December 2003 - cypherpunks-legacy

Capone's Cajones
by Gary Jeffers 17 Dec '03

17 Dec '03

2nd edition. In 1st edition I edited badly & confused authors' texts. This edition will be clearer. Sorry Tim. Tim May writes: >Bid deal, a few cities get nuked. The greater danger is that of the >control freaks like Denning clipping and skipjacking our remaining >freedoms and ushering in the thousand-year Reich of Kaiser Willy. Good point & good attitude Tim! While having a few big cities nuked is a truly horrible thing, its evil is completely dwarfed by the possibility of a world of billions of people crushed down by a long lived state using uncountable lies & computer monitoring to maintain control. That state evil would not have the flashiness & fear of a nuke. Its evil would be boring. Its horror would be in the hopelessness & lack of freedom of the people & in their lives being made up of lies. In the face of that threat, the idea of some ""terrorists"" or ""criminal"" gangs throwing around a few nukes on a wild Saturday night merely gives one cause for hope. Maybe a nuke would land on an oppressor & free us. Incidentally, what is this fear of ""criminals"" & ""terrorists"". I have never had a ""criminal"" extortionist take 40% of my income over a long period of time. I have never had a ""terrorist"" draft me into a war with people I don't know in a foreign country. Also, I don't know of any ""terrorists"" who occasionally murder millions of people. I think we have a problem with words. A ""terrorist"" is a soldier without a uniform. A soldier who ""failed to dress for success""*. A ""criminal"" is a thug without proper papers & badges. WACO & the Weaver family were lessons for those who can set aside their prejudices for awhile. I am quite happy to share the internet with ""terrorists"" & ""criminals"" - if it gives me & my friends a chance for happiness & freedom! Anarchy is simply the absence of a monopoly on weapons & force. If anarchy gives me this chance then I'll take my chances with anarchy. Death before dishonor? How about an even better deal - a risk of death before a life of no honor & no hope! This is the offer of liberty. So, MR or MS State, please don't bother me. I'll take my chances with a few stray ""criminals"" & ""terrorists"". Thank You, Gary Jeffers * p.s. Bob Black originally said ""terrorists are soldiers who fail to dress for success."" PUSH EM BACK! PUSH EM BACK! WWWAAAAYYYYY BBBAAACCCCCKK! BBEEEAAATTT STATE!

1 0

Re: Mac encryption
by kkirksey＠world.std.com 17 Dec '03

17 Dec '03

>What is everyones opinion of the best encryption software forthe Mac? >Frederic Halper I've been using Kent-Marsh's CryptoMactic since last August and have been very pleased with it. It supports two proprietary (i.e. useless) algorithms, LightningCrypt and QuickCrypt, as well as DES, DES-CBC, and Triple (two key) DES. It automatically overwrites your plaintext with a pattern of your choosing. It's fairly quick, and it does what it claims. I do have a couple of minor nit-picks with it, however: 1) No support for IDEA. They've left the architecture open for additional encryption modules, but they've yet to produce the documentation (_Insided CryptoMactic) for the programming interface. I talked with one of Kent Marsh's people back in August and expressed an interest in writing an IDEA module for them, and he thought it was a great IDEA and would get me a copy of _Inside Cryptomactic_ when it was ready. I checked back with him last month, and they still don't have _IC_ together yet. 2) The Allow override feature. One of CryptoMactic's preferences lets you override encryption on any file if you have this feature activated. You simply run the CryptoMactic Administrator program from a floppy (you shouldn't be dumb enough to install it on your hard disk), enter your (entirely optional) password, chose the file you wish to decrypt, and click "Override". If you have the override option on, the security of your files is only as good as the physical security of your master floppy, especially if you do not choose to password protect the administrator app. How hard is it to crack the password on the administrator app? I'm working on it; I'll let you know.... :-) Until then, I'm leaving this option off. 3) The overwrite patterns. I'd like to see a little more flexibility in user defined patterns, akin to what Schneier suggests in _Applied Crypto_. JMHO, of course, Ken ============================================================================= Ken Kirksey kkirksey(a)world.std.com Mac Guru & Developer ----------------------------------------------------------------------------- Harassment is a power issue, and power is neither male nor female. Whoever is behind the desk has the opportunity to abuse power, and women will take advantage as often as men. - Michael Crichton (in _Disclosure_)

