December 2003 - cypherpunks-legacy

Re: Hardware generators was: your mail
by smb＠research.att.com 17 Dec '03

17 Dec '03

How about a SCSI device instead. Most UNIX boxes and Macs nowadays have a few unused SCSI IDs. The great majority of DOS machines with SCSI (all those new ones with CD-ROMs, etc.) have unused SCSI IDs. SCSI has the advantage of being rather fast, and is a cross-platform solution. ``Cross-platform'' is great, but ``fast'' is probably a bad idea. Few random number generators are particularly fast, and if you sample the input too rapidly, you're likely to get too high a correlation between successive bits.

1 0

Re: Hardware generators
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sun, 19 Jun 94 10:50:14 EDT, Adam Shostack <adam(a)bwh.harvard.edu> writes: > Understood, but its not a matter of addressing 90% or the > other 10%, its a matter of "Is the security gain in building a card > that only hands out each number once worth cutting out 10% of the > market?" I think that if you are worried about rouge code on your > machine, you aren't going to run on a computer that can't protect its > memory from random browsing. (I can still access all of a PC's memory > from normal code, can't I?) Thus, building a PC card doesn't really > afford you a gain in security if I can use my hostile code to read > PGP's memory locations. If you agree with that, then there is no good > reason not to build a serial port dongle, and include me in your > potential customers. :) I think I'm a bit confused. Your first post suggested that I was ignoring an important part of the market, and I acknowledge that this was delibrate. Now you seem to be arguing that the paranoia that I addressed in my fourth question is justified. I'd like more backup for this, as all I have is speculation at this point. I don't know if it is paranoia or prudence. Yes, if you are running DOS/Windows, you can address the world. Sigh. And lots of other/better OS fix this, but they haven't got the market penetration. So I'm back to addressing lots of folks, or a few ones with real computers and real operating systems. I'd rather not degrade into that religion, I started with TOPS-10 and moved to Tenex... The problem with the serial port dongles are: 1) while parallel port dongels are known technology, making it work on a serial port is more problematical. 2) Most PC serial ports are junk. Getting reliable data rates above 2400 baud is non-trivial for low end PCs. If I could claim that the users had to have 16560AFN uarts, or better, then I could get decent rates, but then I lose market size. 3) PCs typically don't have a spare serial port. It is interesting that my mail is so far favoring an internal board approach. Given that, and the forthcomming Plug-n-Plan spec from Microsoft/Compaq/Intel/... and the hidious hassles of seting up IRQs, port addresses, etc. Does this suggest that a Plug-n-play board would be more attractive? The key is that they would be more expensive, at least at first. Compaq probably has the volume that can allow the cost difference to be offset by lower tech support costs. I haven't got that volume yet. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Hardware RN generators, data volume requirements
by Pat Farrell 17 Dec '03

17 Dec '03

I'm quite happy about the volume and quality of responses I've received. So here is another question: What data generation rate should we aim for? I guess I should be more precise, given that costs are usually directly proportional to data rates, what are the minimum, hoped for, and high end data rates needed? For example, Tony Patti's RANGER has a very high data rate, but is big and costs more than two cases of beer. Is a good bit a second sufficient? 100 b/s? ??? Right now, I've only generated a few of Pr0duct Cypher's magic money tokens. So if I had a daemon process collecting bits for me in the background, then 3600 per hour is plenty. I am sure that when Perry uses digicash for online trading of eurodollars, he (and his user community) will need orders of magnitude more. But I'd expect them to be willing to pay at least an order of magnitude more for the gear too. I'd like to hear grounded justification for rates, and/or a rate/dollar tradeoff. Don't worry about the exact monetary exchange rates. Estimates in bits per second per case of beer are accurate enuff for this level of design. Thanks Pat p.s. I just got up to the chapter of Bruce's _Applied Crypto_ that addresses some of the approaches to this. It really is a FAQ for serious cypherpunks. Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Anonymous Mailing list?
by Jonathan Rochkind 17 Dec '03

