December 2003 - cypherpunks-legacy

16B_uys
by John Young 17 Dec '03

17 Dec '03

3-18-96. TWP: "FBI, CIA Try to Set Turf Rules as Bureau Branches Out." The growing FBI overseas contingent is establishing liaison relationships with foreign police and intelligence groups that already have relationships with CIA personnel. The FBI agents abroad also try to develop their own clandestine informants, sometimes recruiting individuals who work for the CIA or have been fired by it. At a gathering Feb. 3-4 in Davos, Switzerland, FBI Director Freeh met with six presidents, seven prime ministers and three foreign ministers. 16B_uys

1 0

NSA denies our 3DES license application
by Phil Karn 17 Dec '03

17 Dec '03

Last month, Qualcomm filed with the State Department an application to export my IP Security (ESP) code for KA9Q NOS to Singapore. Our stated purpose was to encrypt an Internet "tunnel" between Qualcomm's US facilities and our office in Singapore, which is staffed by two US citizens. We stated that the software would be used solely for this purpose and would not be transferred to anyone else. Our application indicated that the software in question supported both single and triple DES. On March 11, the Office of Defense Trade Controls returned our application stamped "RETURNED WITHOUT ACTION". The following form was attached: United States Department of State Bureau of Political-Military Affairs Office of Defense Trade Controls Washington, DC 20520-0602 MAR 11 1996 [stamped] IN REPLY REFER TO DTC CASE - 664149 The enclosed application has been voided and is being RETURNED WITHOUT ACTION for the reasons indicated below: _X_1. Submit a new application including all required background and documentation. Do not return the enclosed application. [25 other unchecked items omitted. These referred mainly to administrative problems like "you used the wrong form", "you didn't file enough copies of the supporting technical data", etc. _X_27. Please submit another license [sic] once your software has been modified so that it no longer contains triple DES. Please specify object code only on your license application. [signed] Darlene Staniszewski Licensing Officer (703) 875-5677 [end of form] So there you have it. NSA makes good on its threat to ANSI X9 that triple DES would not be exportable. This was a case where keeping strong crypto out of the hands of terrorists and unfriendly governments was clearly not at issue. It dealt strictly with the ability of a US corporation to defend its international operations against against industrial espionage. Or, perhaps more to the point, espionage by the NSA. Certainly seems like a good argument in favor of the Leahy bill to me. One mildly interesting thing about this form letter response is that item 27 appeared to be part of the standard form -- it wasn't typed into an "other" field of an existing form. Perhaps they added it to the word processing file for this one occasion. Or perhaps they deny triple DES exports so regularly that they now have a standard form item to deal with it. Phil Karn

1 0

Re: InfoWarCon V 1996: Call For Papers
by jim bell 17 Dec '03

17 Dec '03

At 09:29 AM 3/18/96 -0500, Mark Aldrich wrote: >I personally know Winn and several of the folks from NCSA. You're stuff >would be a FANTASTIC contribution, and I'm certain that it would be a >popular session. Yes, some of these folks are a bit "establishment," but >they go to these things looking for new ideas, new perspectives, etc. Well, I've forwarded the essay as is. If they really insist, I'd cut it down to a 1-2 page summary, but I suspect that if it catches their attention they won't mind reading the extra material. >You sound like a guy who can hold his own in a debate, so I imagine >you'll have no problems dealing with this crowd. They may "challenge" >your views, but you're not going to get attacked or anything. You're probably right, but some of the more perceptive ones may shit bricks when they discover what the stakes really are. The REALLY perceptive ones will know that it doesn't make any difference, whether or not they like the idea or me, it's on the way. >Don't read too much into this. Last year, we had Eric Bloodaxe (Chris G) >there, a host of, uh, shall we say "fringe" elements, and I think Eric >Hughes was there (?Eric? Sarah and I *think* we saw you there?), as well. >As far as an "agenda" other than the published one, I think you're probably >being overly concerned. It's actually a fun con and you'd be surprised >the number of people willing to actively listen to anyone they even think >might remotely be a "hacker." > >If you show up trying to "one up" folks, however, you may not get what you >want. It's more of a cooperative, interactive forum; Not a competition. It's not that I'm trying to "one up" them; it might happen automatically. Let me give you a real-life example: I first published the essay on FIDOnet, as well as list called "Digitaliberty," run by Bill Frezza. Frezza's list paradigm was to develop a way to enable the net to stay free in an unfree world; my idea had the prospect of not only making/keeping the net free, but also dragging the rest of the world into freedom whether it liked it or not. (As well as eliminating war, governments, and a few other minor details.) A few weeks after I started publicizing AP, the list went down for a few days and when it eventually returned, I was not among the subscribers and Frezza studiously ignored my inquiries. As you can well imagine, Frezza's original idea was good, it was merely too limited and was overtaken by progress. It would have been easier for him if he had opposed the fundamental concept of net freedom, or believed my position to be impractical or technically flawed. As it was, there was nothing he could do. Jim Bell jimbell(a)pacifier.com

