December 2003 - cypherpunks-legacy

Re: Who has the right to read your e-mail? Old hash, but I need to ask.
by John A. Limpert 17 Dec '03

17 Dec '03

At 06:58 AM 11/28/95 -0600, (Bill) wrote: >Who has the right to read your personal e-mail. >E-mail created at work? >E-mail downdloaded at work? >E-mail stored on a PC at work? The December 1995 issue of Communications of the ACM (CACM) has several articles on e-mail privacy. Managing User Perceptions of Email Privacy Suzanne P. Weisband and Bruce A. Reinig The Ethical and Legal Quandary of Email Privacy Janice C. Sipior and Burke T. Ward -- John A. Limpert johnl(a)Radix.Net

1 0

Harbinger (sp?) system
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Sorry if this question has been asked and I missed it, but does anyone know how their system works? Thanks, -Allen (c) 1995 Copyright Nando.net (c) 1995 Cox News Service ATLANTA (Nov 29, 1995 - 09:44 EST) -- Harbinger Corp. has announced new software aimed at making the Internet safe for commerce, a move that could dramatically reshape the small company. [...] TrustedLink, the product announced Tuesday but not available until next year, will let firms connect via the Net as well as through Harbinger networks, he said.

1 0

Re: Inexpensive Crypto Boxes...
by Brian Lane 17 Dec '03

17 Dec '03

> It isn't likely to be worth doing this with a sony play-station; it's DSP > capabilities are nothing special, and you're paying way too much for > irrelevant stuff like CD-ROMs, 3D accellerators, etc. For the same money I seem to remember a product from Sony last year that had a CDROM drive in it, a small LCD display, and a minimal keyboard. I think it was meant for reading encyclopedias or something. What would be cool would be a small device like this with a Magneto Optical drive in it. Generate yourself a large one-time pad and off you go... Or, you could have a secure messaging system (running a stripped down version of PGP) that could connect to a host via POP3 protocol (thru a internal modem of course) handle your mail, etc. Brian --------------------------------------------------------------------------- blane(a)eskimo.com | Electronics, Privacy, Raytracing. ftp://ftp.eskimo.com/~blane | Embedded Microprocessor Programmer http://www.eskimo.com/~blane |

1 0

Medical Records
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's something that may make attempts such as Clipper a bit harder to mandate, if this (non-escrowed, I believe) system becomes common. It should also provide some pressure for relaxation of ITAR. -Allen (c) 1995 Copyright Nando.net (c) 1995 Reuter Information Service [...] A security system developed at the University of California at San Francisco prevents unauthorized access to x-rays and other medical images transmitted via computer networks. A scientist described the system in a report prepared for a radiologists' convention here. [...] Stephen Wong, assistant professor of radiology and bioengineering, and colleagues developed the system for the picture archiving and communications system used at the university to store and transmit digitized medical images. He said the authenticity of the images as well as patient confidentiality must be protected. "We have to make sure that the digital information and images are not altered accidentally or surreptitiously," Wong said. "In addition, x-rays and other imaging studies are part of the patient's medical record and must be protected from unauthorized access." The system uses mathematical formulas or codes to scramble the images through encryption. It involves a "two-key" system -- one code enables public access but a second, private code is required to unscramble the information. The private code, known only to the individual to whom the information is transmitted, is 1,024 computer bits long, Wong said. In emergencies where fast transmission is needed, the unscrambled image is transmitted with a digital "fingerprint," a smaller code that assures the intended viewer that no one has altered the original image. Wong prepared his report for the annual meeting of the Radiological Society of North America.

3 2

Whitehouse PROFS email privacy case
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

