December 2003 - cypherpunks-legacy

The trial of the century?
by Simon Spero 17 Dec '03

17 Dec '03

Any reports on todays outing to the Bernstein case? Any gifs of courtroom sketches to upload? Simon ----- Johnny Cochran - Sears spokesman: "If it doesn't fit, you can take it back and change it."

1 0

Lack of secrecy in U.S. Banks
by ph＠netcom.com 17 Dec '03

17 Dec '03

I ran across an interesting fragment of the U.S. Code. Apparently, the Federal Government may access any banking records whatsoever if the Director of the FBI (or the Director's designee) certify that the information is sought for "foreign intelligence purposes." Further, it is illegal for anybody to disclose that the records were turned over to the government, or even sought. I do not know the penalties for disclosure. The Attorney General appears to set guidelines for the dissemination of the information obtained through this law. Note that if banking privacy is violated for reasons which are not related to counter-intelligence operations, the victim is unlikely to be in a position to seek relief from the courts because the privacy violation is likely to remain secret. I've enclosed the law below. I'm not a lawyer, so it raises more questions than it answers. Perhaps the more skilled readers on the list will be able to deduce the implications. The U.S. Code is available at http://www.pls.com:8001/his/usc.html This particular law is available at the improbable URL: http://www.pls.com:8001/cgi-bin/taos_doc.pl?unix+0+uscode+17566+query+a+Gov… Here is the law itself: -CITE- 12 USC Sec. 3414 01/24/94 -EXPCITE- TITLE 12 - BANKS AND BANKING CHAPTER 35 - RIGHT TO FINANCIAL PRIVACY -HEAD- Sec. 3414. Special procedures -STATUTE- (a)(1) Nothing in this chapter (except sections 3415, 3417, 3418, and 3421 of this title) shall apply to the production and disclosure of financial records pursuant to requests from - (A) a Government authority authorized to conduct foreign counter- or foreign positive-intelligence activities for purposes of conducting such activities; or (B) the Secret Service for the purpose of conducting its protective functions (18 U.S.C. 3056; 3 U.S.C. 202, Public Law 90-331, as amended). (2) In the instances specified in paragraph (1), the Government authority shall submit to the financial institution the certificate required in section 3403(b) of this title signed by a supervisory official of a rank designated by the head of the Government authority. (3) No financial institution, or officer, employee, or agent of such institution, shall disclose to any person that a Government authority described in paragraph (1) has sought or obtained access to a customer's financial records. (4) The Government authority specified in paragraph (1) shall compile an annual tabulation of the occasions in which this section was used. (5)(A) Financial institutions, and officers, employees, and agents thereof, shall comply with a request for a customer's or entity's financial records made pursuant to this subsection by the Federal Bureau of Investigation when the Director of the Federal Bureau of Investigation (or the Director's designee) certifies in writing to the financial institution that such records are sought for foreign counterintelligence purposes and that there are specific and articulable facts giving reason to believe that the customer or entity whose records are sought is a foreign power or an agent of a foreign power as defined in section 1801 of title 50. (B) The Federal Bureau of Investigation may disseminate information obtained pursuant to this paragraph only as provided in guidelines approved by the Attorney General for foreign intelligence collection and foreign counterintelligence investigations conducted by the Federal Bureau of Investigation, and, with respect to dissemination to an agency of the United States, only if such information is clearly relevant to the authorized responsibilities of such agency. (C) On a semiannual basis the Attorney General shall fully inform the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate concerning all requests made pursuant to this paragraph. (D) No financial institution, or officer, employee, or agent of such institution, shall disclose to any person that the Federal Bureau of Investigation has sought or obtained access to a customer's or entity's financial records under this paragraph. (b)(1) Nothing in this chapter shall prohibit a Government authority from obtaining financial records from a financial institution if the Government authority determines that delay in obtaining access to such records would create imminent danger of - (A) physical injury to any person; (B) serious property damage; or (C) flight to avoid prosecution. (2) In the instances specified in paragraph (1), the Government shall submit to the financial institution the certificate required in section 3403(b) of this title signed by a supervisory official of a rank designated by the head of the Government authority. (3) Within five days of obtaining access to financial records under this subsection, the Government authority shall file with the appropriate court a signed, sworn statement of a supervisory official of a rank designated by the head of the Government authority setting forth the grounds for the emergency access. The Government authority shall thereafter comply with the notice provisions of section 3409(c) of this title. (4) The Government authority specified in paragraph (1) shall compile an annual tabulation of the occasions in which this section was used. -SOURCE- (Pub. L. 95-630, title XI, Sec. 1114, Nov. 10, 1978, 92 Stat. 3707; Pub. L. 97-320, title IV, Sec. 432(b), Oct. 15, 1982, 96 Stat. 1527; Pub. L. 99-569, title IV, Sec. 404, Oct. 27, 1986, 100 Stat. 3197.) -REFTEXT- REFERENCES IN TEXT Public Law 90-331, as amended, referred to in subsec. (a)(1)(B), is Pub. L. 90-331, June 6, 1968, 82 Stat. 170, as amended, which is set out as a note under section 3056 of Title 18, Crimes and Criminal Procedure. -MISC2- AMENDMENTS 1986 - Subsec. (a)(5). Pub. L. 99-569 added par. (5). 1982 - Subsec. (b)(2). Pub. L. 97-320 struck out ''of'' after ''financial institution''. -SECREF- SECTION REFERRED TO IN OTHER SECTIONS This section is referred to in sections 3402, 3409, 3421 of this title. __________________________________________________________________________

