December 2003 - cypherpunks-legacy

DOO_dad
by John Young 17 Dec '03

17 Dec '03

Several pieces on the export of encryption regs, the crypto czar, Motorola's crypto modem, PGP's buy of PrivNet, and Keytronic's finger-ID keyboard. Professor Denning opines that the HP doodad will include GAK. ----- http://jya.com/doodad.txt DOO_dad ---------- The NYT has a long report today on a pedophile computer racket run from a prison. With details on how investigators were able to break through hard drive security and use DejaNews to track a suspect. A prison computer business was used to cloak the kiddy pixels. Red flags the Internet's lurid prospects compared to the virtues of do-me-dads like the Times. see: www.nytimes.com

2 1

Squirrel goes Mixmaster-only
by Johannes Kroeger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello remailer users! I'm sorry, but my ISP complained that the huge mail traffic for squirrel overloaded their servers. Effective immediately, my remailer accepts only Mixmaster packets and is not listed in Raph's type-1 statistics anymore. The operation of the nym server at weasel.owl.de is not affected. Regards, Johannes - -- Johannes Kroeger <jkroeger(a)squirrel.owl.de> Send me mail with subject "send pgp-key" to get my PGP key -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 iQEVAgUBMpBs1bwPSJ4oQv5pAQF3Agf/UYmh1P7DM0Wqy9Dzoq/e0jZdvcTDHpNH 2MFohAmU1rYn0tKCRW1jUDkG8ULAmfM4HY+aSdKwoihndLL4wTRkhzcl2qePVx6L 69ZEs7EpTLpdiFuTAvIvAD8AInqRZY1WgKII9jk7gccU379gl8nxDZtlIyA89jrG 795R8QWysQs5zfyQ4VtS2s94ZchFJD+Wp5u6fsVhzklsjxwb43EdVZ4/dPUFo7nO azctBYNpWdJBW2Rf81zQDE2OPPs+2kXcvDXU/cg64gtGVGf+8okysEr2fEqdVkFe yQsFvpNngaClUSu6xxMIJXiTy3WlbEYXceQE6hUGStq/PkhqKxkqYQ== =nAT3 -----END PGP SIGNATURE-----

2 2

Re: The Utility of Privacy
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 11:13 PM 11/17/1996, Huge Cajones Remailer wrote: > Examples? How about the draft? The privacy protected child has options the others do not. Legal risk okay - beats getting shot. diGriz

2 1

RE: NT insecurity
by Kenneth L. Hamer 17 Dec '03

17 Dec '03

Really? Could you provide a reference for this assertion? What is the name of the "password file"? Where is it located on the disk? I'd be very interested to try this out on one of my test systems, especially if it is true. But my experiences with corrupted registry hives leads me to believe you are incorrect. NT usually does nothing so nice when it's registry is corrupted. That's why we keep "emergency repair disks" around 8-). - Ken >---------- >From: Adamsc@io-online.com[SMTP:Adamsc@io-online.com] >Sent: Monday, November 11, 1996 9:36 PM >To: cypherpunks >Subject: BoS: NT insecurity > >Given the recent comments about insecure machines, I thought it was >interesting to note that you can clear *every* password on an NT box by >using >a diskeditor to corrupt the password file (Boot off of a floppy and use >NTFSDOS if you have to). It'll reboot several times and then you'll be >allowed to login. > ># Chris Adams <adamsc(a)io-online.com> | >http://www.io-online.com/adamsc/adamsc.htp ># <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" >"That's our advantage at Microsoft; we set the standards and we can >change them." > --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review >editorial) > >

1 0

Re: Command confirmation request (057CCA)
by csa＠netmaine.com 17 Dec '03

17 Dec '03

ok

1 0

TIS + HP
by John Young 17 Dec '03

17 Dec '03

A blurb in the Wash Post today says that the HP roll-out this morning will include TIS's "trusted third party" product. "One essential ingredient in the equation: technology developed by TIS. TIS is so far the only company that has received permission to export encryption technology overseas that exceeds the government's existing threshold." Guess we'll know shortly who else in the System is to be Trusted with Information -- other than Thirds, Fourths and other Dots and Steves.

1 0

POC_ket
by John Young 17 Dec '03

17 Dec '03

WaJo reports today on IBM's tiny pocket computer that transmits data through the body -- to another body or to a device such as a telephone. Invented by Tom Zimmerman, formerly of the Media Lab, it can tell "anything you touch who you are." Being shown at Comdex. The body as a token. How to crack a human? Grab and squeeze out a pass phrase. ----- http://jya.com/pocket.txt POC_ket

3 2

Re: [REBUTTAL] Censorship on cypherpunks?, from The Netly N
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> If you do not send it to me by e-mail, I will never see it. > Why are you so paranoid that someone is reading your e-mail? > I never do anything criminal, so I could give a shit less if > everybody reads all of my fucking mail. I was trying hard not to get into this thread as it is basically just one long flamewar that is getting out of control but I have to comment here: There need be no reason for paranoia. I don`t call it paranoia, I call it constant vigilance, to demonize it is a statist position and tries to ostricise those who protect their privacy. Whether you do anything criminal or not is not the point. Indeed I would say that 90-95% of encryption usage is for perfectly legal purposes, and only about 0.1% of encrypted material is concerned with unethical acts rather than illegal acts. The point is you should retain the right to protect your privacy. Sure, it`s not illegal to put forward anarchist arguments in mail today, but do you really want your company boss knowing about it? I personally don`t work - I`m a student so it doesn`t matter to me, but whether it is right that your employement and political views should affect each other they do, so you should be able to protect yourself with technology... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

