December 2003 - cypherpunks-legacy

NSA net trolling
by Eric Murray 17 Dec '03

17 Dec '03

Forwarded from alt.politics.datahighway, sorry I didn't get the Message-ID when it was fowarded to me. This is possibly old news to some, but I think it needs to be spread widely. > Article 1706 of alt.politics.datahighway: > Date: Tue, 16 Jan 1996 > Subject: NSA SHORTCIRCUITING FUTURE CRYPTO CAPABILITIES > > from Global Net News > === > [Want to know the easiest way... Puzzle Palace coauthor Wayne > Madsen, in an article written for the June 1995 issue of Computer > Fraud & Security Bulletin (Elsevier Advanced Technology Publications), > wrote that "according to well-placed sources within the Federal > Government and the Internet service provider industry, the National > Security Agency (NSA) is actively sniffing several key Internet router > and gateway hosts." > > Madsen says the NSA concentrates its surveillance on destination and > origination hosts, as well as "sniffing" for specific key words and > phrases. He claims his sources have confirmed that the NSA has > contracted with an unnamed private company to develop the software > needed to capture Internet data of interest to the agency. > > According to Madsen, the NSA monitors traffic primarily at two Internet > routers controlled by the National Aeronautics and Space Administration > (NASA), one in College Park, MD (dubbed "Fix East") and another at NASA > Ames Research Center in Sunnyvale, CA ("Fix West"). > > Other NSA Internet sniffers, he said, operate at busy routers knows as > Mae East (an East Coast hub), Mae West (a West Coast hub), CIX > (reportedly based in San Jose), and SWAB (a northern Virginia router > operated by Bell Atlantic). > > Madsen says the NSA may also be monitoring traffic at network access > points, the large Internet gateways operated by regional and > long-distance service providers. The NAPs allegedly under surveillance > are in Pennsauken, NJ (operated by Sprint), Chicago (run by AmeriTech > and Bell Communications Research), and San Francisco (Pacific Bell). > > [Quote] > "Madsen claims the NSA has deals with Microsoft, Lotus, and Netscape > to prevent anonymous email." > [quote] > > "One senior Federal Government source has reported that NSA has been > particularly successful in convincing key members of the US software > industry to cooperate with it in producing software that makes Internet > messages easier for NSA to intercept, and if they are encrypted, to > decode," Madsen wrote. "A knowledgeable government source claims that > the NSA has concluded agreements with Microsoft, Lotus and Netscape to > permit the introduction of the means to prevent the anonymity of > Internet electronic mail, the use of cryptographic key-escrow, as well > as software industry acceptance of the NSA-developed Digital Signature > Standard (DSS)." > > Is the NSA really snooping on the Net? And if they are, would that > violate the agency's charter, which specifically prohibits it from > spying within the US? > > "Well, Net traffic is routed from God knows where to God knows where > around the world," says George Washington University Professor Lance > Hoffman, a professor of Communications and Telecommunications Systems > Policy at George Washington University. "So if the NSA is doing this, > they could say they are not violating their charter not to spy in the > US. That's the thing. Intelligent routers send stuff any which way." > > > -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Re: Req. for soundbites
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:57 AM 2/19/96 -0500, tallpaul wrote: >On Feb 18, 1996 19:27:04, 'frantz(a)netcom.com (Bill Frantz)' wrote: > > >>>A local TV station has asked me for an interview, after I sent a graphic >>>of a mono-digital hand gesture with the phrase "censor this!" to the >Prez, >>>Veep, and the area congresscritters (cc'd to 2 TV stations and a radio >>>station), accompanied by a 'confession' and demand for swift prosecution. > >>> >>>Anyone got any nifty sound bites I can try to toss in? >> For the record, that is not my statement, but one I was replying to. No offense, I think I may have made the same kind of mistake. > >I do not think that sound bites are the way to deal with these complex >issues. Tallpaul is right when he says that one SHOULD not deal with complex issues through sound bites. However, the mathematical model for this part of politics is Prisoner's Dilemma. (BTW It is also the model for negative advertising.) When your opponent goes to sound bites, you also must, or you will lose. The CDA fans have been using sound bites such as, "It will protect our children from netporn." and, "The net is a sea of pornography." Lost jobs and dead teenagers are the strongest images I can present on our side and still feel look at myself in the mirror in the mornings. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Encryption in software licenses...
by David J. Bianco 17 Dec '03