17 Dec '03

Has anyone tried to write some mailing list software that uses PGP-anon-remailers to implement a double-blind anon system? It wouldn't be very dificult to have a mailing list people contributed to using a remailer with a encryted address-block, so no one knew the actual address of the mailing list. Or more significantly, the mailing list, instead of keeping a list of addresses, could keep a list of encrypted address-blocks, and the proper remailer to send them to, so the list maintainer doesn't know the real address of anyone on the list. This is intriguing to me because it seems to solve the problem of a "secret" organization's security. The members of this mailing list don't need to trust anyone else on the list not to reveal their identity; no one can reveal anyone elses identity even if they wanted to. Assuming the security of the encryption (which of course can't be assumed; anyone with a sufficiently powerful comptuer and sufficient time to spend can surely break PGP, but anyway...), this mailing list would seem to be pretty much 100% secure. It would also seem desirable to have the mailing list software keep a record of all it's members public keys as well, and send out posts encrypted. As well as perhaps check signatures of incoming messages so that only legitimate list-members could contribute to it. I've been thinking of trying to write such software, perhaps by working with the procmail program from comp.sources.misc, whcih can be used to implement a standard mailing list. But has this already been done? It seems like such an obvious idea, that it's hard to believe no one has thought of it first, but I haven't heard of anything so far. Comments?

2 1

Re: Hardware generators was: your mail
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sun, 19 Jun 1994 11:24:34 -0600, Richard Johnson <Richard.Johnson(a)Colorado.EDU> writes: > > How about a SCSI device instead. Most UNIX boxes and Macs nowadays have > a few unused SCSI IDs. The great majority of DOS machines with SCSI (all > those new ones with CD-ROMs, etc.) have unused SCSI IDs. SCSI has the > advantage of being rather fast, and is a cross-platform solution. Sadly, the state of PC platform SCSI is in turmoil, at least right now. Microsoft is working hard to convince folks that Enhanced-IDE is the answer, and many CD-ROMs, big disks, etc. that are aimed at the mass market are no longer SCSI, but E-IDE. I don't think you can substantiate your claim that a "great majority of DOS machines" have SCSI. Worse, MS is pushing hard to push into Windows-for-Workgroups. Many OEMs no longer ship Windows, even for standalone PCs. They ship W4Wg. W4Wg's support for SCSI devices is a step or two down from even W4Wg 3.10. My SCSI disk setup (1.7GB Maxtor) is significantly slower under W4Wg 3.11 because MS changed things to the point that I no longer have 32-bit disk I/O. Chicago is claimed to have "better" SCSI support, but I was hoping that I could get this at least prototyped this summer. No RSN reliance on 3rd party vendors for me, thanks. Right now, SCSI is too high-end (Suns, HP, Macs, serious PCs, etc.) for the market that I have in mind. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

TV AS A SOURCE OF KNOWLEDGE
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, I just watched the latest episode of "Acapulco H.E.A.T." In this weeks show, "Codename: Ghost," the Bad Guy is a renegade CIA agent who has become an arms dealer on the Black Market. He controls his far flung organization via encrypted e-mail over the Internet. The H.E.A.T. team foils his dastardly plans by *intercepting* his e-mail and sending on *forged* messages signed with his own *code* (digital signature?). Too bad he wasn't a renegade NSA agent (or a Cypherpunk), then he might have had the good sense to use strong crypto. Yeah, I guess there must be dumb criminals who would use Clipper or the like. WHY I WATCH ACAPULCO H.E.A.T. Cheap thrills. Lots of babes in bikinis, lots of guns, lots of car chases and lots of explosions. (Subtract 2 points for Fabio.) I would kill for a night with the woman who plays "Cat" (Alison Something-or-other). WHY YOU SHOULD WATCH ACAPULCO H.E.A.T. We can see really good TV and movies again and again. If you miss it the first time, it will be back again, soon enough. The really bad stuff is gone in a heartbeat. See it now, or never see it again (unless it becomes a cult show). S a n d y

