December 2003 - cypherpunks-legacy

Re: "address verification databases"? (was: Netscape download...)
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

So... I just have to know someone's name and phone number in the US? Ryan ---------- Previous Message ---------- To: tcmay cc: cypherpunks From: jsw @ netscape.com (Jeff Weinstein) @ smtp Date: 07/18/96 12:47:22 AM Subject: Re: "address verification databases"? (was: Netscape download...) Timothy C. May wrote: > > At 9:45 PM 7/17/96, Jeff Weinstein wrote: > > > Because we have not yet been able to obtain the address verification > >databases that we need for Canada. There is someone working on > >tracking this down right now. When we get the proper database we > >will add access to canada. > > > > --Jeff > > Jeff, can you tell us anything more about what these "address verification > databases" are? > > For example, are they derived from government sources? Census data? (Naw, > can't be, for at least two obvious reasons). Voting records? (Naw.) Credit > card purchases? (??) Our database was obtained from American Business Information. They make those CDROMs with 11 million business names and addresses, and other such products. There is a link to their web page from our US download page. > While I can imagine various commercial firms have indicators that a "T. > Christopher May" once lived in Rio Del Mar (the name of a town I lived in, > though not an official "Postal Service" address), I really find it odd > that, for example, there would be any database that could "parse" the > informal information people provide (absent a well-defined set of addresses > and precise spellings). > > In case I'm not making myself clear, there are no "official" addresses of > persons in the U.S! Not even the tax system requires registration of all > persons and specific addresses. This has come up in several "voter's > rights" cases, where persons with no fixed address were nevertheless able > to vote. If I, T.C. May, say my address is Moonbeam Trailer Park, who's to > say it's not? Maybe it's where I'm staying with a girlfriend, maybe it's > where I get my mail, maybe it's my spiritual home. And yet just which > "address verification database" could possibly confirm that I live in (or > get my mail at the Moonbeam Trailer Park at this exact moment? Absent any > laws clearly defining what one's official name is, official phone number > is, official zip code is, official address is, etc., just about anything we > choose to put down on the Web form is kosher. Our verification software does not check that the person whose name is entered in the form lives at the address entered in the form. We do verify some parts of the information entered. Things like is the state code one of the 50 states, does the zip code match the state, etc. (NOTE - these may not be the exact checks implemented currently. I have not examined the code myself, but these are the types of checks being done.) > At least the MIT system was based on ISP domain names, crude as this is, > and not on putative names and residential or business addresses. We also screen out based on domain names. > Anyway, I don't know if Netscape is rejecting the information I'm providing > them, as I've been unable to get through in roughly 30 connect attempts. We will be increasing capacity soon. The demand is very high. It costs us real dollars to buy hardware and T3 lines to allow people to download the software for free. > But I'm still curious about what these "address verification databases." > Sounds ominous to me. I'm sorry that my choice of words disturbed you. I hope my explanation will allay at least some of your fears. There are many people here (including Jim Barksdale) who are very concerned about maintaining personal privacy. Certainly if we could we would make the US versions of our software available in the same way that we currently make the export versions available. At least people now have the choice of obtaining the US version over the internet. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Re: Opiated file systems
by Deranged Mutant 17 Dec '03

17 Dec '03

On 16 Jul 96 at 19:21, Mark M. wrote: > > A problem with a c'punk-style encrypted fs with source code and wide > > distribution is, of course, that attackers will KNOW that there is a > > duress key. > > I don't see how this would effect the security of such a filesystem. There > is absolutely nothing that an attacker can do to get the real key. An attacker > would just ignore all computers that have duress key capability. 1. Confiscate computer (along with physical drive) with duress-capable encrypted file system; 2. back up the encrypted sectors; 3. reverse-engineer file system driver to figure out how the duress-key works, if there are multiple keys, where data is stored; 4. make sure you've rubber-hosed or subpeoned all passphrases or keys; 4a. if the system destroys data, you've got backups ("Very funny kiddo; now give us the real key...") 4b. even if there are two filesystems, the attacker will want access to both, just to make sure... Duress keys rely on a form of security through obscurity. They make sense for real-time situations where the attacker has to rush in, gain access quickly, and leave real fast (ie, bank robberies). If the attacker has plenty of time, he can prepare for that possibility. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