1 0

"Physical Reality IV"
by Duncan Frissell 17 Dec '03

17 Dec '03

Bad Boys, Bad Boys Whatcha gonna do? Whatcha gonna do when they come for you? Bad Boys, Bad Boys repeat endlessly. We did 4) two weeks ago. Here are some more points. 5) The Bad Boys must know where you are. The general problem that Bad Boys face when policing cyberspace (and indeed the whole modern marketplace) is that it is a "target poor" environment. As we saw in the last piece, the basic tactical reality is the force ratio that can be applied to a territory. How many bodies can you deploy per unit of land to control it. Even before you consider the size of the enemy force, you have to consider the size of the territory. This same calculus applies equally to civilian law enforcement. Another basic tactical problem is what von Clausewitz in "On War" called the "fog of war." This is the very great problem of knowing exactly where your opponent is and what he is doing. Note how computers can expand the "space" to be controlled. Even before the Internet became big, the problem can be seen in this excerpt from Sterling's "Hacker Crackdown" (http://www.usfca.edu/crackdown/crack_6.html) "About twenty-five boards vanished into police custody in May 1990. As we have seen, there are an estimated 30,000 boards in America today. If we assume that one board in a hundred is up to no good with codes and cards (which rather flatters the honesty of the board-using community), then that would leave 2,975 outlaw boards untouched by Sundevil. Sundevil seized about one tenth of one percent of all computer bulletin boards in America. Seen objectively, this is something less than a comprehensive assault." Today, 30,000 web sites are created each month or so. Just logging them is hard much less ruling them. The fact is that cyberspace is so vast, that it is very hard to make much of a dent in it. Policing territory is hard enough when you can see most of it. Any city cop or soldier doing house-to-house fighting can tell you that crowded cities are harder to police than open territory. Cyberspace has the topography of madness. Much of it is invisible and it grows changes and deforms with the speed of the thoughts of the millions of its "residents." And it has a doubling rate much faster than the doubling rate of "policing hours" available to the would-be authorities. Aside from sheer size and crazy topography, cyberspace can be very hard to penetrate. We on this list are well aware of the tools of obfuscation: cryptography, false identities, remailers, proxies, etc. An even bigger factor are the features of our world that we as sophisticated users don't even think about. The strange nature of the place is hard for outsiders to grasp. The "locals" always have the strategic advantage of familiarity with a territory. The speed of technological change is also problem as is the speed of "movement" within the system. Even if the opposition had the troopies to patrol the vast new territories there are these frustrating "magical" qualities of cyberspace. You block one WWW site and its content in "teleported" within minutes to another site half a world away. You require your local ISPs to interpose a "Surfwatch" interface between your captive citizenry and the free world and some of those captives don the "invisible cape" of a proxy server to get at the content they want. Then there's the "force field" of crypto to block your investigations. None of these "magical" technologies are perfect they can be defeated (sometimes) but defeating them takes resources. And so far, the Bad Boys haven't been winning too many in cyberspace. <More Tomorrow> DCF

