December 2003 - cypherpunks-legacy

Re:Texas Driver's License database on the web
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Marshall Clow wrote: > >On Wed, 11 Jun 1997, Peter Trei wrote: > > > >> Did Psychos-R-Us request this site? "Could you create a database so I > >> don't miss anyone when I go on a killing spree on the 900 block of > >> Rosewood?" > When my libertairan streak is in full flood, I think that since > this information was collected by government employees and > paid for by tax dollars, that it should be availiable to anyone > who wants it, for (minimal or) no cost. > > Of course, the better solution is to not collect the information > at all. (Not selling it just means that people can buy it on the > black market, or in the case of TRW, etc; buy legislatures) It amazes me that in an age when government and corporations have access to untold mountains of information about all of us, that we seem to get upset when Joe Average is given access to that same information. The end result of this is that those with the most authority (access to information) are able to exert power and control over those with less access to the same information. Dateline NBC just did a show about a Health Insurance company whose refused to tell a potential client that the blood test they did on him was positive for HIV (even though they shared this information with other insurance companies). I will wager that if a few dozen Joe and Jane Average citizens knew of this and knew they could contact the man through the Texas DPS database that one of them would have had the decency to call the man and inform him of the life-threatening disease. The Machine feeds off of us by taking away our rights of self expression and self defence and then convincing us that the Machine is our benefactor and protector while our fellow humans are a threat to us and should be feared. Thus we end up fearing people with different religious views instead of the Machine that launches a murderous assault on the men, women and children who are a threat to our mainstream views. We end up fearing the janitor at the insurance company who may well do volunteer work for good causes instead of fearing the Machine that lets us die and infect our family members while sharing our private information with other parts of the Machine. Yes, you may get attacked by some wacko who targets you and finds your address from a database. Or, you may get attacked by some wacko who targets someone else but can't find their address from a database so they pick you as a random target. The Information Age is upon us, for better or worse. If all parts of the Machine are going to know all my personal data, then I also want for myself and Joe and Jane Average to have access to the same data. If the BATF wants to look me up at home through use of a database, then I want Timothy McAverage to be able to look all of them up through the same database. The Machine will make certain that every instance of some wacko using accessed information to abuse someone gets front-page press. No doubt the weak of wit will cry out for the Machine to protect us from abuse of access to information. This makes as much sense as asking to be protected from education and knowledge because of the potential for abuse. We have citizens who decry the fact that information on explosives should be freely available so they demand that the Machine which produces nuclear weapons censor that information. God forbid that someone would make a pipe bomb that wipes out a nuclear weapons factory. Instead of "Give me freedom or give me death." we now have a nation which cries out for security even if it means imprisonment. In our desire for ultimately unattainable levels of safety and security we allow (and even beg for) the Machine to imprison our bodies, our minds and our spirit. Instead of putting child pornographers in prison we will put cryptographers and remailer operators in prison. Instead of confiscating the assets of drug czars will confiscate the assets of people who have a kid who smokes a joint once a week. Instead of censoring legislation which limits our freedom and privacy we will censor literature which proposes democratic assassination of those who oppress us. Personal data privacy is history, for the most part. The focus of those who wish to retain privacy in certain areas of their life and their communication should be on technologies which will allow them to *personally* keep those things private. To continue to leave public information only in the hands of the corporate and government Machine is to continue to empower the Machine and weaken the power of the citizen. TruthMonger

1 0

[IMPORTANT] e$
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

May Tim C[ocksucker] May's forgeries get stuck up his ass so he'll have to shit through his filthy mouth for the rest of its miserable life. \\\ {OQ} Tim C[ocksucker] May (_)

