December 2003 - cypherpunks-legacy

Greg Taylor: preliminary Wassenaar details from three countries
by John Gilmore 17 Dec '03

17 Dec '03

[Greg graciously allowed me to repost this. --gnu] Date: Sat, 05 Dec 1998 15:22:53 +1000 From: Greg Taylor <gtaylor(a)efa.org.au> Hi John, You wrote: >I have not found a single confirmation of the Aarons statement that >the 33 Wassenaar countries have agreed to change the exemption for >mass market crypto software. (The NY Times and Reuters stories both >quote Ambassador Aarons.) I think Aarons must have an advanced degree in spin doctoring, but nevertheless information about new restrictions on mass market software has also come from 3 independent well-placed sources. >From the UK crypto list: ================= Just talked to Dirk Weicke, Senior Adviser to Wassenaar Organisation. Tel:+43 1 516360) No written details will be issued until next week, but gist is: *) No alteration to question of whether Wassenaar covers intangible exports. Up to signatory states to interpret and legislate. *) mass-market software, symmetric key length limited to 56-bits *) software generally available, but with other restrictive tests on end-user re-configurability, symmetric key length limited to 64-bits *) Assymetric key lengths (not sure how relates to above) limited to: RSA & Digital logarithm: 512 bits Elliptic curve : 112 bits ===================== And here's a view from David Jones (EFC), from the GILC list: ===================== - There is "some relaxation" for restrictions on symmetric methods using key lengths of 56 bits or less. Stronger crypto would require an export license. - There is no restriction on mass-market software using symmetric methods and a key length of 64 bits or less. Stronger mass-market crypto would require an export license. - "Public Domain Software is not restricted" [If this is really true, this is still an important loophole.] - There is not yet any clear information about the status of "intangible goods", like crypto software on a web site, or sent by email, as opposed to "tangible goods", like software on a floppy disk or CD-ROM. - The restrictions on mass-market software greater than 64 bits is "for public safety" reasons and will last for 2 years, after which it will be reviewed. ============================= Yesterday I got the Australian government interpretation from Robbie Costmeyer in Canberra. Costmeyer is the Defence bureaucrat responsible for approving export licenses. I was told that Wassenaar had now agreed that the General Software Note waiver no longer applied to Category 5/2 items (i.e. crypto) on the controlled goods list. It has always been the view of Defence Signals Directorate here that it was an oversight that crypto software came under the GSN. That reason was used to justify Australia's going one step further than required under the original Wassenaar Arrangement and disallowing exemptions to the export licensing rules. A few other countries do the same (USA, New Zealand, France, Russia). Canberra thus views the latest change as the correction of an oversight. Clearly there is a difference of interpretation here regarding public domain software (compare the Canadian view above). This question needs further investigation. The Australian view is that the latest Wassenaar changes are a relaxation of the previous rules. And they're right, when compared with the previous rules applying here. Australia will now move to amend the Defence Strategic Goods List (DSGL) to allow exemptions for small key lengths as decribed above. For other countries, the effects remain to be seen. We'll just have to wait for more information to filter out. Greg

1 0

FREE WEEK XXX PORN SEX http://i.am/dupri
by Thomas Dupri 17 Dec '03

17 Dec '03

PORN AT IT'S FINEST! YOUR SEARCH IS OVER! CLICK NOW FOR A FREE FREE FREE LIMITED TIME OFFER! ONE WEEK FREE! HURRY! http://i.am/dupri http://i.am/dupri

