December 2003 - cypherpunks-legacy

Re: anonymous video rental store - Libraries
by jazz＠hal.com 17 Dec '03

17 Dec '03

Out of curiousity, has any ftp-archive maintainer tried to join the American Library Association, either directly or as part of some university's library system? I'm not sure what this would do. My wife is a professional librarian and a member of the ALA (and SLA and a few other besides) - as far as I know, the ALA doesn't directly intervene to protect its members. Jason

1 0

GPS and security
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

CBS's "60 Minutes" had a "Oooh Scarey" segment about the Global Positioning System last Sunday. The scarey part is, according to 60 Minutes, that any old terrorist government can now put together accurate guided missles and wreak death and destruction upon our homeland. The crux of the problem is that the system broadcasts out positioning information to one and all indiscriminately, and according to the show there's no way we can stop it. Because my mind is regularly exposed to wild conspiracy theories and all sorts of crazed paranoiac ravings (i.e., I read Usenet), I started thinking that this is rather unlikely. I speculated that the government may in fact have designed the satellite systems so that they could be told to do several things in case of national emergency: * Shut down (probably possible; they may have actually mentioned this on the show). Problem is that lots of friendlies may grow to rely on the data for life-critical things, like guiding commercial airliners. * Shut down normal transmission and begin strongly encrypted transmission. No mention of this; apparently, the satellites were originally designed with some sort of weak system that made the data difficult to use for high-accuracy purposes, but that's been defeated (by the FAA or someone contracted thereto). * Enter into a bogus-cleartext with encrypted subchannel mode, where the plaintext is slyly made to be wrong, but using some subchannel encrypted "good stuff" is still available. I don't know much about how this system works, so I don't know whether any of my thoughts are relevant. It's probably most likely that the government indeed blasted these things up into space without considering using encryption technology to enhance security. -- Mike McNally : m5(a)tivoli.com : Day Laborer : Tivoli Systems : Austin, TX ------------------------------------------------------------------------ Remember that all experimentation does not produce extrapolated results. - k. pisichko

2 1

CACM Letters
by Pat Farrell 17 Dec '03

17 Dec '03

There is a very nice letter on the government's rationale for controlling crypto in the current January 94 (received today) CACM, by Walter M Anderson. The main claim is that the government must want to control US citizens, because no other reason is logically consistant. And a nice short one from our own CME. Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

RE: GPS and security
by Pat Farrell 17 Dec '03

17 Dec '03

This is a bit off list topics. Press D now if you don't like it.... In message Tue, 28 Dec 93 14:01:15 CST, m5(a)vail.tivoli.com (Mike McNally) writes: > * Shut down normal transmission and begin strongly encrypted > transmission. No mention of this; apparently, the satellites were > originally designed with some sort of weak system that made the data > difficult to use for high-accuracy purposes, but that's been defeated > (by the FAA or someone contracted thereto). The GPS system was designed to have two modes, one highly acurate for military use, and a low accuracy version for commerce. Since initially no one had receivers, the whole system used military grade for the first few years. Before the Gulf war started, the military needed zillions of GPS units, so they bought commercial marine navigrtion units. After the war, there was talk of turning on the division, but that was made impractical with 'differential' calibration. To get military accuracy, all you have to do is take the commercial GPS to known places. Such as the surveying marks at the US Naval Acadamy, or "ground zero" in the Pentagon. Get your "imprecise" reading, calculate the difference between it at the known value, and use it for subsequent calculations. I expect that triangulation with a few known sites is better than a single one. Last I hear from the Sailing trade press was that the Gov still talked about going to the split setup, but there was little belief that they would. BTW, two satellites is enuff for a general location fix. Three identifies a place on the globe, four adds altitude (handy for planes, bombs, and missles) Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

GPS and security
by jazz＠hal.com 17 Dec '03

17 Dec '03

I speculated that the government may in fact have designed the satellite systems so that they could be told to do several things in case of national emergency: * Shut down (probably possible; they may have actually mentioned this on the show). Problem is that lots of friendlies may grow to rely on the data for life-critical things, like guiding commercial airliners. It's worse; the military relies on GPS. During the Gulf War large numbers of combat vehicles could rendezvous with high accuracy and no radio contact in the dark of night; staggeringly important in limiting fratricide as well (though not as well as one might have liked...) * Shut down normal transmission and begin strongly encrypted transmission. No mention of this; apparently, the satellites were originally designed with some sort of weak system that made the data difficult to use for high-accuracy purposes, but that's been defeated (by the FAA or someone contracted thereto). * Enter into a bogus-cleartext with encrypted subchannel mode, where the plaintext is slyly made to be wrong, but using some subchannel encrypted "good stuff" is still available. Well, this sounds like the "selective availability" (SA) capability, which still exists and has in fact been turned on. It is defeatable, but only under certain circumstances (see below). GPS is a clock-based system; by talking to a constellation of satellites (I think the minimum is 4, with 5 being desired and 6 being best) and munging the timestamps received from them, GPS systems can compute their location to a degree of precision related to the precision of the clocks. SA essentially truncates a few bits off the low-end of the time stamps and makes them available in an encrypted form. Without the key to decrypt the low-order bits, you get location information to within a couple hundred meters or so; with the low-order bits, within about six feet. During the Gulf War, the US military was unable to get enough military GPS receivers (i.e. ones that could decrypt the selectively-available data). Instead, they bought commercial over-the-counter GPS receivers and turned SA off. As soon as they got enough SA-enabled receivers, they turned it on. SA is defeated by something called Differential GPS. Basically, a ground station at a fixed location constantly computes its position via GPS, computes the difference between the GPS location and its known correct location, and broadcasts the correction factor. A differential-capable GPS receiver computes its location via GPS and then applies the correction fac- tor from the nearest differential station. These corrections are obviously of decreasing accuracy the farther you get from the fixed-position station, but you can correct for that to some degree once you have an estimate of the direction and distance from your location to that of the differential broadcaster; apply corrections iteratively until they converge. The requirement, of course, is that you be someplace near a differential GPS station. These stations are maintained by the US Coast Guard and obviously exist only where there is navigable water (and certainly not everywhere, since they take time and money to build). I'm curious if anyone has attempted to crack the encryption used in selective availability; although Differential GPS solves my most important issues (coastal navigation) it's be nice to be able to use a handheld GPS receiver in the middle of Rock Mountain National Park or some such and still locate yourself on the bloody maps with some precision. Jason