3 2

Re: Gorelick testifies before Senate, unveils new executive order
by jim bell 17 Dec '03

17 Dec '03

At 03:04 AM 7/18/96 -0700, David Sternlight wrote: >Serious studies have shown that the kinds of protections to make the >systems we depend on robust against determined and malicious attackers (say >a terrorist government, or one bent on doing a lot of damage in retaliation >for one of our policies they don't like) "Policies"? There you go again. A "policy," at least in regard to the US government, is not merely opinion, but is action. Action which may (legitimately) anger people. Action which may not genuinely be in the interests of American people, although you'd never get those government thugs to admit it. If somebody overseas doesn't like a US government "policy," maybe the best thing to do is to determine whether it's actually beneficial to the ordinary American citizen, or whether its benefits can be achieved simply by changing government behavior. So what's the best way to avoid "terrorism"? Maybe the fastest, more efficent, and overall best way to avoid it is to get the US government to stop doing things that foment it, rather than trying to protect against it after the fact. , have costs beyond the capability >of individual private sector actors. Your friendly neighborhood ISP, for >instance, probably can't affort the iron belt and steel suspenders needed >to make his system and its connectivity sabotage-proof, and so on. Even >cheap but clever solutions involving encryption in such systems require >standards and common practices across many institutions. None of which require government actions to achieve. If anything, what is required is that governments STOP doing things which discourage such implementations of encryption. Government is the problem, not the solution. >In such a case, where public benefits from government action greatly exceed >public (taxpayer) costs, This is the classic Sternlight misrepresentation. Chances are excellent that this public benefit you speak of is almost totally a benefit to government employees, not ordinary citizens. Government's "solutions" are predictably skewed to maintain government budgets, not actually designed to solve the underlying problem. Jim Bell jimbell(a)pacifier.com

