December 2003 - cypherpunks-legacy

RE: FW: A third voice re: science and spirit
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Subj: FW: A third voice re: science and spirit > OOps - sorry, I sent that message to the wrong list. > > Ingore, ^^^^^^ > delete, > forget it. > > Blanc "Ingore"? Is that anything like an "AlGore"? Is that a verb to describe the state of the country, as in "we've just been INGOREd"?

1 0

Van Eck Detection
by Martin Spellman 17 Dec '03

17 Dec '03

> > To: cypherpunks(a)toad.com > > > > I've heard rumors through the years that CIA/NSA/whoever can aim a > > parabolic antenna at your window, read the electronic pulses > surrounding> your computer, and thusly determine what you are typing. > Is there any> truth to this? > How far away, and whether a van parked a block away can do it, is > unknown to me. There are people on this list who have done > this...perhaps they can comment anonymously. > > Note that the TEMPEST spec for shielding equipment is directly related > to this. In Britain we have 'TV detector Vans'. These are to detect licence evaders (you need to pay an annual licence for the BBC channels). They are provided by the Department of Trade and Industry. They use something like a small minibus and use Van Eck principles. They have two steerable detectors on the van roof so they can triangulate. But TV shops have to notify the Government of buyers - so that is the basic way in which licence evaders are detected. I read of a case on a bulletin board where someone did not have a TV but used a PC. He got a knock on the door. They said he appeared to have a TV but they could not make out what channel he was watching! Martin Spellman <mspellman(a)cix.compulink.co.uk>

1 0

Mysterious Deaths was: J.Bidzos life threatened
by Martin Spellman 17 Dec '03

17 Dec '03

> gtoal(a)an-teallach.com (Graham Toal) wrote: > Several years ago lots of British scientists died under > mysterious circumstances. They were generally described as > 'defence scientists' but what a significant number of them had > in common was work in the area of surveillance. Several of > them were connected to UK's system X. (One UK govt official was found dead in > his hotel room in an arab country while there at a trade fair > in an unofficial capacity helping to promotye system X). For those who want to follow this up a bit more there was a book published in 1990: 'Open Verdict - An Account of 25 mysterious deaths in the defence industry'by Tony Collins ISBN 07474 0146 2 Publisher Sphere Books Well worth reading if you can get hold of it. Collins picked up this story when he was a journo with 'Computer News' in England. He later became Executive Editor of Computer Weekly. It all happened in the mid 80s and most of those involved were computer programmers. 28 cases are dealt with in the book and there may have been more (or less) as much of the evidence is circumstantial and all may not have been connected. Collins reckons it has more to do with Electronic Warfare(EW) or C3i than digital exchange surveillance. Although System X was apparently a key component of IUKADGE (Improved UK Air Defence Ground Environment) an early warning system. The backbone for this was UNITER - a comms system to link over 100 USAF and RAF bases around the world. Many of the people worked for GEC Marconi and GEC Plessey (the main System X contractor). Jonathan Wash, fell from a hotel balcony in Abidjan, capital of the Ivory Coast, West Africa, on 19 November 1985, shortly after expressing a fear for his life. He was working for Telconsult, a subsidiary of BT (the telecoms transnational which is also a major defence contractor). He was helping the government there assess bids for a digital exchange contract. Some of the others that died worked for GCHQ, the junior partner of the NSA.Some of the deaths were very odd, to say the least! and some were not fully investigated as murder was not suspected. It is an inviting field for conspiracy theorists. Hilda Murrell, whose death may be linked to our nuclear power industry was also killed around this time (24 March 1984). System X was delayed for a long time and one rumour was that they had designed the basic exchange OK - the problems lay with doing all the 'other bits' that went into it.

