December 2003 - cypherpunks-legacy

my letter to Time's Editor re: Clipper
by Carl_Ellison＠vos.stratus.com 17 Dec '03

17 Dec '03

To: Time Magazine Letters FAX: (212) 522-0601 From: Carl M. Ellison Stratus Computer, Inc. 55 Fairbanks Blvd Marlborough MA 01752 FAX: (508) 624-7488 Re: March 14, 1994; Vol. 143, No. 11; p. 90 "Beware, Uncle Sam Wants to Listen In" Dear Editor: I enjoyed your article and was pleased to see that a poll of American citizens showed 80% opposed to Clipper. That matches my own informal count. However, the introductory paragraph of your article comes close to repeating a very common misconception by claiming that cryptography was secret and was dominated by the National Security Agency. These statements give the impression that cryptography was somehow the property of the government until recently, and that civilian cryptography is a recent development. The only thing which is new in this field is the personal computer -- making cryptography easy to apply without errors. Cryptography itself is as old as writing. David Kahn's history of cryptography, "The Codebreakers" (Macmillan, 1967), shows that cryptography strong enough to frustrate governments of the day has been invented and used by private citizens for the entire 4000 year history of cryptography. Cryptography has not been secret, either. As of 1931 when Herbert Yardley published "The American Black Chamber" (Bobbs-Merrill), there was no legal secrecy applied to even government uses of cryptography. There never has been secrecy applied to civilian cryptography. [A desire to do so was announced back in the late 1970's by the NSA's Bobby Inman about the time public-key cryptography was first published but that desire was soundly denied by Congress in the Computer Security Act of 1987.] The National Security Agency was created in the early 1950s, but strong cryptography in private hands in this country dates back to the country's beginnings. For example, the only provably unbreakable cipher (Vernam's one-time-tape) was put into public hands in about 1920, while a system cooked up between Thomas Jefferson and a civilian friend of his was strong enough that it was reinvented and used by the Navy in WW-II. "The Codebreakers" gives many more examples, through history, of civilian cryptography as strong as or stronger than that used by the military of the time and I recommend that your readers check it out in the local library. Sincerely, Carl Ellison

1 0

Re: anarchy and sobatage! cryptos beware...
by lefty＠apple.com 17 Dec '03

17 Dec '03

"Sobatage"? What's that, the destruction of machinery through the use of Japanese buckwheat noodles? -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: digital cash
by ph＠netcom.com 17 Dec '03

17 Dec '03

hfinney(a)shell.portal.com writes: > Perhaps a digital cash system like Magic Money could serve as the > basis for digital promissory notes. You send me money, I'll send > you a certain amount of digital cash. That particular denomination > and issue date (determined by the exponent) will be redeemable in > one year for X+delta dollars. You can hold the note and redeem it > in a year, collecting the interest, or you can pass it on or even > sell it. Issuers of scrip ("a certificate of a right to receive payment later in the form of cash or stock") will get the attention of Treasury if it is not convertible (by the issuer) to a fixed number of dollars. An easy way for the government to make scrip less useful is to refuse to enforce the contract. It would be interesting to know if there are also punishments and if they can be extended to digital scrip. The laws regarding money can get pretty strange. For instance, it is illegal for a U.S. citizen to hold options in a foreign currency market. The only plausible reason for this is to prevent U.S. citizens from buying insurance against government irresponsiblity. Option rights in a domestic options market are easily abrogated. Mark Hittinger writes: > The global monetary system is notbased on immutable metals prices. > You cannot guarantee that gold will track the inflation of the dollar, > which itself can only be measured relative to other currencies. Even > during times of widespread inflation, some things don't track Commodities have, historically, been more stable than currencies. Over decades they become cheaper as improved means of discovery or production are found, but currencies generally devalue more quickly and unpredictably. I don't have the numbers right here, but I believe even gold is more stable than the dollar. Gold has to be found and dug out of the ground. Currencies are devalued at the whim of the government. A basket of commodities would probably be more stable than government currencies. Unfortunately, governments don't seem to like it when you try to use things other than official measures of value. It would be nice to know exactly what kinds of laws govern the establishment of a digital "bank" which doesn't lend money and which doesn't pay interest. If the only service provided is to make payments, does banking law apply? For instance, U.S. banks are required by law to turn over transactions on an account if an intelligence service wants to see them. The employee of the bank approached is not allowed to indicate in any way that this has happened and the penalties for violation are severe. Would this law apply to a digital transactions bank? Peter

