December 2003 - cypherpunks-legacy

RE: Mounting a "Secure" filesystem in UNIX
by jim＠Tadpole.COM 17 Dec '03

17 Dec '03

I can't even begin to imagine the kinds of calls that Microsoft support will get with this 'feature' in place. "But it worked yesterday, and I haven't changed ANYTHING!" Jim

1 0

digital timestamping
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

I seem to have lost all information about how to use the Bellcore timestamper. Neither could I find their hash code in the Sunday NYT, last I looked (perhaps that was a slow week). Please post information on this, if you have it. Paul E. Baclace peb(a)procase.com

1 0

RE*2: (fwd) Netcom adds access in Denver area
by P.V.McMahon＠rea0803.wins.icl.co.uk 17 Dec '03

17 Dec '03

> these capabilities is far beyond my budget. I can't understand why England > is so far ahead of the U.S. in this regard. Do you refer here to its inexpensive private Internet access services (like demon)? Apologies if there was an antecedent in previous mail under this subject, but I have now deleted it. > No offense intended, but I > always thought of their telecommunications and computing infrastructure as > being several years behind the U.S. What aspect of the UK infrastructure did you perceive as lagging the US ? pvm Ps. I believe that the natural home for this thread isn't on this list.

1 0

HARDWARE MAILING LIST ON-LINE
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

The hardware off-shoot of this list is finally on-line! You can subscribe to the list by sending a subscribe request of the form: SUBSCRIBE cp-hardware <name> to listproc(a)nextsrv.cas.muohio.edu I have decided to call the list 'cp-hardware'. While perhaps this is somewhat more boreing of a name than punk-net, or the like, it is more descriptive of the list as a whole. Thanks to all of the people who sent me mail requesting to be on the list- your're requests are why I've set the list up. However, I decided it will be simpler for people who are interested to send the subscribe request themselves. This should eliminate, or rather minimize errors. So, if you sent me a request previously, you still need to send a request listproc. The intention is that the list will be a forum for discussion of hardware issues related to computer privacy, as well as dicussion, design, and hopefully construction of several projects. If the list gets going sufficiently well, I'll set up an anonymous ftp site for the storage of archive, schematics, and anything else that is related. When you subscribe, you will get a welcome message which describes what I see the list could be. Your feedback is appreciated. A short (very short) informational file can be requested by mailing INFO cp-hardware To listproc(a)nextsrv.cas.muohio.edu, although the welcome message is I think more descriptive of the list at this point. so, punks, why stop at writing code? Let's build hardware! -john

