December 2003 - cypherpunks-legacy

Another clipper editorial
by Jonathan Corbet 17 Dec '03

17 Dec '03

The following appeared as an unsigned editorial in the 2/14 Christian Science Monitor. It lacks the fire of Safire's piece, but it's nice to see anyway. CLIPPING PRIVACY With the rise of electronic mail, public data networks, and cordless and cellular phones has come a rise in devices to encode data to protect the users' privacy. But law enforcement officials worry that these advances will undercut their ability to secretly gather evidence through wiretaps and other surveillance methods. To respond to law enforcement's need, the Clinton administration reportedly is seeking a bill that would require phone and cable companies to use software designed to allow law enforcement agencies to monitor phone and data transmissions. Earlier this month, the administration decided to push federal agencies to include so-called Clipper Chips in computers and phones they use. If that extends to vendors and contractors, the chip may become a de facto industry standard. The chips were designed in conjunction with the National Security Agency to permit unscrambling of coded data transmissions. These moves represent potential dangers to privacy; they take on added urgency with the imminent marriage of computers, phones, and cable services in ways that reduce the diversity of people's means of communication even as they use those means for more activities. No one doubts the need for effective law enforcement. The government, however, should not be in the business of asking manufacturers to build secret backdoors into their equipment, particularly when government holds the keys. The proposals also raise questions as to how appealing United States technology exports will be overseas if such backdoor access is built in. Congress should take a hard look at any bill that tries to expand the government's ability to peer through the electronic blinds, no matter how well-meaning the motive.

1 0

Re: LEAF, SS7
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

With the mail flood here, I've seen pieces of the answer, but no summary. While Clipper and SS7 both give the Wiretappers part of the traffic analysis, Clipper would be much more effective (if it were widely used by Wiretappees.) SS7 is hard to tap, unless you have the phone company's cooperation, somewhat hard even with it, and Async Transfer Mode will be harder. Also, SS7 can only tell you what phone line is being used; Clipper tells you what *phone* is being used, and one of the major wiretap targets for Clipper are cellular phones, which people normally carry around with them - so Clipper traffic analysis can tell you *who* is talking, once a phone's serial number has been identified, not just what pay phone the conversation is from. The two can be used together, if the Wiretappers are both lucky and persistent. One presumes that if ClipperCellPhones are widely used, they'll start keeping records of which cellphone numbers correspond to which ClipperIDs, by wiretapping (or radiotapping) and listening for Clipper. For instance, if they're tapping SS7, and see a phone call from a well known activist's phone number to a recognizeable cellphone company, they can correlate the phone number to find the ClipperID, which makes tapping easier and puts that cellphone on the fun-to-watch list. Paranoidly :-), Bill

1 0

Re: Wide Spread use of PGP
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I agree with those who disagree with Bob Cain about use of PGP on insecure machines (i.e. machines you yourself don't control.) Yes, it's less secure than using it on a machine you control yourself. But it still gives you *some* security - for instance, if your correspondent is in some country with limited freedom of speech, such as China or Canada, your crossborder conversations are protected. Sure, the NSA will tap them, but as long as they're not tapping netcom's internal networks, and you're dialing in rather than telnetting in from somewhere else (sending your passphrase across the entire internet for the FBI\\\BadGuys to wiretap), you've gained some security. Of course you should use a personal machine with good security on it to discuss overthrowing your current government or trading in politically incorrect substances, like money. But even so, it increases the use and acceptability of encryption, and makes you more accessible for people in other not-sufficiently-free countries. [Note - I'm just picking on netcom because they're a popular service used by hundreds of subscribers. I'm not aware that they're being wiretapped, and I suspect that the legal implications of trying to do so would be interesting. Tapping their Internet connection would be legally easier than tapping their phones, though.] [Blatant Quasi-Commercial Mention: Some 10baseT hub vendors, starting with the AT&T SmartHub but followed by others as well, provide a no-eavesdropping feature, which prevents packets from being sent to incorrect destinations. Unlike bridges and routers, which limit traffic, the SmartHub replaces the data field with 10101010...., which it can do faster and less expensively since there isn't the complication of buffering, etc. One use in a dialup networking environment would be to put the herd of terminal servers and cpus on smart hubs, which limits the damage that can be done if some user breaks a system and starts snooping the net, since he'll only see packets for the machine he's on and not the whole broadcast. Obviously, in a larger environment, routers, etherswitches, etc. can handle more traffic, but the different technologies can be used together.] Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