1 0

MISC: gopher & anon ftp
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- About the gopher site: I'm not sure how "easy" it will be to make the files available via anonymous ftp as well. I know Chael is running an anonymous ftp site on chaos, but I'm not sure where it's directory lives... the gopher data directory is within my own directory hierarchy. It may be hard to overlap the two and preserve the security standards Chael wants to maintain. Disk space is tight so just making a duplicate copy is probably not the way to go ;) However, I do back up the gopher data every month or so (and so does Chael!), and since I will be adding 10 or 15 more files over the next week (from anonymous video rental to magic money) and re-arranging the ones already there, I'd be willing to mail you or anybody else uuencoded, gzip'ed tar files. Since most (all?) files have more than eight character names, producing MSDOS compatible file names may be a problem, since there will be some collisions. And I like gopher! It's great for just browsing around :) For a while I was thinking of an "anonymous mail drop-off/pick-up" where mail sent would be filed in a gopher accessible directory. So for example you could reach Pr0duct Cypher, Deadbeat, Wonderer, etc. by mailing here and waiting for them to read your message via gopher. Problems concerning disk space and the lifetimes of messages would need to be addressed, as well as whether or not they would even use such a system to receive messages. Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLXFAF4OA7OpLWtYzAQE5TwQAgLgoO/XotPD6YXX+Tb4JVQK7NuWoSDx6 1Lsa4Q6fhEkODXd/S6biZ65ZBkQypd25VspWniDwkzaHid6JsSot7Ow3pFemW/sc snCKi8vN2ZrupXuHDfhqB9yv+nSBhZ7c1/xdAaKjHje3IB3zGqfna1EfEp0lMzzI xax6Ng3buCU= =ZKl+ -----END PGP SIGNATURE-----

1 0

Re: standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

On reflection, it seems that some users will want an interoperable standard, and other users will want complete stealth. So what I'll do is add a bunch of switches to pnmstego and pnmdestego, so that the user can specify all sorts of different formats. Letting the switches default will get you a simple interoperable mode, so you can send stuff to people without prior arrangement or put stuff on an ftp server; but an attacker will be able to extract the bits and try to decrypt them. Specifying things like offsets and bit-usage schedules will mean that the attacker won't even be able to extract the bits; but the settings you use will be equivalent to that much more key material that you have to communicate or remember. --- Jef

2 1

Newton Crypto?
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Does anyone know of any packages available for/on the Newton or any other personal managers? Last I heard, even the password was in plaintext. --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

Re: standard for stegonography?
by Matt Thomlinson 17 Dec '03

17 Dec '03

Sergey Sez: > Have the offset default to the checksum-value of the reciever's public key! > The sending program could have the user specify the reciever, look his key > up in the public-keyring and offset the message accordingly. While, the > recieving program would automatically scan the file starting at the > appropriate offset based on the same public key checksum-value. While Tim May Sez: > Lots of options for standards. As others have noted, you just don't > want to have to flag what standard you're using in the message itself > (in plaintext, else why bother?) as that means the stego use is not > longer plausibly deniable. I think these two have a lot to do with each other. Sergeys' suggestion would definitely make it a tougher to pick out a starting place to search for hidden text. However, the message (if it is ever found in the file) points to the intended recipient. This defeats the purpose of "stealth pgp", (which would probably be used in this case to strip off telltale headers and such). If you weren't worried about this type of deniability, though, I don't see a problem with it. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

2 1

Anonymous Credit Cards
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

Anybody know anything about this?... ----- Begin Included Message ----- Path: internex.net!thumper.bellcore.com!owner-imp-interest From: dmk(a)allegra.att.com (Dave Kristol) Newsgroups: mlist.imp-interest Subject: Anonymous Credit Card on the Internet Date: 24 Feb 1994 14:57:19 -0800 Organization: InterNex Information Services, Inc. Lines: 71 Sender: daemon(a)internex.net Message-ID: <199402242247.RAA25510(a)thumper.bellcore.com> NNTP-Posting-Host: gaia.internex.net The anonymous credit card (ACC) protocol (paper available at research.att.com/dist/anoncc/anoncc.ps.Z and collude.ps.Z) is meant to be used the way a conventional credit card is - at the Point-of-Sale. (Awhile back) Gingery correctly pointed out that it can be extended to make an anonymous mercantile protocol on the Internet. We have made such an extension that can be used on the Internet to perform two functions: anonymous funds transfer from a customer to a seller, and anonymous delivery in the reversed direction. The delivery can be made either over the Internet, e.g. files, or otherwise, e.g. books, CDs. The following gives an overview of the protocol; a more detailed description of the protocol, including motivations for anonymity, can be found in a working paper available at research.att.com:/dist/anoncc/accinet.ps.Z. Overview of Protocol --------------------- A customer can purchase multiple files in a single session. How the customer chooses files of interest is outside the scope of our protocol. A session proceeds in three phases. In phase 1, a customer transfers funds anonymously from his/her bank account to the seller's bank account. The customer obtains a receipt from the seller's bank certifying the deposit, which he/she presents to the seller to open a session account at the seller. In phase 2, the customer makes possibly multiple requests of files from the seller. The seller deducts the purchase prices from the session account and delivers the files without knowing the identity or address of the customer. Phase 3 is entered when the customer finishes all desired purchases (or when the session account runs out of money). Any balance in the session account is refunded anonymously to the customer's account. Information separation and cryptographic techniques are applied to hide from each party the information the party does not need to perform its function. After a protocol session, 1) the customer's bank only knows that money has been withdrawn from (and deposited to) the customer's account, but knows neither the purpose nor the source (and destination) of the transfer(s); 2) the situation at the seller's bank is similar; 3) the seller only knows that it is paid for the purchase of certain files, but not the identity or the address of the customer. Differences from Gingery's Scheme --------------------------------- Although Gingery's scheme and ours have much in common, there are also several differences between them. For instance, in Gingery's scheme, the customer communicates directly with the seller, whereas in ours, they can communicate through an intermediary that hides one's identity from the other if the customer desires a higher degree of anonymity. In our scheme, the customer initiates a funds transfer by sending a message directly to his/her own bank; in Gingery's, the request (in encryption) is instead passed to the seller, and then forwarded to the seller's bank, and finally forwarded to the customer's bank. Hence, our scheme requires less communication (and the communication can be further reduced if anonymity requirement is relaxed to the same degree as in Gingery's scheme). Finally, unlike Gingery's scheme, the seller is provided with a key and an encrypted address by the customer so that the seller can encrypt and deliver the purchased files without knowing who the customer is. The encryption not only guarantees secrecy to the customer, but also protects the seller's interest since otherwise any eavesdropper can obtain the information for free. Dave Kristol ----- End Included Message -----

