December 2003 - cypherpunks-legacy

Re: "Gentlemen do not read each other's mail"
by Rich Salz 17 Dec '03

17 Dec '03

>They probably should do, the NSA was critical in ensuring the demise >of the USSR and in maintaining stability throughout the cold war period. Please explain.

1 0

Re: [rant] A thought on filters and the V-Chip
by jim bell 17 Dec '03

17 Dec '03

At 11:56 AM 1/26/96 -0800, Alan Olsen wrote: >[Not Perry(tm) approved -- Skip of this offends you] > >I am waiting for someone to come out with a product that will modify the >v-ship (or the various internet "protection" tools) in such a way that it >scans *FOR* pornography. > >Porn is big business. You would think that people would pay for a way to >sort through all of that non-smuttiness and just "get to the good stuff". I >also imagine that as soon as such a product appears, the censors will scream >bloody murder. Sigh! Wonderful idea, but sadly it probably will never be allowed to work, for exactly the obvious reasons. (I know that sounds like an odd argumnt to get from ME, considering MY idea...) On the other hand, this would be an EXCELLENT "argument" to bring in front of a Congressional committee considering the adoption of any V-chip type proposal. Once they discover that a ratings system could be used for the diametrically opposite reasons of their reason for having it in the first place, they'll try to modify their proposal to prevent this. If we're lucky, this'll have the effect of killing the whole concept of government-sponsored (required?) V-chip-type technology. OTOH, I agree with other posters who think that truly voluntary content selection would be an excellent addition to television: In effect, an automatic, programmable TV-Guide search engine.

2 1

Subscription
by MatriX Spider 17 Dec '03

17 Dec '03

I'd like to subscribed to this mailing list. Thanks for your time.

1 0

Windows PGP mail reader
by jims＠conch.aa.msen.com 17 Dec '03

17 Dec '03

Hi. Can anyone recommend a Windows based email/POP3 reader that can decrypt content? Please reply via email: Jim Schueler jims(a)msen.com

