December 2003 - cypherpunks-legacy

Re: PKCS-11 vs. CDSA APIs
by Dave Emery 17 Dec '03

17 Dec '03

Lucky Green wrote : > > Furthermore, as William has mentioned in the past, encrypted instruction > sets make decompiling and thereby reverse engineering the application next > to impossible. Perhaps he has, but I believe I was the one to post about it first. As you know, my fear is magic stuff in OS inner rings that enforces social policies and perhaps also provides "sovereign right of lawful access" to you know who... Encrypted code may be very difficult to decrypt, and if the OS controls key management also nearly impossible to modify (presuming that the encryption is not just XOR'd with the instruction stream which would allow trivial modification once the instructions were decrypted). That combination is nice for copyright enforcement, but sure has some nasty other uses and is a fundemental enabling technology for such future statist possiblities as restrictions on running modified or unapproved software without a license to do so - a software developers license say, or the old Internet drivers license. I am sure that many businesses would be very happy if all their PCs would only allow software that management approved to run - there would be a huge market for such in fact... and probably a lot of the public would willingly buy machines that would only run approved software if they could pay less for the software or access first run movies or other candy unavailable on free machines. It is really hard to think of a way of controlling what the sheeple do with their computers that does not depend on hard encrypted code in both OS and application - code that is decrypted only inside the silicon of the CPU with precautions taken to make access to the decrypted streams very difficult and expensive for hardware probers. Years of trying other methods have failed to produce something practical from a cost and security standpoint; there are just too many smart and persistant people around who will find a means of attacking anything that is exposed. But it is also obvious that there are billions of dollars in revenue lost to software pirates and additional sales of copyright works that don't happen because the owners aren't happy if it is even remotely possible to obtain pirate copies. And money talks, and with those levels of dollars involved one can expect a lot of things to happen, especially in the current DC climate, and with the possiblity that such technology will both provide the protection of intellectual property that the big money interests want and the social control and surveillance that the fascists want. The good part is that making the whole thing adaquately secure is very hard and the attempt may fail, the bad thing is that there very well may be draconian laws that make any attempt to understand or modify the code running on one's computer a serious felony and people may be locked up for years for just trying to determine what a program is doing to them. There have already been attempts to create these laws. But I've said much of this before... Dave Emery die(a)die.com Weston, Mass.

1 0

Re: [CNN] Stolen Laptops and lame 'solution'
by Raymond Mereniuk 17 Dec '03

17 Dec '03

> How is the buyer responsible even indirectly? > > Someone puts an add in the paper NEC Laptop $1,500. I go and check it out > and buy it. Should it be my respocibility to call NEC over in Japan and > > If anyone is responcible for the theft other than the theif is the person > who was so carless with their equipment. > Legally Law Enforcement Agencies (LEA) and the courts willl find you responsible for being in possession of stolen property. If you purchased the unit from a storefront or a person selling the unit from their home you could deflect responsibility to those parties. I would suspect most stolen units are fdisk-ed, re-formatted, and moved a minimum of a state or province and then sold through brokers who operate through a pager or cell phone. The units are sold probably more in the range of $600 to $700 CAN Dollars for 486 color units and abit more for Pentium units. The brokers may offer the unit through an auction. At this point the buyer should start to suspect something is not right, the units are too cheap and all the proprietary drivers have been removed. The reason given is that they are being disposed of by a large corporation and it is policy to erase all data. No manuals or documentation are offered with the unit. Normally when you purchase an unit from the original retail buyer manuals and documentation and extras would be included with the unit and the seller would probably be willing to show you the bill of sale. Would you buy a car from a seller offering no documentation or proof of ownership. It is tough to take the argument that stolen notebooks are the fault of the victim seriously. Notebook thieves can be pretty enterprising. They walk into offices dressed as maintainance people, buy pass keys from the real maintainance people and go through every office. A friend had a notebook taken from a locked office in a supposedly secure area, no signs of break and entry so no insurance coverage and there were notebooks and computers taken from three locked offices in the middle of the day. So in this case it was my friend's fault for doing business in a shared office environment where someone had sold a pass key to the thief?? If there was no market for stolen notebooks thieves would not steal them as there would be no gain. In my experience most people selling merchanise of doubtful origins are not sophisticated, ask lots of questions and their stories quickly fall apart. I have walked away from many deals when the origin of the goods were not clearly explained and I would suggest you do the same. Virtually Raymond Mereniuk Raymond(a)wcs.net

