December 2003 - cypherpunks-legacy

Cryptographers practicing law?
by jim bell 17 Dec '03

17 Dec '03

At 01:28 PM 3/11/96 -0500, Perry E. Metzger wrote: > >anonymous-remailer(a)shell.portal.com writes: >> This is the second in a regular series of postings to expose >> cryptographers and cypherpunks who are either lying to us or >> making a very serious mistake in there judgement. > >No, this is the umpteenth stupid anonymous denunciation of people who >deserve no such stupidity. > >You aren't fit to eat Bruce Schneier or Matt Blaze's toenail >clippings. >Perry While I don't really appreciate this guy's style and anonymity any more than you do, it's a misleading argument to try to challenge his position based on (presumably) his crypto expertise or lack of it. I don't doubt Schneier's or Blaze's commanding position in that limited area, but when it comes to the analysis of a bill affecting crypto, knowledge of the technical details of crypto is far less important than knowing how a prosecutor or court will interpret any given law. I'm an "expert" in neither field, but I knew enough to worry. Further, after having read Junger's preliminary analysis, it is blatantly obvious that this bill doesn't constitute much of a step forward, and in fact is likely a retrenchment if the government has its way. The "guarantees" the bill provides aren't really guarantees at all, they are "feel-good" conditional promises, and the whole thing is so shot full of holes that it's hard to imagine that it will provide any protection beyond what we have today. As I noted in my original comment to VTW (Mr. Safdar, who hasn't taken the trouble to contradict, let alone respond to my comments) my biggest fear is that the organizations and people who originally came out in mistaken favor of this bill either won't see their mistake, or won't admit seeing it if they do. (People are funny that way; they hesitate to admit it when they are clearly wrong; organizations are even worse on this score; tiny organizations are worse still, because they must "appear" to be externally consistent yet there are few "heads" to depend on to fix mistakes.) If anything, _MY_ mistake was in believing that the rest of the bill was acceptable if a single bad section was removed; I now believe (after seeing Junger's analysis, and a much more careful reading of the bill) that a serious re-write is mandatory. (In my own defense, I had only skimmed the rest of the bill once, I focussed my criticism on the one "killer" section that I could easily tell would be the most questionable item.) This fiasco does, indeed, raise serious questions about the motivations and credibility of those who have effectively endorsed this bill so soon: It is doubtful whether we will get any accurate picture about the bill from anybody who is afraid of changing his original assessment. I'd be just as willing to listen to "experts" quoted by the people who have (so far) expressed support for this bill. Maybe, as he himself suggests, Junger is a bit too pessimistic. On the other hand, Junger has clearly raised many questions whose answers depend almost completely on the INTENT of people within the government, not the wording of the bill itself. Since I believe their intent to be uniformly bad, it is hard to imagine how anyone could resurrect confidence in this bill to anyone who was similarly pessimistic. And the people who originally claimed that the Administration would oppose this bill as "going too far" cannot now turn around and claim that the government's intent was anything other than bad, BTW. We now see how little good this bill might do, and how much trouble it might allow the Feds to cause, so it's hard to imagine why anyone would have believed the bill (if passed) would not have been signed. I predict that the organizations that have, so far, "endorsed" this bill will quietly stop doing so, but without any kind of specific retraction or apology or explanation. I also believe that they will refuse to reveal whatever legal advice they originally received that induced them to endorse it, because they probably had none. At least Leahy's bill is DOA. However, I think it would be interesting and useful to do a re-write of this bill, addressing all of Junger's concerns, mine as well, and Tim May's to boot. I recommend that we totally ignore comments such as those by Padgett Peterson which claimed that certain provision "must" be included for the bill to pass. Jim Bell jimbell(a)pacifier.com

1 0

Panorama of the Spy Industry
by John Young 17 Dec '03

17 Dec '03

http://www.fas.org/pub/gen/fas/irp/overhead/index.html _________________________________________________________ FAS Project on Intelligence Reform _________________________________________________________ OVERHEAD THE INTELLIGENCE COMMUNITY As part of our Intelligence Agency model homepage profiles of the components of the intelligence community, we are constructing a picture gallery of agency and contractor sites and buildings. These are derived from US Geological Survey and other aerial photographs. We obtained some of these initial test images from Los Alamos National Lab.