ITAR vs. Diffie-Hellman Key Exchange?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

In the discussions about people sniffing the net and the need for encrypted telnets, one problem that has come up is the ITAR hassles that make exporting Kerberos politically incorrect, though John Gilmore has gotten them to admit that the Kerberos bones is none of their businesss :-) However, is Diffie-Hellman exportable? After all, it's not crypto, it's *just* key exchange, and people can plug in their own triple-DES from the usual sources. It looks to me like it's probably legal, though if you were to then transmit the password by XORing with the login key or some such probably-unsafe behaviour it might not be. I had heard somebody say there would be an updated RSAREF version including Diffie-Hellman key exchange, though it's not in the package I just ftp'd from rsa.com. Is this correct, and is there a planned release date? Thanks; Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

5 4

re: rEaL wOrLd EnCrYpTiOn
by Mark Hittinger 17 Dec '03

17 Dec '03

> Sandy writes: >I would like to start a new thread. I want to know what the >people on this list intend to do with cryptography in the "real >world." >... >My interest is more than academic. I am one of the Cypherpunks >involved in creating a digital bank. Sandy - In the real world there are already secret banks. There are already forms of untraceable cash and forms of completely fungible money. These techniques are very ancient and time honored. They are well understood. Many of them have stood the test of time and have not been compromised by various incarnations of police states. Given the existence of efficient, accessible, secret, and widely accepted monetary exchange I can't really see the need for a digital bank from the privacy side. I can't really see anyone who uses the current techniques being interested in a new experimental form unless they are techno-junkies. Nevertheless, please continue. Some of us are techno-junkies. It is already well known to privacy fanatics that you should not use credit cards, debit cards, checks, atm cards, or other forms of electronic money. All transactions are logged and are easily analyzed. Astute people cash their pay check at the employer's bank and pay cash for everything. Admittedly, this is somewhat paranoid, but on the other hand it is fun to defeat the monolithic database builders who want to make money off of selling information that belongs to you. Cypherpunks must concentrate on solving problems that are true problems now. Do not spend time creating a variant of an existing/workable/fun solution. Email privacy was a true problem. Clear text on your pc's hard drive was a true problem. Right now there is the well known problem of ethernet sniffers and the trivial security breaches that can occur. A telnet/lat traffic encrypter is needed badly by the Sun/Dec/HP world. Novell needs something badly as well. Cellular phones desperately need something. The masses just have NO IDEA how badly cellular needs something! Fax machines need a variant of PGP. Pagers probably need it too. I think the larger issue that cypherpunks need to blue sky about is wether they will be content with a role as grey-area political criminals underneath the boot of an ever growing police state. Can crypto be more than a defensive weapon? What would people be defending against? Crypto can do some things but it won't be the total solution. In the end we need to strengthen the rights of the little guy and devise ways to dilute any new state powers that are created by technology. Crypto is just one compartment on our batman utility belt. People always argue that criminals would use these tools. I'm certain of it. Strengthening the state's hand to fight criminals always screws the little guy. The criminals all go to work for the state when its powerful enough! We've seen this over and over. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: cypherpunks meeting in Mt. View last weekend.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >Chip Rosenthal talked about > >Habitat, an early Commodore-64-client+central-world-server system > That was "Chip Morningstar", not "Chip Rosenthal". Sigh. I knew that, but I'd been drinking decaf all morning :-) Thanks; Bill

