December 2003 - cypherpunks-legacy

Duress
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>Ms. Wilson then gave into the pressure applied and gave >the passwords required by Justice Haggerty. Those of you who follow FIREWALLS may recall that I premote the use of "minefields" on networks, machines that should never be accessed and will trigger an alarm/response on any access. Some years ago I wrote a spec for cryptographic securing of notebooks/ E-Mail that included a "duress" capability: a "password" that, when entered would appear to be properly accepted but would report an error on retrieval. Optional was to be overwriting of any material whose access was attempted. For some time people have been puzzled when I have said that good systems protection will increase the risks to the *people* involved just as good locks on cars led to carjacking. Warmly, Padgett

2 1

Re: A brief comparison of email encryption protocols
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:01 AM 2/29/96 -0800, Laurence Lundblade <lgl(a)qualcomm.com> wrote: .....CME wrote.... >>Like X.509, my certs have an Issuing-name and a Subject-name -- but >>they're both cryptographic hashes of public keys. You can take a portion >>of those hashes [e.g., low order 12 bits] and use it to index a hash table >>of certificates or keys. The cert is more general than X.509 -- that is, ...... >Isn't using a hash as the identifier replicating the key distribution >problem that PGP has or are you including some other data that can be used >to look up the cert? I think a problem occurs when you have 20 billion of >these certs (two for every person in the year 2010 or such). A simple hash >into a table isn't going to cut it because you a single database (with >replication?) isn't going to be possible. Some hierarchical lookup like >DNS is going to be needed. The look ups are needed to check for revocation. There's a name collision on the word "hash" here. Carl was using both hashes in the same sentence. A "cryptographic hash" is a strongly one-way mapping from an input string (in this case a public key) to a number. A hash table is a data structure that uses a mapping from an input string to a number to decide where to put things. An MD5 cryptographic hash function used on PGP public keys (e.g. to get the fingerprint) is 64 bits long, so there may be a few collisions if there are 2**34 keys out there; if things scale to that point, PGP 4.1.3 need to use SHA for fingerprints instead (or in addition). Carl is proposing using a hash table (indexed by a hash-table hash of the cryptographic hash) to store public keys; that's a separate problem, though of course if you want to store 20 billion keys in one place, there are better data structures than simple hash tables. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Netcom and Credit Cards
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: > > The "credit card numbers were stolen" point, that I believe Ed Carp was > > referring to, had to do with the Mitnick affair, and is very old news. > > The fact that they had been stolen was mentioned in an edition of 2600 > 6 months before the Mitnick saga. Netcom had been told about the > security breaches many times, but refused to acknowledge that their > site was insecure. It was this arrogance that pissed people off > more than their insecurity. As someone who was involved in the recent iKP / SEPP /STT / --> SET event I would like to point out that it was the storage of CC numbers in databases connected to the Internet which was the primary concern of credit card companies. Sending credit card numbers across the internet in the clear was to an extent a side issue. Clearly if the merchant was nopt going to be able to store the number the number would have to not be received in cleartext by the merchant. Phill - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToR2yoZzwIn1bdtAQEBDAF+Mgb3VluBwhqkjIgPCJ5YurkDWWm9MRwg RJoqXdalTBmM20ldY5qddiuTGoxni4ac =9L/X -----END PGP SIGNATURE-----