1 0

Cell phone tracking
by die＠pig.jjm.com 17 Dec '03

17 Dec '03

Mike McNally writes: > > Jef Poskanzer writes: > > It looks like at least some switches in Amerika are already equipped > > to read out locations for individual phones. > > This is not actually that surprising. All they need is to know which > phones are using a band on a cell site, and they narrow the search > down to a relatively small area. I seriously doubt that they can do > triangulation (I mean, they *could*, but there's not much likelihood > that the cellular operators would incorporate something complicated A company I am familiar with which does specialized classified interception systems for the NSA and other TLA's has built just such a system for the TLAs. It can locate a cellphone to within a few feet just as soon as it starts transmitting - it uses time of arrival techniques to triangulate the cell phone's position. How many of these are installed and where I do not know, but the technology has been developed and is in use. The system is multi-channel and can keep track of many cellphones at once - but as a practical matter it isn't hard to monitor the control channels and paging channels to locate the phone of interest and identify which of the 866 channels it is transmitting on so even simple doppler DF technology might work. Considering that the LA area is the biggest cellular market in the country it wouldn't surprise me that some of the these systems are installed there. And in the future Phil Karn's company Qualcomm's CDMA digital cellphones will provide few feet accuracy position as a byproduct of the spread spectrum receive correlator operation on every transmitting phone within range of more than one cell receiving site unless they actually aviod trying to make the measurement. Most of the time more than one cell site tracks a given phone so they can vote on which one has the stronger signal - given that each of these sites has a precise estimate of the time of arrival of transissions from each phone it takes little more than netting of the time base (with GPS ?) between the cell sites to detemine cellphone positions since the positions of the cell site antennas are well known. I suspect that if the hardware and software to do this (mostly software) is not part of the current base station that certain TLAs will pay to have it developed and implemented. Dave Emery die(a)pig.jjm.com

2 1

Re: Decline and Fall
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 8:55 AM 6/19/94 -0700, Sandy Sandfort wrote: >Chomsky's error is that he equates governments with democracy. Not true. Chomsky is an anarchist. He would never make a statement like that. Just for the record... --Dave. -- Dave Mandl dmandl(a)panix.com

2 1

MAIL: anon mailing list
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Has anyone tried to write some mailing list software that uses > PGP-anon-remailers to implement a double-blind anon system? > a standard mailing list. But has this already been done? It seems > like such an obvious idea, that it's hard to believe no one has > thought of it first, but I haven't heard of anything so far. Comments? Well, Hal Finney offered a service by which people could subscribe to an encrypted version of this list... which is something similar. Say somebody wants to run a mailing list as you propose. I think they should just run the list at the same address unless the remailers can suitably pad, delay, and randomize incoming messages and redirect them to the true list site (but then delay and randomization may lead to loss of coherency on the list ;). If not, surely external observation of the contact point will show where all the messages are headed. The resources needed would be higher than a normal list since each incoming message would need to be checked for a digital signature (or the list could become victim to an anonymous mail bomber, and you can't filter out anonymous remailers since of course everybody is using them to submit posts!), encrypted to every other member, and remailed. Which isn't to say impossible, just maybe impractical for a large mailing list. Take this list, with say 500 members - every incoming post digitally signed and arriving via anonymous remailer, and upon arrival, checked for a valid signature, encrypted with the public keys of the pseudonyms subscribing to the list;), and remailed out... This may work if you have a small group of people dedicated to this setup, but otherwise, no go. I mean, most people on this list don't even sign their posts, most don't submit via anonymous remailer, etc. It would take much work to make it convenient enough to do this. I think a higher priority is finding the bug that keeps unsubscribing everybody ;) Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLgTdeMSF/V8IjI8hAQHeTwQAjDPXzJgrwubLkxq0Kz6ETM7chR4Ci5kG XbzWrFc3jwT57xpOfHIeeTTWn73Sls7C5UsFAT1sE4hxHRZO2HG6a7psLRa5/82V bhjnW+6KMOByCZb01h4b0toVR+7vF22EzPME0lnlsW+SjBqlAcNYPb+rSnjbnahG g9zzaCL6nJ8= =1WIZ -----END PGP SIGNATURE----- -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu 2.3: 5AD633; D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 2.6: 088C8F21; 97 73 9E 8B 98 3E DD B5 E8 97 64 7E 20 95 60 D9 "One man's mnemonic is another man's cryptography" - K. Cooper

2 1

rec.radio.scanner #7670 - Re: OJ's Cellular
by smb＠research.att.com 17 Dec '03

17 Dec '03

This article, reposted with permission from rec.radio.scanner, sheds a bit of light on the topic. In article <2u47fl$18no(a)hermes.acs.ryerson.ca>, cal(a)ee.ryerson.ca (Calvin Henry-Cotnam) writes: > > I just heard an interview on the radio with a representitive from the > "umbrella group" that represents the cellular industry. He explained > how position tracking is done, and stated that call content is not > involved. A court order is needed to track position, but another court > order, presumably one more difficult to get, is needed to intercept the > conversation. The location tracking basically locates which cell site > the call is being picked up by plus monitoring of actual signal strength > which usually can get to within a mile of the location. The original poster mentioned that he's not an expert on cellular; the person he cited is from an ``''umbrella organization'' for the cellular industry in D.C.

1 0