1 0

Big Bother Inside Stickers at cpsr.org
by Dave Banisar 17 Dec '03

17 Dec '03

The Big Brother Inside Graphic files are now available at the CPSR Internet Archive - ftp/gopher cpsr.org /cpsr/privacy/crypto/clipper big_brother_inside_sticker.ps (postscript-change the size to fit your project) big_brother_inside_logo.gif (Color GIF - good startup/background screen) big_brother_inside_picts_info.txt (Info on the files) Have fun. Dave

2 1

Re: UNSUBSCRIBERS PLEASE READ
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Perry posted a note saying that "Internet mailing lists are run by HUMAN BEINGS, NOT MACHINES", and that you should EXPECT humanly-slow behavior when you subscribe to a mailing list. I disagree. Cypherpunks is run by a human (thanks, Eric!), but many or most mailing lists out there on the net are low-level managed by machines named majordomo or listserv or foo-request, and a large percentage of users expect the rapid response of servers like that, at least for getting off lists if not for getting on. I was briefly on the sf-raves mailing list, which has an even higher volume than cypherpunks, and it was very nice to be able to send mail to the majordomo server and get off it, and one of the automagic notices mentioned sf-raves-calendar which is a once-a-week announcement. I understand how people getting flooded with cpunks mail must feel, especially if they're using brain-damaged mailers that can't defend them. Cypherpunks makes this problem additionally difficult because of one of Eric's self-defense mechanisms for the list, which makes messages appear to come from their authors rather than *cypherpunks*. This is good for bouncegrams and non-germane replies, but means that users of vanilla Mail can't just do a 'd cypherpunks' and trash them all. Users should NOT expect slow human-speed behavior from mailing lists, and they don't. (This doesn't mean they should be totally surprised by it, either, since machines can generate garbage out faster than you can dispose of the stuff :-). It would be nice if, at minimum, there were several administrative addresses, including a cypherpunks-unsubscribe and maybe a cypherpunks-request that autoreplies with an "Are you sure you want 50-100 exciting messages per day, with an occasionally slow turnaround time for unsubscribing? If so, reply to this message" which goes to cypherpunks-yes-really-subscribe or some such address. (As well as forwarding requests saying "unsubscribe" in them to cypherpunks-unsubscribe.) Bill, surrounded by depressingly stupid machines

1 0

RFC822 compliant, and already deployed hack for return addresses
by jpp＠markv.com 17 Dec '03

17 Dec '03

Go ahead, hit 'r' and see what you get. How many of you get the whole verbose reply-to field? j'

3 2

Re: REAL WORLD ENCRYPTION
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Would I use crypto in the real world? Sure, for some things. I'd like to have a bank where I could do transactions by email, and I certainly don't feel confident doing that across the Internet. I'd like to be able to subscribe to Wired by email or buy other stuff by emailing them my credit card number, but I sure don't want to do that without encrypting it, especially with this sniffer-attack supposedly going on. I'd especially like to be able to do it with one-shot credit card numbers, which would be tied to my real account in some accountable way (either through crypto-signatures I generate myself or through online transactions with the bank), so even if the person on the far end tries to rip me off by reusing my card, they only get one shot. Without crypto, that's not a practical system; with crypto it might be. Would I use digicash banking to hide all my income from the IRS? Probably not - I'm an employee, rather than a consultant, though that's never a constant in the computer industry; big companies tend to collect withholding and the IRS likes to squash non-volunteers, and sometimes even fines companies for underwithholding. Too much hassle, at least for now. But I'd certainly like to use it. And I'd love to be able to use digicash to pay for things like Grateful Dead tickets, though I can't say I *know* that drug cops follow you around for buying them :-) Would I use cryptophones? For doing politics or money, sure. It doesn't keep the cops from photographing you at political meetings or anti-war demonstrations, but it does make it harder for them too cause trouble and track down organizations like CISPES. Bill

1 0