1 0

Electronic Frontiers Wyoming (fwd)
by Jeff Davis 17 Dec '03

17 Dec '03

Forwarded message: > From: eagle(a)nyx.net (eagle) > Message-Id: <9603121000.AA25993(a)nyx.net> > Subject: Electronic Frontiers Wyoming > To: kellee(a)uwyo.edu > Date: Tue, 12 Mar 1996 03:00:23 -0700 (MST) > Cc: barlow(a)eff.org (John Perry Barlow), mnemonic(a)eff.org, > brown(a)eff.org (Dan Brown), mech(a)eff.org (Stanton McCandlish), > ssteele(a)eff.org, aburt(a)nyx.net (Andrew Burt), > mbarry(a)stout.entertain.com (Bruce Dane), rcarter(a)nyx.net (Ron Carter), > eagle(a)armory.com > > -----BEGIN PGP SIGNED MESSAGE----- > > It was nice talking to you at the Information Center in the Union earlier. > You might like to know that Information Technology in conjunction with > Administration and Records has seen fit in a convulsion of gross idiocy to > publish your entire UW transcript on the World Wide Web. Anyone with your > social security number and your registration PIN can dowload your entire > transcript and post it to Usenet News if they so desire, where your grades > would be replicated in computers, and circling the planet in a few minutes. > By gross malfecence, the University of Wyoming has seen fit to *PUBLISH* *ALL* > the Non Degree seeking Graduate Students PIN in the Summer Bulletin; 4723. > > Patrick, who is a non degree seeking grad student, went ballistic when I gave > him *his* PIN to access his transcript. The web browser also writes your > social security number to the screen, so anyone watching over your shoulder > has all the information they need to violate your right to privacy. It's > really stupid to create an HTTP link directly into the cgi-bin as well. > > You can check this out for yourself at Whistle: > > http://siswww.uwyo.edu/cgi-win/homepage.exe > > Or wait until the Program Analyst I in charge of computer security at the > Water Resources Center, (they paid him more money that Math CoSci), writes > a *scathing* letter to the Branding Iron. It will be signed Patrick Malone. > > This bit of better living via Electronic Revolution has been brought to you > by your friendly neighborhood Cypherpunk. > > Jeff > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.1 > > iQCVAwUBMUVKIF4aVg6iEWoBAQETKgQAoL4xnCzIPvccRuJZTxslDXb36qC0Zhhj > DAK100FlTyAmgc8oxIJjcQ3C1f4qzKVSOj63hBXBrhdpIoIkvE0x8notQuRsl/ua > sKf6XwVWfl0vAZ2lMUn0/f/GtUU4579NMhsChXnwGADzrHnmzfB3belxVMZzxsyJ > Xc6wHukVRNU= > =wVEh > -----END PGP SIGNATURE----- -- According to John Perry Barlow: *What is EFF?* "Jeff Davis is a truly gifted trouble-maker." *email <info(a)eff.org>* *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** US Out Of Cyberspace!!! Join EFF Today! *email <membership(a)eff.org>*

2 1

Mile High Snakeoil
by Andrew Loewenstern 17 Dec '03

17 Dec '03

I was flipping through a copy of Spirit, the official magazine of Southwest Airlines, while on a flight to Vegas and found a thoroughly enjoyable advertisement for a crypto product. Underlines and emphasis are theirs. ---- Begin Snake-Oil Advertisement ---- __UNBREAKABLE__ COMPUTER SECURITY AND PRIVACY AT A __BREAKTHROUGH__ LOW PRICE! Stonewall-Drawbridge - Encryption Sytem In the face of the increasingly dangerous invasion of professional, business and personal privacy, unbreakable computer security at an affordable cost is a must. Lawyers, Accountants, Doctors, other professionals whose stock in trade is confidential information are especially vulnerable to malpractice as a result of unprotected information. It is important to deal with this very real potetial problem before it becomes a problem. Every business, every individual must also be concerned about computer security. Encryption can now be used to secure everything from credit card numbers to legal documents. Encryption through totally unbreakable Stonewall-Drawbridge is your ultimate security blanket. *Available Only to United States Citizens* STONEWALL an unbreakable, streaming type algorithm, 100 to 10,000 times faster than other encryptions. Stonewall compresses prior to encryption, eliminating the possible invasion of your computer files. Its key cannot be broken except by random chance, once in a million years. Good for DOS; Windows 3-1; Windows 95 operating systems..... ......$195 DRAWBRIDGE applies mathematical algorithms to encrypt messages and uses a quasi-infinite, one-way transfer to ensure veracity. Drawbridge uses an Infinite Venegere Key (IVK), combined with a one-way private key transfer which is impossible to break, except by chance, once in a million years. It also incorporates a forge-proof digital signature for verification and authentication insuring absolute transmittal protection. STONEWALL-DRAWBRIDGE ENCRYPTION SYSTEM provides unbreakable security protection for your "need to protect" files, archives and computer to computer transmission. The Stonewall-Drawbridge System is the ultimate encryption system, unmatched by anything else available...at a price that is significantly lower than any competitive product. This means it is affordable for every professional, business or individual who needs and seeks total and unfailing computer security....especially on the Internet.......$295 (includes a second system for your choice of contact) (800) 610-0859 Mr. Thomas <order form deleted> (30 Day Money Back Guarantee) Make Checks Payable to: HWI 747 E. Green Street, Suite 300, Pasadena , CA 91101-2119 ---- End Snake-Oil Advertisement ---- andrew

