December 2003 - cypherpunks-legacy

Re: Stealth PGP and Stegonagraphy (Summary)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hiding the file in deleted sectors on the disk has a number of problems. 1) It's highly non-portable. 2) If the Bad Guys are looking for contraband files, either they're competent or they're not. If they're competent, they'll certainly notice your weird drivers and TSRs holding the disk stuff around. Your virus-checking software may notice it also :-) 3) If the Bad Guys aren't competent enough, you can get by either hiding the file under an innocuous name (e.g. boring.dat), or you can go a bit farther by using mimic functions or other steganographic techniques to make the file really look like something boring. 4) If the Bad Guys are competent, and they suspect you, they may try using Norton UnErase or similar ommands to recover the stuff anyway. Fractals are a good place to hide stuff, since random-looking low-order bits could come from steganography, or could just be from the fractal itself; it's really hard to tell since it's tough to regenerate unless you know the precise starting parameters and machine behavior. You could probably hide 4 bits per byte without major visibility instead of the 1 bit/byte you typically can get away with in normal gifs. More important is making sure your encryption program doesn't have incriminating stuff visible in it, such as "BEGIN PGP STUFF" character strings in the object code.... Bill

2 1

No Subject
by smb＠research.att.com 17 Dec '03

17 Dec '03

And there's also the question of whether or not I'm going to execute a random program that you've sent me, allegedly to do a decryption....

2 1

Sending encrypted stuff to non-PGP users.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

PGP already lets you do almost what you want. The pgp -c option does conventional crypto, using IDEA, and prompts you for a passphrase to encrypt it with. (You can look at the code to see if it crunches it with MD5 or just uses the first 16 bytes / 128 bits.) To decrypt, you just do pgp -d filename. This lets anybody who has the PGP binaries on their machine decrypt it, even if they haven't bothered setting up public and private keys. If they use DOS, and either you're located in an encryption-tolerant country or they're located in your country, you can send them the binary if they want. If this is too big, you can shred apart the PGP source and do a version with just the IDEA decryption stuff, leaving out the patent-sensitive RSA code and most of the fancy help and file-handling stuff. Of course, if you *still* really want something that's widely executable for people who don't want to install crypto code on their machines, you could write yourself an IDEA-decryptor in PostScript (tm) and let them print the file on their laser printer. A tad slow, but...... (Yes, they'll need some way to input the passphrase; editing the file works but leaves traces around. You'll think of something user-friendly if you're that perverse :-) Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Clipper is currently only rated for non-classified use. It could be done securely, assuming there aren't any unannounced backdoors, by simply using chips for which the keys are not escrowed, or are only held by the military and protected with certain classification levels, but they'd have to do a couple of things to use it. The most important is making sure that a secure Clipperphone is only used to talk to other secure Clipperphones, and in addition you'd probably want to make sure the users have some way of knowing they're talking to appropirately cleared users, since it's sometimes hard to tell if the voice on teh other end of the phone really has the authorization it claims it does. Features like these are built into STU-II and other classified-use approved phones, but aren't likely to be built into vanilla Clipperphones. It may be possible to do that with Tessera, though; I'd have to see more information than they're likely to give out.... Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

Infomercials, FUD... time?
by Kragen J. Sittler 17 Dec '03

17 Dec '03

Despite all our word-of-mouth and -of-net efforts, the general public knows little or nothing about the Clipper issue. Perhaps it's time to let them know what's going on... not in an article buried on the third page (?) of the New York Times, not in an article on page 30 of Time Magazine, but in some way which lets them know the real facts. I suggest that we air an infomercial, or series thereof, urging the citizens of the US to protest. Phone calls to religious groups, special-interest newsletters, and even mainstream newscasters would also be a help. Most of us cypherpunks have little income. A few, such as Winston Timothy C. May, have enough for an infomercial or two. But there is supposedly an industry coalition headed by Novell to oppose Clipper. Is there anyone here who can successfully solicit these companies for money? I don't know enough details to do this. I don't know the cost of a half-hour infomercial on a national network at 11:00 at night. But I know it can be bought. I don't know which companies are involved in the coalition. Nor do I know how committed they are. But I suspect we could raise enough money... and we do have a number of experienced public speakers and broadcasters among us. If the public knows the facts, just the known, confirmed facts, many of them will be outraged. The response that a single half-hour infomercial could produce in a nation of 260 million would make the puny tens of thousands of votes on the CPSR petition look insignificant... as indeed they are. C'mon folks... what's stopping us? Kragen

2 1

Infomercial
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

Most people couldn't care less. They don't encrypt data, and will never use a clipperphone. The FBI can *already* listen to all their phone calls and see all their medical records. Why should people do anything to protect something they don't have anyway?

