December 2003 - cypherpunks-legacy

The Cyber Lexicon of 2030
by terry.smith＠canrem.com 17 Dec '03

17 Dec '03

Mnemonic(a)eff.org wrote |-------------------------------| > of littering. The MD Pound > logo features the mustaches of Salvador Dali, a notably prolific > 20th century surrealist. > > *Municipal Dump*: (n) an institution formed by the |-------------------------------| Hi - this was great - but I only got the first and last message in the series. Could you re-post it? Also, I have no internet access.. Terry Smith - XANTH sysop - 1:259/510 CI$ 70733,3013 PGP 2.3A KEY FREQABLE AS 'KEY'. My opinions are not that of my company. But one day they WILL be! And then - the -+*WORLD*+- Bwaw ha ha !!. Read the Tick and others by NEC. Geraldo - "So, Mr. Smith, you admit you like to eat babies!" Me - "Nono - I admit I like to eat BABES!" --- * TLX v1.55 * A bug is a feature that didn't make it into the manual.

1 0

Secure Drive Distribution
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- After reading Mike Ingle's post of Dec 21, I withdraw my request for a "public-spirited Cypherpunk (perhaps even an anonymous one) to place Secure Drive on an FTP site or a site with an E-mail file server." Mike said: If you do this [upload Secure Drive to an FTP or mailserver site], please make it a U.S./Canada only site. If you mean a site -in- the USA/Canada, no problem. If you mean a site which will not send files outside the USA/Canada, I don't think there is any such animal. The only site even -attempting- to restrict service I've heard of is RSA.com, which distributes RSAREF. And I think it would be rather easy to spoof. A foreigner can easily login to any public -domestic- internet BBS with just an international phone call, giving him a domestic-looking net address. Even if you distribute every copy yourself, Mike, you are not immune from this kind of "spoofing." >So far I still haven't heard from Eric. I did get two responses. >The first was anonymous and sent me a copy of Secure Drive with >a request for me to post it to foreign FTP site(s). The second >was a request from a foreign site for me to send them a copy. I'd like to see more about this, in private mail if you don't want to post it to the list. Not much to tell. I didn't keep copies of either request. I think the non-anon one was from Australia, maybe. The non-distribution of the beta was because I had no way to check it, and it could easily have eaten hard drives. I did say in the ad that you were not to export, although I didn't make anyone send a statement. Maybe I should have. Perhaps. But the ad says: This program may be freely distributed within the U.S. and Canada; do not export it. and the docs say: Exporting this program. This program is for use in the US and Canada only. Cryptography is export controlled, and sending this program outside the country may be illegal. Don't do it. Fine. But "freely distributed in the USA & Canada" would include uploading it to domestic BBS's & anon. FTP sites by my interpretation of English. If a foreigner enters the country and smuggles a copy home with him, whether he does it physically or electronically, he is committing the criminal act; not whoever uploaded SD and certainly not Mike. On the Hacker matter Mike said: They are going to attempt to break Secure Drive. He asked me to write a program which will take a list of passphrases and test them quickly to run a passphrase attack. I had a few qualms about writing a program to crack someone's data, but I don't think it really matters. Unless the hacker chose a very lame key, they don't have a prayer in hell. By all means, go ahead & write the program to their specs.! Of course, as a "forensic software consultant" you're entitled to a fee. I would say a minimum of $100/hour is "fair." After they try that for a while, you can offer an improvement that will try "more keys of a smaller possible set faster" by just trying the 2^128 keys directly without bothering with a passphrase, along with a mod to LOGIN which will insert a binary key directly rather than use MD5 on a passphrase. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLR8uuN4nNf3ah8DHAQHQ1AP/ZXImvQO2XxKXi/k2CCMPgD12rYPAcfZp ZabuyERUGW8UuKZJLS8Wy4i7q2EdWi1TT80dKhHVQgO6ec+ybKyirXN/N8Ahz3BF zKqa+YKKgaroxv50Xg4RdQ3Cr/rfYQeQ0yiH1VdJOJj4dVwDMTnm+uC/Uph/wXJI U53PBfQWR28= =T2cH -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

