December 2003 - cypherpunks-legacy

Re: How to eliminate liability?
by John M 17 Dec '03

17 Dec '03

Bill, Thanks for your response. Such a simple idea, I kinda figgered (was hoping) that it was already thought of, but I hadn't heard of it. I have been meaning to buy Schneier's book... One of my points, however, is that if the division of the encrypted information is done properly, even if the private key were deduced by whatever means, all they would find is (for instance) the high order bits and some ECC, but nothing that could be used to regenerate any meaningful information without the other parts. Because of this, I have been asking myself, how could any one datahaven operator be held responsible for holding classified, porn, or other information if they only have a meaningless slice of it? Perhaps this is more a legal question (even more out of my league) than anything... Any comments? >Secret Sharing is easy, and there are a number of implementations with >useful properties like being able to read the original from K of N parts.* >The problem is how to implement it in ways that protect the server >operators as well as the information providers. For instance, >the author's client software can do the split and send the shares too >different servers, and make sure the readers know how to find the pieces; >this can even be automated enough to make it convenient. >This not only makes it hard for the Bad Guys to find the pieces, >it makes it impossible for the data haven provider to know what's >being stored there, and even if the site is siezed it doesn't give up >the critical information. This is a Good Thing, and we've discussed it. > >On the other hand, what happens if a Bad Guy wants to entrap the operator, >by planting child pornography, pirated software, and TOP SECRET data >in the data haven, advertising on Usenet and then calling the cops. >Anybody, including the cops, can retrieve the contraband and bust them. >So what are the alternatives, besides obviously encrypting your disks >so it's harder to determine what's on them besides the plant, >and the ever popular "don't let them find your physical location"? >Perhaps the data haven can do the split and farm the data out to >other data havens - but how do they know the data they're receiving >is really a slice of contraband data instead of Yet Another Plant? >It gets pretty convoluted. > >[* You can read about secret sharing in Schneier. ] > Thanks! > Bill >Bill Stewart, bill.stewart(a)pobox.com >PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 > ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Re: Why no "Banner Ad Eaters"?
by John Kelsey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 01/25/98 ## Subject: Re: Why no "Banner Ad Eaters"? ] >Date: Thu, 22 Jan 1998 23:53:19 -0800 >From: Bill Stewart <bill.stewart(a)pobox.com> >Subject: Re: Why no "Banner Ad Eaters"? >At 11:16 PM 1/22/98 -0800, Wei Dai wrote: >>It seems to me that blocking ads is no different from >>blocking porn. All of the technology being developed for the >>latter purpose (PICS for example) will eventually be used >>for the former. >With both PICS ratings for web pages and the new TV ratings, >somehow the ratings only apply to the program and not the >ads. After all, if each TV commercial had to be separately >rated, people would rapidly develop equipment to autoblock >commercials, and that just wouldn't do. Note that there's a difference in incentives, here, too. Porn sites in most countries, including the US, have some strong legal and social incentives to rate themselves honestly, and probably have relatively little financial incentive to rate themselves inaccurately. (Think of the hassles you get with things like disputed credit card payments made by someone's 14-year-old kid.) This makes the blocking software's job a lot easier. I just can't see what incentive advertisers have to co-operate with rating systems of this kind. How would it improve your bottom line? Advertisers are likely to get paid either on the basis of number of people who see the ad, or on the basis of number of people who click on the ad. In either case, letting your ad be casually filtered out is just not going to make you any money. About the only incentive I can see for letting your ads be blocked is the desire not to make too many ad recipients mad at the advertiser. (Presumably, this is the reason why spam is almost never used by reputable companies--they don't want to make too many potential customers angry.) But this doesn't seem to apply to webpage ads, which manage not to be quite intrusive enough to enrage their targets. >Unfortunately, you're probably right, though providers and >advertisers who really want their messages to get through >will find ways to do it. The current banners are nice, >friendly implementations in that they're easy to identify >and block; newer ones will just be sneakier. I assume that, sooner or later, the advertisements will be woven in so well that it's all-but-impossible to get rid of them without also getting rid of the useful content you're trying to read/see/use. [Good comments deleted.] >Alternatively, >they may go to clickthrough payment models - the web page >owner only gets paid when people click on the ad, though >perhaps at a higher rate than current "impressions". Maybe. Either way, in the long run, ads that don't seem to be generating sales aren't going to be renewed. Being able to count clicks gives you one metric for this; another is completed sales from those clicks. This defines why web page owners that are making lots of ad revenue will have lots of incentive to make people who use their services look at and respond to their ads. People will try various things to make this happen. If none of them work, then ad-supported pages will cease to exist. Many of the services now supported by ads have other good revenue models. Sites like Dejanews and Altavista have enough name-recognition to do things like sell custom searching or research from their Usenet and Web databases, or provide statistical customer profiles that don't reveal customer identities but are still of use to marketers. >Bill >Bill Stewart, bill.stewart(a)pobox.com Note: I read CP-LITE instead of the whole list. Please CC me on replies. - --John Kelsey, kelsey(a)counterpane.com / kelsey(a)plnet.net NEW PGP print = 5D91 6F57 2646 83F9 6D7F 9C87 886D 88AF -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNMwNTiZv+/Ry/LrBAQH6KgP/c0o0ZiraSW7PbmDK6YQh+D3wp48cIn3S manFeca05yuoJDvs6ZKO85ycvVTvVZXBP8tvVDDAMD35CEfxGMNc/0bk1hqS/rx9 /gkHy/OYeKvcSscP9KwWTRtGu+DhHxjNqxOuFFgw6QBCxA5KDdUakF64POlYbi/2 +/kMlWS3on0= =QsU7 -----END PGP SIGNATURE-----

