December 2003 - cypherpunks-legacy

Tips on Tapping Taps
by Dave Del Torto 17 Dec '03

17 Dec '03

Vernor, What's your thinking on some privacy protection measures for these types of "embedded systems?" Shouldn't these kinds of "instruments" (one ringy-dingy) have some user-defeats or -definable permissions settings built in from Day One? Do we risk e$ accounts being billed automatically by water/gas/electric meters on a daily basis without the possibility of users disputing the readings in a timely way? Is anyone proposing permissions on such boxes? What're the proposals, if any, for how the automated calls they make get billed, get scheduled and show up on customer phone bills? I wonder if the bills decrease, since this all saves the companies lots of money? I'm all for "smart houses" but I'd prefer they learn the tricks _I_ teach 'em. dave ................................. cut here ................................. >Date: 10 Apr 96 19:03:05 EDT >From: Dan Druck <73543.2304(a)CompuServe.COM> >Subject: H2O Phone Taps > >WATER METER PHONE TAPS > >Recently, I received notice from our local water department (Algonquin, >Illinois) that new water meters are to be installed in every residence. >The twist is that the new meter taps into our telephone line and >periodically and automatically reports the meter reading to the water >department. > >Perhaps this is innocent enough but, being ever vigilant about my privacy, >I've contacted the water department to get more info which they've >promised to send. Interestingly, they told me I didn't have to accept this >phone-tap meter, however they asked to install a different meter with a >similar type of reporting device which is triggered via a device that also >receives the meter reading (from just outside my house). I can only assume >this transmission is made via a radio transmitter on the meter (which >isn't really much of a consolation for me). This seems a bit oxymoronical >since there already exists an external meter gauge on the exterior of my >house. What is the advantage to standing outside my home with a >transmitter/receiver over visually reading the external meter gauge??? > >Obviously, how can one tell what the little micro-chip within the gizmo is >*really* programmed to do? As you might imagine, I'm not at all >comfortable with this thing wired into my phone line. I know..... if Big >Brother wants to, he can listen in to my phone conversations or even into >my house without such hard-wire tap. But I don't feel compelled to >willingly submit to a potential invasion of my privacy, none-the-less! > >I can only assume resisting the installation of this Orwellian device will >result in putting my name on every Barney Fife "what's he got to hide" >list - who knows. > >I urge everyone who reads this to be vigilant about such things. If you >receive such a notice from a public utility, you might be well advised to >question them as I am doing. Sadly, most of my neighbors are probably >submitting to this without a thought as I've not seen any letters of >protest to the editor of the local newspaper ....a sign of the times, I >guess. > >Dan Druck, Council on Domestic Relations >Congressional Candidate / 8th District, Illinois > >Permission to repost/reprint (in whole or in part) >is granted so long as such is accurate and proper >credit is given. 96MML12 > >Council on Domestic Relations web page: > http://www.logoplex.com/shops/cdr/cdr.html > (last update 1/5/96) >Druck for Congress web page: > http://ourworld.compuserve.com/homepages/ddruck > (last update 2/1/96) >"CDR Info Hour" Radio Program / every Saturday @ 6:00p.m. CST > Shortwave 9.400 MHz > Satellite - Galaxy 6, Trnspndr 23, 6.1 Wide Band

2 1

Re: Mixmaster through conventional anonymous remailer
by loki＠obscura.com 17 Dec '03

17 Dec '03

Since Mixmaster requires a special message format, you must have the client. You can send a completed mixmaster message throught other kinds of remailers before sending it to the first Mixmaster in the chain (although there is not much point). -Lance At 4:59 PM 4/13/96, Laszlo Vecsey wrote: >Is there a way to send an anonymous E-Mail message to anon.penet.fi and >then have it pass through mixmaster from there, instead of invoking the >mixmaster command locally? ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Is crypt(1) a prohibited export?
by cmca＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [To: cypherpunks(a)toad.com] [Subject: Is crypt(1) a prohibited export?] Is crypt(1) a prohibited export from the US? I thought it was. The reason I ask is that it has come to my attention that HP ships that overseas too, with HP-UX versions 9 and 10... The man page is a bit dated: crypt implements a one-rotor machine designed along the lines of the German Enigma, but with a 256-element rotor. Methods of attack on such machines are known, but not widely; moreover the amount of work required is likely to be large. Clearly written before CBW became popular. Chris McAuliffe <cmca(a)alpha.c2.org> (No, not that one.) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMWtg6IHskC9sh/+lAQF8gQP/XtCrYHjewBvt5EK0BVSRL99lbUqf4Cv7 xRDwlqMyBBPQ1BYOFQk4f3q+x/268EgLXcyu41zkCArdLVBImOmDNlqI8t/0PRLj JFkItIDUBrxd8buEs2LC8oNCJ4W+VyjqVsbHsKnCjmhW0MuclxZqbsaA2oFDOucV S6rkmWxb7XE= =A5mT -----END PGP SIGNATURE-----