17 Dec '03

Does anyone have a pointer to any good discussions on how to build programs with encrypted license keys? ftp.csua.berkeley.edu used to have such a file (/pub/cypherpunks/cryptanalysis/license.asc.gz), but the archive hasn't been accessible for a few days. Although I remember this to be mostly about how to crack such schemes, it has lots of useful information about how they are designed in the first place. Thanks, David -- ========================================================================== David J. Bianco | Web Wonders, Online Oddities, Cool Stuff iTribe, Inc. | Phone: (804) 446-9060 Fax: (804) 446-9061 Suite 1700, World Trade Center | email: <bianco(a)itribe.net> Norfolk, VA 23510 | URL : http://www.itribe.net/~bianco/

1 0

COMMUNITY CONNEXION, INC. RESPONDS TO THE SIMON WIESENTHAL CENTER
by sameer 17 Dec '03

17 Dec '03

For Immediate Release - February 20th, 1996 Contact: Sameer Parekh 510-601-9777x3 COMMUNITY CONNEXION, INC. RESPONDS TO THE SIMON WIESENTHAL CENTER Berkeley, CA - In an open letter sent to the Simon Wiesenthal Center, Community ConneXion, Inc., the Internet Privacy Provider, explicitly stated its refusal to agree to their request to restrict access to services based on the content of the web pages their customers may implement using Community ConneXion services. In a letter to Community ConneXion dated February 6th, the Simon Wiesenthal Center requested that they refuse to carry messages that "promote racism, anti-Semitism, mayhem and violence." Their target in the request was not Usenet, the discussion forums on the Internet which were recently targeted for censorship by CompuServe, but the World-Wide-Web, the area of the Internet which allows anyone to serve their words and ideas to the nearly thirty million people on the Internet. Efforts are growing to regulate content on the Internet and restrict freedom of expression. Community ConneXion, Inc. is opposed to all forms of censorship. In his response to the Simon Wiesenthal Center, Sameer Parekh, President of Community ConneXion, issued a statement in reply to the Center's request that Internet providers pledge to restrict service, "Community ConneXion, Inc. considers it our civic duty to provide Internet access, services, and privacy to any individual or group, no matter what their political or social agenda." The Simon Wiesenthal Center is asking Internet providers to restrict access to individuals and groups who would use their services to promote hateful ideas. "The answer to hateful speech is more speech," said Parekh, "Rather than attempting to ban hateful speech, which does nothing to prevent the hate and the effects of hate in the long run, human rights groups should devote their time and energies towards positive activities, such as speaking out debunking the hate groups and holocaust revisionists. Only by speaking out against the hate-mongers can any progress be made. Trying to stop them from speaking will only serve to encourage them." The very same services that Community ConneXion refuses to censor may be used by the persecuted groups who are harassed by the anti-Semites and neo-Nazis to aid them to protect themselves from persecution. "Using our services someone who may be afraid of the neo-Nazis, perhaps because they live in a very intolerant town, may set up web pages speaking out against the anti-Semites, but not reveal their real name or address. In this way people can provide information and speak out against the hate without fearing any repercussions. The very same services which can help drive out hate are the very same ones which the Simon Wiesenthal Center is asking Internet providers to restrict." Community ConneXion, Inc. is the leading provider of privacy on the Internet. They provide anonymous and pseudonymous Internet access and web pages in addition to powerful web service, virtual hosts, and web design consultation. Information is available from their web pages at http://www.c2.org/. Attachments: Open letter to the Simon Wiesenthal Center; Community ConneXion, Inc. statement on the provision of services to controversial viewpoints February 19, 1996 Rabbi Abraham Cooper The Simon Wiesenthal Center 9760 West Pico Boulevard Los Angeles, California 90035 Dear Rabbi Cooper: Thank you for your letter concerning the spread of unpopular views via the Internet. Community ConneXion, Inc., The Internet Privacy Provider, is not going to censor the content of its customers' Web pages. Our statement regarding provision of services to controversial groups is attached, as well as our official policies. While the reasons to not censor Internet traffic are great, we will only describe a few of them in order to explain our decision. First, the best way to fight speech is with more speech. Second, it violates the fundamentals upon this country was founded, in particular the ideal of freedom of expression. Finally, we believe that trying to restrict harmful speech, which, for example, "conspires against democracy," does more damage to the cause of democracy than allowing the hateful individuals and organizations to speak in the first place. In order to fight the hateful speech to which your organization objects, it is more productive to speak out against the hate and the lies of the anti-Semites and neo-Nazis than to try to prevent them from speaking. By preventing them from speaking, you are giving them more allies, and more legitimacy than they would have if you merely spoke out against them and debunked their words. If you actually take proactive action towards debunking their lies, people will understand that they are actually lying. By preventing them from speaking, you are promoting the idea that they actually might have something valuable to say. Hateful action, of course, should be prosecuted to the fullest extent permissible by law. Second, this country was founded on the ideal of freedom of expression. The First Amendment to the United States Constitution is the first one on the list of the Bill of Rights. Restricting access to freedom of expression to only people with acceptable viewpoints is not true freedom of expression. Finally, and most important, restricting speech in order to ostensibly protect democracy does more to damage democracy than to help it. Censorship leads towards a more restrictive society, one which grows ever more similar to the totalitarian government of the Third Reich, which made the atrocities of the Holocaust possible. In order to prevent such an atrocity from happening again, no government must be allowed to gain the power over its citizens that was allowed the Third Reich. By asking for restrictions on speech you are asking for a return to the controls which gave the Third Reich its power. Therefore, we have taken a stance directly opposed to any and all forms of censorship. Community ConneXion, Inc. considers it our civic duty to provide Internet access, services, and privacy to any individual or group, no matter what their political or social agenda. Thank you. Sincerely, Sameer Parekh President Community ConneXion, Inc. -- Community ConneXion, Inc. on the provision of services to those with unpopular viewpoints The Internet is an unprecedented technological tool which for the first time in history has democratized communications throughout the world. It provides tens of millions of people with the tools to communicate freely and share their ideas to an audience whose size and diversity was previously unimagined. It is the embodiment of the concept of an international marketplace of ideas. As such it deserves to be encouraged and protected from those who would restrict it. There are those who would limit the use of this incredible power only to those with popular views. Community ConneXion, Inc. has a First Amendment right and a moral obligation to provide groups of all viewpoints with the ability to express their viewpoints in an unintrusive, non-harassing manner on the Internet. Given the unprecedented potential and scope of the Internet, Community ConneXion, Inc. considers it our civic duty to provide Internet access, services, and privacy to any individual or group, no matter what their political or social agenda. Sameer Parekh President Community ConneXion, Inc.

