December 2003 - cypherpunks-legacy

Re: ADDRESS DATABASE?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandfort-8802 unit: >> This took about a minute using a shabby consumer-level DB. >> *Now* do you get it? ^^^^^^^^^^^^^^^^^^^^^^^^ > > hint hint hint hint < >Nope. MY name isn't on your list. In addition, my home phone >number is unlisted--therefore contracturally unavailable for >resale. *Now* do you get it? It's kind of cool how much faith you have in the idea that your number is unlisted, considering the fact that you started this thread by griping that someone had the goods on you. The reason you were "taken aback" is because your beliefs don't correspond to reality -- "cognitive dissonance," in the lingo. H -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNHGg73g0mNE55u1AQEfcwH9HPcXAyMQPv9ZNQ2MxvBHfTtsIfqw15zG n7S7yppwR2AsayZgSZQFIDoee0tLRBqEvPFhxNqnOiPCht5PK01YGA== =gIKw -----END PGP SIGNATURE-----

2 1

[UNIX] Re: Secured RM ? (source)
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199512150218.VAA14539(a)homeport.org>, Adam Shostack <adam(a)lighthouse.homeport.org> wrote: >| >| While we're here.. I havn't been able to find anyone on the planet who's >| seen or heard of a linux un-remove, which makes testing my code very >| tricky. > From comp.unix.questions FAQ: > (http://www.cis.ohio-state.edu/hypertext/faq/usenet/unix-faq/faq/part3/faq-d…) [Info about delete/undelete/expunge/purge del] That's not very useful in this context: all it does is move files to .#{oldname} and then later remove them. I'd suggest that anybody interested in this topic under UNIX examine the vnode structures and understand how the filesystem keeps file lists. Many vendor UNIces have fairly well commented header files. {Only marginally cypherpunk-related, in the 'Security in the real world' category.} - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMNDqmSoZzwIn1bdtAQGorwF+KsU/UZom/+C8ldvzKDPajDh6fiVtg1K1 kxTyLGyAjf5W+SNRM1f6kU5YdJlUmZxP =yo70 -----END PGP SIGNATURE-----

1 0

Re: Secured RM ? (source)
by Adam Shostack 17 Dec '03

17 Dec '03

| | While we're here.. I havn't been able to find anyone on the planet who's | seen or heard of a linux un-remove, which makes testing my code very | tricky. If anyone can point me at it I'd apreciate it. Hell, if someone | can definitively say they've /seen/ such a thing it'd be nice. So far | i've found one person who insists that his system admins sisters | boyfriends cousin from Saint Petersburg has been using un-rm for unix for | years. *sigh* From comp.unix.questions FAQ: (http://www.cis.ohio-state.edu/hypertext/faq/usenet/unix-faq/faq/part3/faq-d…) MIT's Project Athena has produced a comprehensive delete/undelete/expunge/purge package, which can serve as a complete replacement for rm which allows file recovery. This package was posted to comp.sources.misc (volume 17, issue 023-026) -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Re: ADDRESS DATABASE?
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> Date: Thu, 14 Dec 1995 13:06:50 -0800 > To: cypherpunks(a)toad.com > From: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: ADDRESS DATABASE? > At 01:32 PM 12/14/95 -0600, you wrote: > >sandfort(a)crl.com said: > >> Something of privacy interest happened to me yesterday. I phoned a > >> company to ask for a copy of their catalog. The phone clerk asked > >> for my last name and zip code. After receiving that info, the clerk > >> asked me, "Is this your full name and address?" and then gave them > >> both correctly. I was taken aback. > > > > Taken aback? Its only going to get worse in the future. As Telcos, credit > >card companies, etc., start looking for new ways to make money I think > >selling information about you will increase dramatically. > > I'm in the process of moving and getting new phones, and Pac Bell asked me > if it was ok to send my Social Security Number to my long-distance carrier. > I told them "no, but you don't have my SSN anyway" "Oh, you're right, we don't; > can we have it" "No" "OK. Would you be willing to give us your driver's license > number or another form of ID? We've just started asking for this recently." > "Is it required?" "No, it's optional, but I have to ask" "No, thanks" You know why they want that, don't you? So if you don't pay your bill, they can ding your credit report. PG&E will do the same thing to you, and they will both do it illegally, without notifying you first as they are required to do by law. So, I'd advise you to check your credit report regularly for signs of abuse.