NBC news.
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

Greetings all, NBC Nightly news recently did a report on the Internet and NII, at the end of which, they mentioned that they have an Internet address of: news:nightly@nbc.com They asked for comments regarding the use/misuse of Internet and I'm sure that they would be thrilled to hear from us. So drop 'em a line and tell 'em your opinion of the NII. ******************************************************************** Geoffrey C. Grabow grabow_geoffrey(a)tandem.com Oyster Bay, New York 'What we demand are rigidly defined areas of doubt and uncertainty!' - Hitchhiker's Guide To The Galaxy ********************************************************************

1 0

GPS and security
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

CBS's "60 Minutes" had a "Oooh Scarey" segment about the Global Positioning System last Sunday. The scarey part is, according to 60 Minutes, that any old terrorist government can now put together accurate guided missles and wreak death and destruction upon our homeland. The crux of the problem is that the system broadcasts out positioning information to one and all indiscriminately, and according to the show there's no way we can stop it. Because my mind is regularly exposed to wild conspiracy theories and all sorts of crazed paranoiac ravings (i.e., I read Usenet), I started thinking that this is rather unlikely. I speculated that the government may in fact have designed the satellite systems so that they could be told to do several things in case of national emergency: * Shut down (probably possible; they may have actually mentioned this on the show). Problem is that lots of friendlies may grow to rely on the data for life-critical things, like guiding commercial airliners. * Shut down normal transmission and begin strongly encrypted transmission. No mention of this; apparently, the satellites were originally designed with some sort of weak system that made the data difficult to use for high-accuracy purposes, but that's been defeated (by the FAA or someone contracted thereto). * Enter into a bogus-cleartext with encrypted subchannel mode, where the plaintext is slyly made to be wrong, but using some subchannel encrypted "good stuff" is still available. I don't know much about how this system works, so I don't know whether any of my thoughts are relevant. It's probably most likely that the government indeed blasted these things up into space without considering using encryption technology to enhance security. -- Mike McNally : m5(a)tivoli.com : Day Laborer : Tivoli Systems : Austin, TX ------------------------------------------------------------------------ Remember that all experimentation does not produce extrapolated results. - k. pisichko

2 1

Re: anonymous video rental store - Libraries
by jazz＠hal.com 17 Dec '03

17 Dec '03

Out of curiousity, has any ftp-archive maintainer tried to join the American Library Association, either directly or as part of some university's library system? I'm not sure what this would do. My wife is a professional librarian and a member of the ALA (and SLA and a few other besides) - as far as I know, the ALA doesn't directly intervene to protect its members. Jason

1 0

Re: GPS and security
by Brenden Kootsey 17 Dec '03

17 Dec '03

Like Mike, I don't claim to know much about the GPS, and I didn't see the 60 Minutes report, but it was my understanding that at least a portion of the signal is encrypted. The signal available to us mortal (non-U.S. military) types has a built-in inaccuracy; while it is still accurate enough for some general use, it is not nearly as accurate as the signal available to the military. Anyone have more of the technical details, especially regarding the accuracy?

3 2

CACM Letters
by Pat Farrell 17 Dec '03

17 Dec '03

There is a very nice letter on the government's rationale for controlling crypto in the current January 94 (received today) CACM, by Walter M Anderson. The main claim is that the government must want to control US citizens, because no other reason is logically consistant. And a nice short one from our own CME. Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

RE: GPS and security
by Pat Farrell 17 Dec '03

17 Dec '03

This is a bit off list topics. Press D now if you don't like it.... In message Tue, 28 Dec 93 14:01:15 CST, m5(a)vail.tivoli.com (Mike McNally) writes: > * Shut down normal transmission and begin strongly encrypted > transmission. No mention of this; apparently, the satellites were > originally designed with some sort of weak system that made the data > difficult to use for high-accuracy purposes, but that's been defeated > (by the FAA or someone contracted thereto). The GPS system was designed to have two modes, one highly acurate for military use, and a low accuracy version for commerce. Since initially no one had receivers, the whole system used military grade for the first few years. Before the Gulf war started, the military needed zillions of GPS units, so they bought commercial marine navigrtion units. After the war, there was talk of turning on the division, but that was made impractical with 'differential' calibration. To get military accuracy, all you have to do is take the commercial GPS to known places. Such as the surveying marks at the US Naval Acadamy, or "ground zero" in the Pentagon. Get your "imprecise" reading, calculate the difference between it at the known value, and use it for subsequent calculations. I expect that triangulation with a few known sites is better than a single one. Last I hear from the Sailing trade press was that the Gov still talked about going to the split setup, but there was little belief that they would. BTW, two satellites is enuff for a general location fix. Three identifies a place on the globe, four adds altitude (handy for planes, bombs, and missles) Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