1 0

CPSR Alert 2.05
by Dave Banisar 17 Dec '03

17 Dec '03

CPSR Alert 2.05 ============================================================== @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@ @ @@@ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @ @ @ @ @@@@ @@@@ @ @ @ ============================================================= Volume 2.05 November 12, 1993 ------------------------------------------------------------- Published by Computer Professionals for Social Responsibility Washington Office (Alert(a)washofc.cpsr.org) ------------------------------------------------------------- Contents [1] Operation "Root Canal" Documents Released: Questions Raised about FBI's Digital Telephony Initiative [2] GAO Report Criticizes Gov't Crypto Policy [3] Health Care Plan Raises Privacy Questions [4] Hacker Sentenced to One Year Imprisonment [5] Matching grant for CPSR FOIA Work Offered [6] New Documents in the CPSR Internet Library [7] Upcoming Conferences and Events ------------------------------------------------------------- [1] FBI's Operation "Root Canal" Documents Disclosed In response to a CPSR Freedom of Information Act lawsuit, the FBI this week released 185 pages of documents concerning the Bureau's Digital Telephony Initiative, code-named Operation "Root Canal." The newly disclosed material raises serious doubts as to the accuracy of the FBI's claim that advances in telecommunications technology have hampered law enforcement efforts to execute court-authorized wiretaps. The FBI documents reveal that the Bureau initiated a well- orchestrated public relations campaign in support of "proposed legislation to compel telecommunications industry cooperation in assuring our digital telephony intercept requirements are met." A May 26, 1992, memorandum from the Director of the FBI to the Attorney General lays out a "strategy ... for gaining support for the bill once it reaches Congress," including the following: "Each FBI Special Agent in Charge's contacting key law enforcement and prosecutorial officials in his/her territory to stress the urgency of Congress's being sensitized to this critical issue; Field Office media representatives educating their contacts by explaining and documenting, in both local and national dimensions, the crisis facing law enforcement and the need for legislation; and Gaining the support of the professional associations representing law enforcement and prosecutors." However, despite efforts to obtain documentation from the field in support of Bureau claims of a "crisis facing law enforcement," the response from FBI Field Offices was that they experienced *no* difficulty in conducting electronic surveillance. For example, a December 3, 1992, memorandum from Newark reported the following: The Newark office of the Drug Enforcement Administration "advised that as of this date, the DEA has not had any technical problems with advanced telephone technology." The New Jersey Attorney General's Office "has not experienced any problems with the telephone company since the last contact." An agent from the Newark office of the Internal Revenue Service "advised that since the last time he was contacted, his unit has not had any problems with advanced telephony matters." An official of the New Jersey State Police "advised that as of this date he has had no problems with the present technology hindering his investigations." Likewise, a memorandum from the Philadelphia Field Office reported that the local offices of the IRS, Customs Service and the Secret Service were contacted and "experienced no difficulties with new technologies." Indeed, the newly-released documents contain no reports of *any* technical problems in the field. The documents also reveal the FBI's critical role in the development of the Digital Signature Standard (DSS), a cryptographic means of authenticating electronic communications that the National Institute of Standards and Technology was expected to develop. The DSS was proposed in August 1991 by the National Institute of Standards and Technology. NIST later acknowledged that the National Security Agency developed the standard. The newly disclosed documents appear to confirm speculation that the FBI and the NSA worked to undermine the legal authority of the NIST to develop standards for the nation's communications infrastructure. CPSR intends to pursue further FOIA litigation to establish the extent of the FBI involvement in the development of the DSS and also to obtain a "cost-benefit" study discussed in one of the FBI Director's memos and other documents the Bureau continues to withhold. ------------------------------------------------------------- [2] GAO Report Criticizes Gov't Crypto Policy A Government Accounting Office report has found that government policies are hindering the development of encryption technology at the same time the industry is threatened by economic espionage because of computer networks lacking adequate security. The report was requested by House Judiciary Chair Jack Brooks. The report _Communications Privacy: Federal Policy and Actions_ (GAO/OSI-94-2) also found that NIST followed the NSA's lead in developing cryptographic standards for communications privacy and that there has been little public input in this process. NIST terminated a project in 1982 to develop a public key encryption system at the request of NSA and in 1991 introduced a NSA developed standard for digital signatures. In addition, no public input was solicited for the Clipper Chip proposal until 1993, over three years after the initiation of its development. The report also noted the wide range of software and hardware available outside the US and that the continued export controls are apparently more stringent than those in other countries. This is apparently hurting sales of U.S. software and hardware products worldwide. Congressman Brooks said that "[I]t is deeply disturbing to find that some U.S. government agencies are undermining American corporations efforts to protect themselves from state-sponsored theft of trade secrets and other propriety information." Brooks also stated that "The plain truth is that encryption devices and software are available around the world. The barn door is open; the horses are out. It is high time for the government to accept this fact of life and stop hog-tying U.S. industry with overly restrictive export controls that damage this country's effort to compete in the global marketplace." The GAO report is available at the CPSR Internet Library (see below). A paper copy is available from the GAO by calling 202-512-6000. ------------------------------------------------------------- [3] Health Care Reform Plan Released Amidst Growing Concern About Medical Privacy The Clinton health care reform plan was released the same week that a new Lou Harris poll found high levels of concern about privacy among the American public. The health care reform proposal includes important privacy safeguards, but the measures may not go far enough to address public concerns. The Harris poll reveals that Americans are very much concerned about medical