4 5

RE: ideal secure personal computer system
by John Fricker 17 Dec '03

17 Dec '03

>Bill Frantz (frantz(a)netcom.com) said something about RE: ideal secure personal computer system on or about 11/17/96 5:37 PM >(Note that even if it only runs with a user's privileges, a Trojan horse >will have no problem stealing e.g. that user's PGP secret key ring. Not >everything of value is in system files. True enough. >Question, can a user-level Trojan >horse insert itself as a keyboard monitor and get the PGP pass phrase as >well?) In the September 95 issue of NT Developer Richard Wright describes an NT Key Log Service (started as a challenge after his wife threatened to password protect the familiy accounting software <g>). Source code for such a trojan is provided. Note that the Login screen is *never* hooked. There must be a way to walk the chain of system hooks. I'll let you know when I find it as that would be the key to writing a detector. --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

HP crypto-announcement and key recovery, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 18 Nov 1996 09:03:25 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: HP crypto-announcement and key recovery, from The Netly News The Netly News http://netlynews.com/ November 18, 1996 Under Lock And Key Recovery By Declan McCullagh (declan(a)well.com) As a non-event, it was a rather well-attended one. This morning Hewlett-Packard Co. threw a press conference in Washington, DC to announce that it had vaulted the Federal government's export restriction hurdles by including "key recovery" technology in its encryption products. At least that's what the press release said. The reality is somewhat less exciting: HP's announcement is crypto-vaporware. "We're not making any specific announcements of products today," admitted Doug McGowan, HP development director. HP's move comes after competitors such as IBM and DEC stole the limelight last month by being the first to buy into the Clinton administration's latest key escrow scheme which would allow U.S. law enforcement agencies to locate copies of the private keys used to encode files and communications. The company's announcement follows a presidential executive order signed last Friday codifying the administration's "key recovery" proposal unveiled in October, which the White House hopes will splinter an industry previously united in opposition to Federal regulations governing encryption exports. HP responded by flying CEO Lew Platt into town today to announce a product using plug-in hardware or software "activation tokens" that can vary by country -- but Platt admitted that the tokens don't exist yet. Rather, he admitted, it's only a product with "a security framework built into it" that currently uses woefully-insecure 40-bit DES encryption. Eventually, HP hopes to export crypto that's stronger, but the company declined to discuss details. Dave Banisar, a policy analyst at EPIC, says such a system would be "worse" than current policy. "It's got this new detection system in it that requires monitoring of your crypto use and program use to determine what the national government says is correct," he says. The "key recovery" technology HP licensing is likely to come from Trusted Information Systems Inc., a company founded by former NSAers that still enjoys close ties to the spook community. TIS's Commercial Key Escrow uses the 56-bit Data Encryption Standard and so was cleared for export on January 18, 1996. "This is the first step toward implementing key recovery. That's a policy that's just not going to solve the privacy problem for Internet users," says Alan Davidson, staff counsel for the Center for Democracy and Technology. "This is the first step on that road toward building key recovery for the world. It's a very dangerous thing." Clinton's executive order is carefully crafted to counter the three strategies that crypto privacy proponents have devised to kill the export rules: the public relations, the judicial and the legislative approaches. Netizens, privacy advocates and high-tech firms rightfully blasted the old export policy, which classified crypto as a "munition," as a relic of the cold war -- a sentiment with which even The New York Times agreed. So Clinton has reclassified it as a non-munition, yet the change is in name only: Netscape browsers remain subject to export controls. Several lawsuits are challenging the constitutionality of the old export regulations. So Clinton's executive order contains language that EFF's John Gilmore says is designed "to evade the current lawsuits" by taking aim at some of the legal arguments. Administration officials spent an unhappy summer on Capitol Hill being grilled by senators who were considering legislation to lift the crypto export embargo. So Clinton carefully crafted his announcement to defuse some of the reasons to pass this legislation when Congress returns in January. In other words, the White House has been able to answer or deflect many issues that netizens have raised in favor of strong encryption. But another argument may not be as easy to counter. Patrick Ball is a senior program associate at the American Association for the Advancement of Science who has traveled the globe teaching human rights workers how to protect themselves from oppressive governments. The stamps on his passport read like a who's who of censor-happy regimes: El Salvador, Ethiopia, Haiti, Guatemala, South Africa and Turkey. "I have done PGP training in every country I've worked in," says Ball. To Ball, the debate over crypto isn't about civil rights or businesses losing export dollars, but over something much more fundamental: human rights. He says: "Why do security police grab people and torture them? To get their information. If you build an information management system that concentrates information from dozens of people, you've made that dozens of times more attractive. You've focused the repressive regime's attention on the hard disk. And hard disks put up no resistance to torture. You need to give the hard disk a way to resist. That's cryptography." And that's a winning argument. ###

1 0