2 1

Re:Texas Driver's License database on the web (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 11 Jun 1997 22:17:24 -0400 > Subject: Re:Texas Driver's License database on the web > From: lucifer(a)dhp.com (lucifer Anonymous Remailer) > It amazes me that in an age when government and corporations have > access to untold mountains of information about all of us, that we > seem to get upset when Joe Average is given access to that same > information. I at least have a contractual relationship with both of them that provides me at least some promise of fair arbitration. Something I don't have with Joe Average implicitly. > The Machine feeds off of us by taking away our rights of self > expression and self defence and then convincing us that the > Machine is our benefactor and protector while our fellow humans > are a threat to us and should be feared. The Machine takes the rights we give up willingly for a long-term loan on a 40" television and another $10k a year. > Thus we end up fearing people with different religious views > instead of the Machine that launches a murderous assault on the > men, women and children who are a threat to our mainstream views. Not just religious views, but skin color, sex, etc. This is a function of all social animals (in fact the society wouldn't work if it wasn't) and in particular primates. To draw the conclusion that this somehow flows from our contractual agreements based on impatience and greed is illogical. ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: [CNN] Stolen Laptops and lame 'solution'
by Raymond Mereniuk 17 Dec '03

17 Dec '03

> How is the buyer responsible even indirectly? > > Someone puts an add in the paper NEC Laptop $1,500. I go and check it out > and buy it. Should it be my respocibility to call NEC over in Japan and > > If anyone is responcible for the theft other than the theif is the person > who was so carless with their equipment. > Legally Law Enforcement Agencies (LEA) and the courts willl find you responsible for being in possession of stolen property. If you purchased the unit from a storefront or a person selling the unit from their home you could deflect responsibility to those parties. I would suspect most stolen units are fdisk-ed, re-formatted, and moved a minimum of a state or province and then sold through brokers who operate through a pager or cell phone. The units are sold probably more in the range of $600 to $700 CAN Dollars for 486 color units and abit more for Pentium units. The brokers may offer the unit through an auction. At this point the buyer should start to suspect something is not right, the units are too cheap and all the proprietary drivers have been removed. The reason given is that they are being disposed of by a large corporation and it is policy to erase all data. No manuals or documentation are offered with the unit. Normally when you purchase an unit from the original retail buyer manuals and documentation and extras would be included with the unit and the seller would probably be willing to show you the bill of sale. Would you buy a car from a seller offering no documentation or proof of ownership. It is tough to take the argument that stolen notebooks are the fault of the victim seriously. Notebook thieves can be pretty enterprising. They walk into offices dressed as maintainance people, buy pass keys from the real maintainance people and go through every office. A friend had a notebook taken from a locked office in a supposedly secure area, no signs of break and entry so no insurance coverage and there were notebooks and computers taken from three locked offices in the middle of the day. So in this case it was my friend's fault for doing business in a shared office environment where someone had sold a pass key to the thief?? If there was no market for stolen notebooks thieves would not steal them as there would be no gain. In my experience most people selling merchanise of doubtful origins are not sophisticated, ask lots of questions and their stories quickly fall apart. I have walked away from many deals when the origin of the goods were not clearly explained and I would suggest you do the same. Virtually Raymond Mereniuk Raymond(a)wcs.net

3 3

Um, I'm probably already in trouble for the last one.
by Rick Osborne 17 Dec '03

17 Dec '03

Forwarded from 0xdeadbeef (inline tabs converted): ----- Michael Strelitz <mstrelitz(a)cix.compulink.co.uk> wrote: > >> But not every bra has a cryptographic function. Most are used for ASCII >> armor or for compression. Some are even designed to make the plaintext >> stand out and more enjoyable to read. > > Touche, but I believe what we have here is a clear case of steganography. Yikes. I think that we should hammer down some definitions before this whole thing gets out of hand. Cryptography: Building an difficult-to-unhook bra. Steganography: Building a flesh-colored bra, or one whose unhook mechanism is hidden somewhere unexpected (Man: "How the Hell...?" Woman: "It unhooks in front." Man: "Damn those steganographers.") Public-Key Cryptography: Building a bra that anyone can put on, but that only Alice can remove. Watermarking: Building a bra that stays on even after smoothing, compression, and rotation. Also, Bob should not be able to put his own bra on over Alice's and claim ownership of her body. Fingerprinting: Um, I'm probably already in trouble for the last one, so I'll just skip this. Signatures: Building a bra with a nametag ("Property of Alice, machine wash warm...") such that bras with Alice's name only fit Alice's body. Bob could in theory remove Alice's bra and replace it with his own, but there's no real reason for him to do so. All-or-Nothing Disclosure Of Secrets: Alice transforms her bra into a duffle bag, and either (a) shows Bob how to open it, or (b) shows Bob how she made it into a duffle bag. Alice repeats the procedure until Bob is satisfied (perverted freak). One-time Pad: Kleenex. NSA: An organization that wants women to go back to wearing corsets and chastity belts. Oh, and Bill Clinton gets to keep all the keys. [looks up at what's written so far and sighs] I'm so damned juvenile. I'm going to go do something more constructive and serious. Well, happy Monday. -Caj [**!!Oh, and these are not the views of my employer!!**] _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Haha.. you fool! You fell victim to one of the classic blunders. The most famous is: Never get involved in a land war in Asia. Only slightly less well know is this: Never go in against a Sicilian when death is on the line!

