December 2003 - cypherpunks-legacy

Re: Having your own computer means never having....
by tim werner 17 Dec '03

17 Dec '03

>Date: Sun, 19 Jun 1994 22:27:23 -0700 >From: nobody(a)kaiwan.com (Anonymous) >carterm(a)spartan.ac.brocku.ca (Mark Carter) wrote: >> Beyond that, unrestrained encryption is dangerous to corporations, because >> what's to stop a ticked off employee from encrypting everything in the >> office as revenge for some imagined slight? > >If he was pissed off and wanted revenge, he would not waste his time >encrypting it, he could just delete it, and/or steal all remaining copies. Not necessarily. One could get in the habit of keeping all one's files encrypted, decoding only the material that one has to occasionally release in order to convince one's boss that one is doing productive work on one's computer. :-) Many times when one is fired, one does not have the option of logging in one last time. The boss taps you on the shoulder, and escorts you to human resources. While you are having your exit interview, the sysadmin is disabling your account. For instance, the emacs editor has a mode (see crypt++.el) that automagically prompts for a decryption key wheneve you open a file that appears not to be pure text, in case you want to pass it through crypt before editing it. Only in the editor's buffer does it ever appear in decoded form. On the disk it is always encrypted. If one got fired unduly, one's former bosses would have to ask for the key. Of course, the usual reason peopnle get fired is incompetence, so there may not be anything worthwhile laying around anyway. tw

1 0

L.J. Freeh and the Opposition
by Dave Otto 17 Dec '03

17 Dec '03

Check out sunday's _Parade_ magazine for an article on Louis J. Freeh, the director of the F.B.I. "Tough on crime", "man of the streets", and ruthless eliminator of directors :-) If he ever throws his weight behind Clipper, the battle will get *MUCH* tougher. Dave Otto -- dave(a)marvin.jta.edd.ca.gov -- daveotto(a)acm.org "Pay no attention to the man behind the curtain!" [the Great Oz] {I *DO* have a life, it's just that my kids are using it right now!}

1 0

Re: Having your own computer means never having....
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Date: Mon, 20 Jun 1994 02:37:42 -0400 From: snyderra(a)dunx1.ocs.drexel.edu (Bob Snyder) Cc: cypherpunks(a)toad.com What to stop him/her from shredding everything in the office? Um, because desks don't *fit* in the shredder? :) Sorry about that, but this thread *is* becoming a little silly on its own. -russ <nelson(a)crynwr.com> ftp.msen.com:pub/vendor/crynwr/crynwr.wav Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | Quakers do it in the light Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0

Re: Hardware generators was: your mail
by smb＠research.att.com 17 Dec '03

17 Dec '03

How about a SCSI device instead. Most UNIX boxes and Macs nowadays have a few unused SCSI IDs. The great majority of DOS machines with SCSI (all those new ones with CD-ROMs, etc.) have unused SCSI IDs. SCSI has the advantage of being rather fast, and is a cross-platform solution. ``Cross-platform'' is great, but ``fast'' is probably a bad idea. Few random number generators are particularly fast, and if you sample the input too rapidly, you're likely to get too high a correlation between successive bits.