3 3

NEW TRAVEL INFO -- Antigua (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From owner-travel-advisories(a)stolaf.edu Thu Jun 12 16:39:22 1997 Date: 10 Jun 97 11:31:44 EDT From: owner-travel-advisories <owner-travel-advisories(a)stolaf.edu> To: travel-advisories(a)stolaf.edu Subject: NEW TRAVEL INFO -- Antigua Message-ID: <970610153144_76702.1202_CHN44-1(a)CompuServe.COM> Precedence: bulk STATE DEPARTMENT TRAVEL INFORMATION - Antigua & Barbuda ============================================================ Antigua and Barbuda - Consular Information Sheet June 9, 1997 Country Description: Antigua and Barbuda is a developing island nation. Tourism facilities are widely available. Entry Requirements: A valid passport or birth certificate and picture ID such as a drivers license are required of U.S. citizens entering Antigua and Barbuda. A return ticket is sometimes requested. Immigration officials are strict about getting exact information about where visitors are staying. There is no fee for entering the country, but there is a $13.00 departure tax. For further information on entry requirements, travelers can contact the Embassy of Antigua and Barbuda, 3216 New Mexico Avenue, N.W., Washington, D.C. 20016, telephone (202) 362-5122, or the Consulate of Antigua and Barbuda in Miami. Medical Facilities: Medical care is limited. Doctors and hospitals often expect immediate cash payment for health services. U.S. medical insurance is not always valid outside the U.S. In some cases, supplemental medical insurance with specific overseas coverage, including provision for medical evacuation, has proven useful. For additional health information, travelers may contact the Centers for Disease Control and Prevention's international travelers hotline at (404) 332-4559, Internet: http://www.cdc.gov/. Crime Information: Violent crimes and armed assaults have been perpetrated against tourists. Petty street crime also occurs, and valuables left unattended on beaches are subject to theft. The loss or theft of a U.S. passport overseas should be reported to the local police and the nearest U.S. embassy or consulate. Retaining a copy of the police report may facilitate return travel to the U.S. A lost or stolen birth certificate and/or driver's license generally cannot be replaced outside the U.S. U.S. citizens can refer to the Department of State's pamphlet "A Safe Trip Abroad," which provides useful information on guarding valuables and protecting personal security while traveling abroad. Both this pamphlet and "Tips for Travelers to the Caribbean" are available from the Superintendent of Documents, U.S. Government printing Office, Washington, D.C. 20402. Drug Penalties: U.S. citizens are subject to the laws of the country in which they are traveling. Penalties for possession, use and trafficking in illegal drugs are strict, and convicted offenders can expect lengthy jail sentences and heavy fines. Aviation Oversight: As a result of an assessment conducted by the U.S. Federal Aviation Administration (FAA) in July 1996, the FAA has found the government of Antigua and Barbuda's civil aviation authority not to be in compliance with international aviation safety standards for oversight of Antigua and Barbuda's air carrier operations. While consultations to correct the deficiencies are ongoing, Antigua and Barbuda's carriers are permitted to conduct limited operations to the U.S. subject to heightened FAA surveillance. Based on the FAA's determination, the Department of Defense does not permit U.S. military personnel to use carriers from Antigua and Barbuda for official business except for flights originating from or terminating in the U.S., or in extenuating circumstances. For further information, travelers may contact the Department of Transportation at 1-(800) 322-7873. Traffic Safety/Road Conditions: Driving in Antigua and Barbuda is on the left-hand side of the road, as in the United Kingdom. Roads are narrow and in poor condition. There is relatively little police enforcement of traffic regulations. The condition of the roads and the speed at which many persons drive lead to serious traffic accidents. More detailed information on roads and traffic safety can be obtained from the Antigua Tourist Board, tel. (268) 462-0480, or the Director General of Tourism, tel. (268) 462-1005. Embassy Location/Registration: U.S. citizens may register with the U.S. Consular Agent, Hospital Hill, English Harbour. The mailing address is c/o U.S. Consular Agent, P.O. Box 664, St. John's, Antigua. The telephone number is (268) 463-6531, Fax (268) 460-1569, e-mail (no caps) ryderj(a)candw.ag. The hours of operation are Monday-Friday, 9:00am-4:00pm. (Please call for appointment.) U.S. citizens may also contact the Consular Section of the U.S. Embassy in Bridgetown, Barbados, which is located in the American Life Insurance Company (ALICO) Building, Cheapside, tel. (246) 431-0225, which has consular jurisdiction over Antigua and Barbuda. The hours of operation are Monday-Friday, 8:00am-4:00pm. No. 97-098 This replaces the Consular Information Sheet dated March 15, 1996 to include entry requirements information, the CDC Internet address, and a section on traffic safety/road conditions. ----- ----- ----- ----- ----- ----- ----- ----- ----- ----- ----- ----- ----- The "travel-advisories(a)stolaf.edu" mailing list is the official Internet and BITNET distribution point for the U.S. State Department Travel Warnings and Consular Information Sheets. To unsubscribe, send a message containing the word "unsubscribe" to: travel-advisories-request(a)stolaf.edu Archives of past "travel-advisories" postings are available at the URL: "http://www.stolaf.edu/network/travel-advisories.html" or via Gopher: gopher.stolaf.edu, Internet Resources/US-State-Department-Travel-Advisories

