December 2003 - cypherpunks-legacy

Re: Net Requlation
by kwaldman 17 Dec '03

17 Dec '03

Say the best way to go is to become a perpetual tourist. That is you don't have US citzenship and thus are not subject to it's taxes and other nosy laws. [Not that other government's don't have nosier laws]. Anyway 1. If you don't have US citzenship, how do you get a passport? (Buy it on sale from the Czech republic or what?) 2. Where do you live? I mean I love to travel but after 3 or 4 weeks of it I'm ready to settle down and hibernate for a long while. [Especially now with a wife and 2 sons, I'd last about 2 days traveling :-)] Somewhere were I don't have to get thrown in jail for thinking the wrong thoughts. [Which given the nature of this list most of us do, except of course our NSA monitors :-)] 3. Are the TELECOM connections there yet? I saw this weeks Economist and it looks promising but last time I was in Europe some of my phone connections were less than perfect. [Even parts of the US leave something to be desired]. I personally need a good phone line (especially if I'm hundreds of miles from my customer), and a minimum of 56kbaud link for my computer. 4. Customer interaction. This is a problem, if you work on computer systems that are unique or program custom software for these systems, customer interaction is very important ( and in other areas I'm sure). Yes email, video conferencing (expensive!) help but you either need to be there or have very good VR (which I have yet to see, this doesn't mean much as I haven't seen bad VR yet either). The one plus is that I believe there is still time (5-10) years before the costs outweigh the benifits of living in the US and thus there is time to plan things like what country to live in, which bank to use in the channel isles and let technological advance solve some of the bandwidth problems. Karl Waldman BTW The above shouldn't imply I disagree with Ducan's premise. In fact I have enjoyed his posts and agree with most of what he says, so I guess I should shut up and buy some DUCAN (or whatever) on HEX. P.S. Ducan please post your talk after you get back from London. I will transfer 1000 thornes to your HEX account (if you have one)