1 0

Alternative Journalism
by enquirer＠alpha.c2.org 17 Dec '03

17 Dec '03

THE CYPHERPUNK ENQUIRER PRESENTS: "Adventures in Alternative Journalism" The Analysis Piece Alice stared at the two strange creatures. She was completely dumbfounded. "So let me see if I've got this right. You make really good wheels. But if the Queen of Hearts had wheels, her subjects who occasionally raid your borders would be able to get away faster, and you wouldn't catch as many of them. Is that right, Tweedledumb?" "I'm Tweedledumber. He's Tweedledumb. Yes, that's right. We have a technological lead over the Cards, and we have to maintain it." "So you won't sell them wheels?" "Well, it's more complex than that. A large part of our population is engaged in making wheels, and we make a lot of money selling them to the Cards. So we made a compromise. We only sell them SQUARE wheels." "But of course," Tweedledumb chimed in, "it's very expensive to make both square and round wheels. So most of our people only make square wheels, so they can sell them to both us and the Cards. Of course, our people are allowed to buy round wheels, IF they can find them." "AND," stated Tweedledumber, "since the wheel is patented here, we get to collect a hefty licensing fee for every wheel sold." "But the Cards DO have wheels!" Alice could see over the fence, and the Cards were happily zipping around all over the place. "And so do a lot of people over here. What happened?" "Well, we couldn't stop the Cards from building their OWN wheels ... " "And people like buying the Card wheels because they're faster than our wheels, and they're cheaper, because they don't have to pay us the licensing fee ..." "You see, we have a licensing treaty with the Cards for most things, so if they make something we have a patent on, they have to pay us, but the wheel can't be exported, so it can't EXIST over there, so our patents don't apply ... " "But I don't understand! You said you needed to catch people, but now you can hardly catch anyone!" Alice was totally astounded at what she was hearing. "It's only a stopgap measure anyway." Tweedledumber clasp his hands behind his back and started pacing. "We need to get an agreement with the Queen of Hearts that both of our people will only use, oh, say, pentagonal and maybe hexagonical wheels. That way, everyone can get around faster, but we'll still be able to catch them." "But who's WE?" "Anybody with a TLA on their shirt. WE get round wheels." "What's a TLA?" Alice almost felt relieved when she saw the familiar grin materialize. The rest of the Cheshire Cat soon followed. "A TLA, my dear, is a Three Letter Anachronism. When people start referring to you by your initials, you've overstayed your welcome. If everyone starts calling ME TCC, I'll know it's time to find another job." The caterpillar spoke up from its perch on the toadstool. "Wrong, tuna breath. TLA's are the only thing standing between society and total chaos." Alice turned to face the caterpillar, who responded by blowing a lungful of hookah smoke in her face. "THESE two goons only deal with the dangers of the Queen of Hearts and her soldiers, I have to worry about the domestic situation. So we came up with a solution. There are certain unscrupulous locals who engage in terrible things, terrorism, drug dealing, child molestation, money laundering ... we have to be able to catch them. If they had wheels, they could outrun us. But if we had ACCESS to those wheels when we needed it ... by the way, speaking of drug dealers, we know about that mushroom, and the pills. You might want to think really hard about playing ball with us, the Queen of Hearts is rather fond of cutting off dope addict's heads." "Access to wheels? Does that have anything to do with those ropes hanging off the back of those carts?" "Yup. We pull on that rope, the wheels fall off. And since we may have to stop a LOT of people at one time, we could have a riot, or another Butthole Surfers concert, we figure that we should be able to stop about ten percent of the population at once, a little less in the rural areas ... well, they've gotta be REALLY LONG ROPES ... and there have to be A WHOLE LOT of them ... course, the ones with the ropes we let have octagonal wheels ... " "But can't just anybody pull the rope? You'll have wheels falling off all over the place." "Price you have to pay for a safe society. Besides, we have trusted third parties holding to to the other end." "How will you get people to use it, when they can get regular wheels from the Cards?" "How else? We could pass a law. But it's easier just to threaten all the wheel dealers - put the rope on or we shut you down. Spread the word that only criminals don't use ropes - what are you afraid of? Got something to hide? Eventually we'll have to outlaw the round wheel, of course, but for the time being, some creative social engineering should do the trick." The caterpillar took another long drag on the hookah. "Good shit. Dole was right about this stuff." "But can't people get real wheels for free?" "Sure, we've pulled off enough they're lying around all over the place. But then you need an axle, bearings, steering - most people still just go down and buy the whole package. We get them, we're in - guy up in Seattle makes something like 90% of all carts sold here, you should see the shit we've got on HIM! No problemo. And those idiots at Netscape - we've got them doing a complete background check on anybody who wants a round wheel - come back in five days, and maybe you can have it." "So, Alice, are you learning anything?" Alice liked the Cheshire Cat, but it did have very sharp teeth, and very long claws, and it did have the habit of appearing out of nothing. Alice felt that it should be treated with respect. "Not really, your cattiness. It doesn't make any sense at all!" "It isn't supposed to. You have to look at it the right way. From their perspective, it makes perfect sense." "I'm confused." "Don't worry about it. It gets worse before it gets better. Come on, we're going to a party. Tim May and John Gilmore are throwing a Mad Tea Party." "Are they really mad?" "May's crazy as a loon. You'll like him. Gilmore, he's just still pissed at Shimamura for that stunt in the hot tub ... "

1 0

Re: Telecom regulations - Reuters coverage
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:22 7/17/96, E. ALLEN SMITH wrote: [...] >>FCC Chairman Hundt Sees Tax On Telecom Industry > >> FAJARDO, Puerto Rico - A small tax will probably be imposed on >> telecommunications companies' revenues to subsidize telephone access >> in rural areas and help wire classrooms for the Internet, Federal >> Communications Commission Chairman Reed Hundt told the nation's >> governors. > >[...] > >> But ensuring that residents in sparsely populated areas have access at >> affordable rates and meeting the administration's goal of wiring every >> classroom in the nation for Internet access will require annual >> subsidies of about $10 billion, Hundt said. Ten billion today will of course mean 100 billion tomorrow. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Opiated file systems
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>a (hidden) drive to your computer using a reasonably surreptious link that >is difficult to trace. Say, an IR optical link, a single bare (unjacketed) >optical fiber, a LAN with hidden nodes, or a similar system. Maybe an I find the idea of the optical fiber very interesting. Is there such a beast currently available? I really don't know anything about fiber, and therefore it would be very difficult for me to construct such a system myself...