record privacy. The poll conducted by Prof. Alan Westin found that 49 percent of all Americans are very concerned and 30 percent are somewhat concerned by the threats to their personal privacy. An additional 56 percent believe that strong federal protection of medical records is necessary to accomplish health care reform. The health care reform proposal includes a strong code of fair information practices, and an explicit prohibitions on the use of medical record information for employment purposes. But the plan leaves open the question of whether the Social Security Number might be used as a patient identifier and also allows more than three years before full legislative safeguards are established. At a conference organized by the US Office of Consumer Affairs, CPSR Washington Office Director Marc Rotenberg and ACLU Privacy and Technology Project Director Janlori Goldman said that the health care reform plan raises far-reaching privacy concerns that must be addressed at the outset. The Office of Technology Assessment released a new report on medical records and privacy at a Congressional hearing held by Rep. Gary Condit (D-CA). "Protecting Privacy in Computerized Medical Information" explores the implications of the automation of health care information and recommends federal legislation to address patient confidentiality and privacy. An electronic copy is available at the CPSR Internet Library. (see below for location details). Senator Patrick Leahy (D-VT) recently held a hearing to explore the privacy implications of medical smart cards. The Senator plans to hold a second hearing on medical record privacy later this year. ------------------------------------------------------------- [4] Hacker Sentenced to One Year Imprisonment Mark Abene (a.k.a. Phiber Optik) was sentenced by U.S. District Court Judge Louis Stanton (E.D. N.Y.) to one year and one day for two counts of computer crime. He will serve a minimum ten months before he is eligible for release. He is also required to serve three years probation and to do 600 hours of community service. Abene pled guilty to two counts of computer intrusion in July relating to incidents of break-ins at a NY television station and a Southwestern Bell computer. He will begin his sentence on January 7, 1994. ------------------------------------------------------------- [5] CPSR Seeking Donors for Matching FOIA Grant A CPSR member who wishes to remain anonymous has offered a $500 matching grant to support CPSR's Freedom of Information Act litigation. If you are interested in supporting CPSR's FOIA work, please send a message to rotenberg(a)washofc.cpsr.org ------------------------------------------------------------- [6] The CPSR Internet Library The Congressional Office of Technology Assessment report "Protecting Privacy in Computerized Medical Information" /cpsr/medical/1993_ota_medical_privacy_report.txt The Clinton health care reform bill and overview (almost 8 megs) /cpsr/medical/clinton_health_care_reform/ (folder). The GAO report is available as 1993_gao_communications_privacy_report.txt in folder cpsr/crypto. The CPSR Internet Library is available via FTP/WAIS/Gopher from cpsr.org /cpsr. Materials from Privacy International, the Taxpayers Assets Project and the Cypherpunks are also archived. For more information, contact Al Whaley (al(a)sunnyside.com) ------------------------------------------------------------- [7] Upcoming Conferences and Events "Cyberculture Houston 93." Houston, Tx. December 10-12, Contact: cyber(a)fisher.psych.uh.edu. Worldwide Electronic Commerce: Law, Policy and Controls Conference. MultiCorp, Inc and American Bar Association. Waldorf Astoria Hotel, New York City. January 17 - 18, 1994. Contact: Fred Sammet (76520.3713(a)CompuServe.COM) Phone (214) 516-4900, fax at (214) 475-5917. "Highways and Toll Roads: Electronic Access in the 21st Century" Panel Discussion. 1994 AAAS Annual Meeting. San Francisco, CA. Feb. 21, 1994 2:30 - 5:30pm. Sponsored by the Association for Computing Machinery (ACM). Contact: Barbara Simons (simons(a)vnet.ibm.com) "Computers, Freedom and Privacy 94." Chicago, Il. March 23-26. Sponsored by ACM and The John Marshall Law School. Contact: George Trubow, 312-987-1445 (CFP94(a)jmls.edu) CPSR DIAC-94 "Developing an Effective, Equitable, and Enlightened Information Infrastructure." MIT Media Lab, Cambridge, MA. April 1994 (tentative). Contact: Doug Schuler (doug.schuler(a)cpsr.org) 5th Conference On Women Work And Computerization "Breaking Old Boundaries: Building New Forms." UMIST, Manchester, UK. July 2-5. 94 Abstracts by 10/1/93. Contact: Andrew Clement (clement(a)vax.ox.ac.uk) (Send calendar submissions to Alert(a)washofc.cpsr.org) ======================================================================= To subscribe to the Alert, send the message: "subscribe cpsr <your name>" (without quotes or brackets) to listserv(a)gwuvm.gwu.edu. Back issues of the Alert are available at the CPSR Internet Library FTP/WAIS/Gopher cpsr.org /cpsr/alert Computer Professionals for Social Responsibility is a national, non-partisan, public-interest organization dedicated to understanding and directing the impact of computers on society. Founded in 1981, CPSR has 2000 members from all over the world and 22 chapters across the country. Our National Advisory Board includes a Nobel laureate and three winners of the Turing Award, the highest honor in computer science. Membership is open to everyone. For more information, please contact: cpsr(a)cpsr.org or visit the CPSR discussion conferences on The Well (well.sf.ca.us) or Mindvox (phantom.com) ======================================================================= CPSR MEMBERSHIP FORM Name ______________________________________________________________ Address ___________________________________________________________ ___________________________________________________________________ City/State/Zip ____________________________________________________ Home phone _____________________ Work phone _____________________ Company ___________________________________________________________ Type of work ______________________________________________________ E-mail address ____________________________________________________ CPSR Chapter __ Acadiana __ Austin __ Berkeley __ Boston __ Chicago __ Denver/Boulder __ Los Angeles __ Madison __ Maine __ Milwaukee __ Minnesota __ New Haven __ New York __ Palo Alto __ Philadelphia __ Pittsburgh __ Portland __ San Diego __ Santa Cruz __ Seattle __ Washington, DC __ Virtual Chapter (worldwide) __ No chapter in my area CPSR Membership Categories __ $ 75 REGULAR MEMBER __ $ 50 Basic member __ $ 200 Supporting member __ $ 500 Sponsoring member __ $1000 Lifetime member __ $ 50 Foreign subscriber __ $ 20 Student/low income members __ $ 50 Library/institutional subscriber Additional tax-deductible contribution to support CPSR projects: __ $50 __ $75 __ $100 __ $250 __ $500 __ $1000 __ Other Total Enclosed: $ ________ Make check out to CPSR and mail to: CPSR P.O. Box 717 Palo Alto, CA 94301 ------------------------ END CPSR Alert 2.05-----------------------