1 0

Privacy Strategems
by John Young 17 Dec '03

17 Dec '03

The New York Times has a long report today on the massive data banks about US citizens operated by commercial services for sale to marketers (and used by databankers for special ops against those who sue them). Emphasis is given to the number of states that sell low-cost inmate services for data entry and preparation of hot-selling Geographical Information Surveys which map and stat in minute detail the life-style preferences of purchasers. And how sharp and horny inmates snatch select data for criminal attacks on unwary citizens (and their children) who cooperatively provided personal information to government agencies and market researchers. Texas is featured as a leader in the privatization of government data and using inmate labor to underbid offshore sweatshop competitors -- all engendered by citizen demands to reduce tax burdens. Another report covers the Microsoft/Netscape effort to ward off government regulation by agreeing on a privacy protection program. It's not clear how government and inmates will join the two public-spirited corps in peddling the illusion of privacy.

1 0

Re: [off-topic CNN] Stolen Laptops and lame 'solution'
by Peter Trei 17 Dec '03

17 Dec '03

Kent Crispin <kent(a)songbird.com> wrote: > On Wed, Jun 11, 1997 at 09:37:42PM -0500, William H. Geiger III wrote: > [...] > >The end buyer should not be held responcible for the illegal activities of > >the seller. > > Regardless of responsibility, if the original owner can prove it is > stolen goods, the end buyer is out of luck -- clearly the original > owner should get their goods back. And if the end buyer provably has > clear knowledge that it is stolen property, they are an accesssory to > the crime. The question of what happens to property which is bought in good faith, but is later discovered to be stolen, is not a clear one, and is dealt with in different ways in different countries. In the US, the property nearly always reverts to the original owner, unless the thief is a government. However, I remember reading articles about stolen art which implied that that is not always the case in Europe. When the stolen article is land, or governments and/or national pride are involved, things get very strange. Greece is still trying to recover the Elgin Marbles, which were taken by a Briton from the Parthenon around 1810, during the Turkish occupation. I'm sure Egypt would also like the Rosetta stone back - this was taken by Napolean in 1799, and later captured by the British. Both are now in the British Museum. Sometimes the claims go across millenia - the record I can think of being that certain specific parcels of land in Israel are claimed by modern Jewish settlers on the grounds that their purchase from the Philistines is explicitly mentioned in the Old Testament, while there is no extant record of their sale to the modern (non-Jewish) owners. [usual disclaimers apply] Peter Trei trei(a)Process.com

1 0

It's only QA.
by bluelist＠hotmail.com 17 Dec '03

17 Dec '03

Thee BlueList is NOT harassment. It's NetWare Quality Assurance. No VM/CMS SMTP bugs here. This time it's a Linux Smail test. In the future, look for similar tests of HP SendMail, SGI/SVI, IBM OS/2, etc.

1 0

just testing ...
by cypherpunks＠Algebra.COM 17 Dec '03

17 Dec '03

Thee BlueList is NOT harassment. It's NetWare Quality Assurance. Check the headers on this, and you'll see that they are somewhat misleading. Maybe there's some Mail Transfer Agent bugs that need fixing. Or, could it be the specifications of how this is supposed to work? In the future, look for similar tests of HP SendMail, SGI/SVI, IBM OS/2, etc.