4 7

Re: (Fwd) British Study Claims That Photo Credit Cards Don't
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"adam(a)lighthouse.homeport.org" "Adam Shostack" 8-APR-1996 22:47:00.53 > Most merchant agreements prohibit asking for more ID beyond >the card. Umm... how many places have you seen with a minimum amount chargable? That isn't allowed by _any_ of the merchant agreements that I know of, and I've seen a lot of places do it anyway. How's the card company going to notice? Most people use cash for small stuff anyway. >cpunk relevance? Most security that relies on people being awake is >broken. Security that relies on people with no financial interest in >a transactions security is broken. Studying how security breaks today >is a good idea. Quite. -Allen

1 0

Re: Scientologists may subpoena anonymous remailer records
by Jim Byrd 17 Dec '03

17 Dec '03

The complete deposition may be found in RealAudio format at http://www.northcoast.com/~grady/depo At 07:02 PM 4/9/96 -0700, John Gilmore wrote: >I thought that most or all of the cypherpunk anonymous remailers don't >keep records. Not even on backup tapes. The whole idea is that there >aren't logs. But maybe they have found some remailers that are >non-cypherpunk. And I haven't verified the truth of what's in the msg >below. If anyone hears anything, please let me (or eff(a)eff.org) know. > > John Gilmore > >Date: Tue, 9 Apr 1996 18:27:02 -0700 >To: fight-censorship+(a)andrew.cmu.edu, eric(a)remailer.net, > farber(a)cis.upenn.edu (Dave Farber) >From: jwarren(a)well.com (Jim Warren) >Subject: (fwd fyi - NOT verified!!) very urgent news > >Seems like it's just a tad overbroad, if true. Another example of, "all >the 'justice' that one can buy"? > >--jim > >>Date: Tue, 9 Apr 1996 15:44:52 -0700 (PDT) >>From: shelley thomson <sthomson(a)netcom.com> >>Subject: very urgent news >>To: jwarren(a)well.com >> >>Hello, Jim Warren: >> >> The church of scientology plans to subpoena the records of every >>anonymous remailer in the USA. >> >> I publish a news/black humor magazine on the net called **Biased >>Journalism**. As a journalist I have covered the collision between the >>church of scientology and the net. My last three issues have focused on >>legal action by the church against Grady Ward and Keith Henson. >> >> Today I had a note from Grady Ward, whose deposition was finished >>today. He said that they asked him a lot of questions about me, and >>warned me that they may issue a subpoena for me and a demand for my >>email. >> >> The church presumably intends to claim that I am not a real >>journalist because I only publish on the net. I need to prepare a legal >>defense, and needless to say, can't afford a lawyer. If you can direct >>me to any resources, I would appreciate it very much. >> >> On the basis of events today, Ward believes the church will >>issue subpoenas for the records of every anonymous remailer in the USA. >> >> If these records are delivered to the church, our First Amendment >>rights go with them. >> >> Shelley Thomson >> >> publisher, **Biased Journalism** >> 800-731-0717 voice message > >