1 0

ZDNet and ZDTV Forums Update
by ZDNet Announce 17 Dec '03

17 Dec '03

++++++++++++++++++++++++++++++++++++++++++++++++++++++ This is the second message from ZD to all the members of our message boards. It contains information and tips about a coming transition to new software. You will receive just one or two more of these messages in the coming week. ++++++++++++++++++++++++++++++++++++++++++++++++++++++ When you go to the ZDNet or ZDTV forums on Tuesday, Dec. 8, you will find the new Deja News software in place. You will see some differences in the way the message boards operate, so you may need to experiment a little. If you are very familiar with our current forum features, it will take some time to become comfortable with the new system. We apologize for the inconvenience this causes and are trying to make the switch as painless as possible. We'll have dozens of sysops online answering your questions every day. We also will update the on-line help files frequently to highlight key differences between the current software, called Podium, and the new version. Below are some advance hints for everyone making the switch to Deja News. You can try these features out in now our Test Forum at http://f5.dejanews.com/frames/test.html ** Messages that you have not yet read appear in bold. ** That's how Deja News tells you which posts are new since you last visited. Once you open and read a message, the bolding goes away. You have the option to Mark Thread As Read, and an entire set of messages will lose their boldness. In addition, you can Mark All As Read, and every message in that forum will become un-bold. ** When you leave a forum and come back later, messages that you read previously are not displayed. ** You can see these already-read messages by clicking the Show All button. Here's the tricky part: If you read all the messages in a thread and then someone adds another, the entire thread will be displayed and most messages will not be bold. Just the new message that you have not yet read will appear with bolded text. (In our current message board software, messages that you had already read remain hidden when a new message is added.) ** On Tuesday, some messages that you have read will be marked as unread. ** We will migrate all the messages currently in Podium over to the new Deja News software. However, we cannot keep track of which messages every user has read. As a result, all messages will be marked initially as unread. You can easily take care of this by doing one of two things: 1) Use the Mark All As Read found at the top of the new message board. This approach is fastest, but it might make you overlook some messages you really do want to read. 2) Use the Mark Thread As Read text link found at the beginning of each thread. This approach is a more selective way to get up-to-date, but it takes a bit more time. ** You can Expand or Collapse the entire thread list. ** The thread list shows all the individual "conversations" happening in the message board. The default setting shows you just the starting topic in each thread. If you want to see a detailed list of all the replies to that initial message, just click the Expand button. To shrink your threads list again, click the Collapse button. Collapse and Expand are basically toggle buttons. Show All and Show Unread are also toggle buttons, and they oper- ated independently of the Collapse and Expand controls. ** Your browser's reload button works in the forums. ** In Podium, when you hit reload in your browser, your forum display settings would disappear. In the upcoming Deja News software, your settings are preserved. So go ahead and hit reload to see if new messages have been added while you are online -- it works! ** Give Search a try. ** The Deja News fast search capability will help you track down messages easily. You can look across all the forums or in just one, for any text in a message. If you choose Mark All As Read but want to locate an earlier message, use the Search function. Thanks for taking the time to read this note. I hope these tips give you some insight into the new software and make the switch smoother. We're adding user-suggested info to our help file with the launch of the new forums next week, so keep those comments and ideas coming! We look forward to seeing you in the new forums, and we are glad to have you as a part of the ZD Community. Wendy Frankwich ZD Community Central http://chkpt.zdnet.com/chkpt/zdn11204/www.zdnet.com http://chkpt.zdnet.com/chkpt/zdn11204/www.zdtv.com _______________________________________________________________________ To be removed from this list, simply reply to this message with "unsubscribe" as your subject.

1 0

[Fwd: y2k/gary north delusions]
by Soren 17 Dec '03

17 Dec '03

To: Igor Chudov <ichudov(a)algebra.com> Subject: Re: y2k/gary north delusions From: Soren <sorens(a)workmail.com> Date: Sat, 05 Dec 1998 08:29:23 -0500 References: <199812042341.RAA18742(a)manifold.algebra.com> Igor Chudov @ home wrote: > > > Well... The answer is that there is much less washing needed for > survival than it is needed for day to day civilized American life. > > For instance, I change my shirts every day. If shit hits the fan, > you can wear a shirt for two weeks. Similar story is with other > clothes. This is a good one. What about the other half of American life (the uncivilized?). You know, the americans who live in those old refrigerator cartons? The ones that nobody sees? I think they get more than 2 weeks out of their shirts. The sad fact is that city brats haven't got the faintest idea what survival is all about (you mean I have to *walk* to the supermarket?). It was in the 1890's when Queen Victoria issued an edict that forced all the english to 'bathe at least once a year'. Sit back and enjoy the carnival.