1 0

Data Fellows announces F-Secure SSH for Internet Service Providers
by Jukka Kotovirta 17 Dec '03

17 Dec '03

Data Fellows Inc. Press Release FOR IMMEDIATE RELEASE June 13th, 1997 Data Fellows announces F-Secure SSH for Internet Service Providers Telecom Finland the first ISP to integrate strong encryption with commercial Internet services Helsinki, Finland - Data Fellows, the leading Internet security solutions provider, announced today a new version of their popular F-Secure SSH product, setting a new level of security for Internet Service Providers (ISPs). F-Secure SSH for ISPs gives the customers of an Internet Service Provider unmatched security by using the SSH security mechanism. The SSH protocol is currently being standardized by the IETF (Internet Engineering Task Force) as an application-level security mechanism to be used in conjunction with Internet protocols. SSH is already widely used by security-conscious organizations around the world. The first user of F-Secure SSH for ISPs is Telecom Finland, who bundle the product with their Internet services. "Since we are the leading telecommunications operator in Finland, we need to assure that our services are reliable and data security maintained at a high level" says Mr. Harri Johannesdahl, Director of Internet Services, Telecom Finland. "Good security features also help us maintain our leading edge in this highly competitive market." The F-Secure product line offers strong end-user authentication and encryption of any transferred data. Because the technologies are of European origin, they are not limited by U.S. Export control. Internet Service Providers around the world can now add strong security to their product offering. "Our F-Secure line of products guarantees ultimate security on the Internet. Now companies can use the Internet as a serious business tool without the fear of compromising their corporate assets because of any lack of security", explains Mr. Risto Siilasmaa, CEO of Data Fellows Inc. "Also private Internet users will benefit from this development." The authentication of users dialling in is done with cryptography, making management and access control much easier to arrange on a large scale. Dialling in can be done through any network structure, including the Internet itself, facilitating Internet roaming. "Internet users will gain immediate benefit from F-Secure products. And the emerging concept of 'extranets' between companies cannot launch safely without strong authentication and encryption mechanisms", concludes Mr. Siilasmaa. Data Fellows company background Privately owned Data Fellows is the leading technology provider of data security solutions for computer networks and individual desktop computers. The F-Secure product family offers protection for sensitive communications over TCP/IP networks in Windows, Macintosh and UNIX environments. The family includes products for the creation of strongly encrypted virtual private networks (F-Secure VPN), secure electronic commerce solutions (F-Secure Commerce) and secure files and folders on the local PC using strong encryption (F-Secure Desktop). The F-PROT product is the industry's leading virus protection software. These products are available world-wide in more than 40 countries through Data Fellows and its business partners. See http://www.DataFellows.com for more information. Contact information Europe: USA: Data Fellows Ltd. Data Fellows Inc. Päiväntaite 8 4000 Moorpark Avenue, Suite 207 FIN-02210 ESPOO, FINLAND San Jose, CA 95117, USA tel. +358 9 478 444 tel. (408) 244 9090 fax +358 9 4784 4599 fax (408) 244 9494 http://www.DataFellows.com email: F-Secure-Sales(a)DataFellows.com RTF file ---------------------------------------------------------------------------- Jukka Kotovirta Tel +358 9 478 444 Director OEM Sales & Major Accounts Fax +358 9 4784 4599 Data Fellows Ltd. Mobile +358 405 883 933 Paivantaite 8 Jukka.Kotovirta(a)DataFellows.com 02210 Espoo http://www.DataFellows.com/ Finland, Europe ----------------------------------------------------------------------------

