December 2003 - cypherpunks-legacy

Re: VISA Travel Money
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>> It's not as anonymous as cash, but it might draw a lot less >> attention in my circumstances. I think it has a place in one's >> aresenal of privacy enchancing technologies. > > This card has the value "written" when you "purchase" it right? > > Any one wanna bet on how long it will take the "Hacker" Community >to figure out how to "refill" it? Otherwise all you have is a >debit card. Interesting related story about DefCon: for those of you who have been to Las Vegas, you know that many casinos have mag stripe cards that are issued for a variety of reasons, that are just as good as cash in the casino, but can't be used anywhere else. Many use them as a sort of debit card for slot machines. The story goes that a few DefCon attendies acquired a few of these cards from the Tropicana, and re-wrote the stripe to read that they had over 60,000 "points". I guess they discovered that the card was re-written each time it was used. Unfortunately for them, what they didn't discover was that the system also kept track on a computer somewhere, and the large difference between the computer's tally and the card's value set off numerous red flags, they found out relatively quickly when two Casino Security guards escorted them to the police station. Oops. I can't help but wonder what would've happened if they only made the difference like 10 points instead of 60K? These two people were not too bright, as they were staying at the Tropicana, and probably had all the equipment in their rooms. If they were of age, I believe (depending on what they found in the room) they can each get multiple 15 year federal sentences. Moral of the Story: Mag Stripe cards are never secure by themselves (the credit card companies mistakenly relied on security by obscurity and are feeling the painful effects still today), but have the potential to be secure if backed up by that kind of system. However, it would only really be practical in a closed environment like a Casino. Thus, for the sake of all the lovely banks I know and love, I hope they either A. choose something other than mag. stripes, or B. use them only as debit cards that are checked against a bank account when used. //cerridwyn//

2 1

Re: fbi, crypto, and defcon
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>> Okay, so their boss is part of the law making process, subject to the checks >> and balances that exist between the three branches of US government. They >> are in a position to supply their boss with data and I am personally >> impressed with their grasp of some of that data (it sounds to me like they >> are telling their boss that hackers like the ones at Defcon are not the >> problem). It was interesting how the Agent made the point that the FBI was there to enforce laws, not make policy. Then his Boss's role in the law making process was brought up, the Agent said "but any of you can do the same thing, you all have a voice" etc etc. Then he refused to answer political questions based on the fact that he was there as a representative of the FBI, failing to see that his Boss is also a representative of the FBI when recommending legislation. (Again, I realize he was "under orders" not to discuss it, I wish he wouldn't try to justify it with obviously faulty logic.) > I think what they are really saying is that they would love to >bust most hackers, but since they can't they might as well use some of >them to catch the bigger fish. If they truly did believe in the laws they >are supposed to uphold they wouldn't associate with hackers (who commit >computer crimes) at all. A more cynical view is that they are there to protect some of the biggest institutions of "organized crime" (ie: Congress, At&t, Microsoft, etc) who are ripping people off on a daily basis from the other organizations who refuse to play by their rules. //cerridwyn//

1 0

Re: A Libertine Question
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>Most demands for ID and conformations with police involve the operation of >motor vehicles. I have never been "IDed" except at border crossings and >when I was operating motor vehicles. Clean and dressed up people are rarely >IDed on foot. Maybe you should mention some of the specific practices in >Seattle that disturb you. I was downtown Seattle at night time (early morning), walking around, minding my own business. Probably not actively maintaining public decorum, but certainly not doing anything unorderly. A cop approached me and asked what I was doing, I told him none of his business. He asked me for my ID, I said why, am I under arrest? He said no, but he needs to see my ID. I told him he has no right to ask me for my ID, especially when I've been doing nothing wrong, if I wanted to live in those conditions, I'd move to Iraq or China or something. I got out my handy pocket tape recorder, and asked him to state his name and repeat his request for the benefit of my lawyer who'd be contacting him. At this point the few other people on the street had sort of gathered a few yards away, and the cop decided he wasn't gonna win this one, so asked me to return to my home and left before I could respond. You are right, "Clean and dressed up people are rarely IDed [read harassed] on foot." I'm not concerned for the clean and dressed up people (with regards to police abuse), I'm concerned about the majority of people who aren't. (For the record, I'm generally clean, but *rarely* dressed up. =) ) >Or flying on a commercial flight. So far, prosecutions for "failure to >possess ID" have not succeeded. You *can* be prosecuted for failure to >identify yourself (which is *not* the same thing). The Philadelphia airport >was allegedly requiring *two* pieces of ID for flights. If they are talking >about two pieces of photo -- government-issued ID, I wonder where the 80% of >Americans without a Passport (x the 90% of Americans who are not government >employees) get the second piece of ID. [Is it a violation of something if >you Heil Hitler od Sieg Heil the airline clerk when they ask to see your ID. >It's not a threat, it's an expression of honor.] When I flew from Philadelphia about a year ago, they required one picture ID and one other ID, just like most stores when you want a check cashed. I still don't like it, but I have less of a problem presenting ID when I am seeking a service of some kind. It is unacceptable to be asked for ID when I am merely walking around a public street.