2 1

a desperate plea
by L. Detweiler 17 Dec '03

17 Dec '03

please do not fill my mailbox with argument in the form `criminal behavior [y] exists or is widespread, therefore similar practice [x] is ok' please do not say `forgeries are hard to prevent, therefore no one should even attempt it' please do not say `the only systems for identity tracking amount to government oppression' please do not talk about some depraved person with multiple personality disorder as a way of describing Utopia. most of all, do not pollute the Constitution with your lies: >The freedom to communicate in any way whatsoever, including >"pseudospoofing", is a Constitutional guarantee and part of the >foundation of this society. the Constitution specifically prohibits `high treason'. Or are we now against the Constitution? It's hard to keep track lately. [Pseudospoofing] >This is a fundemental paradigm shift that you have not made yet. It is one >that few have. If anything, it is shared conceptual memes such as this >subject of identity in a world without substance that is the true >cypherpunk cause. oh, what depravity and moral blackness. Evil promoted as `a fundamental paradigm shift', a `conceptual meme'. Helleluja. many cypherpunks have so utterly deluded themselves, they believe they have invented a new kind of society that is completely free of accountability, while they leech the fruits of one where that accountability was hard-won by many sacrifices of our forefathers. I urge you to live in your `society'. You will get the chance, I assure you! `actions have consequences, even in cypherspace.' * * * Let me ask a question of the `cypherpunks' opposed to identity tracking in any form. A major aspect of catching vicious criminals is being able to link up their multiple crimes. It is absolutely essential for crimefighting. I could point to some examples using credit scams or drug dealing or whatever, but the hard core Cypherpunks would probably just grin with evil pleasure. So-- An excellent case is Ted Bundy. Ted Bundy would be the Cypherpunk Poster Boy for Pseudospoofing. `Medusa' is correct in saying our new societies allow and encourage this kind of anonymity. He slipped and danced between cities and murdered young women in the most grisly and heinous fashions. He lied at *every* stage of the way, perhaps even at the end when he blamed his utter depravity on exposure to pornography. Part of the difficulty in catching him in the end was his total mastery of the techniques that have a striking similarity to what the Cypherpunks promote -- hidden credit, deception, disguise, impersonation, etc. He was a man who was so treacherous, he would truly not `stop at anything'. I'm sure he weaved such a majestic and convoluted `web of lies,' PRZ & the Cypherpunks would be proud. In the end, one of the final critical incriminating pieces of evidence used in court to convict him, and prevent further murders, was the bite marks he had savagely embedded in the buttocks of one of his victims, which matched his own jaw. It took something like 4 police to hold him down to make the cast, he squirmed and writhed with such force and desperation. Cypherpunks, look at yourselves in the mirror. See what you are becoming and promoting. Look at the logical extent of your ideas. Could *any* society truly function without any identity or accountability whatsoever? The cypherpunk `agenda' has become so closely indistinguishable with raw criminality and evil it horrifies me. Oh, how it nauseates me. Perhaps many of you will fill my mailbox with new letters defending Ted Bundy and asserting that the only problem was that he didn't `spawn' a new set of teeth. Perhaps you look forward to the day you can spawn some of your own Ted Bundys, and be so clever you'd *never* be caught. Perhaps you already have the young lady victims in mind. The ones that betrayed you by thinking you were too strange too date, huh? Perhaps the only problem was that these young ladies are just too damn *trusting*? `that which cannot be enforced should not be prohibited'. Like murder? * * * Another question for all the bastard apologists and moral relativists. Are you fundamentally opposed to me having the choice of screening phantom identities in my personal mailbox? Many of your arguments suggest that not only do you wish to make sure you can be anonymous, but you wish to ensure that other people must support and sponsor your anonymity. As for screening, very soon these capabilities will probably exist, based on birth certificate databases etc. that are accessable over the internet. Oh, my kingdom for this capability. But you will infect and poison these databases with your forgeries and lies, won't you? That is the fundamental cypherpunk agenda: wherever accountability or identity is in place, do everything possible to *evade* and *sabotage* it. Not only should there be *passive* anonymity, but there should also be *active* deception. You not only want to swing your fist, you want to batter my face -- with a phantom bludgeon. I'll never know what hit me! Oh, what utter joy! To not only be evil, but to get away with it! You hate Democracy and `egalitarianism' not because they are unfair, but because they are the closest thing to honesty and fairness we humans have ever discovered, and in them *you* would *lose*, because the `perverted majority' of society is *not* in favor of being murdered and raped without consequence. And you will tear and wreck those fragile developing efforts and schemes for identification and accountability, no matter how basic or feeble, with the most insidious treachery. You will subscribe to the mailing lists where the development is going on, you will infiltrate the development groups, you will assault the honest, polite, and courteous ladies and gentlemen with poisonous and acidic email and posts, you will twist your knife into the baby in the crib, and you will stick dynamite sticks up the nostrils of anyone who says, `well, gosh, guys, just hold on a minute here!' ... Oh, how you are thriving on the Internet. Either the parasite or the host will die soon, of at least that I am sure. I pray to God that Cyberspace survives. P.S. Ask all your revered fiction authors like Gibson and Sterling et.al. what they would think of your grotesque perversions. Be sure to explain it in *your* terms of `true and pure anonymity.' `a fundamental paradigm shift? sure, sounds great! right out of one of my own stories.'