2 1

Rising dishonesty level
by Brad Dolan 17 Dec '03

17 Dec '03

jimn8(a)netcom.com remarks about the rising level of dishonesty in (presumably) media/political circles: *It's bad* I once had a faint hope that a change in administrations would reverse the tide. I'm over that now. People from eastern Europe recognize a lot of what they see developing here, as a recent poster noted. jimn8 further wonders if anybody knows a better country to live in: I know of several that are less intrusive in your private affairs. Unfortunately, it's hard for an American to find work in most of them. I've made up a list of decision rules about when it's time to flee to the first place I can find "three hots and a cot" (Places like Belize, for instance). Try compiling your own list, it's an interesting exercise. My rules: It's time to leave when... ... I can't say what I want. ... I can't own a gun. ... I can't use good crypto. ... I can't leave and enter the U.S. freely. Brad bdolan(a)well.sf.ca.us Somewhat related: Does anybody find it interesting that no one noted for over a decade that Ames had (1) a lavish lifestyle and (2) a foreign-born (Colombian!) wife. Normally, spooks aren't allowed either. A cynic might say that the lavish lifestyle was overlooked because it was attributed to the Colombian connection, and not to the other extracurricular activities. -bd

4 3

Viacrypt at NCSC ?
by an69654＠anon.penet.fi 17 Dec '03

17 Dec '03

Why does at least one person from Viacrypt have an e-mail address at dockmaster.ncsc.mil ? Is there an association between Viacrypt and the NCSC, or does the NCSC give out accounts to those in the business ? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

InfoMercials / Getting the word out
by Robert A. Hayden 17 Dec '03

17 Dec '03

I cannot see how an 'infomercial' would be effective at all. The audience of people that commonly watch those things are apathetic about politics. Face it, the only way to get the word out is to get the industries of power against clipper, then the popular support falls into line. The industries include (but are not limited to): Really Rich People Really Rich Corporations The Media Non-US Governments Coalitions need to be built. Face it, the government IS NOT going to listen to the people. The people are the ones that the government is violating. And the commone people have no REAL power, and even shorter memories of those violations. Make the governemtn afraid of those with power, and we can have our way. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Re: story on digital telephony from today's Washington Post (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>From: Mike Godwin <mnemonic(a)eff.org> >Message-Id: <199402250044.TAA04129(a)eff.org> >Subject: story on digital telephony from today's Washington Post (fwd) >To: eniac(a)prudence.fof.org (eniac(a)prudence.fof.org) > cypherpunks(a)toad.com (cypherpunks) >Date: Thu, 24 Feb 1994 19:44:42 -0500 (EST) >The FBI and the Justice Department say the initiative would not expand >their power, but would ensure access to the type of communications they >have been entitled to tap for years. This is totally bogus. The FBI has never had the right to watch computer programs execute. Now that computer programs are being written as distributed systems, what was originally written to be an internal subroutine call can look like a message over the phone system. The FBI never had the right to bug corporate conference rooms. Now that companies are using videoconferencing, a private corporate conference could look like a phone call. Etc. This needs to be fought. - Carl P.S. Even though the FBI has had the wiretap law of 196?, we need to keep reminding them that this law wasn't a constitutional amendment. It's entirely possible for a new routine law to invalidate their law -- or for technology to invalidate their preferred M.O. It might even be reasonable to pass a law prohibiting all wiretaps. That is, now that the FBI has shown that it intends to act like an Iron Curtain surveillance agency, perhaps it should be treated like one and shut down.

1 0