1 0

Minneapolis radio on Netscape US Version
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- KCFE has a brief and shallow "Business Report" in the afternoon. Yesterday, one of the items was Netscape's getting permission to make the US version available over the Internet. The bit mentioned a "strengthened method of scrambling data" and also mentioned the Gov't concern that it might be downloaded by terrorist groups. Some good, some bad. - -- Roy M. Silvernail [ ] roy(a)scytale.com PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMe7JdBvikii9febJAQE28wP/eyvR1jfi5oU4sHwsnro6EwbHMr45Qptb wdX+0CDEtLCZv2eXQt+guWy4jIuEMrvd5obFiTGDJECkQ1aecYNiosQgdyJzqNgb 5xm98V7MlWBWGr7P5Ev4uOsC7mXbPvnPZ2BiCtlG5H+jnv4KKv7fr1ZtSngU+8Xl vDCp8MwQN9Q= =ZVdP -----END PGP SIGNATURE-----

1 0

Cookies etc...
by EVERHART＠Arisia.GCE.Com 17 Dec '03

17 Dec '03

On VMS, I have an applique which can be used to control completely what can be opened by apps you don't trust. It is perfectly capable of ensuring that nothing you haven't authorized is opened behind your back, mainly by telling you before the open proceeds what is being tried and giving you the ability to prevent it. Forcing use of some other disk (or scratch area) instead is of course also possible, selectively. The problem of things like cookies being left around without explicit permission (or other covert actions) would seem to be that there is no basis for assuming that the app is doing any of this as the agent of the person running the app. With EACF I can completely control this sort of thing; native out-of-the-box VMS has some facilities for partial control as well, which can be adequate. In doing so, they step outside the normal paradigm of assuming the "subject" is the user. I would contend that the "subject" should in fact be considered much more complex than user ID. At minimum, use of a tuple containing userid, program being run, location of user, privileges present, time of day, and identifiers ("group memberships") would seem to be needed for serious efforts, so that "subject" has some relation to what actually happens. The ability to treat certain actions as dynamically altering security or integrity levels is important too. Apps that leave files on your system without telling you are doing covert functions; these should be treated with great suspicion. So where are the critics of this? Does leaving such files constitute unauthorized computer use? I would say so. Anyone see the marshals coming to Netscape or Microsoft to haul anyone off to jail? Leaving files around would seem to deserve INFORMED consent. Do we get it? If your OS isn't as secure as VMS, maybe you want to think about this. ;-) Glenn Everhart(a)gce.com

1 0

Re: An interesting instance of poltical anonymnity, now
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 06:56 AM 7/18/96 EDT, you wrote: >Don't feel sorry for Klein - he's a fucking statist who opposes freedom of >speech. If CBS fires the creep for lying, it'll serve him just right. Than they should fire him on that basis (anti-free speech etc), not on the basis of preserving anonymity. //cerridwyn//

1 0

re: Opiated file systems
by EVERHART＠Arisia.GCE.Com 17 Dec '03

17 Dec '03

Hmm... I can set up a cryptodisk on a not necessarily contiguous file on another cryptodisk; the software is free. The second cryptodisk would appear to be just a binary file on the first; would it not be an obscured filesystem? (The drivers have been given away for years public domain for vms, vax or alpha, in source. My old rsx11d driver was published similarly back in 1977 or 78.) In fact, though, the containing file of a cryptodisk does not have to have any specific name or location, and can be hidden away as though it were, say, a sound file or something else among the rest of the system store. Before someone comes demanding your keys, they first have to realize that something might in fact be encrypted. My approach would be to have lots of these obscured cryptodisks for the stuff I wanted private, if I wanted to hide a lot, and have the usual assortment of cleartext stuff of all sorts lying around. The default operation mode forgets the keys automatically once you log off...or even at dismount. If you're stuck with a whole partition being hidden, this is harder to do. When any file of over a few kb can be a separate filestructure when the proper magic is applied, locating the keys can be impossible. glenn

1 0