8 15

Re: help/subscribe
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

>It seems I perpetrated a vile and offensive error in sending a subscribe >request directly to the list. I don't get offended, I just save the subscribe/unsubscribe message in a special folder that I will use to train a learning algorithm to recognize these kinds of requests. Then, I will create a program that detects these so that mailing lists everywhere can automatically bounce messages back to the sender with specific message like "please send un/subscribe messages to fubar-request(a)node.com". In other words, thanks for your example. Anyone who sends me examples will benefit this project. (But don't send examples from cypherpunks--I already get them.) If anyone has suggestions for implementation that maximizes applicability (e.g., I could write a C program that reads stdin or a named file and returns a status code), please let me know. Paul E. Baclace peb(a)procase.com

3 2

Re: ViaCrypt PGP has arrived
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

> From: jim(a)bilbo.suite.com (Jim Miller) [...] > I realize that by not compiling the code myself on my own machine I basically > have to trust the ViaCrypt PGP implementation. So be it. If there is > something wrong with ViaCrypt PGP I believe it will eventually be discovered. > Somebody will no doubt disassemble it and look for backdoors. If someone finds > one, ViaCrypt's reputation will be worthless. It's in ViaCrypts best interest > not to put in any backdoors. Unfortunately, backdoors have not been the main security problem in commercial system software, bugs and "honest mistakes" have been. Unfortunately too, there has been very little pressure by customers to hold companies accountable for the software they ship. Usually somebody uncovers a bug, uses it for a while, is detected, and that causes (in the best case) the software company to issue a new patch. Some distribute the patches for free, some make you pay big bucks for it. But never is the company really harmed by the fact that it claimed some level of security (or functionality), and was not providing it. If, in the future, ViaCrypt says "ooops, there was a debugging switch left on when we compiled, here is a free patch." would you discard your ViaCrypt PGP, buy the competitor's version (there is none), and sue them? Did they include any disclaimer in the license? Call me cynical, Pierre. pierre(a)shell.portal.com

1 0

Re: PGP BUG/FEATURE: multi-platform keys
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> As long as I'm at it, here are some more macPGP2.3 bugs, for those who care. Trying to decrypt a message signed by a key I don't have causes a serious crash requiring reboot. Trying to select cancel in a signature dialogue just raises the same dialogue box instead of cancelling. I'm running on a powerbook 145 under system 7.0.1. > > Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) > 0) 0) =:()]-< <na26436(a)anon.penet.fi> It's been a while since I beta-tested MacPGP 2.3, but I think that... The problem with quitting out of the pass phrase prompt was a "feature." When you pressed CANCEL, the interface told the pgp engine that you had typed in a bad pass phrase. I guess this was an easy quick and dirty way to handle it. The problem was, when you typed in a bad pass phrase, you were given two more chances to get it right. Therefore, when you pressed CANCEL, you were also prompted two more times. So, you had to press CANCEL three times to quit from that prompt. This was fixed in 2.3a, a beta version of which I've got. I guess the official 2.3a has been released by now, but I haven't checked. --Dave.

1 0

Sternlight
by Carl Ellison 17 Dec '03

17 Dec '03

I don't know who wanted to start reposting Sternlight posts to this list, but I have a good way in my news reader to avoid mail from him or in reply to him or talking about him -- but lack such facilities in my mail reader. Could any message mentioning Sternlight or reacting to something he said (however indirectly) include his name in the subject line so that I can kill it without reading? Thank you. - Carl

1 0

Re: trusting software
by doug＠netcom.com 17 Dec '03

17 Dec '03

greg(a)ideath.goldenbear.com (Greg Broiles) said: >It's not clear to me how you can trust systems not under your control to >report on themselves or local conditions accurately. As your program gets >more complex, aren't you going to run into an analog of the Turing >machine/halting problem? The idea is to encode the important-to-be-trusted features of the software and the inter-machine protocol handshake together into the equivalent of a Goedel number which acts as a public key during the protocol handshake, so that any change to that core encoding of the functionality would have the side effect that it was no longer able to communicate. >It's an intriguing idea, but it's still very unclear to me how it might >work on software of any real complexity. Yeah...I'm having strong difficulties with doing it in a way that is computationally feasible as well as theoretically sound. Several times I thought I'd found the right approach but then found holes in it. So I lied in implying that I really did have a final algorithm....I *thought* I did, but I was wrong. Doug

