December 2003 - cypherpunks-legacy

Re: COE Recommendation No. R (95) 13
by smithmi＠dev.prodigy.com 17 Dec '03

17 Dec '03

> >>Forgive me if this point has already been raised, but couldn't an >>objection to such laws be based on the protection against >>self-incrimination? > >There is no such right in most (if not all) european countries. In >France there is not even the presumption of innocence. [Further depressing news deleted] Yes, this was my understanding. I guess the point I was groping toward was that while we could hardly expect that our rights vis-a-vis electronic privacy would be any _better_ than our rights in obviously analogous non-electronic areas, they might well be worse; it's important to be clear, and to make clear, that what rights we have left have obvious extensions to our net.activities, and try to prevent the thin end of the wedge from being inserted in our portion of the perimeter. Of course, this only applies to the set of people who live in countries where people _have_ any rights, and as Phill implies, that may soon be the null set. --Michael Smith smithmi(a)dev.prodigy.com

3 2

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Wed, 15 Nov 1995, Howard Melman wrote: > Vladimir Z. Nuri wrote: > > attempts to get secure credit card number transfer on the internet are > > not an end in themselves. they are the first steps toward an entirely > > new transaction system. those who see a single step and criticize it > > as feeble in the context of past systems are missing the point and > > apparently can't think past the present nanosecond of their lives. My grandfather used to say, that the first horse to break from the gate, isn't necessarily the first to cross the finish line. Often, he'll be pulling up the rear. > You'll have a hard convincing folks that they need something > better than what works perfectly well today. In my humble opinion, the present system can't really be characterized as "working perfectly well". Far from it. While not as familiar with the US system as the Canadian, I can give as a simple example, the bank clearing system for paper checks. In Canada, we can clear a check from one side of the country to the other overnight. We have 24 hour clearing. While this is far from "perfect", our existing paper systems allow for a degree of efficiency which I don't believe is engineered into the US clearing system. Perhaps someone can correct me, if I have erred but I think it takes far longer than 24 hours to clear a check drawn on any US bank, and deposited to any other bank's credit in the United States. It may work "functionally" ... but certainly far from "perfectly" nor "efficiently". > Here's another point that I didn't see in your list. Today it might be > just as safe to send your CC# over the internet as giving it to a clerk, > etc. This is mostly because the number of CC#'s sent over the net vs > the whole traffic is small. It is therefore not very cost effective to > try to steal credit card numbers over the net vs other means (searching > through dumpsters, taping a phone line near LL Bean, etc.). A very good point. But then, dumpster-diving attacks could be moderated by simply implementing carbonless forms. No carbon, reduces a lot of the risks. It's basic risk management. All of this becomes a part of the cost/benefit analysis, and is part of the function of security policy. It's very much like all the talk on another thread on this list about Java security. There is no point in even discussing Java security in Netscape, when Netscape PRESENTLY has existing security holes written into the very fabric of the existing installed codebase. Holes which Netscape and AT&T refuse to address, correct or even comment on. Sun's security approach misses the point. Putting dead-bolts on houses while leaving all of the windows open, just doesn't address the problem. It really misses the mark. > If CC# purchases became common over the net, it would become much more > valuable to try to steal them from the net and more people would. It > would then become much less secure, not for any technical reason but > because there will be more crooks exploiting the existing flaws. This is also unfortunately true. Information on how to "break" a system does propagate. As more people know how to exploit a system, or as more people learn how to utilize the "letter of the rules" (the "code") rather than the "spirit" (the "intent") the degree of exploitation grows. Ask any executive in the Gaming Industry about this. Black-Jack card-counting went through an evolution in exactly this fashion. Many casinos lost a veritable "fortune" to good card counters. They lost to organized "teams" of card counters. Counters who literally broke the bank. Systems always have exploitable features. And new systems will always present new opportunities for exploitation. A completely new set of risks which are additive to those already in place, even those which may not yet be in a state of active exploitation. A pertinent network example: credit card numbers. Credit card numbers are not just a set of random digits. Only particular patterns of numbers can be valid. This existing "security provision" -- check digits -- actually ends up opening a security hole when we look at transmitting credit card numbers via the Internet. The security feature on one side of the ledger makes it far easier to differentiate between what is a random set of numbers, and what is in fact a valid CC number. Simple pattern analysis allows to search for valid numbers. It makes the potential "crooks" job much easier and its already engineered into the system. The "credit card number" risk though is accidental, while the Netscape Navigator risk isn't accidental at all, it's willful. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Thu, 16 Nov 1995, Vladimir Z. Nuri wrote: > but one distinction I do realize has to be made in all this is the > difference between "fraud" and "breaking a system". the latter is > a far more potentially serious problem with cryptographic security than > the former. in fact cryptographic security attempts to deal with all > fraud by making "breaking the system" impossible, and succeeds to the > degree it accomplishes this. I think this is extremely important to consider. The functions which define relationships between large numbers of variables, (such as say the world economy) -- these functions are not "idiot proof". They can collapse. And, yes Virginia, the system can be "broken". To suggest that cryptography can address this issue is to misunderstand the problem, and is part of this whole mindset that "security" is cryptography. Our economies are, if anything, less resilient than they were in the not to distant past. They are far more vulnerable. The introduction of new business practices, such as the reduction in most firms inventories, and the ever greater reliance on "just in time" approaches has made us far less able to sustain any interruption. The headlong introduction of "new variables" and new vectors into an unstable system has never been "sound policy". I guess it's sort of like what happened when rabbits were introduced into Australia. An eco-catastrophe. Perhaps, we can all agree that existing systems are best "not destabilized". Then again, I'm not the one who gets his jollies by rocking the boat. I get mine elsewhere. I guess here then is the real question, what is the fallback plan when something does go catastrophically wrong?? What then, hand-wringing, and saying that it "exceeded our theoreticians predictive capabilities" just does not suffice. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