1 0

Re: "And who shall guard the guardians?"
by jim bell 17 Dec '03

17 Dec '03

At 02:57 PM 7/31/96 -0700, Martin Minow wrote: >This question is also relevant to escrowed encryption: how to >prevent misuse of escrowed keys by file clerks and other people >who need access to the keys as part of their legitimate duties. >Since these keys will protect a very large amount of money (consider >the encryption keys used for interbank clearing) and since we >know from the Aldrich Ames case that $3,000,000 can buy a >high-ranking CIA employee, there are significant problems that >need to be addressed. I would suspect that a Baysian analysis >would indicate that the risk of holding (and losing) a key is >greater than the risk of not holding (and needing) a key. However, even that is a somewhat skewed analysis. Most of us realize that the kinds of advanced surveillance systems that are being promoted these days have nothing to do with crimes that are, statistically, the most common and feared among ordinary citizens. Will a wiretap ever solve a burglary? Rarely. Will a Clipper-type decrypt bring a rapist to justice? Fairly unlikely. How about a carjacking? A strong-arm robbery? An arson? Sure, it's always possible, but we know what's really going on. Governments are afraid that technology will not only replace the protections we've traditionally been told only came from government (and thus make them unnecessary), but also that technology will allow us to force those governments to shrink and possibly to disband. In other words, to a government-type most of the benefits of a Clipper system are to the government itself, certainly not to the person who owns the phone and not even to society as a whole. That's one reason, I suspect, why those secret talks given to various people to convince them to support Clipper "usually" work if the person is a government-type, but will almost never work to an unbiased private citizen. That's also why the lecture is secret: That way, the government can push two different stories without a contradiction being obvious to the rest of us. Jim Bell jimbell(a)pacifier.com

1 0

Re: Jewell is the Militia Bomber!!!!
by Chris Adams 17 Dec '03

17 Dec '03

On 31 Jul 96 22:40:46 -0800, tcmay(a)got.net wrote: >The security guard Jewell is now confirmed to be the prime suspect. While >NBC News is reporting that no evidence _directly_ links him to the bombing, >the evidence against him is overwhelming: > >1. He is overweight. With the exception of The Unabomber, most perps in >cases like this are fat. After all, who could *not* want to conform with crowd? Anyone who isn't obsessed with being thin must have something wrong with him. There ought to be a law against people like him! >2. They found a _shotgun_ in his cabin. Only a criminal would have a reason for that! After, what legitimate use could a citizen have with one? If he wants to hunt, he should use a rifle! >3. He had an interest in guns. (Back issues of "Guns and Ammo" are bad >enough, but possession of even a single issue of "Combat Handguns" is >sufficient to convict in 39 of the 50 states.) Particularly for a cop! Why would anyone in his position need *that*! >4. News sources are reporting that authorities who searched his apartment >and his cabin "came up empty," which surely implies that he planned this >crime with the help of others. We can take prime examples of this: The Whitehouse hiring dilemna - if they can't figure out who hired him, there must be someone in on the job! Maybe it's the dead guy. Maybe it's those evil Internet users... ___ Sorry about breaking your sarcasm-meter... ___ >(P.S. I, too, was convinced Jewell was the guy. But in recent hours it is >looking like a "rush to judgment" could be involved. There is strong >pressure to "solve the crime" by the close of the Olympics on Sunday.) I think we could track this to the replacement of literature and culture with TV - if everyone from T.J. Hooker to Agents Sculley and Mulder solve a mystery in 30 minutes, surely they can do it in real life, too. How much do you want to bet that if it is a frame and it is successful, they'll "find" a PGP encrypted file with plans and use it to promote GAK? # Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! # Automatically receive my resume or PGPKEY by sending email with a subject # of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful! # Web site: http://www.io-online.com/adamsc/adamsc.htm

