December 2003 - cypherpunks-legacy

RE: Safeway + Your Privacy
by Blanc Weber 17 Dec '03

17 Dec '03

From: killbarny(a)aol.com> Hopefully, someone will have this awful thing happen to them and sue the Shit out of Safeway for being so negligent. Peter Mc Gowan, the asshole who owns Safeway, sized down his employees [so his shareholders could make more millions], . . . . . These databases are already collecting information every time we do not pay in cash. Those bar codes record everything. Safeway has taken this a bit higher, and I only wish I had someone steal my checkbook and take Safeway to the cleaners. .............................................. Now that you know how negligent Safeway is and how their database is being used, you can choose an alternate place to shop for groceries, thus preserving your privacy as well as preventing the support of their shareholders. Blanc

1 0

My Job
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

Russell, Thanks for the info and encouragement. My job entails accrediting 5 VAX systems, two of which are running Ultrix, a Share system, and a Banyan LAN. I also am in charge of anti-virus software for the LAN. I am working on digital signatures, since we have a problem with forgery around here. Also I am working implementing PGP on a large around the compound. I want to get in depth with cryptology, and learn as much as I can as fast as I can. Please, if you have questions, ask them to me if I can help, as I know I will bother the list with mine. I learned about the list from the bugtraq discussion list. Thanks ! Sgt Darren Harlow - Computer Security Internet: harlow%isb%mctssa(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable: harlow(a)mqg1.usmc.mil Phone: (619) 725-2970 Fax: (619) 725-9512 "The views expressed are my own, and always will be..."

1 0

Leahy on Supreme Court?
by jimn8＠netcom.com 17 Dec '03

17 Dec '03

In an article on clari.news.gov.usa, Sen. Patrick Leahy was mentioned as a possible candidate for Supreme Court nomination. >From reading his comments, it would appear he's capable of thinking critically regarding privacy and commerce issues. Would it make sense to encourage his nomination, where we might have an ally on the Supreme Court, or to discourage it and leave him in charge of the committees? Who's likely to succeed Leahy in the telecommunications committee, and do we know their stance on Clipper? - Jim Nitchals (jimn8(a)netcom.com)

1 0

Re: Rejected mail (fwd)
by Jim Wilson (VA) 17 Dec '03

17 Dec '03

Forwarded FYI -Jim -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.4 mQBNAi2Ig+EAAAECALImsR18LE9I6NKICf8TVhbV6yJgF95ynGHnWnNo1ERfdqzk Zl3Icl2N5klNM3KQ9zM3uN/z55smi2QOiD3hL80ABRO0L0phbWVzIEQuIFdpbHNv biA8amR3aWxzb25AZ29sZC5jaGVtLmhhd2FpaS5lZHU+ =JTj1 -----END PGP PUBLIC KEY BLOCK----- ................................ . == = = James D. Wilson. . " " " P. O. Box 15432............................. . " " /\ " Honolulu, HI 96830-5432......Fr. Excelsior........ . \" "/ \" jdwilson(a)gold.chem.hawaii.edu.FRC/FAM/AASR/GWB/OTO. ................................................................... ---------- Forwarded message ---------- Date: Fri, 15 Apr 1994 13:55:53 -0500 (CDT) From: Jim choate <ravage(a)bga.com> To: "John C. Brice" <ag588(a)hela.INS.CWRU.Edu> Cc: cypherpunks(a)toad.com Subject: Re: Rejected mail > > ag588 is rejecting mail from you > One really annoying bug in all the remailers and such out there is the above message. I figured it out the first damn time I saw it. I don't need a copy for every post to the c-punks list. The way they should work is send the notice the first time the rejection is activated. After that it should not send any kind of responce, I am being rejected after all....