1 0

Privtool ("Privacy Tool") Beta release
by Mark Grant 17 Dec '03

17 Dec '03

Hi, recently a few people have been asking about PGP-aware mail programs for X-Windows, and I thought they might be interested in the one that I've been hacking together over the last nine months. At the moment, the Beta release is available from ftp.c2.org in /pub/privtool as privtool-0.80.tar.Z, and I've attached the README.1ST file so that you can check out the features and bugs before you download it. Currently the program requires the Xview toolkit to build, and has only been compiled on SunOS 4.1 and Solaris 2.1. I don't think that there should be any ITAR problems as there is no actual cryptography code in the program (you need a copy of PGP and ideally a copy of PGP Tools to run it), however as I'm not a lawyer and I'm in Europe anyway, if anyone in Europe is willing to make it available on an FTP site, contact me and I can upload it there. Also, if anyone wants to collaborate on a port to Xt, Motif, Windows etc, or knows how to fix some of the Xview funnies, mail me at mark(a)unicorn.com. I'm going to be off the net for most of the next two weeks, so don't expect a fast response in the immediate future. Mark Grant P.S. People wanting to integrate PGP with other programs might be interested in the pgplib.c and support files in the Privtool source, which give a high-level C interface to encrypt/decrypt/sign/verify messages, either calling PGP Tools or (on Unix) forking off a copy of PGP and examining the messages it prints out (though I haven't tested this with 2.6, only 2.3a). You're free (within the terms of the GPL) to use it in your own applications if it's of use to you (it only took me a couple of hours to add decryption/signature verification to Pine, for example). --- Privtool Beta Release @(#)README.1ST 1.9 6/31/94 ----------------------------------------------------- Privtool ("Privacy Tool") is intended to be a PGP-aware replacement for the standard Sun Workstation mailtool program, with a similar user interface and automagick support for PGP-signing and PGP-encryption. Just to make things clear, I have written this program from scratch, it is *not* a modified mailtool (and I'd hope that the Sun program code is much cleaner than mine 8-) !). When the program starts up, it displays a list of messages in your mailbox, along with flags to indicate whether messages are signed or encrypted, and if they have had their signatures verified or have been decrypted. When you double click on a message, it will be decrypted (requesting your passphrase if neccesary), and/or will have the signature checked, and the decrypted message will be displayed in the top part of the display window, with signature information in the bottom part. The mail header is not displayed, but can be read by pressing the 'Header' button to display the header window. In addition, the program has support for encrypted mailing list feeds, so that if the decrypted message includes another standard-format message it will replace the original message and be fed back into the display processing chain. When composing a message or replying to one, the compose window has several check-boxes, including one for signature, and one for encryption. If these are selected, then the message will be automatically encrypted and/or signed (requesting your passphrase when neccesary) before it is sent. Being an Beta release, there are a number of bugs and nonfeatures : Known Bugs : Message list scrollbar often set to stupid position when loading a mail file. When you save changes to the mail file, it throws away the signature verification and decrypted messages, so that the next time you view a message it has to be verified or decrypted again. 'New mail' indicator in icon does not go away if you open the window and close it again without reading any messages. Known Nonfeatures : Currently if you send encrypted mail to multiple recipients, all must have valid encrpytion keys otherwise you will have to send the message in plaintext. Also, the message will be sent encrypted to all users, not just the one who is receiving each copy. 'Add Key' button is enabled and disabled as appropriate, but does not do anything ! A number of other buttons and menu items do not work either. Passphrase is stored in ASCII rather than MD5 form, making it easier for hackers to find if you're on a multi-user machine (of course, you shouldn't be, but many of us are). Kill-by-subject does not work. Ignores Reply-To: lines, and could probably do with an improved mail-reading algorithm. Only one display window, and only one compose window. Message List window code needs rewrite. Code should be more modular to assist with ports to Xt, Motif, Mac, Windows, etc. Not very well documented ! Encrypted messages are saved to mail files in encrypted form. There is currently no option to save messages in decrypted form. No current support for remailers and pseudonyms (this will be added for the final release). Not very well tested on Solaris 2.x. Privtool can be compiled to either use PGPTools, or to fork off a copy of PGP whenever it is needed. There are also a number of different security level options for the passphrase, varying from 'read it from PGPPASS and keep it in memory' to 'request it every time and delete it as soon as possible', via 'request it when neccesary and delete it if it's not used for a while'. See the README file for information on compiling the code, and the user.doc file for user documentation (the little that currently exists). You should also ensure that you read the security concerns section in user.doc before using the program. Mark Grant (mark(a)unicorn.com)

1 0

ACAPULCO H.E.A.T.
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, Today's episode was, "Codename: Feminine Intuition." The Bad News: No crypto The Good News: No Fabio Gooder News: Lots of shots of Alison Armitage in swim suits. S a n d y

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

bmorris(a)netcom.com (Bob MorrisG) writes: > I've heard rumors through the years that CIA/NSA/whoever can aim a > parabolic antenna at your window, read the electronic pulses surrounding > your computer, and thusly determine what you are typing. Is there any > truth to this? If this is a reference to the TEMPEST attack, yes, they can. From what I hear, it's trivially easy for them to do, because they have The Right Equipment. Rumor also suggests that that The Right Equipment isn't so difficult to come by. I don't pretend to understand the intricacies of TEMPEST, but I do know that the government requires all of their computers (used at any level of security above none) to be TEMPEST shielded. This tells us its a real concern. There are other ways to beat TEMPEST, like making it damn near impossible to get close enough to the computer in question to get a reading. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

