and
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Henry W. Farkas <hfarkas(a)ims.advantis.com> writes: >On Tue, 12 Sep 1995, S. Keeling wrote: > >> I would just like to point out that, when a LEA comes to you >> to get at the contents of your computer, (s)he is not going to >> patiently wait while your system wipes the offending evidence off your >> hard disk. ... >> they can work from the copy. Besides, you do have backup tapes laying >> around all over the place, don't you? > >They have to decrypt the file sometime if they want it's "contents". > >I use the -w option when encrypting. After encryption, the "dummy" file >(would be) embedded and the plaintext is wiped. ... And the idea is that on decrypting with the 'wrong' key, it outputs the dummy file rather than the real plaintext, correct? > ... Don't back up plaintext and what is the problem here? >Where will they get the "real" data from? What does it matter where the >decryption takes place? ... Why would they use your copy of the program to decrypt the file? They could just use a version that lacked this 'feature'. Of course, they still couldn't get at the real plaintext unless you gave them the key, but you are right back to the same old standoff where they say, "Give us your key," and you (try to) say, "No." -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

4 3

An opportunity not to be missed
by David C. Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It has occurred to me with the approach of the presidential campaign in the US (and its attendant press frenzy), that there is an an unprecedentedly vast opportunity to bring certain items on the cypherpunk platform into the public spotlight. There are two planks of this platform that I believe: 1. would benefit from this exposure; 2. would be relatively easy to inoculate among the press and/or the candidates (actually, inoculation of the candidates, with subsequent propagation by the rabid campaign press). The first of these has to do with net.censorship, and formal recognition under law of ISPs' common carrier status. The second concerns remailers. I'll deal with each in turn. I believe that, given the hunger of the candidates for as much exposure as possible, that one of them might be persuaded to take a part in the Scientology fracas. (This would have to happen fairly soon, since it looks like the Church <spit> is losing some major battles lately - the brand new news from Denver re:FACTnet and the ruling in VA concerning Arnie Lerma and the Washington Post). The desirable features of such a candidate might include: a certain amount of current power, marginal current press exposure, fairly deep pocketed financing, an anti- regulatory stance, and a smidgeon of net awareness. It should be fairly straightforward to convince such a candidate that: 1. there would be tremendous increase in exposure due to the songs of praise from netizens (whose influence is most likely to be overly discounted by campaign strategists, IMHO, at this point in time), and from the mainstream press (especially Time magazine and the Washington Post, for obvious reasons). 2. that the exposure would be worth the peril of inviting the wrath of the Church <spit>. The payback of the press coverage of such a candidate would be infection of John Q. Public with the idea that ISPs are no more responsible for content of carried messages than the phone company, and an anti-censorship stance that does not make him (John Q.) pro-porn. This last is a huge flaw in the current battle for free speech on the net, IMO. (Thank you Marty Rimm.) If this issue could be refocused, I think that John Q. (and Jane) would find it much easier to support. The second plank that could be potentially advanced is anonymity. Anonymous remailers in particular, but the benefits of anonymity to users of the Net in general as well. I propose that we get some likely candidate (actually, a similar candidate to the one above) to advocate the benefits of anonymity on the net. The "spin" that would have to be used would depend on the particular candidate, but let's for example we have: Candidate Posturing Required Spin ----------------------------------------------------------------- Pro-business, tough on crime anonymous crime tip e-mail a la Fed whistleblower stuff, and the SPA Pro-choice, womens' vote anonymous support services Of course, there are many more examples, but we'd have to see which postures this campaign's candidates are going to pick. Of course, I am somewhat cynical in my advocation of the particular "Required Spins" (the SPA support, especially), but I feel that the threats to privacy and public use of strong encryption (which walks hand in hand with the use of the remailers, naturally) are worth the potential risk on other fronts (the burgeoning software patent silliness, eg). You may ask why these candidates would be interested in this type of thing, and my response is that they can be forced. The religious right has no problem bringing their agenda into the public spotlight and forcing their issues onto candidates because of their willingness to use hyperbole and fanaticism (not to mention pressure on advertisers and other sponsors). I believe that netizens in general, and cypherpunks in particular can bring similar, and more reasoned, pressure to bear. I think that our job is easier than the religious right because it should be trivial to enlist the support of the mainstream press on these issues, and to direct the anti-federal ire that has been building in the US. In addition, Democratic candidates that are currently in office would love to have some way of attacking the Republican plans for this session of Congress. An attack on net.censorship via the CDA and the telecomm bill could be seen as the ideal place to attack the Republican agenda, and thereby the success of Republican candidates in the presidential race. <whew.> Let the flames begin. - - David C. Lambert dcl(a)panix.com (finger for public key) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFcB+qpplsfgM88VAQFdewP9G0aHVTweUeCMa7J7Xhtu2R4cID6yP/J3 7WS5OicRWfl/hPRXj1Db74A9tDrkStEfobbL/2H6CsO9N4wZNgcDLQAa5MjX8ujf 0EF6v57nlcANb1qLJ5kmwfGj96PUMDtw00409tin3KssRAL0uz/lL9SWP/Mhj9q5 emZHYW3VC3c= =bTsO -----END PGP SIGNATURE-----

