December 2003 - cypherpunks-legacy

Re: No SKE in Daytona and other goodies
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May "If Microsoft has never met with NIST/NSA or Denning or TIS on this matter, and was only pursuing SKE research on its own initiative, without any incentives or threats from the government, then I will withdraw my speculations and cheer Microsoft on." ................................................... And then you can say: Blanc was right all along; I really had nothing to worry about. Signed: Tim C May "We need to see a public debate on software key escrow, regardless of Microsoft's involvement one way or another. And we shouldn't wait until the press conference is held to announce the program!" ....................................................... I would like to see more explanations on key escrow, myself. To me, the issue is control: who gets it, who excercises it, who will try to prevent an individual from their right to exert it. How does the mere existence of a system of key escrow necessitate that no one will ever again have the means to secure their privacy? I do understand the difference in the situation of an individual in a corporate environment using a given software environment, vs the individual at home with their own pc trying to access the internet & send email. But you all write code: you have ideas on how to deal with this, right? Do you think that having created a means to an end, that it will be impossible to retain ownership and control of it? In the present political atmosphere, there are many ownership issues being threated. The government's position is to take away the means to an end, thereby preventing the whole problem of having to think about who has the right to use it or not. Do you think that preventing companies from implementing their own key escrow schemes, this will eliminate the problem of having to fight with the government over the keys? Blanc

3 2

penet hack
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Does anyone know what all these names have in common? These are some of the userids that the person hacking penet has been trying to find. They don't all look like either cypherpunks or usenet crypto people to me. G angilong(a)bach.seattleu.edu angilong(a)bach.seattleu.edu archer(a)elysium.esd.sgi.com armond(a)delphi.com anon09e3(a)nyx.cs.du.edu aross(a)oregon.uoregon.edu asg(a)jupiter.sun.csd.unb.ca asuter(a)Xenon.Stanford.EDU aw54(a)aol.com barrett(a)iastate.edu best(a)anasazi.com bjeffrey(a)crl.com brooking(a)lynx.navo.navy.mil cj419(a)aol.com ckalina(a)gwis.circ.gwu.edu cjburke(a)io.com clamen(a)CS.CMU.EDU conover(a)max.tiac.net deniero(a)ace.com blackadd(a)news.delphi.com c_robert(a)sacam.OREN.ORTN.EDU christopher.klepacz(a)daytonoh.ncr.com eba(a)netcom.com dsm(a)iti-oh.com dtwede(a)med.umich.edu dw627(a)cleveland.Freenet.Edu dspiegel(a)oucsace.cs.ohiou.edu ecsd(a)well.sf.ca.us 133an(a)ppsdev1.sch.ge.com mwilson(a)ncratl.AtlantaGA.NCR.COM barbose(a)netcom.com 1l26coop(a)bnr.ca 8226(a)suzie.tccn.com 860099w(a)eagle.acadiau.ca AHALL@FMRCO.COM@roundtbl.sccsi.com AXSDL(a)ASUACAD.BITNET =o=(a)remarque.berkeley.edu 895822ja(a)cent.gla.ac.uk 1l26coop(a)bnr.ca Bill.Wenzel(a)f1571.n363.z1.fidonet.org C476014(a)mizzou1.missouri.edu af786(a)cleveland.Freenet.Edu acm(a)kpc.com ecsd(a)well.sf.ca.us eddy(a)crl.com ed(a)twain.ucs.umass.edu eeyimkn(a)unicorn.nott.ac.uk ejh(a)larry.gsfc.nasa.gov edward.rhodes(a)nccbbs.network23.com eris(a)bga.com energia(a)uxa.cso.uiuc.edu ablow(a)mentor.sdsu.edu etc(a)po.CWRU.Edu/hj ejohnso8(a)mason1.gmu.edu ag848(a)cleveland.Freenet.Edu elliott(a)medea.princeton.edu elyse.zois(a)syncomm.com evansmp(a)mb52112.aston.ac.uk eeb1(a)kimbark.uchicago.edu evansmp(a)mb52112.aston.ac.uk ewill(a)wv.mentorg.com elcid(a)iastate.edu adrianrc(a)astro.ocis.temple.edu exutpsc(a)exu.ericsson.se fallous(a)ksu.ksu.edu ez022854(a)dale.ucdavis.edu evrwrite(a)powergrid.electriciti.com etellefsen(a)lehman.com eylerjs(a)ctrvx1.vanderbilt.edu farthing(a)leland.Stanford.EDU fergie(a)netcom.com felinoid(a)ccnet.com fishe(a)casbah.acns.nwu.edu foleye(a)viper.CS.ORST.EDU flash(a)austin.lockheed.com etc(a)po.CWRU.Edu frazzle(a)aol.com fjc(a)gracie.atl.hp.com fsjsd(a)acad3.alaska.edu fwp(a)fwpbbs.mcs.com gails(a)denebs.cray.com fwells(a)pmafire.inel.gov gannon(a)sbphy.physics.ucsb.edu garvin+(a)pitt.edu gibson(a)bmrl.med.uiuc.edu ggentry(a)kuhub.cc.ukans.edu guenther(a)kirk.fmi.uni-passau.de jbrown(a)apollo3.com jks2x(a)fermi.clas.Virginia.EDU jmc3k(a)honi2.acc.Virginia.EDU ajc1(a)mail.ast.cam.ac.uk jar41610(a)uxa.cso.uiuc.edu kenh(a)YaleADS.CIS.Yale.Edu lange(a)dseg.ti.com ahall(a)fmrco.com ak8188(a)albnyvms.bitnet ak877(a)cleveland.Freenet.Edu fj(a)cwi.nl lee(a)g1.rmc.ca