1 0

punk-net mailing list
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

To those interested in participating in a hardware specific cypherpunks list, (punk-net, net underground, whatever) e-mail me. My sysadmin is cool with the idea of setting the list up here, so if a decent number of people respond over the next week, I'll set it up. So, hardware fiends... time to bring a whiff of burnt flux and overheated resistors to the world of underground cryptography. -john. jdblair(a)nextsrv.cas.muohio.edu

1 0

Re: Hole in MD5 (Not)
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

What follows is a private e-mail exchange with Burt Kaliski (posted with his permission), where he clarifies the 'hole in MD5' and shows that it does not afford the attack I described previously. Mike Ingle: >Recently there was a message here about MD5 having a hole in it. >Maybe this is what the person was talking about... Bruce Schneier: [ describes Bart Preneel's Ph.D. thesis, which cites the work of den Boer and Bosselaer ] Burt Kaliski: [ a LaTeX document noting the implications, or lack thereof, of den Boer and Bosselaers' work ] Scott Collins: [ describes an attack on (e.g.) Bellcore's timestamp system; wonders if den Boer and Bosselaers' work makes this attack possible ] Burt Kaliski (private response): >When operating on single blocks, MD5 computes a function z = f(x,y0), >where x is the 512-bit message block, y0 is a fixed 128-bit value, and >z is the 128-bit message digest. > >den Boer and Bosselaers found a way to construct a triple (x,y1,y2) >such that f(x,y1) = f(x,y2). The y1 and y2 values are not the same as >the fixed y0, so clearly this is different than an MD5 collision, >which would have different message blocks. > >I'm not sure how this relates to the attack you have in mind, although >I'd be interested in more details. Also, the attack you describe is >"after-the-fact" in the sense that the target value h_N is already >published. To forge a time-stamp at that point, what I need is not a >collision, but an inversion. (I have to find something that hashes to >h_N.) Collisions play a greater role "before-the-fact," where I might >give Eve something to sign, where I happen to know another message >with the same digest. > >-- Burt Kaliski >RSA Laboratories Scott Collins: > [ ... ] > >Ahh. This is not (even close to) a big enough foothold to support my >attack. :-) > > [ ... ] > >The attack does, in fact, require inversion. Since the verifier can't >compare the depth of the alleged hash tree to the actual one, the attack is >still possible even when only _some_ inversions are possible, as long as >the attacker can find one along the actual path to the root (the degenerate >case being when the attacker can find an inversion for the root itself). > >The attack only came to mind because the the depth cannot be verified, and >so the attacker is not limited in the number of steps (in case she can only >find inversions of a special form); the intermediate hash values are all of >minimal size; the intermediate hash values are expected to be 'random', and >so there is no constraint requiring human-readable inversions. Thus, it >seemed that if an the hash could be usefully inverted, this would be the >situation that allowed it. > >Thanks for the clarification. May I repost your answer, or at least _this_ >message which quotes it, to the original distribution list of my question? Permission was granted. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Sarah's Bio
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <199311051657.IAA20001(a)mail.netcom.com> doug(a)netcom.com writes: > ogr(a)wyvern.wyvern.com (Jason Plank) said: > > Phil Zimmerman solved this problem by supplying the source code for > >his product. You can see for yourself that there are no backdoors. > > This helps, but is imperfect. How many people will read their particular > copy in sufficient detail to ascertain that there aren't any obvious > backdoors added by e.g. a sneaky archive site maintainer, or some sneaky > cracker who found a way to modify the archived copy? Well, I did for one. Some of you may remember me posting to sci.crypt quite some time ago, because the one thing I wasn't happy about was the use of a probabilistic primality tester when there were completely certain primality tests available (albeit a bit more expensive in cpu). (especially since I didn't understand how the probabilistic one worked) I see from a posting on sci.crypt today that the probabilistic tests have been show to be possibly mildly weak in some infrequent cases. Probably not worth worrying about, but still, it's a sobering thought. The rest of the code I understood well enough to trust it, mostly :) G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0