1 0

Technolgies of Political Control
by John Young 17 Dec '03

17 Dec '03

Thanks to Axel Horns and Ulf Möller we offer an excerpt of the draft European Parliament report on global surveillance cited in news reports recently: An Appraisal of Technolgies of Political Control Scientific and Technological Options Assessment Working Document (Consultation version) PE 166 499 Luxembourg, 6 January 1998 The report covers: - The Role & Function of Political Control Technologies - Recent Trends and Innovations - Developments in Surveillance Technologies - Innovations in Crowd Control Weapons - New Prison Control Systems - Interrogation, Torture Techniques and Technologies - Regulation of Horizontal Proliferation - Further Research See excerpt: http://jya.com/atpc.htm Printed copies are available from the staff of the British MEP Glyn Ford (tel +322 2843748 fax +322 2849059, jford(a)europarl.eu.int)

2 1

Welcome to our WebBoard!
by webboard＠netstrike.com 17 Dec '03

17 Dec '03

Thank you for participating in our conferencing system, Random Q.. Please save this message. It contains important information, such as your login name and password (see below). Our web conferencing offers online Help for all major features. If you have questions about a feature, look for the help button on the menubar or post a message asking for help (Click "Post" on the menubar). You may also want to try features such as email notification, spell checking, file attachments, and more. Here is your login information. Be sure to keep it somewhere safe! Your Login Name: cypherpunks Your Password: cypherpunks You can change your password, email address, and other items by clicking the "Profile" button on the menubar. Please be sure to come back and visit us at: http://max.netstrike.com:8080/~1 We hope you enjoy participating in our conferences! Sincerely, WebBoard Administrator

1 0

Welcome to RebaNet
by Registration＠Reba.com 17 Dec '03

17 Dec '03

Hello, and welcome to RebaNet! I hope you enjoy what we have put together for you on my web site. We've tried to make it fun and entertaining, as well as informative. RebaNet is filled with extras such as: chat, message boards, Reba Review, and you'll even have to opportunity to send me questions through Ask Reba. Isn't modern technology just amazing? I still find it hard to believe that I can write you a letter, hit send, and you have it waiting in your e-mail box just minutes later! From time to time, I will send you email messages. This is a great way for me to keep in touch and let you know what's going on with me. Love, Reba

1 0

Ultra computer
by Anonymous 17 Dec '03

17 Dec '03

Go back to the sushi bar and read your English book. Chop chop. >Ultra computer which NEC had the calculation speed of the world >maximum of about 1000 times of the super computer to was decided >to be developed. >Ultra computer will be completed in 2001. >It has the performance that the calculation which takes 10000 years >with the personal computer is made of 3, 4 days.

2 1

Re: Announcement: RPK InvisiMail released on 12 Jan, 1998
by Bill Stewart 17 Dec '03

17 Dec '03

I was amused to receive two mail messages back-to-back, one from Peter Gutmann talking about New Zealand having one of the strictest formal export controls in the world, and one from RPK New Zealand talking about how their encryption product is not export-controlled because it's from NZ, not the US, and how their RPK Fast Public Key Encryptonite(tm) Engine is the strongest crypto in the world. Either they haven't bothered asking for export permission, or they asked in such a way that the export bureaucrats didn't notice it was crypto and regulated by their crypto export preventers, or their crypto somehow falls through the cracks, e.g. by using an algorithm with public keys shorter than 512 bits (works for ECC, not RSA) and private keys shorter than 40 bits (or 41 on a good day), or perhaps passes the "snake oil test" for export permission. I suppose it's possible that the NZ Export Bureaucrats have lightened up since Peter's last dealings with them, but it's not likely. >--------------- The mail, referencing www.invisimail.com >RPK New Zealand Ltd. in a joint venture with Virtually Online Ltd. >has released RPK InvisiMail, a standards-based e-mail security >application for use with Internet mail software (SMTP/POP3). >The product offers the strongest encryption available anywhere in >the world. Since it was built outside the United States, >it is also available all over the world with strong encryption. >RPK InvisiMail is also the easiest product of its type >to setup and use which makes it quite unique. ========= From Peter Gutmann's web page This policy has resulted in New Zealand enjoying the dubious distinction of having the strictest export controls on earth, with everything ranging from crypto hardware down to software, library books, computer magazines, and journals being restricted from export. It's not even possible for a university to publish academic research without prior permission from a government agency, and the requirements for obtaining this permission are structured to ensure that they can never be fulfilled. You can find the information on: http://www.cs.auckland.ac.nz/~pgut001/policy/ ============================== Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