1 0

Re: Legalisering Drugs
by kafka＠desert.hacktic.nl 17 Dec '03

17 Dec '03

In article <2oken2INNt59(a)dds.hacktic.nl>, you write the following: AN> AN> Ha PAt, AN> AN> In a previous article, kafka(a)desert.hacktic.nl (=== Patrick Oonk ===) says: AN> AN> >Ja, Perron 0, waar alle mensen die weleens een blowtje roken terecht AN> >kunnen. AN> AN> Ik rook ook wel eens een blowtje, maar op perron 0 waag ik me AN> maar niet. De bagatellisatie van Perron 0 wijst erop dat je er AN> waarschijnlijk niets van weet. Ik woon in een oude wijk in Rotterdam, en AN> kom dagelijks op het CS, omdat het Openbaar Vervoer me daar langs brengt. R'dam CS is inderdaad geen gezellige plek. Ik ben er weleens door de politie op aangesproken omdat ik er een blowtje rolde, terwijl de junks om me heen krioelden. AN> En dat al enige jaren. Ik heb autoriteit, omdat ik al deze zaken van AN> dichtbij zie. Jij bagatelliseert waarschijnlijk omdat dat goed in je AN> wereldbeeld past. Maar wat voor reden heb je er nou eigenlijk voor om AN> mijn verhaal niet te geloven, of Perron 0 te bagatelliseren ? Doe eens AN> hetzelfde als ik. Kom ook eens in het Oude Noorden wonen. Ga ook eens AN> dagelijks over het CS. Doe dat eens een jaar of 4. Dan gaan we weer AN> praten, dan heb jij ook autoriteit. Rinus, heb je wel eens van s-a-r-c-a-s-m-e gehoord ? AN> Wat hebben duizenden (hoe kom je aan dit getal) illegale AN> >Marokkanen met soft-drugs te maken? AN> AN> Je lijkt Theo Dudeck wel. speel je naieviteit ofzo ? Theo en ik kennen elkaar al jaren. Maar je beantwoord mijn vragen niet. AN> Runners ? Voor soft-drugs ? AN> AN> idem dito AN> AN> >En niet te vergeten al die vrouwen die verkracht worden door AN> >stonede mensen, en al die overvallen door mensen die geld nodig AN> >hebben voor wat weed. AN> AN> idem dito AN> AN> >Rinus, get a fucking LIFE! AN> AN> Hier zeg je eindelijk iets wat ik me aantrek. Ik realiseer me dat de AN> manier waarop ik er mee bezig ben, best wel ver gaat, en zelfs een stukje AN> van mijn eigen welzijn er door inlever. Maar ja, er zijn altijd mensen, AN> die (een deel van hun) leven beschikbaar willen stellen voor een ideaal. AN> Een soort wereldverbeteraars dus. Als jij de wereld moet verbeteren, dan laat ik hem liever zoals hij is. AN> >AN> gebied. Ik begin te denken aan Singapore- varianten (en niet van de GRIEP) AN> > AN> >Je bedoelt het verbod op kauwgom in Singapore ? AN> AN> De doodstraf voor drugshandel, natuurlijk ! Ja! De doodstraf! Die endlosung ! Rinus Visser! De DDS zijn eigen net.loon... Patrick --- "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 4 1994 == To get PGP, FTP /pub/unix/security/crypt/pgp23A.zip from ftp.funet.fi ==

1 0

Clipper (Tessera, to be exact) laptops already being made
by Stanton McCandlish 17 Dec '03

17 Dec '03

NOTICE: Tessera PCMCIA card laptops are already being manufactured, as of at least one week ago. For those new to the issue, the Tessera is an encryption device for PCMCIA-capable notebook computers, being a cartridge bearing a hardware encryption chip. The chip is based on the Skipjack algorithm, just like the Clipper chip (for phones), and it too features so-called "key escrow" (key surrender, to police/intelligence agencies). See ftp.eff.org, /pub/EFF/Issues/Crypto/ and subdirectories thereof for more inforation. Or call the EFF BBS at +1 202 638 6120 (N81) and look in the "Privacy--Clipper" file area. I spoke 2 days ago, informally, with a friend who works for a PC manufacturer. He told me he was thinking of quitting, and was looking for a new job. He was asked by his employer to help resolve a technical problem for a customer. The customer turned out to be none other than the NSA, and the problem product was a notebook PC manufactured by this company. Specifically, there was a serious design flaw that rendered it incompatible with the Tessera cards they were installing in the laptops. This "batch" were being made for internal NSA use, not commercial distribution, and it appears that the NSA will go looking elsewhere unless this bug can be fixed, so Tessera deployment is temporarily stalled. I have no reason to doubt this information, and believe it to be genuine. All this aside, I personally couldn't give a hoot whether the superspooks cripple their own security. However, this is yet another indication that Executive branch agencies are ready and willing to deploy Skipjack-derived product, and are unlikely to give it up w/o even more of a fight. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

call for security products!
by ying＠trd.iii.org.tw 17 Dec '03

17 Dec '03

Hi: Is there any product for Netware security(access control, auditing). Or for LAN security. I would like to detect the intrusions to my Netware system. Any information is appreciated. e-mail: ying(a)research.trd.iii.org.tw