1 0

No Subject
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

A continual subject of debate has been the privacy of swiss accounts... and lichenstein and luxemborg banks... according to a recent text I read on the subject the hot way to conduct banking in privacy by mail is to a. use a canadian PO Box to avoid US mail covers on swiss postmarked incoming mail... b. if the money is derived honestly(i.e. legitamate but underground businesses simply underground for tax-avoidance) and NOT drug dealing derived or from an offence that is also an offense in Switzerland, then all privacy laws on swiss banks apply...tax avoidance is specifically excluded as an area where US. TLA can obtain cooperation of swiss authorities. c. Swiss Banks issue credit cards on accounts... :) d. further privacy is derived via a trust or corporation in Lichenstein and transferring the mony to said trust or corp from a swiss bank... e. A list of Swiss Banks to start with: Union Bank of Switzerland Bahnhofstrasse 45 8021 Zurich, Switzerland Telephone: 29-4411 Swiss Bank Corporation Aeschenborstadt 1 4002 Basel, Switzerland Telephone: 23-2323 Swiss Credit Bank Paradeplatez 8 8021 Zurich, Switzerland Telephone: 29-2811 Foreign Commerce BAnk Dept 284 Bellariastrasse 82 8022 Zurich, Switzerland Telephone: (01) 45.66.88 Foreign Commerce BAnk Dept 42 3 Rue de Marche CH-1211 Geneva 3 Rive, Switzerland Telephone: (01) 21.42.33 Bank Indiana Suisse Attn: F.C. Mishari 50 Ave. de La Gare 1001 Lausanne, Switzerland Telephone: 20.47.41 Bank Leu Postfach 8022 Zurich, Switzerland Cambio & Valorenbank Postfach 535 8021 Zurich, Switzerland Ueberseebank, A. G. Limmatquai 2 8024 Zurich, Switzerland f: All of the above was derived via "Personal Privacy through Foreign Investing..." and "How to determine Undisclosed Fianacial Interests" "a Manual for financial investigators.. both by loompanics press.... I am checking the above banks to see if ANY are internet connected and would be willing to receive orders via signed PGP messages If the above is positive I will get back to the group anon