1 0

Re: Hardware generators
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sun, 19 Jun 94 10:50:14 EDT, Adam Shostack <adam(a)bwh.harvard.edu> writes: > Understood, but its not a matter of addressing 90% or the > other 10%, its a matter of "Is the security gain in building a card > that only hands out each number once worth cutting out 10% of the > market?" I think that if you are worried about rouge code on your > machine, you aren't going to run on a computer that can't protect its > memory from random browsing. (I can still access all of a PC's memory > from normal code, can't I?) Thus, building a PC card doesn't really > afford you a gain in security if I can use my hostile code to read > PGP's memory locations. If you agree with that, then there is no good > reason not to build a serial port dongle, and include me in your > potential customers. :) I think I'm a bit confused. Your first post suggested that I was ignoring an important part of the market, and I acknowledge that this was delibrate. Now you seem to be arguing that the paranoia that I addressed in my fourth question is justified. I'd like more backup for this, as all I have is speculation at this point. I don't know if it is paranoia or prudence. Yes, if you are running DOS/Windows, you can address the world. Sigh. And lots of other/better OS fix this, but they haven't got the market penetration. So I'm back to addressing lots of folks, or a few ones with real computers and real operating systems. I'd rather not degrade into that religion, I started with TOPS-10 and moved to Tenex... The problem with the serial port dongles are: 1) while parallel port dongels are known technology, making it work on a serial port is more problematical. 2) Most PC serial ports are junk. Getting reliable data rates above 2400 baud is non-trivial for low end PCs. If I could claim that the users had to have 16560AFN uarts, or better, then I could get decent rates, but then I lose market size. 3) PCs typically don't have a spare serial port. It is interesting that my mail is so far favoring an internal board approach. Given that, and the forthcomming Plug-n-Plan spec from Microsoft/Compaq/Intel/... and the hidious hassles of seting up IRQs, port addresses, etc. Does this suggest that a Plug-n-play board would be more attractive? The key is that they would be more expensive, at least at first. Compaq probably has the volume that can allow the cost difference to be offset by lower tech support costs. I haven't got that volume yet. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Hardware RN generators, data volume requirements
by Pat Farrell 17 Dec '03

17 Dec '03

I'm quite happy about the volume and quality of responses I've received. So here is another question: What data generation rate should we aim for? I guess I should be more precise, given that costs are usually directly proportional to data rates, what are the minimum, hoped for, and high end data rates needed? For example, Tony Patti's RANGER has a very high data rate, but is big and costs more than two cases of beer. Is a good bit a second sufficient? 100 b/s? ??? Right now, I've only generated a few of Pr0duct Cypher's magic money tokens. So if I had a daemon process collecting bits for me in the background, then 3600 per hour is plenty. I am sure that when Perry uses digicash for online trading of eurodollars, he (and his user community) will need orders of magnitude more. But I'd expect them to be willing to pay at least an order of magnitude more for the gear too. I'd like to hear grounded justification for rates, and/or a rate/dollar tradeoff. Don't worry about the exact monetary exchange rates. Estimates in bits per second per case of beer are accurate enuff for this level of design. Thanks Pat p.s. I just got up to the chapter of Bruce's _Applied Crypto_ that addresses some of the approaches to this. It really is a FAQ for serious cypherpunks. Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Anonymous Mailing list?
by Jonathan Rochkind 17 Dec '03

17 Dec '03

Has anyone tried to write some mailing list software that uses PGP-anon-remailers to implement a double-blind anon system? It wouldn't be very dificult to have a mailing list people contributed to using a remailer with a encryted address-block, so no one knew the actual address of the mailing list. Or more significantly, the mailing list, instead of keeping a list of addresses, could keep a list of encrypted address-blocks, and the proper remailer to send them to, so the list maintainer doesn't know the real address of anyone on the list. This is intriguing to me because it seems to solve the problem of a "secret" organization's security. The members of this mailing list don't need to trust anyone else on the list not to reveal their identity; no one can reveal anyone elses identity even if they wanted to. Assuming the security of the encryption (which of course can't be assumed; anyone with a sufficiently powerful comptuer and sufficient time to spend can surely break PGP, but anyway...), this mailing list would seem to be pretty much 100% secure. It would also seem desirable to have the mailing list software keep a record of all it's members public keys as well, and send out posts encrypted. As well as perhaps check signatures of incoming messages so that only legitimate list-members could contribute to it. I've been thinking of trying to write such software, perhaps by working with the procmail program from comp.sources.misc, whcih can be used to implement a standard mailing list. But has this already been done? It seems like such an obvious idea, that it's hard to believe no one has thought of it first, but I haven't heard of anything so far. Comments?