1 0

Re: Contempt charges
by jim bell 17 Dec '03

17 Dec '03

At 10:32 AM 4/10/96 -0400, Moltar Ramone wrote: >>No doubt, a judge might whimsically keep Bob in jail for a while, trying >>to assure that he has revealed all of the pass phrases, but the judge >>can never be certain, even when Bob has disclosed everything. This >>situation creates doubt that Bob is in contempt, even when he is, and >>makes a prison term relatively pointless, unless for revenge. Despite your silly inferences below, I did not write this note that you are responding to. However, I'd be happy to enter into a $1000 wager with you on this. I'll give permission to any anonymous remailer through which this message might have passed (assuming it keeps reverse addresses, many do not) to release the original message IF I sent it. If I did not, you pay me $1000. If I did, I pay you $1000. Deal? Somehow I don't think you'll take me up on it. >But that's what a contempt charge is _for_: "You're not treating me with >respect, so I'm going to punish you." It might be described as being for >a particular reason (ie supressing evidence), but each of those reasons >ultimately boils down to lack of respect. Question: How can a judge tell he's being treated with "respect" under the conditions described? Simple answer: He can't. What, exactly, would the difference between "respect" and "no respect" be? >In addition, were I handing down (or prosecuting) the contempt charges, I'd >claim that the statement (even if it was made in public) that the individual >didn't know all the keys in the first place was a lie, and that, by repeating >the lie, they were purjuring themself. Proof would be a bit difficult under the circumstances. However, I am sure that you consider minor issues such as proof to be of no consequence.

1 0

Re: So, what crypto legislation (if any) is necessary?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Sandy Sandfort <sandfort(a)crl.com> >To which Jim Bell wrote: >> And the rest of us are tired of seeing those non-responses! >Exactly for whom is Bell speaking? Jimbo, please let us know >who has given you a limited powers of attorney to be their >mouthpiece. It's sad when someone (correctly) deems their >opinions too weak to stand without (dare I say it?) pseudo- >spoofing by reference. I got rather tired of the Jim Bell - Black Unicorn debates a while back... and I was getting tired of _both_ sides. Neither came off very well. One reason was that they kept talking past one another, as someone else pointed out a bit back and neither bothered to notice. -Allen

1 0

Re: Bank transactions on Internet
by Dave Emery 17 Dec '03

17 Dec '03

> >>>>> "Dave Emery" <die(a)pig.die.com> pessimised: > > > [... the tools are too expensive...] > > [... and the skills required are too high...] > > [... for anyone on cypherpunks...] > > Come on, Dave, this isn't alt.2600! > I want to immediately applogize to the list readership if anything in my posting seems to imply that I doubted that some of the list members possess the skills or brainpower to build a key cracker. I am sure a considerable number (at least by comparison with most other net communities) do, and many more certainly have the raw brainpower to learn the required technology if not currently up on it. Motivation and available time are another matter however. My only disparaging comment (at least as intended by me) was that the task was probably beyond some of the alt.2600 type crackers who primarily use canned programs and scripts to perpetrate their attacks. That comment was actually intended as a left handed warning about the advisablity of releasing a readily reproduced hardware key cracker design to the world at large. This seems especially true if entire FPGA array PC plugin boards are becoming a commodity item and readily available and the cracker recipe is buy one of those and install this canned software on it. > Most of the subscribers to this list are professionals -- engineers, > programmers, mathematicians, lawyers -- not phone phreaks. I'm sure > that there are more than a few of us with the knowledge, experience, > and free access to the resources needed to handle most relatively > small-scale designs like this. > > (It's like saying that no one on cypherpunks has