1 0

RE: Yeo, Pea-brained Imbecile
by Michael Peponis 17 Dec '03

17 Dec '03

The Economist, 16 March 1996, pp. 42-43. Asia and the Internet: Not too modern, please Here is my two cents on the whole subject of countries wanting to recieve the technical and economic benifits of the internet, but reject groups they have moral or ethical problems with. Like myself, there are a number of subscribers on this list that maintain sites, archives, or have public domain software. Given the plethera of reports like this, I will start maintaining a list of country that will not be given access to my site, no FTP, no HTTP, no nothing, on top of that, I will hard code into all the new versions of my network aware programs to check for a domain subfix, if it is on of the black list, the software will not function. Thus until policies I find offencive are not changed, everything I create will not be acceptable or functional within those regions. I am only one person, but if this practice becomes common place, those countries will find that their access is limited to their own limited world view, and can only obtain goods and services that they create themselves. They want isolation, let them enjoy the full benifits of that decision. One thing I would like to see happen rather quickly is to eliminate thier access to usenet, or other areas of common knowledge. It seems they want the benifits of the technical expertise of the western "morally defuct" experts, but not the opinions of those ares. Well it's an all or nothing deal. Filtering works both ways, they filter out the political and sex groups on their end, we filter out the technical information on ours, I hope they enjoy what is left, which is not much. Regards, Michael Peponis PGP Key Avalible from MIT Key Server

1 0

nootropic drugs, etc...
by Phil G. Fraering 17 Dec '03

17 Dec '03

Path: hks.net!news-mail-gateway!owner-cypherpunks From: asgaard(a)sos.sll.se (Asgaard) The reason FDA has not approved this drug is most probably because it does not make mildly retarded boys less retarded. But of course, ... Well, it wasn't until the past year that the FDA approved depakote for things like bipolar disorder. It can be prescribed for seizures. Psychiatrists have been prescribing it to their manic-depressive patients for the past ten years to help with their "seizures" when the patients have been unable to tolerate the lithium to treat their "seizures." (Depakote is usually used as an anticonvulsant.) I suspect the FDA hasn't ever approved _anything_ as a nootropic. And I guess the nootropic in question isn't useful for something else. Depakote has been known safe and successful for about ten years for the treatment of bipolar disorder. It's been approved for that for the last year. If the FDA had been more zealous, they would have probably forced many people into nine years or so of the progression of bipolar disorder _or_ lithium toxicity. on snake oil. It becomes more difficult to uphold a pure market philosophy when it comes to poisonous snake oil or, as is often the case with potent drugs, effective oil but which will kill you from side effects after a delay. FDA has a very good reputation of not 'recommending' drugs with (delayed) adverse effects outweighing the beneficial ones. Why not let the patients research the drugs themselves? They'll find out more than their doctors will ever tell them. [...] Until this happens, trust FDA. Have you ever stopped and wondered just how many drugs out there cause birth defects, and asked yourself why thalidomide is illegal and other drugs are legal? Asgaard Phil