2 1

NBC news address correction.
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

Oops! The previous message incorrectly gave the address of news:nightly@nbc.com it should be: nightly(a)nbc.com Sorry about that chief!

1 0

GPS and security
by northrop＠netcom.com 17 Dec '03

17 Dec '03

If the military is worried about delivery systems' accuracy, Phil Karn already mentioned kamikazies, but if you don't want to make suicide part of the package, you could always just have someone drop a radio transmitter on your target sometime in advance, possibly a day or two. The missile can then home in on the signal. (If you need to get it inside a high-security area, you could always encase it in foam and drop it from a model airplane or launch it in a model rocket.) Or you could just leave a suitcase with a timed bomb at your target location; plutonium bombs can be very small. It boggles my mind that the military mind prevents the use of tools that are just too complicated for the "bad guys" to bother with. Does CBS have an email address yet? :) -- Scott Northrop <northrop(a)netcom.com> (206)784-2083 ObVirus: The demand for obedience is inherently evil. ObVirus2: As a juror in a Trial by Jury, you have the right, power and duty to acquit the defendant if you judge the law itself to be unjust.

2 1

Re: Secure Drive Distribution
by W. Kinney 17 Dec '03

17 Dec '03

Edgar Swank writes: > If you mean a site -in- the USA/Canada, no problem. If you mean a > site which will not send files outside the USA/Canada, I don't think > there is any such animal. The only site even -attempting- to restrict ripem.msu.edu evidently has such a policy. I'm considering using it to distribute Curve Encrypt. Anybody have any experience with this site? Should be pretty funny distributing PGP-authenticated software from the Ripem ftp site, but I guess if they don't mind, neither do I :-). -- Will

1 0

Re: GPS and security
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Thanks to Phil for the technical descriptions about GPS; I'd heard numbers like 1 foot for Differential accuracy. One minor correction to the "military buying civilian GPS gear" issues - a lot of it wasn't the military itself buying the gear, it was individual soldiers or their parents buying the sets so their kids wouldn't get lost out in the desert. I was at an AFCEA trade show, mainly looking for imaging and crypto stuff, but two of the biggest hits were the various GPS vendors and a vendor selling small drone airplanes. (Very few people probably needed the things for work, but they were Neat Stuff and you could understand what it did.) The 6-foot wingspan model had a payload of about 35 pounds; the 10-foot model had about 120 pounds, where payload includes fuel plus whatever else. The primary applications it was being marketed for were radio repeaters and video camera transmission systems, but the Army makes a backpack-carriable nuke that leaves you enough fuel-weight to get 1-200 miles.... Bill Stewart # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com

1 0

Cylex is already reality
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

The very first entry of the Cyberspace Lexicon, *autolott* is well on its way to becoming a reality. An Associated Press story, "Is lottery by phone the ticket?" was on the front page of my local paper today. The article describes a proposed plan to establish a lottery where one would select numbers and pay for tickets via a touch-tone phone. The system would involve depositing money in a special account which the lottery commission could also access. The system could be set to purchase tickets when the jackpot reaches certain levels automatically. "Players could bet until their accounts are depleted, withdraw mopney anytime and replenish their accounts by check, electronic transfer, or credit card." It does state that "each wager would carry a $2 service charge." It souldn't be long before they realize they save more money by not printing the tickets. I don't have time to type in the whole article, but I think you get the picture. Six states are already interested. I'm surprised they didn't suggest just setting it up as a 900 number, or are there laws against that? So how long will it be before Las Vegas goes on-line? Call 1-800-LOAN-YES for easy credit extensions today! -john. ------------------------------------------------------------------------------ John Blair <jdblair(a)nextsrv.cas.muohio.edu> phone: (513) 529-4879 Insert cool signature file that makes a trendy, yet bold and original statement about my cyberspace proficiency, then mentions that I'll send you my PGP public key if you want it, and you trust that I'm actually me.

1 0