2 1

Privacy/Property
by Dark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mr. Godwin - -> I note that the ruling against INS would probably not occur today in the post-Feist world. <- Conceeded. Mr. Godwin - -> I don't see how this reads as Brandeis's having a reservation about privacy. Perhaps the premier legal theorist about privacy issues in the last 100 years, Brandeis is simply noting that privacy isn't a given--one must actively work if one is to preserve it. This is perfectly consistent with cypherpunk philosophy, IMHO. <- I concur, and add that this is a long cry from reading any "Right to Privacy" into the law. If indeed Brandeis is asserting that privacy isn't just "given" (Your assessment with which I agree) then isn't this a reservation about a existing "right to privacy"? It's possible, Mr. Godwin that the only level we differ on is semantics and definitional? I like the cypherpunk approach, very much. Self empowerment is a rewarding and self regulating regime. I would like to see broader remedies available for privacy enforcement. You can't sit on your porch with a shotgun all day and keep trespassers off. It's a well accepted premise that a determined attacker will always prevail, given enough resource. Or at least cause lots of problems trying. It would be nice if this were an option, but not the ONLY manner of protection. No? Cypherpunks is about change of attitude as well not so? - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLOPi4RibHbaiMfO5AQG5cwP9HbYSlZuJlRVcyScCFVIjMui8m1MxoAfj G9pzvCqZN5PTSaZfMVFxSHcgqRSDiEpILdPZs7mI1+1vdZCNkNPcwHbBvVxuxIf+ IY0tavhtXBAll14c4RA1zq/82OlDqkBcBC+P8FtE1Juf+6MfRZwmrXjmpiWhsCNu Cg/l8xpdfVM= =h4K+ -----END PGP SIGNATURE-----