1 0

Re: What was the quid pro quo for Wassenaar countries?
by HyperReal-Anon 17 Dec '03

17 Dec '03

"Phillip Hallam-Baker" <hallam(a)ai.mit.edu> writes John Gilmore may be right, but remember folks that in Europe we have this thing the Greeks invented called democracy. One of the ideas of democracy is that decisions are not made in secret closed meetings. Yes, and people democratically demand government enforcement of the majority will, something made more difficult if the subjects have strong cryptography. As Donn Parker observed several years ago, strong cryptography is inconsistent with democracy. (Published in Scientific American --- reference on request.) John Gilmore <gnu(a)toad.com> writes Some countries actually seem to care what their citizens think about their crypto laws, unlike the shining example of democracy, the USSA. And when we educate the citizens, they tend to make the right choices. Let's keep trying. But don't educate them too much, or they will understand that cryptography can set people free, and if people were free there would be no political government, and if there were no political government their social security checks would stop coming, along with all their other government ``benefits''.

1 0

a strategy
by bill payne 17 Dec '03

17 Dec '03

I just read the most recent AFTER MONTHS of nothing happening. http://jya.com/a6e.htm Love it. Can you possibly get suspected terrorists on your landlord's case?

1 0

Frequent Asked Questions Re: $9.99 to build your own
by promo124＠hotmail.com 17 Dec '03

17 Dec '03

(FAQ) Frequent Asked Questions --CABLE TV DESCRAMBLER (do not hit the reply button, this message is generated automatically for those interested in the product. You'll receive this message only once) Hello!!! =) "Thank you for requesting more information about the Cable Television Descrambler. I've been asked so many good questions that I left unanswered in my first letter. For that reason, I have put together this Question & Answer letter. I apologize in advance for not being able to answer each of your questions personally. The response has been overwhelming. " Q: Will the descrambler on Fiber, TCI, Jarrod and satellite systems? A: The answer is YES. In respect to satellite, you just get MORE stuff! Q: Do I need a converter box? A: This plan works with or without a converter box. Specific instructions are included in my plans for each! Q: Where can I find the 75pf-100pf variable capacitor, Radio Shack doesnt have it? A: Many Radio Shacks do have it. However, you have two other options. 1st call a radio speciality supply store in your area that is listed in the yellow pages. 2nd you can order the capacitor from me. If needed I will mail you as many as you need for the price (s) below. Im not trying to make a profit out of it, just want to help you. Ill wrap it carefully and send it to you only if you send me a self addressed #10 size padded envelope, with 64c postage affixed. 1-10 75pf - 100pf variable capacitor $12.99 ea. 20-Up ................ $ 10 ea. Q: Can the cable company detect that I have the box? A: No, the signal descrambles right at the box and does not move back through the line. Q: Do I have to alter my existing cable system, television or VCR? A: The answer is no. Q: Does this work with my remote control? A: The answer is no. It's a manual kind of thing... but very easy. Have your spouse or significant other get off the couch to do the deed! Q: Can you email me the plans? A: No, the plans come with an easy to follow picture guide. Q: Does this work everywhere across the country? A: I have friends in four states and one in England and Brasil that use the same parts and the same plans and they are all successful. Q: Is this deal guaranteed? A: Yes, if you are unhappy for any reason I will refund your money. Q: Is this a rip off or a scam? A: No, if it were Id charge $50.00 or more for the plans. Be sure I not going to damn myself to hell by ripping you off for a measly $9.99 or so. Q: When I order, when will I get my stuff? A: I mail out all orders within 24 hours of receiving it... IF YOU SUPPLY A SELF ADDRESSED, STAMPED RETURN ENVELOPE WITH 55 CENTS POSTAGE AFFIXED. Q: Again, How much does it cost to get the instructions plans and the easy to follow diagrams? A:To order a set of the instructions send $9.99 by cash, check or money order payable to: RMS Enterprises Send to: 50 Lexington Ave, Suite 209 / New York City, NY 10010. Q: Can you give me a list of the parts again? A: Yes. 1 - Radio Shack mini box (part #270-235) 1 - Œ watt resistor 2.2K - 2.4K ohm (part #271-1325) 1- 75pf-100pf variable capacitor (special order) 2 - F61a chassis-type connectors (part #278-212) 12" no. 12 solid copper wire 12" RG59 coaxial cable Q: I lost your address, could you give it to me again. A: 50 Lexington Ave, Suite 209 / New York City, NY 10010 USA Q: How can I pay for this? A: Check, Money Order or Cash. Sorry, no credit cards accepted. I look forward to your order. Raul Mendez Enterprises (RMS Enterprises) Kindest Personal Regards, Raul Mendez

