December 2003 - cypherpunks-legacy

Mostly offline digicash
by Mike Ingle 17 Dec '03

17 Dec '03

>>After-the-fact detection probably won't fly, because organized multiple >>spending could kill it. There are people who are dumb enough to write >>their PIN numbers on their ATM cards. >Nevertheless, millions use ATM cards, with substantially less loss to >fraud than with credit cards. Improvement in privacy and reduction >of incidence of fraud over credit cards are sufficient goals for a >digital cash system. True, but if someone swipes your ATM card and PIN, they can only get what's in your account, and only $300 or $500 a day. If someone swipes your digi-coins, they can spend them hundreds of times, obtaining merchandise worth much more than the coins, before being detected. That's the hazard I'm worried about. A few such heists could make people back away from digicash. The problem with credit cards (and cellular phones) is the "replay attack." Some kind of authentication is needed. As I understand it, ATM's use DES with the PIN being used as part of the DES key, correct? >For Pretty Good Digicash, which would probably far exceed those >goals, how about a "mostly offline" system as follows: I like this approach. It does require the "online infrastructure" to be present at every shop, but it would generate less bandwidth than fully online systems. Offline processing could be done at night when the system is otherwise idle. The Russian-roulette aspect of trying to cheat would certainly discourage it. >I envision a decentralized credit-rating system, so that the >integrity of ratings cannot be jeopardized by corrupting one or a >related few credit rating agencies with false information. (The IP >paradigm: an economy should be able to route around node failures). Definitely. The goal of digicash, at least in my opinion, is to destroy centralized power. An online system should have multiple servers, and an observer-based system should have multiple suppliers of observers. The only secret in the observer should be the key. --- MikeIngle(a)delphi.com

3 2

to mark re: MoD tapping
by Cdt Pvt Dan Doughty 17 Dec '03

17 Dec '03

well from what I have read, an observer watched as one of the members loaded a program, called a local telephone system, (the utility was a phone utility produced by the phone company) and then whala he could hear the people voices or if data he could watch it scroll down his menu. I was amazed when I heard this. No tech available but I thought I should mention that it was a hardware utility available through the modem. Dan

1 0

No Subject
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

i've heard rumors that one or more pgp key servers have been shut down due to lawyers letters from bidzos and/or pkp. anyone have any facts?

1 0

TV scremblers.
by blaster＠rd.relcom.msk.su 17 Dec '03

17 Dec '03

Hi! How can I receive any information about TV scremblers (and hacking of one)? --- Victor A. Borisov aka blaster; Relcom R&D; Email: blaster(a)rd.relcom.msk.su; Phone: +7(095)-943-4735; +7(095)-198-9510; === Don`t panic! ===

1 0

Article in biz.clarinet.sample
by Lyle_Seaman＠transarc.com 17 Dec '03

17 Dec '03

I don't know whether forwarding Clari articles posted to ...sample is permitted or not, so I am posting just a pointer. Trot on over to biz.clarinet.sample, and check out this article: > Subject: Software you can buy but can't sell > Message-ID: <biz-computerUR971_3N1(a)clarinet.com> > Date: Sat, 6 Nov 93 18:08:02 PST > In mid-October, the House Subcommittee on Economic Policy, Trade and > Environment began a round of hearings on legislation to reauthorize the > Export Administration Act, which sets export control policy for the > United States. There's not a lot of information, but it's a favorable article. Peeve: I wish tech editors wouldn't insist on spelling out acronyms that nobody ever (ever! Well, except tech writers/editors) uses in their spelled out form. If they must spell them out, do it in parens, and bury it. I *hate* having to try to figure out what "the Transmission Control Protocol / Internet Protocol suite" is (eg). > It wasn't that Iraq's dictator had hired the world's best technical > wizards to work for him. It was because the technical minds which were > already in Iraq recognized the fact that standard Internet Protocol > routers were designed well. Knock one out and another takes over, > invisibly. The computer network keeps running.

1 0

Re: Remailer Abuse?
by nobody＠cicada.berkeley.edu 17 Dec '03

17 Dec '03

hh(a)cicada.berkeley.edu says: > Harassing other users is considered abuse, and sending chain letters is a > form of harassing other users. However, it's not a very serious form of > abuse. If I found conclusive evidence that someone were sending something > like childporn through my remailer, I would take some pretty drastic > actions. Interesting. I wonder what those drastic actions would be? People sending serious death threats and the like through anon remailers should be aware that those actions are considered seriously anti-social and may cause them some problems. But I don't view "kiddie porn" the same way. Its very definition is VERY ill-defined, and there is widespread disagreement on how much of an evil threat to truth, justice, and the American Way it really poses. This makes me start to think that borderline policies like this should be well publicized by the operator of the remailer. I don't support the kiddie porn witch hunt going on in the U.S. currently, and would not have assumed that posting what many people consider to be harmless photos of kids under 18 would get someone automatically turned in to the cops. (Again, keep in mind that the definition is very fuzzy. Some people who have been busted as kiddie pornographers have been busted for extremely mild and un-pornographic material that no reasonable person would consider harmful.) .....Cindy