1 0

Re: Watchword
by Carl Ellison 17 Dec '03

17 Dec '03

One reader asked: >Will you please send me some additional information on Racal - Guardata >Watchword technology? I would appreciate any addresses you might have of >sellers, resellers, and the company itself also. Racal-Guardata is a British company, I believe, but they have a US office: Racal-Guardata 480 Spring Park Place Herndon VA 22070 1-800-521-6261 in VA: 703-471-0892 FAX: 703-437-9333 They make both authorization and encryption devices (all DES based, I believe). The WatchWord I have is a small 4-fcn calculator with an 8 digit display, 4 1/8" x 2 1/4" x 3/8" in its own vinal case. It has the normal buttons, including M+, RM, CM .... It also has an unlabeled red button. You press it and the fine print says "AUTH \n ENTER PIN". You enter your PIN and press "=" and it changes to "ENTER CHALL" You enter your 7-digit challenge number and press "=" and it shows you the 7-digit reply. (DES of the challenge number, using your key as selected (probably merely modified) by the PIN.) labeled "RESP". You clear that by turning the calculator off. Each unit can be programmed with a key of your choice. You don't have to use a key provided by your employer. (Note: if you use your own keys and have a good source of rannos, this is a hand-held DES encryption device. The operating rate is slow but the security should be full DES. (Alice generates a ranno and tells Bob in the clear, Bob encrypts ranno and adds in a 7 digit message fragment, tells that back to Alice who also encrypted the ranno.) It can hold two different keys, for two different services (machines, people, ...). The last I heard, a new model was coming out (I'm holding the old one -- from a year ago or more) which is more like a credit card in size but has all the same functionality. That one should be out by now and it was predicted to cost around $50. You need to ask Racal about it, if you're interested. - Carl

1 0

Dinkelacker II
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311121302.AA07765(a)anon.penet.fi> an12070(a)anon.penet.fi writes: > WHO is ARTHUR CHANDLER?! Dunno, but if I'd remembered your ID about it three days ago I could have told you who S.Boxx was :-) ... I found a nasty bug in penet.fi whereby putting a return-receipt-to line in mail to an na01234-style ID caused that person's mailer to tell you who they were :-) (I did of course tell Julf within 24 hours, and it's now fixed. He wasn't too amused at being woken up by a phone call at 1am Finland time ;-) ) However, this isn't to brag; it's to warn anyone with an anon ID to look through all the mail they've received on their anon accounts (if they've kept it) and see if any of it has a Return-receipt-to field in it. If it does, your ID will have been compromised. I know a lot of Mac mailers put these in automatically, so a lot of you might already have been compromised by accident. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Re:Bandwidth limitations
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry writes: >The human genome fits nicely in 1 GB. Mere Gigabit networks could allow you >to send your whole genome in seconds -- and fiber can do many orders of >magnitude better than that. The human genome has approximately 3 x 10^9 base pairs. Each base is represented as the following binary code: G=1000, A=0100, T=0010, C=0001. Thus the human genome represents about 3 gigabytes of info (uncompressed), as Perry said easily transmitable by fiber optics. When you all do finally get your genome sequenced, the last thing you should do is let anyone see it (perhaps only small segments of it). I can think of no better use for cryptography than to keep citizens genomes to themselves. Would you give anybody a crystal ball which tells of your past, present and future? Some of us write genetic code and, IMHO, one's own genetics are a source code which should not be freely distributed. Scott G. Morham !The First, VACCINIA(a)uncvx1.oit.unc.edu! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLONRDD2paOMjHHAhAQHKTQP9ExGhcllgQrSVLPaucpEM+1/6HSUcyf71 OC4dloljbhV2S0qu1VnutiyPHa/OwZyDu0prXA1Xt+8q17CVsMKgmp38xVO/i1fy JOrw+9EOUE4K13HLGiH0GPE07gow8MoaYqIGN4a6gqHFDoejOi27zNoAz/gulVr9 0xNUIWSfE28= =Cvzf -----END PGP SIGNATURE-----