access to the > distributed computing resources necessary to perform other sorts of > brute-force cracking -- which is patently ludicrous.) > I'm sorry, but rereading my post I simply don't find the statement that cypherpunks readers couldn't carry out the task, My comments were directed at the original cost and effort estimates that I thought were a little low - I'm certainly aware that many cypherpunks list members are working professionals or grad students/researchers with very considerable "free" resources at their beck and call. And even the pessimistic resource estimate I posted is not beyond motivated people. particularly if they see a large profit or advantage in it. But most importantly I may be making a very nieve assumption about the list readership - that it is mostly good guys and not thieves preparing to rip off hundreds or thousands of credit card numbers/ bank access codes from the Internet for gain. It is the implication that for this thief group it would be an easy $400 project to *design* and build a useful key cracker that I was challenging. (I might add that there certainly are other easier ways of obtaining large numbers of credit card numbers and access codes by such means as tapping unencrypted non-Internet data or voice communications and/or altering existing credit card terminal firmware to make it save up and deliver credit card numbers via a backdoor or bugging device. Gaining illegal access to the phone cables or credit terminals at a mall is certainly easier for most crackers and more typical of their experiance base than designing efficient pipelined key schedulers that fit into an FPGA). Presumably most of the competant, talented cypherpunks who could easily design a cracker are already far too well paid for these design skills to have much of any motivation to build such hardware for criminal purposes. And I might add that to my knowlage (admitedly rather limited) I know of no hardware crackers having been built with this technology (at least outside of the classified world). If it really is a simple trivial project that can be carried out with $400 worth of resources why aren't there NYT front page articles about someone having built a useful one and cracked something ? There certainly are lots of ambitious young grad students with lots of resources available to them and time to do this who would love to make their reputation by being the first to crack DES in under a week ... > For instance, from where I'm sitting in my *home* office, I can see > the full development packages for Xilinx and AT&T FPGAs, Viewlogic > VHDL, schematic, and simulation tools, an HP 1660A logic analyser, and > a Tek THS 720 500 MHz digital scope. > You have better tools than I do (I have a 16500B for example rather than a 1660A (which I'd love), but not hugely so, and I've been mostly semi-retired, taking a sabbatical to care for my newborn son and haven't wanted to spend the money to update resources I'd be largely using occasionally for very casual playing. > And I doubt if I'm the only one here who does this for a living. > Judging from other posts I've seen I have little doubt. Certainly I have done related stuff in the past... > The problem isn't resources, but time and motivation -- what sort of > situation would it take to get me (for instance), and one of > cypherpunk's cryptography wizards, to take the time to collaborate on > something like this. I completely agree. But I'd be surprised if it took much of a crypto wizard to do a brute force cracker as a just a simple brute force cracker. The task would demand much more of the skills of a good clever parallel logic designer to figure out how to effectively pipeline the well known and well defined crypto algorithms within the constraints of a still limited FPGA. What a crypto wizard might add might lie more in the direction of optimized strategies for key generation and scheduling to reduce the number of clock ticks and or gates devoted to this. The game of course is how many keys per second per dollar... anyone can build something that will eventually try a key, it is building something that will try keys at a maximum rate on cheap hardware that is interesting. (Sorry to take so much list bandwidth on this).. Dave Emery die(a)die.com