1 0

RE: Civil Rights
by Blanc Weber 17 Dec '03

17 Dec '03

As I read the contribution from Jim Choate on the subject of "rights", I had some further thoughts & comments on the subject. Please delete if you don't care; it doesn't address cryptology directly, but some of you *are* interested, and if you have further comments please just send to me and copy only those others who also have expressed interest. ~ Blanc ---------- >From Jim choate: Seems to me that a 'right' as is being discussed should be 'Civil Right'. When used in this context I believe a suitable definition would be the following: Civil Right A characteristic granted to a citizen of a country which is beyond the normal law making ability of that countries governing body. In effect it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government. It in effect says that there are certain facets of an individual which are outside the normal operations of a government and can not be regulated or otherwise controlled through legistlative means. ........................................................................ It is true that the term a "right" can mean different things, depending on how one is considering the word & its meaning; in terms of a governed society, the meaning should be considered within the context of action as limited by agreement/consent, as something that involves the group's assessment of what is to be allowed (or not) within the organization; what permission will be granted and by whom, for what purpose, considering the consequences to all involved. The ability to determine what shall be considered a "right" depends upon the knowledge and intelligence of those who can make such decisions, who can achieve a comprehensive view of the situation and put individual action into perspective within this sweeping view. Given such a requirement, I would question the order of things, in concluding what the proper source is for the establishment of what these right should be, and give serious examination to the interpretation of what the actual nature of our circumstance is, (within the context of a society "under" government, but with liberty & justice for all, etc.). It is a bit difficult to make a succinct sentence which comprises all of my thoughts into a few sentences, I hope the above is not too difficult to understand. Not to make an example of Jim's contribution, but it just so happened that going through the sentences in the paragraph offered by him, I found concepts which I see as sources ripe for confusion & contention: A characteristic granted....... . So, the origin of this 'right' is from the decision-making of those elected to make considerations of this kind, which no one else is permitted to make. And I wonder: what qualifies them for this, the exclusive right to determine what it is all right to do within the context of a governed body of people, to be the ones who "grant" permissions to move, to do, to act. i.e., the source of an allowance to movement comes not from the ability to think correctly about it, to make valid judgements, but only from a permission *granted* to one by another. This immediately puts an individual's own thinking in danger; there is created the possibility of having one's own decisions categorized as without merit because they do not serve the purposes of the government, or because they do not serve the purpose of the governed society (the significance of which is seen as more important than that of being an individual of a singular character - compared to, say, an amoeba which absorbs all, as societies often begin to imagine themselves to be and presume themselves to have the right to demand utter mindless conformity on account of their numerous fears of what wanton individuals might do). It is unreal, that the determination for what is a 'right' is thought to come not from the ability to think successfully about life, liberty & the pursuit of happiness, but from the position one has been awarded over other citizens. This is like the right to a position over their minds, as well. And the ability to think and to serve the purposes of one's own interest are seen, then, as a crime, unless first submitted to the State for review and authorization as politically acceptable and therefore allowable. ...it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government...... . who are all honorable men..... :>) who recognize the merit of being an individual, not simply a "member" or society; i.e., not a lesser being, a minor "element" of the greater good, the Great Society, but, au contraire, who is expected to engage (to the max) in the pursuits explicity named in the Constitution (or was it the Declaration of Intent, Know What I Mean, George). ...there are certain facets of an individual which are outside the normal operations of a government . . . . . . As an exception to the rule? where most of the facets of being an individual are *within* the "normal" operations of a government? This concept does not represent they way that I think of the activities or the boundaries of my life, nor what I would wish to impose on others (or no one that I could admire). I'm sure government employees would agree with this, where I would not. It really is necessary to consider what is "normal" for a human being first, rather than what is normal for a government. First there must be someone to be governed......and a satisfactory reason why they should be governed. ...certain facets of an individual... cannot be regulated or otherwise controlled through legistlative means . . . . So there are a "few" things to be acknowledged, after all, as existing outside the atmosphere of governmental control. You know, "legislative means" are only the precursors to action; legislation only arranges verbally the threat of what will later be done physically to someone if they do not comply. This statement implies that one is only free secondarily, but primarily exists within an environment of control (external to one's own). I don't think it was intended that citizens of the US think of themselves as regulated first and freemen second. I don't think this is the correct way to think about life per se, or about "rights" within the context of an organization. Furthermore, the truth of the matter is that legislation alone does not control my (or anyone's) actions from some power of its own, and it alone does not automatically convince me of what I ought or ought not do, simply because it has been written, and voted agreeably upon, by members of an electorate. They could all be wrong. The control which exists as brought about by legislative means is only the effect upon the mind of those who will fear the consequences, delivered by "enforcement personnel" armed with weapons of subjugation. And as we all know, legislators themselves have ways of getting around this fear and its expected consequences. But this does not necessarily do any justice to reality, the cause/effect that we live with in the 'real world', which it is our responsibility to come to terms with if we want to live and have a quality existence. And this is what is left out of legislation: that we have to come to terms with it (reality) independently, not only in association with each other, and that we have to do this first in regard to our own lives, before we worry about those of others. The direction of the concept of a 'right' is set towards group thinking (the collective), whereas the Constitution would set it in the other direction. Gosh, I'm so glad everyone on this list is crypto-anarchist and can appreciate the fine details of anti-government analyses. ~ finis ~

2 1

T-shirt update...
by Christian Void 17 Dec '03

17 Dec '03

We are slightly behind schedule... I've been swamped by work and everything else. The shirts will be screened starting this week, and should be done by next week. I'll keep everyone updated. Thanks to everyone who ordered. This project has been a lot of fun to put together, and despite the few mishaps, has gone almost flawlessly (aside from being behind schedule!). Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0