1 0

Algorithims ?
by john.ellis＠wmcmail.wmc.ac.uk 17 Dec '03

17 Dec '03

Were can i get a set of the most popular algorithims from for encryption, and does any one have and info on the algorithim used in the second WW by the germans, (The Enigma system) any info would be greatfully recieved Cheers John

2 1

Re: ADDRESS DATABASE? (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: > From toad.com!owner-cypherpunks Thu Dec 14 17:36:57 1995 > Date: Thu, 14 Dec 1995 14:50:19 -0800 (PST) > From: Sandy Sandfort <sandfort(a)crl.com> > > So far, no one has come up with anything stronger than specula- > tion about my database question. Some "anonymous" told me how > easy it was to buy *phone numbers* on CD-ROMs. Great, but I > didn't give the guy my phone number. > It was probably a shrewd guess on the part of the phone peon, combined with a fresh database from the telephone company. Are there many people in your zip code with the same last name as yourself? If not, that pretty much answers your question right there. When you pull a credit report from TRW's database, the only information TRW needs is the first four (?) letters of the last name, the initial of the first name, the numeric part of the address, the first character of the street name, and the zip code. I'll leave it to the experts in information theory to explain that in rigorous technical detail. Given only a last name and a zip code, I wouldn't be surprised if you found the proper individual most of the time. (If you're in Minnesota and you're looking for Swenson in 55419, you may need more info, but not much.) Another anecdote to add to the pile: I moved to a new apartment last May. For various reasons, I got an unlisted number, and had my credit card bills and magazine subscriptions sent to a mail drop (MBE). The phone, gas, electric and cable bills went to the new apartment, not to the mail drop. I didn't get any junk mail at the new apartment until a couple of weeks ago--right after I changed my subscription to Byte to come here (now I'm getting AOL disks, etc.). Before that, I got no junk mail here (except from the phone or cable company). I get almost no telemarketing calls; I used to get at least one a night with a listed phone number. My experience appears to be that credit card and magazine companies sell lists; utility and cable companies don't. Mass mailers must not get unlisted number customers on the lists they get from the phone company. Again, this is only from my experience, all disclaimers apply. And all this has no relevance whatsoever when you bring the government into the picture. Crypto relevance? Well, I did mention information theory...