1 0

Time for a change?
by Hal 17 Dec '03

17 Dec '03

What's that smell? Doesn't it seem a little... musty? A little stale? Something's getting old. Something needs to be changed. It's your key. There are a lot of old, stale keys out there. Moldy, dusty keys a year or two old. It's time for those keys to change! The need for regular change of public keys has not been emphasized enough. The longer you use a key, the more likely something will happen which will expose your secret. Plus, it gives attackers more incentive to try to break or steal your keys if they know they'll be able to decrypt messages for a long time once they get them. A lot of people seem to think of keys as quasi-permanent, sort of a voluntary version of social security numbers. One key, cradle to grave. But this is not the idea at all. I was reminded of this by Graham Toal's response to Bill Stewart: > Public key has the advantage that the operator doesn't *need* a database. > If you want to implement use-once addresses (or use-N-times), > you could include a tag with the address (such as the IV), > and reject future messages using that tag (e.g. save a hash of the tag). > > I think you missed the point - with your scheme it's still technically > possible to decrypt the address years afterwards - you're relying on the > remailer to always stay secure; with a delete-the-key scheme you couldn't > even if you were hung upsidedown from the ceiling from your toenails by the > gestapo. (Though you might want to...) - so a corrupted remailer would > limit damage to only live keys that arrived after it was corrupted and not > its entirely history of dead ones from the period beforehand. Graham is thinking in terms of remailers which retain their keys for years. What is a good interval for key changes? I would suggest every year or so makes sense, especially if infrastructure can be developed to make it easier to propagate key changes. Keys should be overlapped in time, so that you make a new key and start using it, while continuing to support the old key for a time. But for remailers, I'd like to see a considerably accelerated key turnover schedule - maybe every month, or every week. This would help defeat the kinds of attacks Graham is talking about. And the remailers should securely dispose of their old keys to the extent possible. Granted, right now the difficulties of distributing keys are rather high, so the costs of changing keys may be large. But as this technology becomes more available, key changes should be scheduled regularly. PGP has some fields for key expiration, but support for that was never implemented. The idea was that you would get warned when it was time for you to change to a new key. Users of old keys would be warned as well that they should try to find out the new key they should use. All this was not done because there wasn't time. Hopefully the feds will change their mind about pursuing legal sanctions against PGP developers and progress can be made again. Hal

2 1

re: call for security products!
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I work with a Banyan Vines Network which contains it's own logs. What type of logs are you wanting to maintain? I may be able to help point you in the right direction. Sgt Darren Harlow - Computer Security Internet: harlow%isb%mctssa(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable address: harlow(a)mqg1.usmc.mil "The views expressed are my own, and always will be..." - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi2pYOoAAAEEAJ0Fdc1HDwlww3Wz8JPeQDZT2Gk/q1gh0J+4njtUC66HXngN DNyxzoGnZVcA0bbkirsCdjvvZlsP84QVgxdijzgW4pNOJKowJgrQWFftGEqJKH5b I2NxJrk0kmKt/jli5kV/wDs9Rr4PxXQjGN4B+uJOCSlyWX+fnWNyHMOkIY2tAAUR tENEYXJyZW4gSGFybG93IDxoYXJsb3claXNiJW1jdHNzYUBud3NmYWxsYnJvb2sz Lm53YWMuc2VhMDYubmF2eS5taWw+ =v34V - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLa8zRmNyHMOkIY2tAQHm7AQAmde5g8D4MPorbwPyxx+P1mMoBOtw0W1/ sXIsXUgNaMwEQLGohuYYGOU05KITqPGCynhaRTBoj2jGhH4nmay7h/OBt421nGI8 Pvthbt4aBkiPHdaNecESs085CWHdvUzTyBErWdgZuHueGHoI+z2tPdcAaxDdZ3R1 M3BcYEFCia8= =3Mv6 -----END PGP SIGNATURE-----