No Privacy Right in UK ?
by James M. Cobb 17 Dec '03

17 Dec '03

Cypherpunks assume privacy is a good thing and wish there were more of it. --Welcome to cypherpunks Friend, 11 16 95 The Electronic Telegraph runs a newsstory headed Doorstep polish researcher was whiplash injuries spy Here are excerpts from the newsstory: Miss [Natalie] Goldner had been hurt when a car in which she was a passenger was hit from behind in April 1988, and she was forced to leave her video library job. Shortly after the accident, she started a claim for compen- sation and future loss of earnings against the Royal Insur- ance Company. ...Margot Christie...was working for the Hampshire Detec- tive Agency when she went to Miss Goldner's house in Octo- ber 1991. Christie posed as a market researcher. It was only when a compensation claim reached court that Miss Goldner realised the "researcher" was a private de- tective hired to discover the extent of her injuries. In a report which was due to go before the court, Mrs Chris- tie said she had asked Miss Goldner to test some polish and window cleaner. [Christie] returned 11 days later. "I asked the plaintiff if the polish had given a good shine and if she had rubbed hard. The plaintiff said 'Yes I did, it didn't smear at all'." Natalie lives with her mother. "I felt as though we had been burgled. I felt violated. We were so worried afterwards that we just didn't trust anyone who turned up at our door. "She asked lots of questions about who did the housework in our house. We were just chatting away and I had no idea she was there to spy on me." Natalie settled out of court. In September, she accepted a 20,000 [pound] settlement after one day of a planned four-day court hearing. She is to lodge a complaint with the Association of British Investigators.... Fortunately, the Daily Telegraph publicized the case. The news- story points out: A spokesman for Liberty, the civil rights group, said: "There is no right to personal privacy in Britain and so it [invasion of privacy by deception] is not against the law." Cordially, Jim NOTE. The Electronic Telegraph can be accessed at http://www.telegraph.co.uk The online filename of the above newsstory is: nspys16.html

2 3

Re: NSA, ITAR, NCSA and plug-in hooks.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 15 Nov 1995, Bill Stewart wrote: > >>Does anyone know the ostensible justification for this? > > Isn't the NCSA government-funded? If so, they've probably got > less slack in what they can get away with than private citizens; I think that government-funding does give a certain degree of control -- the control that comes with the budget axe. Private citizens alternatively, get to face a different type of tool. They get to face stuff like RICO provisions, which "effectively" -- as they are presently used, rather than as they were written and intended to be used -- tend to allow the government to "influence" private citizens. > the NSA's got more leverage over their funding, especially if > "Supercomputer Applications" are often military or civilian-govt. I doubt that the NSA approves the NCSA's budget. Far more likely would be for the NSA to use a rogue programmer at the NCSA. Someone who might hide some very damaging code into one of the existing applications without anyone (else) knowing about it. I could even see an independent doing this simply to profit from it. I could see someone doing something like that. It's no different really than the "free" programs that were given away years ago which appeared to be useful but actually contained "poison code". > Not only do they have to worry about ITAR as law, they have to > worry about their continued cash flow. Like I said, I don't believe in the "grand conspiracy" model. I tend toward "contained" enterprises. All the more reason though, NEVER to use black-box code, and all the more reason for public open review of code. NSA and ITAR aside ... safe computing is safe computing and is in everyone's collective interest. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: No Privacy Right in Indonesia ?
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:54 PM 11/17/95 -0500, "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> wrote: >An 11 17 95 Reuter Information Service newsstory headlined > Politics, not sex, is Indonesian Internet's concern ... > Activists in Indonesia who use the Internet say it is a power- > ful tool for distributing information in a society where self- > censorship abounds, newspapers are tightly controlled, jour- > nalists are jailed and unlicensed magazines banned. The primary difference between Indonesian and Singaporean censorship is that the Singaporeans are a lot more urbane about it, and generally don't have crowds of protestors to shoot at. Reporting on the East Timor activity is an especially good way to get kicked out of the country; I know people it's happened to. Uncensorable communications can be a substantial help, though rubber-hose cryptanalysis is still fairly effective, and it's the type of place that would use it. A certain amount of US activism on the East Timor problems is Internet-based; I don't know how connected it is to Indonesia or East Timor, which is too underdeveloped to be very active on the net, and has the added problem that activists are heavily watched. The Indonesian military recruitment process is unfortunately not something that crypto can affect much, except by keeping political activist's identities private so they're not targets. Basically, the draft board knocks on your door and says "Uncle <whoever> wants _you_", and they're authorized to shoot you if you don't cooperate, though they're also authorized to not shoot you. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