1 0

..
by Anonymous 17 Dec '03

17 Dec '03

> > (Furthermore, most remailer structures still can't erase some other security > > concerns -- > > 1: remailers acutally can be hacked or physically compromised > > 2: clients really can be screwed > > 3: etc. > > > > To help solve the first, you'd want a two-box setup doing remailing, with the > > security-critical stuff loaded on a box not directly connected to the Net with > > something 140-1ish to make tampering harder, a secure OS, etc. -- or, of > > course, you can scrap all that to get really big remailer count. > > As long as you do not see the box and do not control its manufacture, > I see no reason why you should have ny more trust in it. Well, you shouldn't have complete trust -- a tamper-resistant net could be compromised, too -- but there's a good reason to have more trust in it than in the existing one. More on that after a parenthetical remark. (This brings up the "hardware web-of-trust" issue; you can set up such a web with trusted spot-checkers and statistical/cryptographic means of assuring the user that the box works as advertised, if your threat model demands it. There's more about it in the "Beyond Class (A1)" section of the Orange Book, although the section's use to Cypherpunk types is limited because it's written without any thought to, say, doing things cheaply or having a decentralized setup.) The tamper-resistance simply means that if the mailer was set up secure, it's not going to become compromised. Instead of having to trust that one of the remailer operators is currently honest and has always done all the necessary homework to ensure the system was safe, you have to trust that this entity was honest and diligent when the remailer was set up (unless, of course, you think the tamper-resistance was circumvented); if the operator is bribed after the remailer's set up and the public key is published, there's no way to suddenly and invisibly make messages traceable, as there is in a "normal" Mixmaster remailer. (This is because, given the normal assumptions about crypto strength, it takes the remailer's private key to process a Mixmaster-like packet and that key is generated by and stays within the tamper-resistant box) My predictions about the biggest attacks on a tamper-resistant remailer net: 1: traffic analysis. Until the net structure is overhauled, this will always be possible. 2: propagation and exploitation of faulty server software. Related to the whole web-of-trust issue. 3: direct attacks on specific clients. Again, no web of trust. 4: creation of bad remailers and attempts to shut down good ones. More messages could be traced in a world with 6 good and 47 bad remailers than in one with 9 good and 3 bad. 5: direct attacks on new remailers 6: attempts to make an operator feign a catastrophe and set up a new, compromised remailer. Users, however, would know that the new key not signed by an old one means that they must now trust that the remailer was not compromised before the publication of the new key. 7: attacks on tamper resistance ... n: attacks on crypto n+1: etc.

1 0

pgp disk
by HyperReal-Anon 17 Dec '03

17 Dec '03

>At 03:05 AM 12/5/98 +0100, Anonymous wrote about some new product: >>If the source code isn't available, don't trust it. That's a good general >>rule. > > >Where is the source for pgpfone? Good question. That's why I wouldn't use it either. (I haven't had reason to use it, so 'll take Anonymous's word that source isn't available.) If people want to release software like this, they need a better argument for its security than "Trust us, it's secure." Considering that there is no net loss when developers of such a product release source code so that people can look it over and compile it themselves, I don't have any reason to trust such software. Aren't McAfee and PGP Inc. members of KRAP and promoting Big Brother Inside? I've lost track.

4 3

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Sorry for all the questions but I've been away from crypto for a while and I'm looking for the best encryption program for exchanging email between Unix and Windows folks. I hope these questions are appropriate here. What do people generally think about S/MIME ? Is it well designed (strong and extendable) ? Is it convenient because its available in the popular email clients ? Is the most annoying thing about it that you have to pay for the keys ? Is there a way to self-sign keys ? SSLeay ? Are most people still using PGP ? If IDEA and MD5 (and PGP2.6.2) are not strong enough anymore, what are the Unix folks using ? Does the source for PGP5/6 compile to any target besides Windoze ? Thanks

1 0