1 0

(fwd) USA / Australia - Civil Liberty
by unknown＠example.com 17 Dec '03

17 Dec '03

Path: news.aus.world.net!news.us.world.net!usenet From: tomk(a)world.net Newsgroups: aus.legal Subject: USA / Australia - Civil Liberty Date: Sun, 03 Mar 96 01:59:02 PDT Organization: (none) Lines: 78 Message-ID: <4hbcu6$jco(a)news.i.net> NNTP-Posting-Host: portland04.world.net Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Newsreader: NEWTNews & Chameleon -- TCP/IP for MS Windows from NetManage 1 March, 1996 At 1:50 pm today PST in the Federal Court of the USA in the State of Oregon, an Australian national Ms. Amanda Wilson was unfairly incarcerated by Justice Haggerty of the US Federal Court. During her incaceration, she was denied legal counsel, her request to have her embassy contacted was refused and she was informed by the Sherrif of Oregon, that she had no rights until she was transferred to a Federal Jail. This individual was a witness in a civil case and was neither named as the plaintiff nor the defendant. Work that she had performed for the plaintiff under contract was not being paid for by the Plaintiff and Ms. Wilson was not inclined to provide the information without her agreed remuneration. Justice Haggerty then claimed that Ms. Wilson was an agent of Koltai Inc and Thomas P. Kotlai and that her work was not Intellectual Property owned by herself until remunerated. Ms. Wilson claimed that she had evidence that she was acting as an independent agent. Justice Haggertys' response was that "I'm not interested in your evidence". Justice Haggerty ordered the Sherriff to detain Ms. Wilson for Contempt of court. Ms. Wilson then informed the court that she had done nothing wrong and that she was an Australian resident. The sherriff and his assistant then handcuffed and removed Ms. Wilson to the holding cells on level four of the Federal Courthouse in Portland. She requested leave to contact her embassy. This was refused. She requested the right to counsel, this also was refused. She then requested that the sherriffs office contact her parents in Australia to notify them of her arrest. The sherriff refused this request. She was then photographed, finger printed and informed that she would be removed to a jail later that afternoon if she did not comply with the courts order to divulge the passwords giving Ausnet Services Pty. Ltd. free access to her Intelectual Property. Justice Haggerty then visited Ms. Wilson in the holding cells to counsel her. Ms. Wilson requested from Judge Haggerty that she be allowed to contact her father and/or the Australian Embassy. Justice Haggerty declined this request. Ms. Wilson then gave into the pressure applied and gave the passwords required by Justice Haggerty. During her three hours and fifteen minutes of incarceration Ms. Wilson was humiliated with a personal body search. Threatened with transport to a jail in California. Informed that she had no rights and was generally verbally and mentally abused. Under USC 28, 1603, (B)(3) Ms. Wilson is an alien and the US Federal court has no jurisdiction over her. It is the opinion of this individual that the US Federal Court has exceeded its authority and has failed to recognise the civil rights of an Australian National. This file was posted by: Thomas P. Koltai Ex Managing Director of Ausnet Services Pty. Ltd. (http://www/world.net) Mobile: 1-503-260-3666 -- "I mean, after all; you have to consider we're only made out of dust. That's admittedly not much to go on and we shouldn't forget that. But even considering, I mean it's sort of a bad beginning, we're not doing too bad. So I personally have faith that even in this lousy situation we're faced with we can make it. You get me?" - Leo Burlero/PKD +---------------------+--------------------+----------------------------------+ |Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | |proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | |proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | +---------------------+--------------------+----------------------------------+

2 1

(Fwd) Gov't run anon servers
by James Caldwell 17 Dec '03

17 Dec '03

This states that some anonymous remailers are run by various gov't and that encryption keys up to 1000 bits are crackable. Whether this is true or disinformation, you are using a 1024 bit key and all your messages through anonymous remailers are encrypted aren't they? Also note that while later versions of PGP are capable of larger keys, that these versions of PGP are not known to be secure. PGP 2.3a is the last version released prior to gov't interference. PGP 2.3a will do 1264 bit keys if you enter 1264 in the box instead of the number it askes for when if asks for the type of key security you want. ------- Forwarded Message Follows ------- alt.privacy.anon-server,alt.anonymous.messages,alt.anonymous, talk.politics.crypto,alt.politics.org.covert,alt.politics.org.nsa,alt.politics.datahighway, alt.culture.internet,alt.culture.usenet,alt.cyberspace,alt.conspiracy From: an366601(a)anon.penet.fi (** CRAM **) Date: Sun, 3 Mar 1996 13:15:55 UTC Subject: Strassman & Marlow comment on NSA/remailers Forwarded message: >From ausman(a)wired.com Tue Feb 6 01:42:13 1996 Message-Id: <199602060109.RAA09056(a)wired.com> To: sameer(a)CSUA.Berkeley.EDU Subject: has this been on cypherpunks? Date: Mon, 05 Feb 1996 17:09:17 -0800 From: Jim Ausman <ausman(a)wired.com> Received: (from daemon@localhost) by wired.com (8.7.3/8.7.3) id QAA27559 for pork-list; Mon, 5 Feb 1996 16:13:51 -0800 (PST) Received: from [204.62.132.47] (mckinley.wired.com [204.62.132.47]) by wired.com (8.7.3/8.7.3) with SMTP id QAA27543 for <pork>; Mon, 5 Feb 1996 16:13:43 -0800 (PST) Message-Id: <v0213050bad3c4c88b88d(a)[204.62.132.47]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 5 Feb 1996 16:14:37 -0800 To: pork(a)wired.com From: kate(a)hotwired.com (Kate McKinley) Subject: CIA and you Sender: owner-pork(a)hotwired.com Precedence: bulk Status: O >Sorry to send this through the "help email address" but I couldn't find >your news email address. >I attended last weeks "Information, National Policies, and International >Infrastructure" Symposium at Harvard Law School, organized by the Global >Information Infrastructure Commission, the Kennedy School and the >Institute for Information Technology Law & Policy of Harvard Law School. >During the presentation by Paul Strassmann, National Defense University >and William Marlow, Science Applications International Corporation, >entitled "Anonymous Remailers as Risk-Free International Infoterrorists" >the questions was raised from audience (Professor Chaarles Nesson, >Harvard LAw School) - in a rather extended debate - whether the CIA and >similar government agencies are involved in running anonymous remailers >as this would be a perfect target to scan possibly illegal messages. >Both presenters explicitly acknowledged that a number of anonymous >remnailers in the US are run by government agencies scanning traffic. >Marlow said that the government runs at least a dozen remailers and that >the most popular remailers in France and Germany are run by the >respective government agencies in these countries. In addition they >mentioned that the NSA has successfully developed systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they semselves use 1024 >bit keys. >I ask Marlos afterwards if these comments were off or on record, he >paused then said that he can be quoted. >So I thought I pass that on. It seems interesting enough, don't you >think? >Best >Viktor Mayer-Schoenberger >Information Law Project >Austrian Institute for Legal Policy Kate McKinley kate(a)hotwired.com CAVE CANUM \ \ \ \ \ \ \ \ \ | / / / / / / / / / / _______ ________ _____ _____ _____ /// \\\ ||| \\\ /// \\\ |||\\\///||| ||| ~~ ||| /// ||| ||| ||| \\// ||| ||| __ |||~~~\\\ |||~~~||| ||| ~~ ||| \\\ /// ||| \\\ ||| ||| ||| ||| ~~~~~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ / / / / / / / / / | \ \ \ \ \ \ \ \ \ \ C y b e r s p a t i a l R e a l i t y A d v a n c e m e n t M o v e m e n t --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi Yet she became more and more promiscuous as she recalled the days of her youth, when she was a prostitute in Egypt. There she lusted after her lovers, whose genitals were like those of donkeys and whose emissions were like that of horses. So you longed for the lewdness of your youth, when in Egypt your bosom was caressed and your young breasts fondled. Ezekiel 23:19-21 Fight the Communications Decency Act or suffer not being able to transmit the Bible online. http://www.cdt.org/ I like cats, probably more than I should. They are cute, cuddly and kill things and then lay them at my feet in tribute.