1 0

Don Listwin, flaming idiot of the month
by Paul Traina 17 Dec '03

17 Dec '03

I'd like to nominate Don Listwin for the first 'Flaming Idiot of the Month' award, since he has not fucking clue what he is talking about. Suffice it to say, most all of us are in favor of things like anonymous remailers and devices on the net to protect anonymous activities and keep us free from the clutches of big brother. Unfortunately, I happen to work for a company who's vice president of marketing likes to hear his fucking gums flap and who doesn't have enough of a brain to match his oratory complex. Little does he know that cisco's already been infiltrated by avid cypherpunks, cypherpunk friends, and proto-cypherpunks (before John's first meeting). Sigh... anyone got a deal on some lead pipe suitable of embedding in the empty skull of a certain suit? Paul

3 3

Re: CIA@funet.fi ?
by Graham Toal 17 Dec '03

17 Dec '03

: From: paulj(a)xs4all.hacktic.nl (Paul Jongsma) : Well don't think the funet.fi one is a CIA setup, but i know for sure that : anon(a)hacktic.nl isn't..... The trouble with the cypherpunk remailers is there isn't a single one of them I'd trust. The overwhelming credo of the sort of person I've met in this area is that they want extreme absolute privacy for *themselves* but sneak and spy on everything they possibly can about everyone else. (Oops - that sounds bad - I don't specifically mean the people who run cypherpunk remailers; I mean people who're obsessive about secrecy in general and hackers in particular. Secretive hackers being the worst.) And you can take it as read that every remailer will be logged by the Black Hats too. Only double-blinded *encrypted* remailing is going to have any chance of maintaining secrecy, and then only if you go out of your way to explicitly chain round dozens of remailers in the hope of finding *one* that isn't compromised. (And that, only if all the remailers are regularly spoofing traffic between themselves to foil traffic analysis) G

3 2

Loompanics: SECRETS OF A SUPER HACKER
by walter kehowski 17 Dec '03

17 Dec '03

Cypherpunks: I recently received the recent Loompanics catalog and read the review of SECRETS OF A SUPER HACKER in it. I wondered if the book was just hype ("Approaching Zero" comes to mind) so I'm glad to read in Timothy May's "Books, Loompanics, and other weird stuff" that the book might actually be worth reading. I've appended the review. Thanks, tcmay! Walter A. Kehowski <wak(a)next0.math.pitt.edu> ###################################### SECRETS OF A SUPER HACKER by The Knightmare, introduction by Gareth Branwyn, 205 pp., 8 1/2" x 11", ISBN 1-55950-106-5, March, 1994, Loompanics Unlimited, Box 1197, Port Townsend WA, 98368. Price: $19.95 plus $4.00 for shipping (includes a copy of their must-have 280 page catalog of unusual books). Credit card orders to 206-385-2230 (phone) or 206-385-7785 (fax). This is a very good practical book on breaking into computer systems. It's readable, interesting, informative, balanced, and accurate, with a nice spirit of fun and swashbuckling! Here's the contents: Introduction: Hackers: Heroes or Villains? I: The Basics II: The History of Hacking III: Researching the Hack IV: Passwords and Access Control V: Social Engineering VI: Reverse Social Engineering VII: Public Access Computers and Terminals VIII: On-Site Hacking: The Tresspasser-Hacker IX: Hacking at Hope: Dialing Up Computers With Your Modem X: Electronic Bulletin Board Systems XI: Borderline Hacking XII: What To Do When Inside XIII: This Lawful Land XIV: Hacker Security: How To Keep From Getting Caught XV: Conclusion Further Reading Glossary 8 Appendices The Knightmare covers lots of clever technical tricks for gaining access, but he shows most glee with scores of hilarious "Social Engineering" scams for seducing legitimate users into revealing their passwords. The striking thing about these spoofs is, just reading them, you realize through the laughter how often these simple Social Engineering techniques will produce results and how the credulity of non-security- minded naive users is the weak point of any security system. Sometimes while reading, I wished the book provided more specific info about phone numbers, brand names, specific techniques that work on specific bulletin board systems, etc. But I recognize that such information would go quickly out-of-date, or would be fixed in response to the book's publication, or could implicate the author. The Knightmare is presenting concepts that won't go out-of-date soon, giving the interested non-hacker a comprehensive and comprehensible survey of the field, and tipping off the potential hacker with just enough details to get him/her started and steered in the right direction and minimize the chance of getting caught. On this final point... a few times during the early chapters I thought The Knightmare was being cavalier about personal safety, favorably reporting (for example) Social Engineering advertizing scams that would likely bring the cops to one's doorstep. But The Knightmare was saving his warnings for 2 chapters towards the end, 22 sobering pages that make very clear the risks involved and what definitely NOT to do. A very balanced presentation. As usual with Loompanics books, this one can be read backwards, and pages 167-168 are directed specifically to System Administrators interested in beefing up security. I also appreciated all the hacker philosophy and pragmatic do-no-damage hacker ethics. The Knightmare disdains and derides "crackers" who break into a system in order to wreak havok; for him, "hackers" are peaceable, non- destructive puzzle-solvers and liberators of information. In a world where the govco is ever working to extend and centralize its control over financial data, encryption techniques, cyberspace, and every aspect of people's lives, the hacker may emerge as a modern-day Robin Hood.