NYTimes web cookies
by ghio＠temp0199.myriad.ml.org 17 Dec '03

17 Dec '03

> Cookies and the NYTIMES subscription: NYTIMES.COM tries to store your > userid and password in the cookie with keywords PW= and ID=. Problem is, > it tries to encode them using 8-bit characters. Lucky for us, at this time > NYTIMES.COM does not check if userid/password are valid, just that they're > a part of the cookie!! So, just add these two lines to your junkbuster > config: > > wafer PW=0 > wafer ID=0 > > and nytimes.com will greet you as "0" and let you right in. It doesn't check the PW or ID at all except the first time you log in. After that it generates a new cookie titled NPLCNYT and that is the only cookie it checks; the PW and ID are not required to be there at all. If you delete the NPLCNYT cookie, it will check the PW/ID and generate a new one. An example cookie is below: NPLCNYT=AAAALw>AAAAAX9IUUWiPhfALqHZuSh2mUM0yzNOwGRReAAAAAsAAAAAY3lwaGVycHVua3M> ^^^^^^^^^^^^^^^^^^^^^^|||||##### The characters marked ^^^ appear to be random, and change every time a new cookie is generated. The ones marked ##### appear to encode the originating IP address, and ||||| appears to be date/time. The rest don't seem to change (tho I only tried ID=cypherpunks PW=cypherpunks). The server will still accept the cookie if your IP address changes. There does seem to be some sort of checksum on the data. While the relatively small area it uses to store the time and IP address wouldn't seem to leave much room for this, I wasn't able to find a spoofed cookie that it would accept - perhaps the checksum is included in the 'random' part.

5 5

Re: Announcement: RPK InvisiMail released on 12 Jan, 1998
by John Young 17 Dec '03

17 Dec '03

Bill Stewart compared the PR of RPK New Zealand's crypto to Peter Gutmann's claims for NZ export controls. This contrast confirms the report a few days back that any commercial crypto product that receives export approval from any country is probably compromised notwithstanding the manufacturer's claims otherwise. Not that it's news here, but this appears to be the unpublished requirement for granting of approvals, case by case. Either cooperate or face indefinite delays. As Peter noted some time ago, this is what he was running into when he could not get a clear answer about NZ regulations, and parallels reports of similar experiences in the US, UK and other countries. There is a similar current thread on UK Crypto about the difficulty of getting a straight answer about crypto policy from HMG while observing the success of cooperating crypto manufacturers. It will be interesting to see how hard Congress pushes in the new session to expose what the Administration is up to behind BXA's closed doors in contrast to open accounts. And, what will be revealed (and concealed) bit by bit from the horse-trading of the Bernstein, Karn and Junger cases.

1 0

Re: Burning papers (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 26 Jan 1998 04:00:08 +0100 (MET) > Subject: Re: Burning papers > From: nobody(a)REPLAY.COM (Anonymous) > I've heard that you can look at it under a microscope with a polarizing > filter and see the magnetic patterns. Go down to your local security or electronics supply (not Rat Shack) and you should be able to buy a polarized loupe and see it directly. > Plastic should burn fine, as most is polyethylene (CH2) which produces > water and carbon dioxide when burned, leaving virtually no residue. The > only plastic that you'd need to worry about is chlorinated stuff like PVC. If it has any N in it then don't burn it in a closed space otherwise you will get various xCN compounds. These are very toxic, KCN is Potassium Cyanide. In general you don't want to burn most plastics in closed spaces or be downwind because they do give off various toxic chemicals. You can check with your local fire dept. and they can provide references on the plastics used in television cases, 3.5 floppy covers (v the disk itself), video tape, etc. and the sorts of gases they give off. When my house burned 3 years ago both my cats were killed because of smoke inhalation (approx. 9 computers and bunches of other plastics went up). It was not a pretty sight. Congealed blood from lung eruptions on their lips, very blue tinge to the skin, etc. Not a pretty sight. If you're smart avoid burning plastics except under very controlled circumstances. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1