1 0

Re: Fwd: Corporate Crime and CDT Funding on behalf of so-called medical privacy
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks (belatedly) for posting this, Russell. Who was it said, "Follow the money." Great stuff. For a good time, call the EFF about these folks. For a better time, call the ACLU. It might be hilarious to make some inquiries around Stanford... Maybe Rich Graves can give us the poop. Best, Clark Probably time someone wrote an expose of industry and cryptocrats "hacking" public policy groups. Wonder where one could PLAGIARIZE such tidbits? ;-) (apologies -- "plagiarize" is an inside joke for the filterslugs ;-) //--- forwarded letter --------------------------------------- > MIME-Version: 1.0 > Date: Tue, 21 Nov 95 12:01:10 -0500 > From: JWRCLUM(a)aol.com > To: cypherpunks(a)toad.com > Subject: Fwd: Corporate Crime and CDT Funding on behalf of so-called medical privacy > The following article appeared in the current issue of > Corporate Crime Reporter (Volume 9, Number 44, November 20, 1995, > page one). It is redisseminated on the Internet with the > permission of CCR. > > SELF-PROCLAIMED "PUBLIC INTEREST" GROUP HEAVILY FUNDED BY > COMPUTER, TELECOMMUNICATIONS, DATABANK CORPORATIONS THAT WOULD > BENEFIT FROM "MEDICAL PRIVACY" LEGISLATION GROUP SUPPORTS -- > EQUIFAX, TRW, DUNN & BRADSTREET IN THE MIX > > The Center for Democracy & Technology (CDT), a self- > proclaimed "public interest organization," is in fact heavily > funded by large private computer, telecommunications, and > databank corporations. > Funders of CDT, a two-year old Washington, D.C.-based > advocacy organization, include Dunn & Bradstreet Corp., Equifax > Inc., and TRW Information Services, three large databank > corporations that stand to benefit from federal legislation CDT > actively helped shaped and is shepherding through Congress. > This year, CDT has received $699,643 from more than 30 large > corporations, including $100,000 from Microsoft, $75,000 from > AT&T, $60,000 from Bell Atlantic, $50,000 from Apple Computer, > $25,000 from IBM, $10,000 from TRW Information Services, $10,000 > from Dunn & Bradstreet, $5,000 from Direct Marketing Association, > and $5,000 from Equifax Inc. (For a complete list of CDT's > funders, see At A Glance, page 16) > At a hearing before the Senate Labor and Human Resources > Committee last week, CDT deputy director Janlori Goldman said > that CDT "strongly supports" legislation, S. 1360, sponsored by > Senators Robert Bennett (R-Utah) and Patrick Leahy (D-Vermont), > because it represents "the most comprehensive and strong privacy > bill the Congress has yet considered in this area." > But opponents of the bill argue that the legislation is not > a privacy statute at all, but instead is a vehicle that would > legitimize the creation of large computerized databanks of > personal medical information, thus benefitting those companies > like TRW and Equifax that give financial support to CDT. The > legislation would allow for broad, unauthorized searches of those > databanks, opponents claim. > In an interview, Goldman told Corporate Crime Reporter that > all of CDT's corporate funding is earmarked for other projects > and that none of the corporate funding is supporting her work on > the medical privacy bill. > "The corporate funding is not related at all, in any way > shape or form to my work on this bill," Goldman said. "The reason > we are doing this bill is that I've worked on privacy issues for > a decade. The most important privacy issue to work on is the > passage of the medical records privacy legislation. That is a > very sincere issue for me." > "None of the corporate support that CDT gets is related to > my work on this bill," Goldman emphasized. "None. Zippo." > CDT's executive director, Jerry Berman agreed. "We have no > funding for the medical privacy project -- zero," Berman said. > But critics of the CDT's position on the legislation were > skeptical. > "During the Senate hearing this week, Senator Bennett was > angered at the suggestion that S. 1360 was an industry bill," > said Jamie Love of Ralph Nader's Center for Study of Responsive > Law. "He claimed that he had widely consulted with privacy groups > and patient advocates. CDT's Janlori Goldman was the key person > who decided who was in the loop, and who was not in the loop on > this issue. Groups that were not receptive to the idea of massive > database systems of personal medical records were excluded from > deliberations." > "To find out that CDT has been funded by companies such as > Equifax, TRW, Dunn & Bradstreet, IBM and the telephone companies > is remarkable, because these are among the