2 1

The Courtesies of Cypherpunks
by L. Detweiler 17 Dec '03

17 Dec '03

From: jazz(a)hal.com (Jason Zions) >It's also common courtesy. You can have significant disagreements with a >person, yet still honor their simple requests. I owe no courtesy to someone who forfeits any respect in their atrocious misbehavior. This is as simple as the maxim, if you are a criminal your rights are diminished. If you mailbomb me, you have forfeited your `right to privacy'. If you email my postmaster a complaint about me before contacting me, you have forfeited your `right to privacy'. If you lie to me, you have forfeited your `right to privacy'. If you fail to adequately respond to my personal accusations of impropriety or criminality, especially meeting them with evasion or stonewalling, you have forfeited your `right to privacy'. If you have ever sent me mail as a Snake of Medusa or a Tentacle of a Monster, you have forfeited your `right to privacy' -- under ALL your pseudonyms and identities. If you ridiculously condone and endorse any such reprehensible behaviors under such patent idiocy as `respecting copyright' or `common courtesy', you have forfeited your `right to privacy'. If you have done any of the above to *anyone*, you have forfeited your `right to privacy' with respect to EVERYONE in your society! I also think you have forfeited your right to speak in that society as well -- maybe only temporarly -- but in situations where these kinds of outrageous behaviors are condoned by a corrupt moderator, no recourse except leaving or starting a new list is possible. In particularly obnoxious cases of criminal abuse, I will attempt to shame you into repentance by ridiculing you in front of people who appear to be your friends and community (presuming you actually have any), if all other measures have failed. (Even this may be ineffective, but if you have no shame, you have no humanity.) That is the Detweiler Code of Cyberspatial Ethics and Privacy. If it is incompatible with the Cypherpunk Code of Chivalry, my heartfelt condolences go out to you. Perhaps you would like to elucidate me as to which of the above practices require my RESPECT. As I was saying, psychopunks have elevated their religion of `privacy' and `pseudospoofing' to perverse extremes. ``The cypherpunk agenda is becoming indistinguishable from raw criminality.'' May you choke on your own poisons. Already, you wallow and drown in them and defile the naive, trusting, honest, and innocent daily on your list. Frankly, I can barely stand to be in the same Cyberspace with you. The `psychopunk core' of the cypherpunks is nothing but a fanatic, brainwashed religious cult. No wonder you guys identify with David Koresh. I assure you, future Cyberspace will not be big enough for the both of us. Go ahead, CENSOR me! For the crime of writing `FLAMEBAIT' or, equivalently, YELLING THE TRUTH. What depraved hypocrisy, that some psychopunks attempt to CENSOR ME indirectly by mailing my postmaster (who could care less about your sniveling whinings). You guys really do have *some* ethics, don't you? ``Don't ever DIRECTLY CENSOR ANYTHING!'' ``NEVER GET CAUGHT or be PERSONALLY ACCOUNTABLE or RESPONSIBLE for ANYTHING!''

4 4