3 3

Time codes for PCs (fromn German Banking)
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:11 PM 1/24/96 -0500, Dave Emery wrote: >> >> Was the person in the basement eavesdroping or actuall performing a >> man-in-the-middle attack? >> > Very much the easiest way of doing this is a classic man in the >middle attack with two vanilla off the shelf modems and a vanilla off >the shelf central office simulator. The modems would be tied more or >less back to back through two serial ports and software on a laptop in >the basement, one modem connected to the actual phone line to the central >office and the other connected to the local wires to the targets home >through the central office simulator. This way all traffic in both >directions would go through the modems and software on the laptop >allowing the connection to be taken over cleanly between packets, and >packets to be injected and deleted as needed. I beleive that it would >not be hard to make such a MITM decode the DTMF dialing from the target >and dial the same number on its outgoing modem thus enabling the >MITM to passively relay modem calls it wasn't interested in spoofing. >And incoming modem calls could be similarly handled. A peripheral I've long wanted to see, commonly available: ACCURATE time, broadcast to the millisecond/microsecond/nanosecond, available from sources as varied as TV VIR's, FM subcarriers, and other sources, available as an easy input (via a peripheral card) to a computer. I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, and had the foresight to install it with its computer interface option. (receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, containing "exact" time.) While I've never taken the time to connect it to my PC, it provides (through an RS232 jack) correct time with a rated accuracy of about 5 milliseconds, as I vaguely recall. (Even has a dipswitch setup on the bottom to tell it how many 500 mile increments you are away from WWVB... corrects for delay to a first order of magnitude.) (BTW, if anybody knows how to easily connect it to the pc, or has the appropriate software, please tell me The task isn't difficult from a hardware standpoint; it's just RS-232 serial ASCII timecode at about 9600 bps which either continuously retransmits or on request. The problem is the software: How, exactly, do I INTERFACE such a serial input to the existing computer/RTC combination? (Don't tell me to plug it into an unused serial jack! I'm not stupid. I'm not a programmer, and I don't play one on TV! (I know gates, flops, op amps, A/D, D/A, microprocessor hardware design, even some Z-80 assy language, RF, and I've programmed in Fortran, Basic, APL, Algol, PL/1, Pascal, LISP, but not recently and I don't enjoy it!) (Then again, there are those "Receptor" watches which have (at least) similar accuracy, which as I understand it work on FM subcarrier principles.) Technology has now supplanted this old monstrosity: Even with CHEAP GPS receivers, they put out time which is rated in accuracy to well better than 1 microsecond, and probably better than 200 nanoseconds even with S/A turned on, and probably 100 nanoseconds with S/A off. Once GPS receivers contain equally cheap DGPS receivers, they'll be able to tell you your location to about 1 meter and corresponding time accuracy, about 3 nanoseconds. I'm not particularly familiar with TV VIR signals, but I'd imagine they are timecoded, or at least they COULD be without a lot of effort. Resolution would be FAR better than 1 microsecond, and accuracy would be primarily limited by knowledge of your location compared to the xmitter. MITM attacks would be far more difficult if both ends of the data conversation agreed on the "exact" time, and could detect transmission delays and CHANGES in transmission delays. While it would be possible to locally spoof the accurate timecode, a cheap version of a "disciplined oscillator" (which any GPS receiver is going to have, anyway) would detect such short-term spoofing trivially. Occasionally, I've speculated on whether it might be useful to be able to synchronize (or, at least, KNOW) to the PHASE of the 60 Hz power grid. True, I know that the HV grid is 3-phase and most people won't know which phase they're on anyway, but that wouldn't change (at least not frequently!) , and I would imagine that it might be useful. You wouldn't necessarily know which CYCLE you're on, either, but again that might be compensated for somehow. If your computer were talking, locally, to another computer at 4100 baud (? whatever) (7 bits per symbol(?); equals 28.8kbps) you could "easily" agree on a particular cycle relationship, which is going to be essentially constant over a distance of a few tens or even hundreds of miles. What I DON'T know (and some HV transmission engineer will probably be able to tell me, hint hint!) is how STABLE this phase is across the entire country? I realize that this will probably depend on who'se shipping excess power to whom at the moment, But I'd imagine the variability will be distinctly limited. The biggest attraction of such a system is that the interface would probably be trivial: Getting it from the P/S is out because they didn't anticipate such a thing. The easiest interface might be an AC wall xformer with a rectifying limiter and slicer (Okay, maybe just a resistor and a diode, possibly with the addition of a comparator for precision), driving a readable pin on an otherwise-unused RS-232 interface. (Possibly installed similar to a dongle.) Appropriate software (yucch!) would read the square waves, and record the phase at any one time. Such information could be used to verify the relative synchronization between two different computers, although it would be necessary to identify particular phases, as I mentioned before. BTW, if you're read this far, I think it would be appropriate to introduce myself, despite the fact that I've already been posting to this area for a few weeks. I'm James Dalton Bell (yes, THOSE Daltons!) and I'm in Vancouver, Washington, USA. I may talk like a EE, but am not; I have formal and/or informal backgrounds in Chemistry (BS Chemistry MIT 1980), electronics (analog and digital and RF (N7IJS) and uP), physics, and keep an eye on numerous other technical fields. Politically, I'm 120/120 on the Nolan chart (there's some questions they left out (that's a joke)) which means I'm a "extremist libertarian." I'm also rather newly anarchistic, and (with all due modesty) rather inventive. Current employment? None. Well, nothing to speak of. But you'll be hearing more about me. Jim Bell Klaatu Burada Nikto Remember this. It'll become important, soon. "Something is going to happen. Something....wonderful!" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQlyv/qHVDBboB2dAQHZvQP+IKeO508C7ZTA22DSELjvpWTYa0iGtTcX U486t+8P0iC9qxq346wzxm9USae4d8NOM9wBKrio095hrKnzAZQE1BETUKCx3BJv bywqin7Qjb87j6OECJ6S/eAh5t6LXMnDepGdUr7rw+gBxsNg7kzz10/TGh4pXKNu D5PuGPnTY34= =r4JO -----END PGP SIGNATURE-----