1 0

ITAR Amended to Allow Personal Use Exemption
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

>From the most recent RISKS: >RISKS-LIST: Risks-Forum Digest Friday 16 February 1996 Volume 17 : Issue 75 ... Date: Fri, 16 Feb 96 14:04:39 EST From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) Subject: ITAR Amended to Allow Personal Use Exemption Today's Federal Register contains a notice from the Department of State, Bureau of Political Military Affairs, announcing final rule of an amendment to the International Traffic in Arms Regulation (ITAR) allowing U.S. persons to temporarily export cryptographic products for personal use without the need for an export license. The product must not be intended for copying, demonstration, marketing, sale, re-export, or transfer of ownership or control. It must remain in the possession of the exporting person, which includes being locked in a hotel room or safe. While in transit, it must be with the person's accompanying baggage. Exports to certain countries are prohibited -- currently Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria. The exporter must maintain records of each temporary export for five years. See Federal Register, Vol. 61, No. 33, Friday, February 16, 1996, Public Notice 2294, pp. 6111-6113. Dorothy Denning [This will probably become known as the Matt Blaze exemption. See Matt's ``My life as an international arms courier" in RISKS-16.73, 6 January 1995. PGN] ------------------------------ Date: Fri, 16 Feb 1996 13:18:02 -0500 (EST) From: Educom <educom(a)elanor.oit.unc.edu> Subject: Spreading the Word (Edupage, 15 February 1996) *The Washington Post* has reported that a Maryland family received a number of threatening calls after a University of Maryland student used the Internet to circulate a hearsay allegation that a daughter in the family was being mistreated by her mother. Posting his message on Internet newsgroups concerned with child welfare, psychology, left-wing politics, and civil liberties, the student urged people to call the mother "at home and tell her you are disgusted and you demand that she stops." The student claims: "You should be able to write what you want on the Internet, whether it's true or not." (*Houston Chronicle*, 14 Feb 1996, 2A) ------------------------------ _______________________ Regards, "Men are not against you; they are merely for themselves." -Gene Fowler Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Net Partying Last Week?
by Bruce Baugh 17 Dec '03

17 Dec '03

I'm noticing something odd in the course of my remailer tests. There's an across-the-board increase in turnaround times for Sunday/Monday as compared with Friday/Saturday. Was there some remailer cyberbash I don't know about, or was this more likely to be a local problem? -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: Remailers not heard from; info?
by Bruce Baugh 17 Dec '03

17 Dec '03

At 03:25 PM 2/19/96 -0500, Dave Mandl wrote: > >I know that there's no sure-fire way to find signatures that aren't >prefixed by, say "--", but that's better than nothing. A fix along the lines of :: don't-send-anything-after-this might be readily applicable. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