this was a hot subject a long time ago on the list, here's a book with the scoop ------- Forwarded Message From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PROFS Case: Book on White House e-mail Date: Wed, 22 Nov 1995 12:50:49 -0500 (EST) From: Eddie Becker <ebecker(a)cni.org> Subject: PROFS Case: Book on White House e-mail NEW BOOK PROVIDES NARRATIVE ON PROFS CASE ALONG WITH REMARKABLE PRIMARY DOCUMENTS. Following Press Release 11/22/96 REVELATIONS FROM --WHITE HOUSE E-MAIL: THE TOP SECRET COMPUTER MESSAGES THE REAGAN/BUSH WHITE HOUSE TRIED TO DESTROY, Edited by Tom Blanton (New York: The New Press, 256 pp. plus 1.44 megabyte computer disk), distributed by W.W. Norton & Company. For more information, contact: Tom Blanton (o) 202/994-7000, (h) 301/718-6543, nsarchiv(a)gwis2.circ.gwu.edu SECRET SUPPORT FOR SADDAM HUSSEIN Top Reagan administration officials, including Colin Powell, presided over covert intelligence support to Saddam Hussein during the Iran-Iraq War, including targeting information on Iranian civilian infrastructure for Saddam's SCUD missiles. In secret e-mail messages, National Security Council staffer William Cockell recommended -- and Deputy National Security Adviser Alton Keel agreed -- they cover-up the assistance to Saddam, because "it is difficult to characterize this as defensive assistance." [pp. 36-41] Subsequently, while Powell served as Deputy National Security Adviser in 1987, the Reagan administration discussed a "shopping list" of pro-Iraq actions in order to "stiffen them up." [pp.235-237] HELPING NORIEGA "CLEAN UP HIS IMAGE" Three months after Seymour Hersh and The New York Times exposed Manuel Noriega's involvement in drugrunning and murder, Noriega approached the National Security Council staff with an offer to assassinate the Nicaraguan Sandinista leadership. Oliver North relayed the offer to his boss, National Security Adviser John Poindexter, writing that "you will recall that over the years Manuel Noriega in Panama and I have developed a fairly good relationship." Poindexter replies, "I have nothing against him other than his illegal activities" and approves a North meeting with Noriega -- as does Secretary of State George Shultz. The bottom line? The White House agrees to help Noriega "clean up his image" in return for Panamanian sabotage operations against the Nicaraguan Sandinistas. [pp. 23-25] THE WHITE HOUSE SENDS A COCAINE CONSPIRATOR TO CLUB FED Top Reagan administration officials from the White House, Pentagon, and Justice Department just said yes to a reduced prison sentence (in a minimum security facility) for a Honduran colonel and sometime CIA asset who was convicted of cocaine trafficking and conspiracy to assassinate the civilian president of Honduras, because otherwise the colonel might "start singing songs nobody wants to hear" about covert operations in Honduras. [pp. 42-48] SECRET DEALS WITH LOBBYISTS ON A CONTROVERSIAL CONGRESSIONAL VOTE The White House struck a secret deal with the American Israel Public Affairs Committee in the spring of 1986 to avoid an AWACS-style all-out battle on a Saudi arms deal vote, and in return got AIPAC's help on foreign aid funding and on the Iran- contra scandal. But National Security Council staffer Howard Teicher warned, "whatever one may think of the jewish leadership, the 'masses' are rarely if ever swayed by what the rational, reasonable leaders say. instead, it is the israel right or wrong demagogues at the grassroots level that will try to take advantage of the leadership's pusillanimity." [pp. 150-157] HIDDEN FAILURES OF THE POLYGRAPH (PRECURSORS OF ALDRICH AMES) According to the National Security Council's top counterintelligence official in 1985, career FBI agent David Major, two out of the 48 individuals indicted, arrested and/or convicted of espionage against the U.S. in the years 1975-85, had successfully deceived the CIA's favorite screening tool, the polygraph (lie detector) -- a 4% error rate. (Aldrich Ames subsequently beat the polygraph twice.) [p.220] ROSS PEROT'S EGO RIDES AGAIN Ross Perot "sandbagged" the Reagan White House at a 1986 Congressional hearing on the POW-MIA issue, according to the lead White House staffer on the issue, Col. Richard Childress, who also wrote, "he has played into Hanoi's hands for his ego and doesn't even know it." [p. 162] MORE WHITE HOUSE E-MAIL STORIES * Then-Israeli Defense Minister Yitzhak Rabin personally arranged with Oliver North for secret shipments of captured PLO weapons to Central America in September 1986, with the approval of the National Security Adviser. Rabin also commented, according to North's e-mail, "at some length about his low opinion of our intel service [CIA] - both in terms of coverts ops and intelligence collecting," and promised "no more Pollards." [pp. 119-122] * The regular breakfast meetings in the Reagan administration of the National Security Adviser, the Secretary of State (George Shultz), and the Secretary of Defense (Caspar Weinberger) often degenerated into what staffers called "slugfests." p. 193 * Contrary to claims in a recent autobiography, National Security Adviser Robert McFarlane did not anticipate the collapse of the Soviet Union and craft U.S. policy accordingly to pressure the Soviets, rather, in his 1984 e-mail, McFarlane wrote "it will not change ideologically and therefore our task is to establish a basis for peaceful competition with them." p.189 * At the behest of Israeli Prime Minister Shimon Peres, Vice President George Bush proposed a "7-point peace plan" during a Middle East trip in 1986, only to have it shot down by White House and State Department opposition back in Washington. p. 200 * While serving as Deputy National Security Adviser to President Reagan in 1987, Colin Powell lived in an alarmed house at Fort McNair which "scared hell out of the family initially and then became amusing when the MPs assaulted the house every time the alarm misfired." p. 211 * White House staffers joked about CIA Director William Casey's renowned "mumbles," writing, "The last time he told Goldwater we were going to 'lay some mines in Nicaragua,' Goldwater thought he said we were going to 'pay some fines for some joggers.'" p. 214 END - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