5 5

An Enigma - Wrapped In a Circle
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the January/February 1996 Mensa Bulletin on pages 9-10 is an article by Teresa Fisher titled "An Enigma Wrapped In a Circle." The article is about a phenomenon which has interested me for quite some time, "crop circles" or "pictograms." I have tried to find this excellent article on the web and failed, so I will quote a few parts of it I consider relevant. All typos are mine, Ms. Fisher is an excellent writer, and I have changed her well done presentation only for brevity and clarity. If you think that this post has "no cypherpunk relevance" you can: 1. Flame me, in *private* e-mail. [I'll happily ignore you.] 2. Go hump a tree. Article excerpts (in quotes) and my comments follow: "In the late 1970s, farmers over the world were finding unexplainable, perfectly round, flattened areas in their grain fields. The flattened crops made irreproducible, layered swirl patterns. As time went on and crop circle incidents increased tremendously, the outlines of the formations became more complex and came to be called pictograms." They appeared overnight, "[by 1990] some 2000 circles and pictograms had been formed all over the world. A large percentage...were showing up in a small area in southern England, mainly in Wiltshire Downs." "Then, in 1991, two retired Englishmen named Doug Bower and Dave Chorley announced that they had been responsible for the crop circle phenomenon for the past 13 years." The dim media swallowed this hook, line, and sinker; neglecting to question "how they created intricate, sometimes braided swirls, executed elaborate pictograms in the dark, and caused crop formations in 19 other countries besides England." Brittle plants in the (non-hoaxed) circles were also bent in a way "that no investigator has been able to duplicate." Recent tests, including some at the Oak Ridge National Laboratories, show isotope changes in the soil, and differing biophysical and biochemical properties of the grain within the pictograms when compared to adjacent grain in the field. Gerald Hawkins was not fooled. He did "a systematic study of the geometry of the circles, and found ratios of small whole numbers that precisely matched the ratios defining the diatonic scale. Further statistical analysis revealed three other geometric theorems in the circle patterns, and he realized that all four theorems had a common thread that led to a fifth, more general theorem. His inability to find any of these theorems in Euclidean geometry or any of the math books he consulted caused him to conclude that whoever is making the circles had to not only know how to prove a Euclidean theorem, but also to conceive of an original theorem. Hawkins says that proving a theorem is easy; conceiving it in the first place is quite another matter." ["FN 6 Ivars Peterson, "Euclid's Crop Circles," *Science News* 141, No. 5, pp. 76-77."] In late 1991 in Ickleton "a perfect depiction of the mathematical configuration known as the Mandelbrot Set" appeared. ["FN 9 Beth Davis, *Ciphers in the Crops,* (Bath, England: Gateway Books, 1992)pp. 9-15."] I am now experiencing Tim's wish that I could draw in e-mail, as there is a diagram here of "a circle inside a triangle inside a ring inside a hexagon inside a ring." Don't even *try* to imagine it. The article points out that "NASA will be promoting the space program with a crop circle image and the slogan, 'We need to be out there.'" [Agreed, but with *tax* money?] Back to Ms. Fisher. "I have been amazed at the need many people have to dismiss this mystery. They will ignore all of the evidence to claim that the circles are being formed by weather or hoaxers. Neither claim stands up to even minimal scrutiny. I don't know what is causing crop circles to appear, but I'm certain it isn't being done by the wind or by an old man with a board. What do you think?" I must add that anyone who has seen the cover of Robert Plant's "Now and Zen" album would have trouble believing that a couple of drunks from the pub down the street did _THAT_! I do not know if "extraterrestrials" or "UFOs" are responsible for these images. [In my long-held opinion, governments tend to lie about UFOs (surprise!).] I do feel that these pictograms, these "Ciphers in the Crops," cry out for cryptanalysis, by someone far more adept at complex mathematics than I am. Results might well be felt worldwide. Thoughts? JMR Regards, Jim Ray -- Boycott espionage-enabled software! "He that would make his own liberty secure, must guard even his enemy from oppression; for if he violates this duty, he establishes a precedent that will reach to himself." - T. Paine http://www.shopmiami.com/prs/jimray _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMQmUiG1lp8bpvW01AQE+OwP/URevvKxeTnV75DfXm0+XM9JTWR9w2ZCn 9RbdwBmVK5WTw5228x2EBNrhAQeGeksFQX9z/YEZgLCbscX1vtAT1PydSf2JBruM jOBhRX/a4MJWo4l7UcyefQwK2NyB8YXwqGoDPQKYtC9dqY0X6wuDnRWP2SGVYkG4 pf28zVDk1Vc= =MxuH -----END PGP SIGNATURE-----

2 1

Possible Java hack.
by Steve＠aztech.net 17 Dec '03

17 Dec '03

I had a brainstorm this morning, and I think that I may have a possible hack against Java that might circumvent a few network access policies and the firewalls that support them. Looking at the Java APIs it seems pretty likeley to me that when a name to address lookup is performed, all it does is call gethostbyname() or the equivilant. If this is the case (and I don't have a source license at this point, or even a system that will run Java) there is the possiblility that a sytem with control of a web server and a DNS server could coerce a Java client into initiating TCP connections to clients other than the system that provided the applet (which should be a prohibited behavior, as I read the specs.) This is still at the WAG stage, since I don't have access to source code and have not received confirmation (nor denial) from any of the vendors that I have contacted, but I'd appreciate feedback (positive or negative) from the list(s). FWIW, my WAGs have about an 80% hit ratio, but this is the first that I've posted without confirmation. ObCrypto: _When_ will DNS be secured via PKE? -- Steve(a)AZTech.Net