3 2

Re: Tense visions of future imperfect
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 11-APR-1996 00:21:15.87 >Personally, I find the idea that the government could hope to track the >economy so closely as to notice a $10M/year addition to the money supply to >be disturbing (though it was done in a science fiction story about >20 years ago :-) With digital cash, it's also unrealistic - we >finally have a technology for moving money around _without_ >them being able to track it all, if we want to deploy it. One related question is if the government would notice an underground fully anonymous digital cash setup - transactions disappearing from their "radar screen." -Allen

1 0

Any examples of mandatory content rating?
by tcmay＠got.net 17 Dec '03

17 Dec '03

There are several swirling proposals for "rating" of Internet packets, Usenet articles, Web pages, and perhaps other computer-communicated items. There are also things like the "V-Chip," included as part of the Telecommunications Act. (The V-Chip is ostensibly a "voluntary self-rating" scheme, with an included mandate that government will give industry a year or so to come up with a plan.) I foresee major legal challenges to mandatory ratings of content. Issues involving prior restrain, censorship, and the First Amendment of the U.S. Constitution. I'm interested in hearing about any _actual_ examples where a government body in the United States has mandated that intellectual property (roughly, written words, magazines, motion pictures, CDs, etc.) be "rated" or "age-labelled." Before anyone out there fires up his "Reply" and tells us about movie ratings, magazine warning labels, and the like, read on. To forestall a couple of likely examples some will cite, let me discuss a few oft-cited cases: 1. Movie ratings. The familiar "G," "PG," "R," and "NC-17." (Used to have "M" for "Mature," and "X" for, well, X-rated stuff.) In actuality, these ratings are _not_ mandated by law, and are done by the MPAA, the Motion Picture [something] Association. There may be serious legal charges brought if, say, a 10-year-old child was let into a showing of "Debbie Does Fort Meade," but this would be after the fact and would presumably involve negligence charges of some sort (contributing to the delinquency of a minor, child abuse, etc.). (A parallel to this is ordinary speech to a child. While speech is not required to be rated, there might well be various sanctions applied to an adult who spoke to a child in various indecent or obscene or "patently offensive" ways. I'm not saying whether I endorse this, and it would depend on just what was said, but the point is that there is no "rating" system for speech imposed, nor would the Constitution admit one.) We may speculate that had the movie industry not adopted "voluntary ratings" in the 1960s, government may have tried to impose ratings, but the fact is that government did NOT impose content ratings. (The important point being that we cannot look to how the movie situation evolved for hints about how Internet packets or articles might be rated.) Note also that the MPAA ratings are not "self-ratings," but are done by a panel of MPAA representative. Many film directors have been very angry over the MPAA ratings they received, and would not have rated their films as the MPAA panel did. There are then local ordinances about allowing children in to see "R" or "NC-17"-rated movies, but this is a case where the government piggybacks on the "private" ratings service (which could raise some important constitutional issues if it was ever seriously challenged, which seems unlikely). This MPAA situation is an important example because it is neither "self-rating" nor "government" rating, but is, instead, something else. This model would be extremely hard to apply to the Internet, as there is no similar body to the MPAA, nor is there the same economic incentive for any such body to form and then to try to cope with tens of thousands (at least) of articles and pages per day.... 1A. A special case of this system is _television and radio broadcast_ of indecent material, a la the FCC's regulations about content broadcast over the airwaves at various times of the day. Cable is not regulated in the same way, though most cable systems I have seen have "adult" material in the evening hours (though definitely not confined to late evening). Lots of wrinkles here, and the FCC is attempting some regulation of some cable..."The Playboy Channel" is involved in a dispute where they are being told they can only send their channel out after certain hours...details should be accessible on the Web. I think this special case of FCC involvement covers a different set of issues than the "content" issue per se. Though this may help to explain some of the rumors about the FCC seeking a broader mandate to regulate "cyberspace," as this gives them a foot in the door to regulate content on the same basis they regulate content of broadcasts. Moving on.... 2. Magazines, as in "For Adults Only!" emblazoned on the covers. In doing my "research" for this article, I consulted my "reference materials," and discovered that such warnings are less common than I remembered them as being. Neither "Penthouse" nor "Playboy" issues that I have at hand contain any such warnings, though some other mags do. So far as I know, there is no government requirement for labelling. Again, there may be sanctions imposed for, say, selling such a magazine to a minor. I can't say as I've ever heard of a court case along these lines. Importantly, there appears to be no "ratings board" run by the government that rates such materials a priori. ("Obscenity" is not the same as pornography or nudity, as we all must know by now.) I conclude that magazines need not be labelled, voluntarily or otherwise, though there may be sanctions if children are exposed to certain materials (though this is unlikely). More to the point, it seems likely that the laws which exclude children from entering bars and strip joints are the one which would apply to keeping children out of "adult bookstores." An important point was made recently by someone on the Cypherpunks list, that some libraries make a point of providing access to _all_ materials, by _all_ patrons, including back issues of "Penthouse." So far as I know, no librarians have gone to jail for this. Moving on... 3. "Explicit Lyrics" labels on CDs and music. This one is more iffy. I recall the _proposals_ to require such labels, and Tipper Gore (wife of VP) was a leader in this campaign some years back, but I don't believe any laws were formally passed. I could be wrong. And some local jurisdictions may have such laws; I recall some part of Florida mandated a labelling law, or banned sales of explicit lyrics CDs in some way. (The "2 Live Crew" issue, with "Me So Horny" and other gems.) And none of the CDs I have seen here in California with "Explicit Lyrics" or "Parental Advisory" notices mention who did the rating, whether the lyrics are "Government Censor Approved," etc. This tongue in cheek mention of "Government Censor Approved" is an important point: any hint that a government censor is to apply ratings to written or spoken or similar materials runs smack dab into the First Amendment. This is not just an academic matter. There is no provision for a "ratings board" to review content, and such a "prior restraint" (can't publish something until it's been rated or approved) is a textbook case of prior restraint, forbidden by the First Amendment. (The H-Bomb case involving "The Progressive" was ultimately decided in favor of no prior restraint, even for such a potentially serious situation.) So, if anybody's still reading this, I am interested in _any_ examples where intellectual content (as opposed to food or drug packaging, for example) is required to be labelled. Such examples might shed some light on how these various proposals for "labelling" of Net traffic might work. And absent such examples, might show just what a tough road lies ahead for those advocating such labelling. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 6