1 0

Any Ideas??
by electro 17 Dec '03

17 Dec '03

Hello im new to this mailing list and I have seen alot of talk about re-mailers. I run my schools netconnection (it was just a Win 3.11 Computer before i got there) And I have installed Linux 1.2.8 (Slackware 2.3) (T-1 Connect!!!) I want to setup as mutch anonmized stuff (It whould all be free) that I can find. I have wrote shell scripts that let you ftp stuff and then download it by zmodem. But i havent benable to find WWW Baised Remailer Software or The software that anon.pennet.fi uses (not sure the name for it) If you have any ideas, or Places where I can find this software. Please e-mail me

1 0

Re: Duress
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:49 PM 03/3/96 EST, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >"A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> writes: >> Those of you who follow FIREWALLS may recall that I premote the use of >> "minefields" on networks, machines that should never be accessed and will >> trigger an alarm/response on any access. >> >> Some years ago I wrote a spec for cryptographic securing of notebooks/ >> E-Mail that included a "duress" capability: a "password" that, when >> entered would appear to be properly accepted but would report an error >> on retrieval. Optional was to be overwriting of any material whose access >> was attempted. > >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. > Many (if not most) alarm companies make the duress code the *reverse* of the normal code. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTlEzsVrTvyYOzAZAQG9sAQAjfAQP6pEReh/vzx/dsJKU987FOMbqWgV Ik/NtzW7fRRzVYmruribT1ZtPQAcPTkdORZC22xHvk82E/m9Awv9q6Zhkbd29/TQ kcLQ42G3ddcUMA7EWtWtP231tofnyQtM5M7KRdIkKyT7oZdyXgjP42mysjGNDHAy wv2VcfiPwPQ= =fc6C -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: Crypto Export Legislation?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I took a look at the text of the bill. There was a line in it making it a crime to use crypto in a way that obstructs a federal investigation. While understandable, this is too vague... it could easily be interpreted (IMO) as any strong crypto without escrow of some kind. Anyone else feel this way about that line in the bill? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTorUyoZzwIn1bdtAQEWJgGA1KdA1HtbX9L0U22rBLKFouIQHQniAdA3 lvimml/i+Z/KmYSmHGqkGBwCb1hAfSxc =E2ZA -----END PGP SIGNATURE-----

1 0

Interesting Identity Hacking Experiment: www.switchboard.com
by Just Rich 17 Dec '03

17 Dec '03

http://www.switchboard.com/ is a white pages directory. Basically, it's the Database America CD-ROM on the Web. The difference is, it's writeable, and free. Pretty cool. I don't think it was wise for them to allow anyone with an email address to change anyone else's white pages entry, though. Can anyone think of a prominent politician who would be in the phone book? The freeform "more information" field is just asking to be used. Potentially interesting applications for anonymous web proxies and secure pseudonym servers. At least they don't make direct changes to the database -- I'd guess they only set a flag to look in the separate user-supplied file. I.e., I changed my entry, then hit "unregister," and all the original information returned immediately. -rich

1 0

Leslie Fish address?
by mlove＠olywa.net 17 Dec '03

17 Dec '03

Do you know of an e-mail address for Leslie Fish? m

2 1