1 0

Re: Access to Storage and Communication Keys et al
by Peter Nicol - VRL / BroomStick Productions 17 Dec '03

17 Dec '03

> > Secrecy is a tool, period. Who is TruthMonger? There are *no* > tools (at this abstract level) that are used exclusively by the > state. Also, the raw material of politics is human nature, and politics > permeates all human activity, whether connected to the state or not. > > > > > Two daughters of a silk merchant live in Kyoto, > > > > The elder is twenty, the younger, eighteen. > > > > A soldier may kill with his sword, > > > > But these girls slay men with their eyes. > > > > > > Basho? > > Ummm . . . My copy of "Zen Flesh, Zen Bones" only attributes this to > > "A well known Japanese poet". Do you know anythang? > > I no nothing. > > Many years ago I was heavily into zen -- I have a well-worn copy of > Zen Flesh, Zen Bones at home. Further exploration lead me to > Chuang-tzu: > > http://songbird.com/gc/river/chuangtzu.html > danke > Perhaps I saw that poem in ZFZB. But I have a couple of collections > of Japanese poetry at home, as well as a very nice edition of Basho's > "Journey to the North", or whatever it's called (it gets translated > different ways, and I am confused...) > > > current project: www.iinet.net.au/~ratty/legends > > This has moved... Not only that, but the site and the client SUCK. Oh how I hate capitalism. Even when I try to be one of the "winners" and involve myself in it, I still hate it. etc etc rant on > -- > Kent Crispin "No reason to get excited", > kent(a)songbird.com the thief he kindly spoke... > PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 > http://songbird.com/kent/pgp_key.html > Thankyou for your posts. It pleases me to see that a bunch of crypto intellectuals will take my posts seriously. I have been interested in this topic for a while and only recently got my shit together enough to understand how to subscribe to a mailing list. The last time I used PGP was when it was in DOS and I found it a hassle. Does that make me a clueless newbie? Ummm . . . my training was in Non Violent Action (NVA). This is being used by ppl at the moment to protect Gibblett Forest from being clear fell logged by a (IMNSHO) corrupt "Conservation and Land Management" (CALM) authority in Western Australia. As a way of countering destructive paranoia, we have developed a doctrine of "secrecy is a tool of the state". (I am well aware of the limitations of Doctrine as a logical formal system godelwise). To this end, we have NO SECRETS. Everything we do is "public domain", ie, everyone, including our "enemies" gets to know it. In practice, this is simple, ie Civil Disobedience. You wanna log the trees, we gonna stop you, aint no big secret. We even go to the lengths of notifying the authourites, ie CALM/police of our strategies and telling them who will be doing an arrestable action on a particular day. At the moment we have 3 ppl up Karri trees on platforms. I find it very empowering. I see no need for secrets. Sure, secrecy is a tool. I ask these questions: 1. Does it work. 2. Is it useful. (also known as the Doctrine of Utility) 3. Does it make me happy. I usually use these to analyse behaviour patterns, but hey . . . 1. Hmmmm . . . It kinda works, but it is a big hassle. Then you gotta worry about looking like you are trying to hide somethang and thereby attracting attention. Also, you get to worry about IF it does actually work and is uncrackable/contains no back door etc. 2. If you are paranoid or cannot organize yourself so that secrecy is unneccessary. 3. I am not sure WHAT makes me happy, but secure communications and commerce are not high on my list of priorities. Perhaps an end to paranoia and capitalism that REQUIRE secure comms would make me happy. Anyway . . . Thanx for the pointer Neter Picol Violence is the last refuge of the Incompetent - Assimov (?) A week is long time in crypto politics Pete Nicol Global Media Magnet nicol(a)iap.net.au BroomStick Productions VRL - the Virtual Record Label (+61 9) 335 9490 fax (+61 9) 335 9508 nicol(a)iap.net.au broomstick(a)occtech.com.au Current Project: www.iinet.com.au/~ratty/legends

1 0

FYI: release of "For the Record: Protecting Electronic Health Information"
by Lee Gibbon 17 Dec '03