1 0

Article on Digital Cash in "Worth"
by tcmay＠got.net 17 Dec '03

17 Dec '03

I don't recall seeing mention of this, so here goes. The October 1995 issue of "Worth" magazine has a fairly long article about digital cash in several forms, and about David Chaum's Digicash in particular. It has a more detailed description of his Amsterdam operation, and his history, than I recall seeing anywhere else. While I'm on the subject of Chaum and Digicash, several recent posts here have commented about my dislike of Digicash's current approach, or about my criticisms of the current approach. Given the recent "piling on" aimed at Netscape (for various reasons I think are obvious--see Note), I don't want to be perceived as one of Digicash's leading critics. The fact is, I'm not in the business of trying to deploy any kind of digital cash, so I don't follow too closely the ins and outs of what various "digital money" systems are currently offering. I have some long-range interests in the societal implications of truly anonymous digital cash, and argue the issues frequently, but I avoid worrying overmuch about Mondex vs. First Virtual vs. QuickenCash vs. whatever. Note: About half of all posts to the CP list for the past several weeks have somehow involved Netscape. The attacks on Netscape have been impressive, but many of the posts have a "me too" flavor, sort of the way my smaller cat takes every opportunity to nip at my larger cat when the larger cat is in distress. The phrase "kicking them when they're down" comes to mind. Not that the issues aren't real, just that a lot of folks want to be the "next Goldberg and Wagners," or that they want to add their two cents about how Netscape is blowing it. I stay out of this, but I certainly don't want to see Digicash given the same treatment. Their current product may not be all that some of us desire (in terms of anonymity, for example), but it sure does beat the alternatives in essential ways. I don't want to see Netscape so trashed that people turn to lesser-tested alternatives without good reason (Microsoft Network being one example), and I don't want to see Digicash so trashed that people turn to some product like Mondex. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: textbooks
by Rich Salz 17 Dec '03

17 Dec '03

I have also heard good things about a book by Warwick Ford.

2 1

Re: 50 attacks on Netscape - please send the check
by Ray Cromwell 17 Dec '03

17 Dec '03

> > fc(a)all.net (Dr. Frederick B. Cohen) writes: > >50 Attacks: a.k.a. Why Not to Run Hot Java in your netscape (or other) browser: > > ... (drivel elided) > > This fellow seems to be systematically (if not deliberately) ignorant > about these things. I'm frequently seeing this same behavior by lots of people on this list and it's sad. There are people making claims about HotJava/Java that are obviously bogus if you even read the white paper, looked at the source code, or programmed a "Hello World" applet. The Java papers are an easy read. If you want to know about the implementation, read the source. At least criticize specifics about the implementation rather than speculating what they are and then proceeding to claim to have found a security hole in the implementation. I'm even more surprised when I see someone with a Phd acting like this. -Ray

2 1

M$ Windows 95 swap files, disk recovery & PGP
by Eric Anderson 17 Dec '03

17 Dec '03

Hi there, I read about this list in the Electronic Engineering Times, so I scored PGP as soon as I could. My ?? is this: When I create a document on M$ Word or XL and then PGP it, how could I eliminate the plaintext left in the swap file? Now, I understand the PGP -w command but that only wipes the original plaintext. My other ?? is if my disk is seized by the S.S. , how easy would it be for them to recover old plaintext messages? Thanks, Eric

1 0

No Subject
by owner-cypherpunks 17 Dec '03

17 Dec '03

1 0

ADMIN: Cypherpunks list meltdown, temporary delay in postings
by John Gilmore 17 Dec '03

17 Dec '03

Somebody started forwarding every new cypherpunks message BACK to the mailing list. Each such message would, of course, trigger yet another message back to the list, resulting in a runaway situation. My guess is that it's caused by a bug in a procmail script being run by one of three people at io.com. We're investigating. Meanwhile to break the loop I am manually screening cypherpunks messages, which will result in multi-hour delays before your posting is seen by the list (since I only look at new stuff every few hours). I've yanked the three suspect users, and can probably turn it all back on sometime on Saturday. If you have urgent messages to go out, cc them to me personally and I'll probably notice them sooner. By the way, Hugh and I will probably be upgrading our version of Sendmail within the next few weeks, so you can possibly expect some further funny behaviour while we test it. I hope it isn't nearly as funny as this last meltdown. Don't worry, I didn't really write this message. The NSA had a few glitches in their MITM impersonation of toad.com, and posting this to reassure you that everything is OK. :-) John