2 1

Re: Hardware generators was: your mail
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sun, 19 Jun 1994 11:24:34 -0600, Richard Johnson <Richard.Johnson(a)Colorado.EDU> writes: > > How about a SCSI device instead. Most UNIX boxes and Macs nowadays have > a few unused SCSI IDs. The great majority of DOS machines with SCSI (all > those new ones with CD-ROMs, etc.) have unused SCSI IDs. SCSI has the > advantage of being rather fast, and is a cross-platform solution. Sadly, the state of PC platform SCSI is in turmoil, at least right now. Microsoft is working hard to convince folks that Enhanced-IDE is the answer, and many CD-ROMs, big disks, etc. that are aimed at the mass market are no longer SCSI, but E-IDE. I don't think you can substantiate your claim that a "great majority of DOS machines" have SCSI. Worse, MS is pushing hard to push into Windows-for-Workgroups. Many OEMs no longer ship Windows, even for standalone PCs. They ship W4Wg. W4Wg's support for SCSI devices is a step or two down from even W4Wg 3.10. My SCSI disk setup (1.7GB Maxtor) is significantly slower under W4Wg 3.11 because MS changed things to the point that I no longer have 32-bit disk I/O. Chicago is claimed to have "better" SCSI support, but I was hoping that I could get this at least prototyped this summer. No RSN reliance on 3rd party vendors for me, thanks. Right now, SCSI is too high-end (Suns, HP, Macs, serious PCs, etc.) for the market that I have in mind. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

TV AS A SOURCE OF KNOWLEDGE
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, I just watched the latest episode of "Acapulco H.E.A.T." In this weeks show, "Codename: Ghost," the Bad Guy is a renegade CIA agent who has become an arms dealer on the Black Market. He controls his far flung organization via encrypted e-mail over the Internet. The H.E.A.T. team foils his dastardly plans by *intercepting* his e-mail and sending on *forged* messages signed with his own *code* (digital signature?). Too bad he wasn't a renegade NSA agent (or a Cypherpunk), then he might have had the good sense to use strong crypto. Yeah, I guess there must be dumb criminals who would use Clipper or the like. WHY I WATCH ACAPULCO H.E.A.T. Cheap thrills. Lots of babes in bikinis, lots of guns, lots of car chases and lots of explosions. (Subtract 2 points for Fabio.) I would kill for a night with the woman who plays "Cat" (Alison Something-or-other). WHY YOU SHOULD WATCH ACAPULCO H.E.A.T. We can see really good TV and movies again and again. If you miss it the first time, it will be back again, soon enough. The really bad stuff is gone in a heartbeat. See it now, or never see it again (unless it becomes a cult show). S a n d y

1 0

Cell phone tracking
by die＠pig.jjm.com 17 Dec '03

17 Dec '03

Mike McNally writes: > > Jef Poskanzer writes: > > It looks like at least some switches in Amerika are already equipped > > to read out locations for individual phones. > > This is not actually that surprising. All they need is to know which > phones are using a band on a cell site, and they narrow the search > down to a relatively small area. I seriously doubt that they can do > triangulation (I mean, they *could*, but there's not much likelihood > that the cellular operators would incorporate something complicated A company I am familiar with which does specialized classified interception systems for the NSA and other TLA's has built just such a system for the TLAs. It can locate a cellphone to within a few feet just as soon as it starts transmitting - it uses time of arrival techniques to triangulate the cell phone's position. How many of these are installed and where I do not know, but the technology has been developed and is in use. The system is multi-channel and can keep track of many cellphones at once - but as a practical matter it isn't hard to monitor the control channels and paging channels to locate the phone of interest and identify which of the 866 channels it is transmitting on so even simple doppler DF technology might work. Considering that the LA area is the biggest cellular market in the country it wouldn't surprise me that some of the these systems are installed there. And in the future Phil Karn's company Qualcomm's CDMA digital cellphones will provide few feet accuracy position as a byproduct of the spread spectrum receive correlator operation on every transmitting phone within range of more than one cell receiving site unless they actually aviod trying to make the measurement. Most of the time more than one cell site tracks a given phone so they can vote on which one has the stronger signal - given that each of these sites has a precise estimate of the time of arrival of transissions from each phone it takes little more than netting of the time base (with GPS ?) between the cell sites to detemine cellphone positions since the positions of the cell site antennas are well known. I suspect that if the hardware and software to do this (mostly software) is not part of the current base station that certain TLAs will pay to have it developed and implemented. Dave Emery die(a)pig.jjm.com

2 1