1 0

Laundering money through commodity futures
by gnu 17 Dec '03

17 Dec '03

I wonder if anonymous digital cash will really consist of shares in frozen orange juice futures... John Date: Fri, 15 Apr 1994 06:55:58 -0400 From: farber(a)central.cis.upenn.edu (David Farber) Subject: The Soft Pork Underbelly of Efficient Markets [I knew electronic markets were good for something .. djf] To: interesting-people(a)eff.org (interesting-people mailing list) Date: Thu, 31 Mar 1994 23:30:20 -0500 From: Peter Wayner <pcw(a)access.digex.net> Subject: The Soft Pork Underbelly of Efficient Markets The Under Pork Belly of Efficient Markets, or How to Launder Money Using Cattle Futures The great promise of electronic networks and virtual communities is a collection of very efficient markets. In the future, information will be moved, products will be sold and trades will be executed in a blink of an eye. This efficiency is usually considered to be a pretty good thing by everyone in business, in economics or in line at the video store. The underside of this efficiency, though, is a blurring of the line between legitimate and illegitimate business. A good way to understand this effect is to study the case of how to launder money using the futures markets. Laundering money is an age old problem for people who want to move funds from person A to person B without leaving a suspicious trail. Cash is the nieve approach and it has plenty of problems: it is bulky, it can be lost or stolen, and most importantly it often leaves people asking "Hey, where did that come from?" The futures markets, though, make it simple to move funds in a way that is indistinguishable from ordinary commerce. If it is done correctly, the recipiant, person A, looks like a lucky stiff or a market savvy investor. Person B is usually out of the picture or out of luck. The same games can be played with almost any other market, but futures markets are so efficient that the process is actually feasible and easy to do. The basic transaction in futures is to buy or sell a contract for the delivery of x pounds/barrels/tons/feet of some commodity at y dollars/yen/marks etc. If you buy a contract, then you're obligated to actually cough up y dollars when the contract comes due. Most people don't hold on to the contracts long enough for them to actually take delivery. They sell another contract and the futures market maintains a clearing house that is responsible for matching up the contracts and cancelling them out. It's a great system. Very efficient and very useful for farmers, manufacturers and others who actually produce and consume commodities. Futures markets are great for laundering money, though, because they can generate big losses or big gains in a short amount of time. It is quite possible for $100 to turn into a $5000 gain overnight. The downside is that it can often turn into a $5000 loss in the same amount of time. In fact, the market is a zero sum game. If you make n dollars, then there is someone out there who just lost n dollars. The sum total of the losses and the winnings equals zero. This zero sum nature is the key to laundering the money. Person A and Person B get together and guess that the price for a commodity is going to go up. That means that who ever buys a contract will make money. So Person A, the intended recipient buys a contract and Person B sells a contract. If they're right, then Person A gets the money and Person B loses the same amount. Bingo. The money moved from B to A and no one can trace how it got there. Person A looks smart or lucky and Person B looks out of luck. There was no direct connection between the two. There are thousands of other people out there winning and losing money at the same time. The marketplace's central clearing house arranges it so each wins and loses their rightful share. You may wonder why B bothered to sell a contract and lose money. This is the safeguard against guessing wrong. No one is correct all of the time. Even the people who try and rig the markets and corner them get burned as often as they succeed. The best investors in the futures markets, the ones who make money time after time, are the arbitrageurs. They spot inefficient pockets and try and remain neutral to the overall shifts in the market. Person B sells the contract so that if the market goes down, i.e., the wrong way, then A and B together have lost no money. It's a zero sum. Now they just have to play the game a bit longer or for stakes that are twice as high. You can think of the process as flipping a coin until you have encounter a heads. Ideally, you play this game with two players with relatively deep pockets. This means that A can cover the short term loses. This is a bit of a disadvantage because many money laundering operations must move cash from the rich to the poor. You can cover up this problem by using the same broker for A and B. The broker executes the trades and then assigns the winning trade to A and the losing trade to B. They fill in the order books after the fact. Using the same broker for A and B can be problematic because it may look too suspicious if the mirrored trades appear on the same ledger. The beauty of this system is that it can look quite indistinguishable from normal business practices. Many companies actively enter the futures markets to hedge themselves against foreign currency movements. Others actively enter the futures markets to guarantee themselves a good supply of their raw materials. The essential point of this lesson is that fast, efficient markets make it possible to move money easily. The futures markets were designed so that is no real other half to every trade. It's literally you against the world with every trade. The RISKS, of course, is that accountability can vanish as the size of the crowd grows to be as big as the world. There is no way to catch up with this. The futures market are so great because there is no need to deal one on one. The effects of speed are not only apparent in big financial markets. Credit cards and overnight delivery are a dangerous combination. You could steal cards, order a fortune of stuff, arrange for it all to be delivered overnight and then jump town quickly before people notice the card was gone. Suddenly, merchants must deal with the fact that something that used to be complete legitimate (exchanging cash for goods) is now a potential theft. Of course, there are other crimes that lose their edge. It is much harder to escape the law by heading to a new town. Computerized fingerprint files are very, very efficient. I think everyone felt that perfect, computerized markets would bring about the right mixture of accountability and efficiency. It would be a perfect mixture of Big Brotherly scrutiny would take care of everything. Every trade, after all, is recorded in the futures market. Yet, the best mechanism for anonymous fund transfer yet discovered exists here in the midsts of all of this record keeping, legal scrutiny and oversight. ------- End of Forwarded Message

3 2