3 2

Re: How would Leahy bill affect crypto over HAM radio?
by Deranged Mutant 17 Dec '03

17 Dec '03

jim bell wrote: > Even so, it isn't clear that this new law WON'T change the rules under which > hams operate. An affirmative statement of the right to use encryption would > seem to pre-empt prior bans, except if there was some sort of explicit > exception for over-the-air transmissions. After all, the law was written I re-read the bill... it notes "wire" communications, as opposed to all forms. It also allows for previous restrictions to keep in effect, I think. Still, the distinction between wire and wireless is not clear anymore with new technologies. Certainly if enough HAMs pester Sen. Leahy about this 'oversight' positive changes could be made. [..] > Not that such an interpretation will necessarily be welcomed by some hams: > Part of the reason for maintaining the ban on encryption would be the fear by > hams that ham bandwidth will be surreptiously used by commercial services > masquerading as ham users. Encryption would make such usage difficult to > detect. Interesting point... Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: TWP on Crypto Keys
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

I think the upshot of it is that they just read the bill (and the surrounding issues) incorrectly. I read the editorial and said to myself, "they aren't reading the same bill the rest of us are reading". -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace Thaddeus J. Beier writes: >Somebody posted this editorial this morning, that includes the >following passage: > >> The Washington Post, March 11, 1996, p. A18. >> >> Security and Software [Editorial] >... >> >> Legislation introduced this month in both the House and the >> Senate would ease the export restrictions while attempting >> to meet some of the government's security concerns. Code >> makers would deposit a "spare key" to any exported >> encryption software with a trusted third-party agency... > >Now, I thought that the bills did no such thing. How could The >Washington Post get this so wrong? > >As I understand it, the bills do not in any way tie export to >key escrow. They mention key escrow only to the extent that >they specify that it is illegal to disclose the keys. > >Why would the paper get this cockeyed? Is it just a screwup, >or are they pushing for a change? > >thad >-- Thaddeus Beier thad(a)hammerhead.com > Technology Development 408) 286-3376 > Hammerhead Productions http://www.got.net/~thad

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- markm(a)voicenet.com wrote: On Mon, 11 Mar 1996 savron(a)world-net.sct.fr wrote: > > I began testing PGP a few days ago ( I'm a PGP newbie ) and I found > > that it gives out the key ID of an encrypted message . From this you > > can get the identification of the recipient of the message , if it's > > someone who has publicaly distributed his key (keyserver , homepage > > ...) . So even if you are unable to decode the message you can find > > who is the recipient of a given message . I think this is a big > > privacy problem . > > The recipient of the message is right in the "To:" header of the message. > If you anonymously remail a message, however, only the last remailer in the > chain will know to whom the message is encrypted, but the last remailer can > also just read the "To:" header. I don't find this to be a problem at all. Not everything goes via email, eg. mail exchanges via alt.anonymous. Gary - -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUVP2CoZzwIn1bdtAQGlBwF8DxnCbaU1P0pz0TQ7OkuE9kkuSgnf6Ump 3p6Ut328gqJGj7oEza5S78rjBMpHgUej =2Ymx -----END PGP SIGNATURE-----