Re: Remailers not heard from; info?
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 11:17 AM 2/19/96, Bruce Baugh wrote: >And as long as I'm asking questions :-), I see that some remailers >(hfinney(a)shell.portal.com, hal(a)alumni.caltech.edu, homer(a)rahul.net) preserve >subject lines while others do not. Is this a readily settable option? If so, >I'd like to commend it to other remailer operators. Even more important, I believe that many (most?) remailers still leave signatures in by default. This is extremely dangerous, and inconvenient too, since some mail programs make you jump through hoops to turn off the signature feature. I think it'd be a good idea if ALL remailers omitted them by default and, if anything, allowed the sender to optionally leave his or her signature in (though I imagine that'd be a rare request). I know that there's no sure-fire way to find signatures that aren't prefixed by, say "--", but that's better than nothing. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

2 1

Re: Encryption in software licenses...
by mch＠squirrel.com 17 Dec '03

17 Dec '03

On Feb 19, 14:25, "David J. Bianco" wrote: } Subject: Encryption in software licenses... } Does anyone have a pointer to any good discussions on how to build programs } with encrypted license keys? ftp.csua.berkeley.edu used to have such a file } (/pub/cypherpunks/cryptanalysis/license.asc.gz), but the archive hasn't } been accessible for a few days. Although I remember this to be mostly about } how to crack such schemes, it has lots of useful information about how they } are designed in the first place. license.asc.gz and some other related stuff is available on ftp://utopia.hacktic.nl/pub/replay/pub/cracking This all goes back to the familiar lesson for all of us reading this newsgroup, the easy way to break most practical applications of cryptography is to find a way to "work around" or "subvert" the cryptosystem being used. Consider two popular UNIX licence managers FlexLM - uses weak cryptography by default to produce licence keys, although vendors can plug in their own Elan (V4.1 and above) - can use DES or a 5-rotor enigma. Both of these are better cryptosystems than that used by FlexLM. Now, does anyone here think that Elan is significantly harder to crack than FlexLM because it uses better cryptography than FlexLM? I hope not. The Elan marketing literature makes the use of DES sound like a big advantage. But, it doesn't make any difference to the cracker. There is actually some good content in the marketing goo at http://www.globetrotter.com http://www.elan.com if you're willing to sift through it. Writing and debugging a floating network licence manager which is reliable and multiplatform is hard. For a real challenge, try and put in some sort of redundancy (multiple hosts), and keep everything sane. The danger for a software vendor is that they end up with a good software product, which has a licence manager that makes it unreliable and causes problems for customers. I've seen this happen a few times. In this senario, customers often abandon the product and stop paying for support and upgrades, which are a significant part of the income of a software vendor. If word gets around (and it will), that your licence manager is buggy will adversely effect new sales. I'm a sysadmin, and every time a licence manager craps out and needs to be restarted, users can't use their software until they can get a hold of me. For some products (I'm not going to mention names), this happens on a more or less weekly basis. Licence manager malfunctions are relatively rare with products like FlexLM and Elan. The home-grown licence managers tend to be a real problem from a systems administration point of view. Here are my free (and worth every penny you paid) recommendations to a software vendor considering some sort of software based licence management scheme. 1. Trust your customers (best choice!!!) and concentrate your efforts on producing good quality software. This way you'll get more customers, etc. Crackers will be able to get around any sort of licence-management scheme anyway (just check out Usenet newsgroups devoted to binary mods to unlock applications and distributing keys for applications) 2. Buy an off-the-shelf licence manager which has a good track-record. It will already have the worst bugs worked out. Better to spend time working on improving the software you are trying to licence. 3. If you must roll-your-own, avoid trying to write a network-floating licence scheme. These are harder to write and have a lot more potential to turn an otherwise good product into a worthless piece of crap. 4. If you must roll-your-own network-floating licence manager, be prepared to expend a lot of time and effort debugging and testing. Be sure to build in some sort of redundancy I mention FlexLM and Elan because I know a fair bit about them. This isn't an endorsement, etc. -- Mark Henderson -- markh(a)wimsey.bc.ca, henderso(a)netcom.com, mch(a)squirrel.com PGP 1024/C58015E3 fingerprint=21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer - ftp://ftp.wimsey.com/pub/crypto/README.html ftp://ftp.wimsey.com/pub/crypto/sun-stuff/change-sun-hostid-1.6.3.tar.gz

1 0

Re: NET_run
by Bruce Baugh 17 Dec '03

17 Dec '03

> 2-19-96. NYT: > > "In this new game, you'll never play with a full deck." > > Sometime next month a game will be played on the > Internet, challenging surfers to leap between sites, > solving puzzles and cracking codes that will give them > access to secret data hidden behind firewalls and > software barriers. Okay, I just checked with Wizards of the Coast, and here's the story. Netrunner is indeed a card game. As part of the intro publicity, some demo games will be run on the Web. (No, no info about that at the moment.) The rest is the intersection of overenthusiastic publicity folks and clueless reporters. "Go, marketing department, go" were the exact words of my friend. However, he also says that the game is an exceedingly cool one, and that those of you who like the collectable card games should check it out. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0