1 0

Cracking RC4/40 for massive wiretapps
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:13 AM 7/30/96 -0700, frantz(a)netcom.com (Bill Frantz) mused paranoidly: >I combine the above with Whit Diffie's observation that, while crypto users >are interested in the security of *each* message, organizations which >monitor communications want to read *every* message. A TLA interested in >monitoring communications would need to crack RC4-40 much faster than >1/week. When we discussed using FPGA machines to crack RC4/40 last year, someone calculated the cost of cracking a message at 8 cents if you're doing enough to amortize your machine, and Eric had designed a system that should be able to crack it in about 15 minutes for $25-50K. The two basic search approaches are to take a cyphertext and decrypt it trying many keys to see if you get a likely plaintext, or to take known plaintext and encrypt with many keys to see if you match the cyphertext. But those designs are for one-at-a-time cracks. An interesting question is whether you can speed up performance substantially by cracking multiple messages at once. For instance, if you've got known plaintext, such as a standard header format saying "FooVoice" or "BEGIN DSA-SIGNED..", you can try many keys and compare them with _many_ cyphertexts, which may not slow down the FPGA very much. Also, even for unknown-plaintext, since key scheduling is a relatively slow part of RC4/40, you can split the key-schedule and the block-encryption phases, feeding one keyschedule output to multiple decrypt-and-compare sessions in parallel. So the cost per victim of cracking many sessions may be much lower. >Now expensive specialized cracking equipment can certainly speed up the >process, but there may be a better way. If cryptanalysis of RC4 yields >techniques which make the process much easier, then it is the ideal cypher >to certify for export. >The paranoid conclusion is that there is a significant weakness in RC4. Just keeping the key length down to 40 bits on a fast cypher is a good start. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

3 2

Re: Jewell is the Militia Bomber!!!!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:53 AM 8/1/96, Rich Graves wrote: >Ferchrissakes, guys, take a step back and look at yourselves. You're playing >the spin control game just as fast and furious as the "bad guys" (?). First >the glee over how easy it was to find bomb-making instructions anywhere, >then saying it was a provocation by the government, now it becomes a ^^^^^^^^^^^^^^^^ >conspiracy against fat people who read gun magazines. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Rich, maybe you're spending too much time amongst the Zundelsite Neo-Nazis. You no longer recognize humor even when it's pretty damned obvious. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A Libertine Question
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:12 7/31/96, Duncan Frissell wrote: >Most demands for ID and conformations with police involve the operation of >motor vehicles. I have never been "IDed" except at border crossings and >when I was operating motor vehicles. Clean and dressed up people are rarely >IDed on foot. Maybe you should mention some of the specific practices in >Seattle that disturb you. I have been IDed numerous times for no other reason than walking on the sidewalk at a late hour in an area where most people use cars to go to the 7/11 down the block. Southern California is especially bad in this regard. A friend, who had the same problem, finally got a dog. After that the cops left her alone. Seems walking your dog is a legitimate reason to be out at night... -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Violation or Protection? [OLYMPICS]
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:03 7/31/96, David Rosoff wrote: [...] >On the local news I saw footage of a couple schmoozing in the Olympic >(Centennial?) Park after its reopening. The voice-over said that all >bags are being searched, and the couple said that rather than be >alarmed or nervous, they "appreciated" it. > >I'm not quite sure what to think about this. I don't have enough >experience to form a well thought-out opinion. I'd like to hear some >of everyone's thoughts on this: Is this bag-searching a violation, >(which was my immediate reaction) or is it not, because you have to >already be going into the controlled area to get searched? You are confused because you wonder how it could be that the couple could appreciate having their bags searched, something you intuitively regard as a violation of their rights. The very simple answer is that, generally speaking, individuals enjoy to have their rights violated, provided that they are given a (often false) sense of security in return. Surveys from a few years ago showed that a majority of Americans would approve of warrantless house-to-house searches, including their own, to combat the use of narcotics. ObCrypto: The public will cheer the day that strong, non-escowed crypto is outlawed. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Smart cards "a giant leap backwards" - Canadian Privacy Commissioner
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:12 7/31/96, Duncan Frissell wrote: >At 02:23 PM 7/30/96 -0400, Richard Martin wrote: >>Very little that might be new or enlightening to the world; attendees >>of CFP '96 will remember [fuzzily, in my case] the closest thing to >>Bruce's counterpart in the states admitting that the USA doesn't actually >>have much of a counterpart to the privacy commissioner. > >Most Central European countries have both privacy commissioners and legal >requirements that everyone register their addresses with the police. I'll >do without the former if I can also avoid the latter. I remember a time when Privacy Commissioners were a new thing. Their primary purpose seemed to be to sanction government access to (and keeping of) large databases on the activities of the population. Their secondary purpose was to prevent the private sector competition from doing the same. Eliminating access to such data by the individual in the process. Things may have changed for the better, but I doubt it. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0