1 0

Mark Abene (Phiber Optik) sentenced
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311080705.AA15339(a)toad.com> newsham(a)wiliki.eng.hawaii.edu writes: > I have heard that tapping high speed modems can be a little tricky > because of the adaptive filtering done. The modems both have > adaptive filters that adjust to the line as they see it. If you > are tapping at some other point the filtering will not be optimimal > for your case. I believe these filters take care of smearing and > echos and things of that nature. > > Maybe someone in the know can elaborate and clear up all the > bad data I probably just spewed :) Dunno if this is how they did it, but you get *perfect* data tapping if you record digitally off the exchange trunks... G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

TEMPEST, Van Eyck Radiation, and Eavesdropping
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

TEMPESTpunks, The theme of TEMPEST/RF/eavesdroping/Faraday cages/Van Eyck Radiation/etc. comes up on this list every month or so, nearly as often as the threads about generating random numbers in hardware. (If you don't know about eavesdropping on computer sessions by monitoring and decoding RF emissions by the computers, keep reading this list and the topic will pop up, as it just has!) Anyway, I found this item interesting. I'm not yet sure we need to become "Faraday-Cage-punks quite yet, but the articles and laws mentioned in this report might be useful for someone. From: mitchell(a)ncsa.uiuc.edu (myself) Newsgroups: talk.politics.crypto Subject: Re: illegal taps Date: 8 Nov 1993 22:39:54 GMT Distribution: world Reply-To: mitchell(a)ncsa.uiuc.edu (myself) In article <2bjdvm$6gh(a)vixen.cso.uiuc.edu>, trh42502(a)uxa.cso.uiuc.edu (Dream Weaver) writes: |> I suggest that this be the last post here, as the topic is going well |> out of the groups charter. Please redirect, somewhere else. |> |> This officer was in the same way. He freely admited that he was monitoring |> cellular freqs. My reading of the posting as that he had no idea that this was |> illegal. BAD training, and/or lack of understanding of technology based laws! |> It needs to be emphasized to police that just because something is |> transmitted in the air does not mean they can listen to it! Ordinary |> telephone lines transmit, microwave repeaters for long distance & etc. |> Does anyone know if Tempest or any other non-visual surveillance is |> legal without a warrant? |> There is a file available from NIST discussing TEMPEST tech, and its legal status. It is quite an interesting read. Anonymous ftp to csrc.ncsl.nist.gov file /pub/secpubs/tempest.txt It summarizes the legal status of TEMPEST as follows: The use of TEMPEST is not illegal under the laws of the United States3, or England. Canada has specific laws criminalizing TEMPEST eavesdropping but the laws do more to hinder surveillance countermeasures than to prevent TEMPEST surveillance. In the United States it is illegal for an individual to take effective counter-measures against TEMPEST surveillance. This leads to the conundrum that it is legal for individuals and the government to invade the privacy of others but illegal for individuals to take steps to protect their privacy. <quote.off> The reason for the preventive equipment being illegal is that it is classified. (Shocker!) The eavesdropping is legal due to the fact that the radiation emitted in not considered to be a 'communication', and hence is not covered by ECPA, etc. I am leaving this followup in talk.politics.crypto due to the fact the as crypto gets better, the best way to 'crack' it will be through techniques such as TEMPEST. Even a one-time pad doesn't help if your opponent can read monitor from a half-mile away! Anyway, I highly recommend that everyone interested in this thread get a copy of the file. Curious that it should show up on an NIST server. Looks more like something EFF would be distributing. -David Mitchell |> Tom |> |> ______________________________________________________________________________ |> Tom Hilquist Internet:t-hilquist@uiuc.edu |> Disclamer: I didn't write this! Email for PGP Public Key |> PGP 2.3a Key fingerprint = 20 FF CA 46 1D B8 CD 55 F7 9D 71 B0 BD B7 B3 B5

2 1

Bits-n-Bytes Online
by Stanton McCandlish 17 Dec '03

17 Dec '03

Anyone have the address of Bits-n-Bytes Online newsletter? I think Jay Machado is putting that out, but I don't recall... -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715 Fido 1:109/1103 IndraNet 369:111/1, 14.4V32b 16.8ZyX Join EFF! For more information about membership, send mail to eff(a)eff.org

1 0

Re: ID of anonymous posters via word analysis?
by doug＠netcom.com 17 Dec '03

17 Dec '03

"Perry E. Metzger" <pmetzger(a)lehman.com> said: >Astonishing how far urban legends go. This keeps getting distorted >further and further. I've heard this go further and further and >further from the version I first heard. I wonder if there ever was a >real story to begin with. Good question. I just checked a terse history of machine translation, and it didn't mention any version of this. I suspect that its origin was as a hypothetical example of the kinds of problems that can arise, and that it didn't actually happen in any real life situation. Examples like that have always been common in linguistics papers on such subjects. Doug

2 1