1 0

Re: CIA@funet.fi ?
by Black Unicorn 17 Dec '03

17 Dec '03

Graham Toal cypherpunk regular said: The trouble with the cypherpunk remailers is there isn't a single one of them I'd trust. The overwhelming credo of the sort of person I've met in this area is that they want extreme absolute privacy for *themselves* but sneak and spy on everything they possibly can about everyone else. (Oops - that sounds bad - I don't specifically mean the people who run cypherpunk remailers; I mean people who're obsessive about secrecy in general and hackers in particular. Secretive hackers being the worst.) <- It's interesting to me how double standardized (is that a phrase in english?) the concept of privacy is in general. One seems to have to do some snooping to make sure one's privacy and security is assured. In doing so one is invading the privacy of others. I have met very few privacy purists. Most tend to feel that privacy is not a general responsibility of the collective to assure. The collective in this sense is either the government, or the people as a whole. Phrased another way, most of the privacy advocates I have met and discussed with seem to feel that what is not protected is fair game. They lay the burden on the individual to secure his/her own privacy and scowl at those who are too lazy to do it. (note that this message isn't signed because I'm too lazy to do it) In addition they seem to snarl at any attempts to collectivze privacy and make it a function of government to enforce privacy on the ground that there exists a conflict of interest. Unfortunately, while there exist SOME tools for the individual today to provide for his or her own privacy, (stong encryption) many of the other tools are provided by smaller collectives. (the remailers for example) Indeed it is a collective of perhaps 2 (the operator of the mailer and the system admin if seperate) but a collective none the less and one which the user must rely on. Are remailers then a departure from the "secure your own privacy" doctrine? It stands to reason that all remailers should provide for double blind double encrypted remailing. (Provided you subscribe to the theory, ) Just as a side note, I tend to think that laying the burden on the individual is the best approach. -uni- (Dark)