Re: key for Alice as promised (not)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Tue, 28 Nov 1995, Adam Hupp wrote: > >> >Can you imagine?? I'm simply not willing to fool myself into thinking >> >that I ahve security by posting a key and using PGP. >> >> Unless you can post some proof that PGP is insecure, stop insisting it is. > >Hold on a minute. Alice is, here, 100% correct. no, he isn't. He isn't even using a minimal effort to prevent spoofing, and he's blaming this on the fact that some particular piece of software (for example, PGP) isn't absolutely foolproof. >If I use PGP to read messages and there's a videocamera trained on the >keyboard, and other people have access to the machine, PGP is not >secure. Similarly, if PGP is on a computer which other people may use >without my supervision, they can monitor keystrokes, etc. and PGP is not >secure. True but irrelevant. This is especially true since the only purpose to signing messages to a public area is to prevent spoofing. If somebody does, indeed, figure out how to break (say) a 1024-bit PGP key and "Alice" gets spoofed, HE WILL KNOW because he will see a message with his signature that HE KNOWS he didn't send. At that point, he will at least be able to reduce the number of spoofed messages to 1 before he alerts us that there is a problem. We won't necessarily know who to believe, of course, but we will know that one of a number of this is probably true: 1 "Alice" is lying to us. (by far the most likely.) 2. Somebody actually has physical access to "Alice's" machine and is actively using it to spoof messages. 3. Somebody found out how to break 1024-bit PGP keys easily. (Very unlikely, of course.) >A chain is only as strong as its weakest link; Alice recognizes this, and >makes no claim that PGP itself is the weak link. But "Alice" resists using ANY chain at all!

2 1

San Diego Cpunks Physical Meeting
by Chris Claborne 17 Dec '03

17 Dec '03

San Diego Area CPUNKS symposium Thursday, December 7, 1995 Invitation to all Cypherpunks to join the San Diego crowd at "The Mission Cafe & Coffee Shop". Get the latest update of Lance Cottrell's anonymous e-mail server, "mixmaster", exchange keys, and discuss other topical subjects. If you are in to what's happening on the list, encryption, privacy, The Mission is the pace to be. Don't forget to bring your public key fingerprint and forms of identification. If you can figure out how to get it on the back of a business card, that would be cool. Drop me a note if you plan to attend. Place: The Mission Cafe & Coffee Shop 3795 Mission Bl in Mission Beach. 488-9060 Time:1800 Their Directions: 8 west to Mission Beach Ingram Exit Take west mission bay drive Go right on Mission Blvd. On the corner of San Jose and mission blvd. It is located between roller coaster and Garnett. It's kind of 40s looking building... funky looking (their description, not mine) They serve stuff to eat, coffee stuff, and beer. See you there! New guy, bring your fingerprint. 2 -- C -- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Re: The future will be easy to use
by Rich Salz 17 Dec '03

17 Dec '03

>There is more to this problem than how it is that I trust the key. There >is also what I trust it for. ... >It is hard to see how to record the information about how much I trust the >receipent's systems security. Bingo! This is one of the hard parts of certificate authorities; just what are you attesting to? The American Bar Association has a big document for public review that addresses what this might mean; there are a couple of RFC's that specify CA policies (one from COST in Sweden, I think), and RSA and/or Verisign will give you their policy in hardcopy. In x.509v3 certificates, there is an extensible field where the key-signer can put arbitrary data. The intent is apparently that you put the ISO object-ID (you know, those funny 1.3.2.11.... numbers) of the policy document. There is, of course, no way to interpret the semantics of this electronically. It will be interesting to see how various companies address this issue, for example as they start to support arbitrary CA's in browsers or servers while doing commerce over the web. /r$

2 1

Re: key for Alice as promised (not)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Tue, 28 Nov 1995, Adam Hupp wrote: > >> >Can you imagine?? I'm simply not willing to fool myself into thinking >> >that I ahve security by posting a key and using PGP. >> >> Unless you can post some proof that PGP is insecure, stop insisting it is. > >PGP is really not the issue. The issue is more my security and the >environment that I use PGP in. I don't have a trusted machine to run PGP >on. Anyone who wants to can come up to machine and copy my secret keyring >or they can even watch me typing my password in. > >So, I don't fool myself, and I don't use PGP, except for things like >exchanging a one-time pad with someone when I've already sent the message >out across another delivery mechanism, like on a floppy delivered my >courier. > >Alice de 'nonymous ... You're a bonehead. On the one hand, you FAIL to stop or dramatically reduce claimed spoofings of your notes by using PGP (which would almost certainly work perfectly for this limited purpose) yet you claim that you'll only trust PGP in a limited scenario of courier-delivered data! Talk about "penny-wise and pound foolish"! Wake up, idiot! The purpose of encryption and signing and such is to REDUCE problems, ideally to zero but if not to some adequately small value. To fail to use signing when there is no ongoing problem is risky; to not use signing when there is a serious continuing problem is downright lunatic. That sets up an irresolvable contradiction: On the one hand, you're willing to tolerate a continuing problem, yet on the other you claim that your standards are so high that you won't use a system unless the probability of security essentially precludes a loss of security. Now can you see why we're laughing?

2 1

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

At 03:30 PM 11/28/95 EST, Carl Ellison wrote: > Of course. This isn't the base case. We would have some keys which I sign > based on my own personal knowledge; things handed to me by people I know; > some possibly published in the paper where the real key owner would see the > claim and be able to contest it. You are making the same erroneous assumption that Phil made when he designed the Web of trust: You assume that it is important and interesting to link key ID's to physical bodies. This is usually not the case: Linking key ID's to home web pages etc is not only easier -- it is also usually more interesting and important. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2