4 3

Re: Password Difficulties
by smb＠research.att.com 17 Dec '03

17 Dec '03

I'm not a touch typist (although I am also not quite a hunt-and-peck typist, either). And using only about 6 fingers (well, I am counting both thumbs in this count, and sometimes I use my other fingers as well) I have no problems typing in my long (40-50 char) pass phrase! However, I am a computer geek (well, I prefer to be known as a nerd, but I have Nerd Pride, so... ;-) Anyways, I have a feeling that Steve's testing was done with non-computer-geek-type people. I.e., secretaries, managers, and high-up muckety-mucks. Is this true, Steve? What was your sample space in your research? My tests were informal. The target was mostly taken from the sci.crypt readership -- I don't deal much with management... The initial tests were on passphrases of lengths from 12 to 20, as I recall. The phrases were created by chosing random words from /usr/dict/words -- and the resulting pass-phrases were exceedingly weird, which may have contributed to folks difficulty in typing them. Not that the scores were bad, but they weren't great. Access was by telnetting to a special port (or was it a special login? I forget). All and sundry are welcome to participate. Anyway, I never had a chance to follow up, since I was distracted by the book I was writing. That's done, and I'm getting back to research (though I'm thinking of starting another book this fall...). Rerunning the experiment, using longer passphrases, is high on my list; there's some chance I'll be getting to it this summer, along with a student who's working for me. (We're currently working on another project of interest to this audience; the paper will be available for ftp when it's ready, though that's still a couple of months off.) --Steve Bellovin P.S. For the record -- I've been a touch typist for >30 years, as appalling as that number sounds. And secretaries are likely to be *better* typists, not worse. My concern for folks typing ability was just that: concern. We don't *know*. We do know that lots of folks aggressively pick bad passwords; it isn't at all clear to me if the problem is typing, memory, or both. Passphrases will tend to exacerbate both problems.

3 2

Re: PC Expo summary!!
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 10:26 AM 7/3/94 -0700, Timothy C. May wrote: > >About the "Copyright Cypherpunks" blurb: > >Had that been an interview I gave, I'd've been pissed off to see >someone else attach the "Copyright Cypherpunks" blurb on my words. >Even with my permission (and I assume Dave Mandl and Perry Metzger >were asked for permission), attaching the words "Copyright >Cypherpunks" is misleading: Cypherpunks are not an organized group. >Issuing things in their name creates a misleading impression....and >might, very unlikely though it is, create some kind of legal pressures >on us. (An advantage to our disorganization is that governments can't >find anyone to prosecute for the crimes of the "group.") Just for the record: I discussed the transcript with RAR (though I didn't see it) before he posted it. I made it clear that anything he did with it was OK with me. The "copyright" issue is funny: Personally, I generally anti-copyright things like that. I didn't even notice the "copyright" when I quickly skimmed the transcript (which is all I've had time to do--just checking to see whether I'd made any obviously bone-headed statements). I assume it was meant kind of tongue-in-cheek, and nothing more; I agree that it might call undue attention to the group and piss off list members who don't want that transcript representing them. That's perfectly reasonable. Again, far as I'm concerned, I'd rather the "c" word just didn't appear. Yeah, it may not be the best piece to distribute to the general public since, as Perry pointed out, this was specifically an anarchist talk. The audience consisted mainly of people who already consider themselves anarchists and would therefore be interested in these new developments from that perspective. Don't know how much sense it makes to people who don't accept that to begin with. Personally, I usually don't shy away from using blatantly political language when I think it's necessary or appropriate, regardless of the audience (on my radio show, for example), but I can see how people might think it's counter-productive here. As far as distribution goes, I'm glad it was posted to the list, at least. Beyond that, anything that's OK with Perry is OK with me. But there's no reason that all list members should be blamed for that talk. It was just me and Perry, speaking for ourselves. One more thing: If anyone were to _charge_ anything for copies of that transcript beyond a reasonable "handling" fee, I'd be REALLY mad. That doesn't include Perry, of course, but I doubt that he's considering making his fortune off that anyway. --Dave. -- Dave Mandl dmandl(a)panix.com

2 1

Re: Password Difficulties
by smb＠research.att.com 17 Dec '03

17 Dec '03

I wonder how much the success that I (and apparently others) have with long pass phrases is due to the fact that we pick our own sentences which have some meaning (presumably) to us. Yes, that is an issue. I attempted to compensate for that by not turning off echoing. This way, if you pause in the middle, you'll be able to see where you are.

1 0

Re: Password Difficulties
by Hal 17 Dec '03

17 Dec '03

(I tried posting on this a couple of days ago, but I never saw the message. Apologies if this is a rehash.) Kent Borg makes a good point that our 128-bit IDEA keys are generated by pass phrases of typically a few dozen bits. He suggests doing things to slow down the process of turning a pass phrase into a key, perhaps by iterating MD5 multiple times. A similar thing is done in the SecureDrive software as well as in RSA's Public Key Cryptography Standards (PKCS). The problem is that this doesn't help all that much. If you slow down the process by, say, a factor of 1000, that is about equivalent to adding 10 bits of entropy to the pass phrase (either way would slow down the searcher by that much). 10 bits is perhaps nothing to sneeze at but it doesn't really solve the problem. I suspect that Kent is right that most pass phrases don't have over 50 or 60 bits of entropy, far below the 128 bits of protection that we like to think IDEA is giving us. Hal

1 0