groups who have the > most at stake in legitimizing and preserving the current system > of maintaining and managing medical records," Love said. "I think > that Janlori Goldman should have mentioned in her Senate > testimony that CDT was funded by corporations who have an > interest in this issue." > "If CDT were doing its job, TRW and Equifax wouldn't want to > give it money," Love added. > Harold Eist, president-elect of the American Psychiatric > Association, said that "any datagathering and large computer > company would clearly benefit from legislation that drives large > amounts of individually identified data about American citizens > into data banks without the knowledge and permission of those > American citizens." > "Selling that information would represent a gold mine for > those companies," Eist said. > "It is not surprising that an organization with a > disingenuous name -- Center for Democracy & Technology -- would > be supporting a bill with a disingenuous name -- The Medical > Records Confidentiality Act," Eist said. "In fact, this bill > represents an effort to give away the privacy of American > citizens without their knowledge." > "My understanding is that Janlori Goldman was involved in > writing the bill," Eist said. "It seems to me that as a former > civil libertarian, she should know very well that there are > loopholes in that bill regarding protections to privacy that you > could drive a Mack truck through." > "Unless people can be assured that their privacy will be > protected, there is little or no chance that they will reveal the > kind of tormented and dark secrets that they have to reveal to > recover from their illnesses," Eist said. "Confidentially is the > sine qua non of medical treatment, and especially if it is > psychiatric medical treatment." > A driving force behind the effort to derail the > Bennett/Leahy bill is Denise Nagel, a Boston physician who > organized the Coalition for Patient Rights of New England "to > restore confidentiality to the doctor-patient relationship." > Nagel refused to comment on CDT's funding. > At the Senate hearing last week, Nagel told the committee "I > have no industry ties." > Nagel charged that S. 1360 was written "to advance the > interests of certain segments of the computer, > telecommunications, data processing and health-care industries." > "With this bill they would be able to careen full speed > ahead to develop data networks that will give innumerable people > access to our medical records legally and without our knowledge," > Nagel said. > "I am convinced that S. 1360 is not at all primarily > concerned with the confidentiality of medical records," Nagel > told the committee. "It is just the opposite. It talks about > informed consent, but then authorizes the creation of databases > without patient knowledge or consent. It talks about individual > rights, and then allows police broad authority to search > databases directly instead of obtaining a specific record from > the patient's doctor. It talks about civil and criminal > sanctions, and then pre-empts all common law and most existing > and future state statutes. It talks about ensuring personal > privacy with respect to medical records, and then sets a ceiling > rather than a floor on medical confidentiality." > > AT A GLANCE: CENTER FOR DEMOCRACY AND TECHNOLOGY FUNDING, 1994- > 1995 > > American Advertising Federation 500.00 > America Online, Inc. 25,000.00 > Apple Computer Inc. 50,000.00 > AT&T 75,000.00 > Bell Atlantic 60,000.00 > Business Software Alliance 6,000.00 > Cellular Tellecomm Indust Assn 10,000.00 > CompuServ 30,000.00 > Delphi Internet Services Corp 10,000.00 > Direct Marketing Association 5,000.00 > Dunn & Bradstreet Corp 10,000.00 > EMA 5,000.00 > Equifax Inc. 5,000.00 > John Gilmore 2,500.00 > Hartford Foundation 153,000.00 > IBM 25,000.00 > Information Technology Industry 5,000.00 > Interactive Digital Software 5,000.00 > Lotus 6,250.00 > MARC 80,000.00 > MCI Telecommunications 15,000.00 > Microsoft 100,000.00 > National Cable Television Assn 15,000.00 > Netscape Communications Corp 5,000.00 > Newspaper Association of Am 5,000.00 > Nynex Government Affairs 25,000.00 > Pacific Telesis 25,000.00 > Prodigy Service Company 10,000.00 > Software Publishers Assn 10,000.00 > Time Warner Inc 5,000.00 > TRW Information Svcs 10,000.00 > US Telephone Association 10,000.00 > US West Inc 10,000.00 > > Total Funding 814,020.00 > > Received 1994 114,377.00 > Received 1995 699,643.00 > > Total Funding 814,020.00 > > > > Russell Mokhiber > russell(a)essential.org > voice: 202/429-6928 > [big birdie follows] .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3