2 1

Re: Denning's misleading statements
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:51 PM 1/27/96, Alan Olsen wrote: >Why is it that whenever I read Denning's pronouncements I feel like I am >reading something from a villainess in an Ayn Rand novel? > >Denning has become the epitome of the pure authoritarian government world >view. Analysis of her viewpoints makes me more of an anarchist every time I >read her rants. It is that smarmy "We know better than you do" with One of the interesting things about the whole crypto debate, going back at least to the Clipper announcement (and actually some months before) has been that the pro-restrictions, pro-GAK side of the argument has almost no defenders! Except for David Sternlight, Dorothy Denning, and Donn Parker ("attack of the killer Ds"?), there are almost no public spokesmen for the pro-restriction, pro-GAK side. She has written numerous pro-GAK position papers for various conferences, journals (including the "Proc. of the ACM"), and other fora. Where are the other defenders? Even the producers of GAKked products are fairly careful to finesse their positions by saying they are only doing what they are doing because the government is paying them to, or because the export laws leave them few other options. I've never met Dorothy Denning, so I hesitate to characterize her as a villainess. But certainly she's the only noted cryptographer I know of who's gone so far out on a limb to defend a position the vast majority of computer scientists, civil libertarians, and cryptographers scoff at. (And I don't just mean it is we libertarians and civil libertarians who are scoffing, I mean that nearly every noted expert who has carefully reviewed the various schemes to control crypto and to provide GAK has found them to be essentially unenforceable except via draconian police state methods, and maybe not even then.) I personally believe her estrangement from the mainstream position these last several years and her apparent close association with the inside-the-Beltway crowd has actually skewed her judgment, that she is no longer evaluating policies and capabilities based on reasonable objective, academic analysis. Her views, and even many of her examples, are very close the views and examples used by FBI Director Louis Freeh in his testimony to Congress a few years ago. (I scanned and OCRed this testimony as a favor to Whit Diffie, so in reviewing the text for OCR corrections, I became very familiar with Freeh's fear-inducing testimony.) I don't mean this as a cheap shot against her, but I would not be surprised to see her take on some sort of "Undersecretary for National Information Infrastrucure Affairs" or somesuch position in the next Administration (no matter which side wins the election). She's become a player in the Washington game. >Depends on your ability to challenge the status quo. A vague law with lots >of harsh but undefined penalties is much more effective than something that >is rigidly defined. With rigidly defined laws, you can find loopholes and >ways to push the envelope. With vague rules, people will tend to err on the >side of caution. Psychologists call this "random reinforcement." A plethora of vague laws about intent, conspiracy, and threshold have made this the norm. When there are 25,983 distinct laws on the books, what else is to be expected? >"Hey, we found this Tim May guy down at the school playground selling crypto >to the kids! Let's throw the book at him!" "This could not have been me, Your Holiness! I would never think to _sell_ cryptography to the kids--I would give them free samples first." --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

8 7

re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by eric＠remailer.net 17 Dec '03

17 Dec '03

Thanks to Sandy Sandfort for bringing this to my attention. Date: Mon, 29 Jan 1996 15:07:46 -0500 (EST) From: Nathaniel Borenstein <nsb(a)nsb.fv.com> As you may already have heard via the popular press, First Virtual Holdings has developed and demonstrated a program which completely undermines the security of every known credit-card encryption mechanism for Internet commerce. I'm breaking my silence in cypherpunks to respond to what must be the most self-serving and fatuous expression of "concern" I've seen in a while. To wit: Ohmygod! PC's don't have perfect integrity! Will someone please write a filter for common email packages which automatically removes selected First Virtual transactions from the confirmation messages? Encryption isn't the issue, Nathaniel, and you know it. Me, I prefer bad faith over stupidity as an explanation for this latest outpouring. To all those Internet payment analysts out there: Financial institutions are in the business of risk transfer. If you don't transfer risk in some form, you're not a financial institution but rather a service bureau. Managing endpoint integrity risk is just one of the kinds of risk an Internet payments provider has to deal with. First Virtual has demonstrated time and again that they're pretty clueless about the whole subject of risk. As a result, I don't give them more than about two years longer before they go belly up. Eric

3 2

Need testing help
by Rich Salz 17 Dec '03

17 Dec '03

I need some help testing my rewrite of mixmaster. It is four separate programs (keygen, user-agent, queue process, daemon reception) writting in portable ANSI C (gcc -Wxxxx is silent). It does not include RSAREF, but has a sane makefile for it if you need. It uses autoconf. It has some bugs. If you're in the US, drop me a line. Is decrypt-only software okay to export? If so, then I have an export version, too. /r$

2 1