GPS and security
by jazz＠hal.com 17 Dec '03

17 Dec '03

I speculated that the government may in fact have designed the satellite systems so that they could be told to do several things in case of national emergency: * Shut down (probably possible; they may have actually mentioned this on the show). Problem is that lots of friendlies may grow to rely on the data for life-critical things, like guiding commercial airliners. It's worse; the military relies on GPS. During the Gulf War large numbers of combat vehicles could rendezvous with high accuracy and no radio contact in the dark of night; staggeringly important in limiting fratricide as well (though not as well as one might have liked...) * Shut down normal transmission and begin strongly encrypted transmission. No mention of this; apparently, the satellites were originally designed with some sort of weak system that made the data difficult to use for high-accuracy purposes, but that's been defeated (by the FAA or someone contracted thereto). * Enter into a bogus-cleartext with encrypted subchannel mode, where the plaintext is slyly made to be wrong, but using some subchannel encrypted "good stuff" is still available. Well, this sounds like the "selective availability" (SA) capability, which still exists and has in fact been turned on. It is defeatable, but only under certain circumstances (see below). GPS is a clock-based system; by talking to a constellation of satellites (I think the minimum is 4, with 5 being desired and 6 being best) and munging the timestamps received from them, GPS systems can compute their location to a degree of precision related to the precision of the clocks. SA essentially truncates a few bits off the low-end of the time stamps and makes them available in an encrypted form. Without the key to decrypt the low-order bits, you get location information to within a couple hundred meters or so; with the low-order bits, within about six feet. During the Gulf War, the US military was unable to get enough military GPS receivers (i.e. ones that could decrypt the selectively-available data). Instead, they bought commercial over-the-counter GPS receivers and turned SA off. As soon as they got enough SA-enabled receivers, they turned it on. SA is defeated by something called Differential GPS. Basically, a ground station at a fixed location constantly computes its position via GPS, computes the difference between the GPS location and its known correct location, and broadcasts the correction factor. A differential-capable GPS receiver computes its location via GPS and then applies the correction fac- tor from the nearest differential station. These corrections are obviously of decreasing accuracy the farther you get from the fixed-position station, but you can correct for that to some degree once you have an estimate of the direction and distance from your location to that of the differential broadcaster; apply corrections iteratively until they converge. The requirement, of course, is that you be someplace near a differential GPS station. These stations are maintained by the US Coast Guard and obviously exist only where there is navigable water (and certainly not everywhere, since they take time and money to build). I'm curious if anyone has attempted to crack the encryption used in selective availability; although Differential GPS solves my most important issues (coastal navigation) it's be nice to be able to use a handheld GPS receiver in the middle of Rock Mountain National Park or some such and still locate yourself on the bloody maps with some precision. Jason

2 1

GPS and security
by northrop＠netcom.com 17 Dec '03

17 Dec '03

If the military is worried about delivery systems' accuracy, Phil Karn already mentioned kamikazies, but if you don't want to make suicide part of the package, you could always just have someone drop a radio transmitter on your target sometime in advance, possibly a day or two. The missile can then home in on the signal. (If you need to get it inside a high-security area, you could always encase it in foam and drop it from a model airplane or launch it in a model rocket.) Or you could just leave a suitcase with a timed bomb at your target location; plutonium bombs can be very small. It boggles my mind that the military mind prevents the use of tools that are just too complicated for the "bad guys" to bother with. Does CBS have an email address yet? :) -- Scott Northrop <northrop(a)netcom.com> (206)784-2083 ObVirus: The demand for obedience is inherently evil. ObVirus2: As a juror in a Trial by Jury, you have the right, power and duty to acquit the defendant if you judge the law itself to be unjust.

2 1