17 Dec '03

On-line versions appear to be available at this site as well as means to buy it. http://www.nap.edu/bookstore/enter2.cgi?0309056977 For the Record: Protecting Electronic Health Information by: Committee on Maintaining Privacy and Security in Health Care Applications of the National Information Infrastructure, National Research Council ISBN 0-309-05697-7; 1997, 288 pages "...This book makes practical detailed recommendations for technical and organizational solutions and national-level initiatives. For the Record describes two major types of privacy and security concerns that stem from the availability of health information in electronic form: the increased potential for inappropriate release of information held by individual organizations (whether by those with access to computerized records or those who break into them) and systemic concerns derived from open and widespread sharing of data among various parties. The committee reports on the technological and organizational aspects of security management, including basic principles of security; the effectiveness of technologies for user authentication, access control, and encryption; obstacles and incentives in the adoption of new technologies; and mechanisms for training, monitoring, and enforcement...."

1 0

New key for shamrock@netcom.com
by Lucky Green 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- C'punks, I am preparing to retire my old 1024 bit RSA key. It was generated 1/14/1993 and good key hygiene suggests it is time to retire this key. What better time to generate a new key than now that PGP has moved away from shaky MD-5 and patent encumbered RSA to DSS and DH. I would ask anyone that signed my old key to please sign my new key with fingerprint 4A17 A6D7 8E80 3B44 C196 F509 8971 9FA7 B663 B0FD. The key is on the servers. Thanks, - --Lucky -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQCVAwUBM5+iUwSQkem38rwFAQFQPAP/U8Ck6CYQUJI8W/TEf3BQDW1XF0YmYsF1 GcuIp9fYQnRXdB7fKdYvzSffaSs/N5TCjmyeqpTyuE9c7nFqIlu6L+iHoiwdaFdj UR3DBesS1BpmA71kRKzyt3bue1qttz+dhbhcQFd421sPzkqA7gSkOaQzP1ujspI7 mNS8FH9LyGs= =hwfW -----END PGP SIGNATURE----- --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

2 2

Re: PKCS-11 vs. CDSA APIs
by Dave Emery 17 Dec '03

17 Dec '03

Lucky Green wrote : > > Furthermore, as William has mentioned in the past, encrypted instruction > sets make decompiling and thereby reverse engineering the application next > to impossible. Perhaps he has, but I believe I was the one to post about it first. As you know, my fear is magic stuff in OS inner rings that enforces social policies and perhaps also provides "sovereign right of lawful access" to you know who... Encrypted code may be very difficult to decrypt, and if the OS controls key management also nearly impossible to modify (presuming that the encryption is not just XOR'd with the instruction stream which would allow trivial modification once the instructions were decrypted). That combination is nice for copyright enforcement, but sure has some nasty other uses and is a fundemental enabling technology for such future statist possiblities as restrictions on running modified or unapproved software without a license to do so - a software developers license say, or the old Internet drivers license. I am sure that many businesses would be very happy if all their PCs would only allow software that management approved to run - there would be a huge market for such in fact... and probably a lot of the public would willingly buy machines that would only run approved software if they could pay less for the software or access first run movies or other candy unavailable on free machines. It is really hard to think of a way of controlling what the sheeple do with their computers that does not depend on hard encrypted code in both OS and application - code that is decrypted only inside the silicon of the CPU with precautions taken to make access to the decrypted streams very difficult and expensive for hardware probers. Years of trying other methods have failed to produce something practical from a cost and security standpoint; there are just too many smart and persistant people around who will find a means of attacking anything that is exposed. But it is also obvious that there are billions of dollars in revenue lost to software pirates and additional sales of copyright works that don't happen because the owners aren't happy if it is even remotely possible to obtain pirate copies. And money talks, and with those levels of dollars involved one can expect a lot of things to happen, especially in the current DC climate, and with the possiblity that such technology will both provide the protection of intellectual property that the big money interests want and the social control and surveillance that the fascists want. The good part is that making the whole thing adaquately secure is very hard and the attempt may fail, the bad thing is that there very well may be draconian laws that make any attempt to understand or modify the code running on one's computer a serious felony and people may be locked up for years for just trying to determine what a program is doing to them. There have already been attempts to create these laws. But I've said much of this before... Dave Emery die(a)die.com Weston, Mass.

1 0