[BOOK] "SPYWORLD" (was: Re: CSE gets flak on TV)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >On Tue, 14 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > >> Electronic snooping part of the game >> >> OTTAWA (CP)--Intelligence experts say it's no big secret that Canada's >> high-tech spy agency snoops on friendly countries for financial gain. > >No big secret?? It was news to me. ;-) [elided] Dear Alice, To the few on the list who have not already had the pleasure, I'd put "SPYWORLD" in the "Puzzle Palace" category of must-reads. Before recently leaving our own Wunderland for a course in advanced bird-watching off in the Canary Islands, Michael Sattler was kind enough to loan me his hardcover of this pithy little 1994 history/expose on the Canadian spook community by one of their first key propeller-heads, "Mike Frost." After being unceremoniously dumped by the Canucks a few years back, he decided to "share" about it all to work out his frustrations. Though I assume it was 'tidied up' by various government censors in pre-publication, and according to the inside page was printed and "bound in the U.S.A." ;), I must say it was nevertheless an arousing read, albeit a bit nit-sloppy with the ghost writing/editing here and there. It paints a colorful picture of the TLA gang-bang that resulted in the conception of the Canadian black budget intercept operations. The potent schtuppingvermachen of the American and British, each waiting patiently for sloppy seconds is, to say the least, pruriently fascinating. "Frost" manages to (un)cover, in pleasurably lurid detail, some of the tools used, and policies openly violated, during such intercepts as "Stephanie" in Moscow. There are even some descriptions of the scenes behind the green doors of the NSA and CIA. Frankly, all it really lacks is a nude picture of the American Ambassador in Ottowa pulling his pants up _before_ drawing the shades for the last time. If you do read it, use protection. ;) "SPYWORLD" Subtitle: Inside the Canadian and American Intelligence Establishments By: "Mike Frost" as told to Michel Gratton ISBN 0-385-25494-6 Publisher: Doubleday Canada Ltd. 105 Bond Street Toronto, Ontario M5B 1Y3 dave PS: Don't worry, Mike, none of the pages stick together. :) _______________________________________________________________________ "If you're ever robbed of your virtue, trust me: it was an inside job."

1 0

Dec 5th KE meeting details
by Carl Ellison 17 Dec '03

17 Dec '03

Date: Mon, 13 Nov 1995 13:15:32 -0500 From: Elaine Frye <frye(a)micf.nist.gov> November 8, 1995 To: Key Escrow Distribution Lis From: Ed Roback, NIST Subject: Planning for December 5th Meeting At the September 6-7, 1995 key escrow issues meeting, I received a number of comments that the government presentations should have addressed more topics in greater detail. To respond to this concern, I would like to request submissions of any specific questions/issues related to the draft criteria that you would like to see addressed on December 5th. I cannot guarantee we can meet all requests, but your suggestions will greatly help in planning the meeting agenda and government presentations. Please forward your questions/issues/ideas to me via e-mail at "edward.roback(a)nist.gov", fax at 301-948-1784 or telephone on 301-975-3696. FYI, the current outline for the December 5 meeting is as follows: A. Government presentation of draft criteria, followed by Q&As B. Industry presentations on draft criteria C. Breakout sessions on criteria (a suggestion has been made to also have one on policy issues) D. Reports from breakout sessions E. Wrapup Remember, also, that if you would like to make a presentation at the meeting, you are asked to contact Elaine Frye at "elaine.frye(a)nist.gov". You may also bring written comments to the meeting for distribution (our estimate is that 250 copies are necessary.) Thank you. ***************************************************** Elaine Frye Computer Systems Laboratory, NIST Bldg. 225/Rm.B154 Gaithersburg, MD 20899-0001 Voice: 301/975-2819 Fax: 301/948-1784 *****************************************************

1 0

Re: Corrections about Bob Noyce and Intel
by John Young 17 Dec '03

17 Dec '03

Worth magazine of Dec/Jan has a lubricious article on "The Super Investors of Silicon Valley": " 'Rise of the Silicon Patriots,' by Donald Katz. If their egos and paychecks are oversized, so is their impact on the economy and culture. It's not for nothing that California's venture capitalists think they're at the center of the universe." It traces some of the mauling by rapacious VC tigers of unwary techno-bambis and gleefully vaunts winner-take-all when the chips are down (multiple puns there) -- commensurate with the flatulent flattering flummoxing of this "financial intelligence" oilslicker. For more FFF FinInt organ-grinding the monkeys, see "Downloading Warren Buffet's Brain."

2 1

Ecash account
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

So who here is going to use their ecash account to set up a money lau^H^H^Hexchange service? Ob Cyphernoise: Would Dr Fred, Alice, and any other names LD has set up for himself lately please keep the noise limited to email? Please? Ob Plonk: amen. So let it be written, so let it be plonked. Don

2 1