1 0

Re: FCC & Internet phones
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Shostack wrote: > Loren James Rittle wrote: > | >Most > | >presumably use a mix of a UDP data connection and tcp for control > | >functions. > | > | OK, everything after the IP header is encrypted. I don't even know > | which protocol is in use. > > Are you willing to play Mallet? Drop IP packets, and look for > duplicates. Those are TCP. (IPSEC might handle this, but I bet there > will be broken implementations that save time by resending.) Are you saying UDP protocols don't retransmit un-acked packets? If not, then you can't be sure the duplicates are TCP. Gary - -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUVWwioZzwIn1bdtAQHQaAGA1EjYZpEKrie9t/eIohlrHCC4rUY8Dzu1 HgB+1ZbAS8X7hIRb3eSHLlBB13LZtkDH =4Tgg -----END PGP SIGNATURE-----

3 2

Re: What about PGP? (was Re: Leahy Bill a Move to Slow Crypto Exports as Much as Possible)
by jim bell 17 Dec '03

17 Dec '03

At 08:04 AM 3/11/96 -0500, Shabbir J. Safdar wrote: >I think this is somewhat skewed. Let's look at our situation now: > > We don't get to export much crypto software. > >The Leahy bill takes us to: > > We get to export lots of software that is "generally available", > "in the public domain or publicly available", or if similar > products exist already in other countries. (That's a lot of > stuff, but it's not the whole enchilada.) This is very debateable. Generally, I've found that the government will always disappoint you, in the implementation of any legislation, "good" or "bad." The "good" gets less good, the "bad" gets more bad. >We want to be at: > > We get to export all crypto software. (I mean legally; I think > we all know that export controls don't work against someone with > enough brains to post news, send mail, or use ftp) > >This is a pretty good improvement in the situation, and will hopefully >pave the way for the "whole enchilada". It's not good strategy though >to criticize this because it's not the ultimate crypto bill. I don't know about others, but _I_ haven't done that. I've made some distinct criticisms that say NOTHING about the extent to which export controls are loosened. (I leave that part of the issue alone because it is being addressed properly, unlike the matters I'm focussing on.) BTW, it has been two days since my first comment to you, however, and you have presumably seen a few more criticisms that I've heaped on a portion of the bill. Your response (or lack of it) is particularly unexpected, because you ought to be interested in defending a positive review of the bill. Sticking your head in the sand isn't a good tactic at this point. > Let's be >honest with ourselves here, this is Congress we're talking about and >this is a pretty bold step. We need to educate them to see the facts >we understand so thoroughly: "What's wrong with this picture"? If this is "a pretty bold step," then my question is, who "on our side" did they consult before they wrote this law? If, as you state, "we need to educate them..." then the implication is that this bill simply popped out without any apparent "ordinary-crypto-user/small-crypto writer-seller" input, right? In that case, we should ask "how [arguably] did they get what we wanted as well as they did?" On the other hand, if they DID get consultation from a number of "our" organizations, why didn't they fix the remaining problems? Here's a totally unsupported hypothesis for your consideration: I speculate that they DID get some input from "our" side, via some confidential arrangement, by some of those same organizations that were falling all over themselves to praise most of the bill. In other words, those organizations were subtly co-opted, although not nearly completely of course. However, those organizations then felt like they had a "hand into" the structuring of this bill, and you know how blind to faults a proud parent can be! Am I getting close to the truth here, Mr. Safdar? Tell me, Mr. Safdar, did you consult a lawyer before you endorsed this bill? Please share with us whatever legal opinions you received which induced you to speak positively about this bill. > that crypto export controls do not work, >endanger our own requirements for confidentiality, and aren't helping >contain this technology in the rest of the world. Then let's take the position that this law CAN be changed! In fact, let's insist on it. >Forcing Congress to have this debate will lay bare these facts and >hopefully embarass the Administration for their absurd policy >approach on encryption. With that limited statement I totally agree. >They say that liberty is seldom lost all at once, but a little at a time. >Regaining it is probably done this way as well. In this case, the >Leahy bill gives us back a mouthful. And the "mouthful" contains enough poison to kill our freedoms. Fortunately, the poison is easily identifiable, and is all in one spot, and should be removeable if we see it in time. So why are these people trying to shove it down our throats? Jim Bell jimbell(a)pacifier.com

1 0

spy sats
by Dan Harmon 17 Dec '03

17 Dec '03

Tonight on the Discovery Channel at 10 eastern is a program about spy satellites. Dan

2 1