1 0

Re: [CNN] Stolen Laptops and lame 'solution'
by geeman＠best.com 17 Dec '03

17 Dec '03

At 05:22 PM 6/11/97 +0000, Raymond Mereniuk wrote: > >> >> > The call goes to a Canadian office >> > that in turn phones the cops. So far, >> > it has a 100 percent recovery rate. >> > >> ====== 100% of WHAT? Systems with it installed which are stolen? How >> would you know what systems do NOT call in? >> It's like the question the clerk asks at the airport: "Did anyone put >> anything in your luggage you don't know anything about?" >> >> Now that the word is out, of course, the wily thief will eschew pluggin in >> until the hard drive is reformatted and installed >> with a clean OS. As usual: the stupid will be caught. > >This has been discussed on this list before, about 1 year ago. The >Computrace software is installed on a place on the hard drive where >DOS utilities like Fdisk and Format can not get at it. This is the >same as Diskmanager Version 7 or higher, Fdisk and Format will not >remove this version of Diskmanager. > Unless you overwrite the MBR and the first TRACK on the disk. Well, the bar is raised by about 3 minutes with DEBUG, thanks.

1 0

Re: Photo ID is not needed for key signings...
by Mark Grant 17 Dec '03

17 Dec '03

Joshua E. Hill (jehill(a)w6bhz.calpoly.edu) wrote: > Because _these_ people _are_ binding true names to keys. That's > what _this_ is about. No, they're binding supposedly government-issued ids to keys. There's a difference. There are three problems with signing keys based on government-issued ids. 1. There's no link between a driver's license and an email address, so anyone with a license for 'Mark Grant' could claim to be the owner of the 'mark(a)unicorn.com' key. 2. Governments will issue fake ids to their agents, so there's no proof that that 'Mark Grant' is 'really' 'Mark Grant' and not 'Joe Sasquatch, NSA, FBI, BATF'. 3. Thieves have got fed up with faking individual licenses and can now do so wholesale; see the following from a recent RISKS Digest (18:94) ------------------------------ Date: Tue, 25 Mar 1997 16:39:50 -0500 (EST) >From: GaryG4430(a)aol.com Subject: Thieves steal license machines Excuse me Sir, but would you watch my Golden Goose while I go get a cup of coffee? Published in the *Portland Oregonian*, 25 Mar 1997, p.2, Around the Nation: Thieves steal license machines MIAMI - Last year, Florida bought computers to make driver's licenses that are virtually impossible to counterfeit. But brazen South Florida thieves have been stealing the computers, sometimes later returning to the scene to pick up accessories. In seven burglaries at five virtually unprotected driver's license offices from Key Largo to Okeechobee, crooks have gathered the $15,000 computers, software and supplies for five complete systems -everything they would need to crank out the state's new high-tech, counterfeit-resistant licenses. Yup, only our high-tech systems can make our high-security, tamperproof, extremely valuable documents. And you can't just buy one of these system just anywhere... Gary Grossoehme, Oregon Electronics [Also commented on by Bob_Frankston(a)frankston.com, who notes that if the new licenses are considered "foolproof", it only increases their value! PGN] ------------------------------

2 1

New key for shamrock@netcom.com
by Lucky Green 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- C'punks, I am preparing to retire my old 1024 bit RSA key. It was generated 1/14/1993 and good key hygiene suggests it is time to retire this key. What better time to generate a new key than now that PGP has moved away from shaky MD-5 and patent encumbered RSA to DSS and DH. I would ask anyone that signed my old key to please sign my new key with fingerprint 4A17 A6D7 8E80 3B44 C196 F509 8971 9FA7 B663 B0FD. The key is on the servers. Thanks, - --Lucky -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQCVAwUBM5+iUwSQkem38rwFAQFQPAP/U8Ck6CYQUJI8W/TEf3BQDW1XF0YmYsF1 GcuIp9fYQnRXdB7fKdYvzSffaSs/N5TCjmyeqpTyuE9c7nFqIlu6L+iHoiwdaFdj UR3DBesS1BpmA71kRKzyt3bue1qttz+dhbhcQFd421sPzkqA7gSkOaQzP1ujspI7 mNS8FH9LyGs= =hwfW -----END PGP SIGNATURE----- --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

2 2