2 1

Cypherpunk Enquirer
by enquirer＠alpha.c2.org 17 Dec '03

17 Dec '03

THE CYPHERPUNK ENQUIRER "Encyphering minds want to know." The recent opening of One Time Pad season was a resounding success, with previously unknown competitors Internet.Security.Guaranteed throwing out the first troll. Unfortunately, the annual cypherpunk contest may have to be renamed as it has been discovered that the phrase "One Time Pad" has been trademarked by the Kotex division of Johnson & Johnson. A second entrant, Stonewall-Drawbridge, was disqualified when it was found that the so-called "Infinite Venegere Key (IVK)" is the same one used by the New York Times for its popular Sunday Cypher series. Dr. Fred Cohen, noted virus expert and President of Info-Sec, recently announced the discovery of a new Internet security threat, the telnet bomb. First discovered when Dr. Cohen found, to his surprise, that people were actually trying to access the information that Info-Sec was posting on the Internet, this insidious attack seems to only go after sites that are getting down on their knees and begging for it by announcing to the world that people are actually trying to access our site and if you don't stop, we're going to tell the CERT and the FBI on you. Info-Sec quickly announced its solution, a $20,000 "Air Wall" (tm) turnkey computer with it's serial ports and ISA and PCI bus slots filled with crazy glue. Tim May's IQ dropped ten points today after the noted cypherpunk and retired Intel engineer was stopped at the Mexican border by Customs agents, who seized and confiscated over two hundred grams of an "unspecified pharmaceutical substance". Mr. May was released on his own recognizance when presented with an Alta Vista list of over two hundred aliases he has used to post to various Internet newsgroups and mailing lists and admitting, "Yup, that's me!". Eric Blossom has announced that CPLite is NOT out of business, but the S/N ratio has been so low for the past month that no posts made it through the CPLite filtering system. Not a single subscriber has requested a refund, claiming, en masse, "Hey, that's what we pay him for!". Asgaard's popular web site, a revisionist view of Viking history, has relocated to c2.org after being shut down by his original ISP due to complaints from the French government, which has declared as illegal Asgaard's claim that the Viking raiders were not actually early terrorists, but merely law-abiding tourists who didn't take any shit from rude French waiters. Surfwatch today reinstated access to AOL after the Wall Street Journal explained that their claim that AOL was "getting into bed with Bill Gates" was standard business school terminology and did not refer to consensual sexual activities. Neither party has responded to requests to clarify who was pitching and who was catching. Jim Bell died this week when a homemade "nuclear detonator" exploded in his hands. The detonator was immediately awarded the over ten thousand dollars bet on Mr. Bell in the Blacknet "Dead Pool" when the committee decided that the detonator had correctly predicted Mr. Bell's time and place of death, and that the prediction of "death by radiation poisoning" was "close enough for cypherpunk work." Nathaniel Borenstein was arrested on sexual harassment charges today after several female employees of First Virtual reported that he had been wandering around the offices for the past two months sniffing their keyboards. Next time in the Enquirer - the photos that DIDN'T get posted at www.c2.org/party/masquerade! How far did Lucky Green get his hands up Peter Pan's costume? What was Sandy Sandfort REALLY doing with that gun, or was he just happy to see her? What WAS that strange religious icon under "Father" Eric Blossom's robe? Did Dan Farmer REALLY design the rec room? Encyphering minds want to know!

1 0

Request for reference info + Possible job offer
by Edgar Swank 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I would like people to send me (pointers to) reference information on how to write WinSock-compliant client software. Also tools required, hopefully free/shareware ones. The particular application of interest is a "web-crawler" which can log certain information in web pages it finds. If such reference information is not available or forthcoming, but there are people reading this who nevertheless know how to write such software, they are invited to contact me about contracting to write such an application for a negotiable payment. Please respond by Email, as I only subscribe to a digest of the Cypherpunks list. Edgar W. Swank <edgar(a)Garg.Campbell.CA.US> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMU4jnN4nNf3ah8DHAQEdwgP/RaYtSbT9RCA2MtR3++r6U7Sj9HAYKFZp GKunKKgDaE+/7mb08ixOq4/rtZ0THqwb9GyrYhoebKPKX3HeHIv4y4JbrG06zIMg YZQg7ex2YSZXBu2xcjuXDaVsLIdhpfBaJsuJ8RKODIFtElvXJkMpIaJFVAXg9P7K r8/2os1uMfs= =PgH7 -----END PGP SIGNATURE----- -- edgar(a)Garg.Campbell.CA.US (Edgar Swank) The Land of Garg BBS -- +1 408 378-5108

2 1

Commercial crypto in Zurich
by Joel McNamara 17 Dec '03

17 Dec '03

Just got back from doing some consulting in Europe. In the Zurich airport, there was a large illuminated sign (near the business class lounges) that proclaimed: Reliable cipher systems for absolute telecom protection TST 7790 Secure telephone, sat phone, ISDN TST 5573 F/U Fax ciphering TST 5573C Data ciphering with 10 EXP 80 Key TST 4045 HF SSB krypto modem TST 8010 Spread spectrum transceiver TST TeleSecurity Timmann Timman Gmbh Lutzing, Germany Full color photos of all of the above products were displayed. No technical details on the cryptosystems being used, but quite refreshing, considering the current state of things in the good old US of A...

1 0

Re: M$ CryptoAPI Question
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 06:27 PM 3/17/96 EST, Dr. Dimitri Vulis wrote: > I wonder if it's worth it to crack their approval mechanism so we can > add our own crypto subsystems without asking Microsoft's approval. Wait. Wait for some apps to come out that use Microsofts crypto. Wait until Microsoft makes some oppressive decisions, or is compelled to make some oppressive decisions.] I do not expect that any cracking will be needed. Microsoft will approve a freeware module for use in America, and then, alas alas, someone will leak it. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2