1 0

FidoNet Remailer
by Jim.Cannell＠f21.n216.z1.fidonet.org 17 Dec '03

17 Dec '03

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----BEGIN PGP SIGNED MESSAGE----- I have been a long time lurker on this list, as well as having a long time interest in crypto. Most of my activity in this area has been on FidoNet rather than the internet. Due to the control phreak nature of much of FidoNet, I've spent a lot of time and effort in an attempt to just simply route around the bastards. I created the SecureMail system, which is a network of FidoNet nodes that agree to route any and all traffic without monitoring or censorship. Within SecureMail, encrypted traffic is not only permitted, it is encouraged. Which brings me to the point of this message. I have written a anonymous remailer program for FidoNet. It is currently running on my FidoNet node in an alpha test mode. It has only been running a couple of weeks, and seems to be doing quite well. I have just added internet addressability to it. What this means is that now anonymous messages can be remailed between FidoNet and the internet. Having still another routing path should further decrease the traceability of these messages. I would like to ask the cypherpunks to help me test the remailer across the gateway. Please send many messages through this remailer from both the FidoNet and the internet side of the gateway. Try to break it. I want a good reliable piece of software, and if it can survive attempts by this group to break it, there will be a lot more confidence in it. Following are instructions for using the FidoNet remailer: - From FidoNet, send your message to Remail at 1:216/21. From the internet, send your message to: remail(a)f21.n216.z1.fidonet.org In all cases, the first text line of the message must contain a double colon. The second line contains the remail command, and the third line is blank. The actual text to be remailes starts on line 4. To send a message to Joe Sixpack at FidoNet address 1:102/903, enter: :: remail-to: Joe Sixpack @ 1:102/903. To send a message to an internet address, enter: :: remail-to: tcmay(a)got.net (Sorry, Tim -- couldn't resist using you as an example :-) To get a short help file, enter: :: help To post a message to the FidoNet SYSOP Echo, enter: :: remail-to: SYSOP I'll welcome discussions of this remailer on the list, or in private mail. Bug reports and/or comments are encouraged. I can be reached at Jim.Cannell(a)f21.n216.z1.fidonet.org BTW, I will be at the cypherpunks meeting in Anguilla next week. Hope to meet some of you there. Jim - International SecureMail Host (ISMH) PGP key 1024/B7822B3D fingerprint = 0F F4 79 06 3B 33 99 D1 07 36 66 66 80 85 76 B3 Protect your right to privacy. Say no to GAK. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIg6pSWTIMO3gis9AQEKLQP/TVodxgTJiik3KQK1C8QgSp/O3wzdxi+P eC2flE6qgtlmwh6X4vbBNTmj4bKAfGLgbJyvdcMAZCESYab1dxO8q1lwOAnayW8d qoSRhL+zT0KepmV5FXyLscq+SbzgxKoX3gkWgHlhrhHbmycr3rFGLKz6ZsoR/xmb WX16LX2JVFk= =vBaR -----END PGP SIGNATURE-----

1 0

Sun speaks out - but not to the cypherpunks
by fc＠all.net 17 Dec '03

17 Dec '03

This response came from Sun to Risks: > Date: Mon, 16 Oct 1995 21:22:40 -0700 > From: Caveh.Jalali(a)eng.sun.com (Caveh Jalali) > Subject: Re: Risks in Java > > If we are going to "analyze" java security, let's keep in mind that there is > an important distinction between the language (java) and the machinery which > runs the java program. > > Java is a general-purpose programming language along the lines of C/C++. > So, there is no doubt that its expressive power overwhelms our > theoretician's abilities to predict java-programs behavior -- this is where > we start getting into the halting problem, computability and other black > magic. Basically, i don't think we can "trust" programs written in any > *useful* programming language. Read: We can't trust Java programs. > The area where we can (must) build trust is the computing base. > Traditionally, this has been the OS, but in the case of java, it is the java > interpreter (such as netscape 2.0 and hotjava). The browser is now the TCB > (trusted computer base) for all practical purposes... Read: The Java interpreter is supposed to be a TCB > And, to address the specific concern about applets spamming the net -- from > what I've seen, applets are only allowed to connect to the server that > supplied the applet in the first place (by default). The worst thing one > could probably pull off is to spam oneself. Read: By default only - also note, none of this invalidates attacks 30-49 from the previously posted list. Who here truly believes that the implementations of Java meet the requirements of a TCB? -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0