2 1

Re: Whitehouse "dissident" web site monitoring?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:03 PM 9/12/95 -0400, Brian Davis wrote: >Unbelievable!!! To add to this distressing truth, I have learned that >the White House also subscribes to a number of newspapers and periodicals >which are reviewed for things of interest to the Administration and to >the President. I I I I I I ammmmmmmmmm shocked! The government, as you no doubt know, sometimes operates under different rules. Thus when the "Red Squad" (Intelligence Division) of the New York City Police (located in that big building on the North side of Vandam between Greenwich and Houston BTW) was sued for maintaining files on "lawful protest groups" they entered into a consent agreement to refrain from this sort of thing. Later, the courts said that this agreement meant that the cops couldn't even listen to WLIB radio (NYC's favorite radical African-American station) to find out in advance where rallies were going to be. Since the White House is doing this reading of sites with public funds and since that institution is the most powerful in the world --- it can nuke its enemies, for example --- people are naturally interested to discover if they are the subject of an investigation. This is a demonstration of the unintended effect of electronic surveillance technology. The fact is that it can do more harm to the authorities than to the public. The Nixon Tapes/The Thompson Square Park Riot Video/The Rodney King Video. Since those in power are more interesting than ordinary people, they represent a more "target-rich environment." Information about their activities has greater commercial value and is thus more likely to see the light of day. DCF "There are more of us than there are of you."

2 1

Re: Mixmaster posting poll
by loki＠obscura.com 17 Dec '03

17 Dec '03

I think that I am not being clear enough about what I want to do. Back when I started running remailers, I was using a machine with no local news software at all. Rather than compile a bunch of software just to allow the "Anon-Post-To:" command to work, I hacked the scripts to automatically send those messages to a mail2news gateway. Mixmaster now has a similar built in anonymous posting ability. If you have inews on your machine, then Mixmaster can build the "Newsgroups:" header and send the message to inews. But what if you are running Mixmaster and you don't have inews but you want to support posting? The answer is to have Mixmaster put together a message to send to a mail2news gateway for it to post. When I look at the currently available public mail2news gateways, I see that two standards already exist. The first is the group.name@gateway. The other is mail2news@gateway with a "Newsgroups:" header. It is easy for me to have mixmaster take the request for anonymous posting, and build the appropriate message for whichever kind of gateway I want to use. I only want to support one of them. The question is, which one should I support? Which are there more of. Which are there likely to be more of in the future. I seem to recall that someone on this list wrote some mail2news software, Who was it and which standard did it follow (if either). Has anyone installed it? Is anyone else planning to install it. I will install a gateway when I get my T1 (in a couple of months). -Lance At 8:35 AM 9/13/95, Rich Salz wrote: >> If the form alt.usenet.group(a)remailer.com was used, wouldn't the >> system running the remailer have to have an alias defined for each and >> every newsgroup that it plans on handling? > >No. Sites running sendmail, for example, could set up rules that >just knew the top-level hierarchies and fed those into a special >"mailer" that gatewayed them. > >My opinion is that making any names well-known is a bad idea, and >that attaching special semantics to "mail2news@xxx" is a real bad >idea. Instead, just send the message to the specified recipient >and let do whatever magic needs to be done. > >If mixmaster wants to function as a mail/news gateway, it should >do something special when it sees the Newsgroups header -- process >the message and feed it into rnews, presumably. > >I guess, but not yet having read the code do not know, that this is >cleaner and more easily extensible (or removable). > /r$ ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Can GAK be made "not interoperable" with PGP?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:26 AM 9/13/95 -0700, Timothy C. May wrote: >But is this even possible, to make a GAK system "not interoperable" with, >say, PGP? > >Unless the GAK system has some sort of entropy analyzer, and can recognize >high-entropy sources which it presumes to be encrypted data (*), one can of >course PGP-encrypt a text file and then GAK the resulting file. I took it to mean that they were saying that an approved program on one end of a communication exchange could not exchange encrypted messages or established an encrypted session of some kind with an un approved program on the other end. Not trying to outlaw superencryption (PGP on both ends using a GAKed channel) but GAK on one end working with an unapproved system on the other end. A ringer GAK-work-alike that would defeat the intent of GAK. I don't know if the government can prevent that with a software-only system or indeed if half a secure system can be made completely secure. DCF "Markets and open systems beat governments and closed systems."

1 0

Corporate Use of Anon WWW Proxies
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

[I pulled this from the firewalls list (use majordomo(a)greatcircle.com to join)] Alex Eveleigh <Alex.Eveleigh(a)kellogg.com> writes: > Subject: Monitoring Activity on the Internet [...] > I would like to get some opinions on how easy it would be for someone > to monitor what information is being accessed on the Internet by our > company. For example how easy would it be for our competition monitor > all sites that people in our company are accessing and what > information we are pulling off the Internet. This struck me as rather ironic in the wake of The Govt. Could Be Reading _Your_ Home Page. It also sparked me to draw the short connection between industrial espionage (and simple industrial nosiness), and anonymous Web proxies. An obvious point, really, but companies often have an interest in concealing the nature/extent of their Web crawlings, too. Perhaps there's a market niche, or a few pro-anonymity publicity points, here for someone. -Futplex <futplex(a)pseudonym.com> "Everybody's got something to hide except for me and my monkey" -J.L. & P.McC.

1 0

Minor Risk to LSB Steganography
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Last week I attended a lecture given by Dexter Kozen at Cornell, on "Efficient Algorithms for Optimal Transmission of Video Data". He mentioned in passing a couple of approaches to choosing data that may acceptably be lost in the process (i.e. without excessive picture quality degradation). One scheme (which I believe counts as a "corona method") involves simply discarding the LSBs of all the encoded pixels or whatnot. This method was not at all a focus of the talk. Anyway, I thought I'd mention it as another minor potential threat to the use of LSB steganography in video transmission, e.g. MPEG streams. -Futplex <futplex(a)pseudonym.com>

1 0