1 0

PC Week article
by Giuseppe Cimmino 17 Dec '03

17 Dec '03

Copyright (c) PC Week - Reproduced without permission Volume 11, Number 10 - March 14, 1994 Jim Seymour's column The Corporate Micro Businesses would be Clipper victims, too This Clipper-chip stuff is getting out of hand. A manifestly bad idea that seemed likely to sink of its own weight has taken on a life of its own as government officials offer ever more specious arguments for its desirability. Many corporate computing managers tell me they haven't thought about Clipper much, because they aren't interested in politics. That's naive. Ignore this one at your own - and at your company's - very substantial risk. In case you've been on Mars for the past few months, the Clinton administration is pushing for adoption of a data-encryption standard using an embedded chip in every piece of communications equipment. Decryption by any entity other than the intended recipient of the data would be impossible - except by the government, under strict limitations: The necessary keys would be held in trust by a government agency, which would deliver them to a law enforcement agency only after issuance of a court order based on probable cause. The government expects that by requiring Clipper chips in every piece of communications equipment it buys, Clipper chips will become ubiquitous. There is also talk about barring data that is not encrypted by the Clipper standard from any national information superhighway, further assuring its universal use. Uncle Sam assures us this is the best ever data-security system and that we have nothing to worry about from government snooping which just wouldn't happen. This whole proposition is so ludicrous that it seemed unlikely to make it to the congressional hearings on a new telecom act. But it did, and now our servants in Washington are considering making this the law of the land. Which has led to the spectacle of FBI Director George Orwell - oops, make that Louis Freech - saying that Americans should be willing to give up some of their freedoms to become more secure. What's next, Lou, viewscreens in every room? Organizations from Computer Professionals for Social Responsibility to Wired magazine are sponsoring petitions and letter-writing campaigns to try to end this craziness. You can't get on the Internet these days without being asked to sign a petition. All that is well and good; the personal-privacy arguments are powerful and appropriate. But in the flag-waiving over potential government snooping, we're missing a compelling business argument against the Clipper standard. If the image of Uncle Sam as a snoop doesn't move you to action, maybe this one will. Say Clipper becomes the standard and your company's electronic communication is Clipperized. How secure from interception and decoding by competitors do you think your data will be? Beyond the press-release smoke about how limited access to Clipper decryption keys will be, the fact is that ordinary people will be responsible for safeguarding them. And people can be bribed, and can take impetuous and spiteful actions. It's not a question of whether a scandal will erupt when critical and highly confidential corporate information is invaded - only how long it will be before that happens. You and I break our backs devising super-secure communications systems. Our livelihoods depend upon our expertise and commitment to that goal. Do you really want to undermine that work and commitment with this kind of insane back-door risk? Jim Seymour can be reached via MCI Mail at 336-5687.

1 0

Re: spyproofing your house/work building
by System Operator 17 Dec '03

17 Dec '03

"Perry E. Metzger" <anagld!lehman.com!pmetzger> writes: > > Make sure the drapes block IR. There are instances of even local > > police forces flooding the front of a house with IR light, > > You mean heat? What did they do, exactly? Erect giant heat lamps in > front of the house? No one inside noticed either? This is getting rather far afield, but I'll answer: Light sources to generate usable IR aren't any larger than visible systems, and do not generate the amounts of heat you're imagining. These aren't Kentucky Fried Chicken food warmers. Pick any of several security industry magazines and you'll find many advertisements for "undetectable" (in the sense of being visible to the naked eye) IR surveillance systems. Even the FLIR systems mounted on police observation helicopters (Ft. Worth being the most notable user) are easily mounted inside a van or delivery truck. >From the literature I have, the British SAS have long used this observation method immediately prior to initiating hostage rescue. It will be interesting to see if any "peeping tom" cases come out of the large amount of Soviet night vision gear now available, relatively cheaply, to civilians. Due to it's low price, it has also become popular with local police departments. Even the town I went to high school in, population 10,000, has some night vision gear. Dan -- system(a)decode.UUCP (System Operator) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

3 2

Re: PowerMacPGP
by Derek Atkins 17 Dec '03

17 Dec '03

Forwarded with permission. ;-) FYI: I saw a Power PC yesterday, and asked about running standard Mac Apps, and was told it would do it, but not get the Power PC speedups... -derek ------- Forwarded Message Date: Mon, 14 Mar 1994 17:10:42 -0800 Message-Id: <199403150110.RAA26805(a)mail.netcom.com> Mime-Version: 1.0 To: Derek Atkins <warlord(a)MIT.EDU> From: plaz(a)netcom.com (Plaz) Subject: Re: PowerMacPGP Derek Atkins <warlord(a)MIT.EDU> replies to someone. >> Does anyone know if Mr. Zimmerman or anyone else will be writing a >> Power Macint -osh PGP porgram. What about the other popular >> encryption programs. Thanks, > >The source code is available. If you have a C compiler, it shouldn't >be very hard to build. Then again its a Macintosh, so who really >knows? I don't expect to see Phil to do it, since Phil hasn't done >any coding for PGP. Also, I don't think that PowerMacs are prominent >enough for developers to have them, yet. I am 99.9% certain that MacPGP will run on a PowerMac, in emulation mode. Some time soon someone will get around to recompiling for native mode. For the original poster: PowerMac is supposed to run all Macintosh OS based programs, right out of the box. No porting of the programs is required. They run slower than native apps, but they run as fast as they would on most Macs now. _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 ------- End of Forwarded Message

1 0