Re: Pornographic stories
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

jadestar(a)netcom.com (JaDe) writes: > > > > Daniel Miskell <DMiskell(a)envirolink.org> writes: > >>>I'm sure. > > > I too fail to see the cryptorelevance of this thread... Unless > > alt.sex.stories is used for steganography... Alice wants to send a > > secret message to Bob, so she posts a porn story to alt.sex.stories, > > where the key phrase is "That was the best sex I've ever had", which > > sounds like a mild hyperbole to most people; > > I like the stegonography angle. However I'd encode the > actual message contents into the typos. Filter out the > typos to retrieve your crypto-text. Wouldn't text with a lot of typoes look suspicious? For ultimate silliness, I've put together the following program to encode 8 bits at a time in an R-rated sentence: #include <stdio.h> #define BIT(c,n) ((c>>n)&1) const char*bits[]={ "Senator Exon", "L.Ron Hubbard", "made passionate love to", "had great sex with", "Hillary Klinton", "J.D.Falk", "experienced", "gave her", "six", "twelve", "in", "during", "one", "a single", "night", "weekend"}; void stegaporn(int c) { printf("%s %s %s and %s %s orgasms %s %s %s. ", bits[BIT(c,7)], bits[2+BIT(c,6)], bits[4+BIT(c,5)], bits[6+BIT(c,4)], bits[8+BIT(c,3)], bits[10+BIT(c,2)], bits[12+BIT(c,1)], bits[14+BIT(c,0)]); } int main(void) { int c; while (EOF!=(c=getchar())) stegaporn(c); return(0); } > Ultimately I think that the whole issue of legal cryptography > actually boils down to this: > > If you illegalize strong crypto than criminals will > simply resort to steganography and "hidden" channels > of communication (in which they can also embed/tunnel > the crypto-text of their strongly encrypted data). > > Therefore all you've done is create a lesser crime > for the real criminals and make people with valid > (non-criminal) uses of the technology into criminals. > > Unfortunately this reasoning doesn't help at all with our > (U.S.) legislature. There is some hidden aggenda as to > why "they" really want strong cryptography to be difficult > for the average user to obtain. I have a uniquely hard time > believing that "they" are merely concerned that "we" might > be pursuing simple privacy (even if cryptography were already > illegal I could use it for years and never get "caught." > so long as I was using non-broadcast channels and communicating > with "trusted" associates (fellow "crypto-criminals") > > In fact I've suggested to several people that we start > a dial-up uucp revival for this and related reasons. (If > the number of users/webpages and the bandwidth usage continues > to increase at the recent rates -- without a corresponding > improvement in the infrastructure we'll probably all want to > go back to uucp for mail and news anyway. Old fashioned dial-up > may be faster than T1 access in a few years and direct point-to- > point uucp over ISDN is probably faster already. > > So: > > What is the "real" reason for opposition to > strong crypto? Who "really" benefits? (and please > don't mention the LE types 'cause I don't believe it). > > and: > Anyone else want to participate in the great '90's > uucp revival? I'm in Santa Clara and could use > some feeds and some help with the setup. I'm all for it. My site is connected to the rest of the world via dial-up UUCP, I haven't touched the setup in 5 years, and am not planning to. It might be interesting to have a variation of dial-up UUCP where site 1 passes encrypted stuff to site 2 and doesn't quite know what site 3 they're supposed to go on to. Sort of like the remailers with encryption. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 2

Re: And the standard continues to lower...
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:17 PM 12/13/95 -0600, you wrote: >Dr. Brian L. Crissey includes in his .sig, courtesy of cactus(a)hks.net >[ much WRT YetAnotherSecureInternetCreditCardPaymentSystem(*tm) deleted ] >> ***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 >> (503)-434-2426 brianc(a)linfield.edu >> Professionals built the Titanic, amateurs built the Ark... > >However, the Ark was *designed* by GOD (if you believe the story). Can Dr. >Brian L. Crissey say the same thing about his payment system? He seems to think so... He is so assured as to the security of his system. I am going to ask if I can post his challenge he made to me in private e-mail here. He needs to be taught some basics in security. (I do not have the proper hardware to subvert his scheme. I do have some other ways of subverting it, but that would be telling... (I occasionally assist with the web server on Teleport. Changing his script to collect information would not be difficult...)) I will see if he will let me forward his e-mail to the list. (I will also check with the webmistress on Teleport before I do... She might get pissed if I turned the people on the list onto Teleport's server.) | What is the Eye in the Food Pyramid? | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | <fnord> |

1 0

Re: .PWL spin
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 9 Dec 1995, Joel McNamara wrote: > One system administrator said the problem would have a greater effect on > less-secure environments, such as universities and other institutions, > than on corporations. I didn't quite understand the "corporate speak" here. It sounds like something coming from Bosnia or something. It's Greek to me. What would make a University less secure than a corporation?? Universities (at least the ones, I've checked) have entire departments and theoreticians devoted to Computers ... companies usually don't. I'd think that Universities are much, much more secure environments than corporations are. Doesn't Microsoft know this?? Or is this unique to Seattle?? Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

5 4