2 1

Re: Catch-22
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

> United States Department of State > Bureau of Politico-Militart Affairs > Office of Defence Trade Controls That's interesting that they went to the effort to track you down. Do you have any idea of how they found out about your package? Was that the one that started all the fooferaw on sci.crypt with PRZ upset about someone shipping a modified version of his program? I doubt very much they tracked him down. I imagine some two-faced back-stabbing shit on sci.crypt or cypherpunks shopped him. I didn't agree with his attitude over the PGP hacks either, but this sort of in-fighting is just going too far. I hope some FOIA someday turns up the name of the back-stabbing bastard. Personally I have a shortlist of two. G

2 1

Re: Just say NYET to kneejerking
by Blanc Weber 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" Graham Toal says: > > Don't be such a condescending shit. We read your post clearly enough, > thank you very much. Typical control-freak crap. If you want your > little xtian kids to be namby-pamby'd on the net, I believe Graham is being rather rude. ....................................................................... I myself do not find Graham's rudeness offensive, as long as it's funnier than Perry's. Blanc

1 0

Just say NYET to kneejerking
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

I must admit that I'm disappointed. I figured that I would take some hits, but for people to only scan a post before reaching for the lighter... Highlights of the post: 0- I'm a pro-elctronic privacy religous rightist. (Someone didn't even get THAT right...) 1- We are rapidly approaching a point that there will be a broad-based demand for censorship. If the net is to survive in a recognizable form, we have to head this off. Specifically, BBS sysops have been drug into court on porno or aiding the deliquency of a minor charges. I advance the proposition that we need to establish a system that will allow sysops to be able to brush these attacks off. 2- The censorship that I advance is censorship _by parents_ _for their own children_. Only. People have talked about cable boxxes and telephones. Are you not aware that many cable companies offer boxes with a (physical) key that must be present in order for certain channels to come through? That the phone companies currently allow customers to disallow outgoing 900 calls? My idea is to implement a net-equivalent system--household by household determination of what will be allowed into their homes. 3- In this system, the work to determine which parts of the net to allow/ disallow access to falls entirely on the parents. 4- I believe that this system could be used to gain the protection sysops deserve. Look at the system. Imagine you were trying to sue/prosecute a sysop who utilized such a system. One what basis could you attack? All decisions to allow access were determined by the parent. The sysop genuinely attempts to verify that adults are adults. Let me repeat. This system is an attempt to cut of an almost certain attempt by some to censor the net. If we can get this in place, if we can get legislatures to recognize the system, we should be able to defeat censorship attempts by people who, from the net's point of view, are on the margins of society, but, from the nations point of view, are only slightly "right" of center. For those of you who wish to attack me on this, I must insist that you read my proposal, _in its entirety_. I am re-posting the article in case you deleted it. I want the net to continue to function as is, with further extensions. I want to be able to let my kids (when I have them) on this same net, w/o being asked "What's bestiality?" I am not about to demand that net users modify their behavior to accomdate me. I want a system in place so that sysops aren't forced to constantly overlook their entire system in order to avoid legal hassles. Nathan A nation that fears guns in the hands of its citzens.... should.

4 3

FW: No SKE in Daytona and other goodies
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May "If Microsoft has never met with NIST/NSA or Denning or TIS on this matter, and was only pursuing SKE research on its own initiative, without any incentives or threats from the government, then I will withdraw my speculations and cheer Microsoft on." ................................................... And then you can say: Blanc was right all along; I really had nothing to worry about. Signed: Tim C May "We need to see a public debate on software key escrow, regardless of Microsoft's involvement one way or another. And we shouldn't wait until the press conference is held to announce the program!" ....................................................... I would like to see more explanations on key escrow, myself. To me, the issue is control: who gets it, who excercises it, who will try to prevent an individual from their right to exert it. How does the mere existence of a system of key escrow necessitate that no one will ever again have the means to secure their privacy? I do understand the difference in the situation of an individual in a corporate environment using a given software environment, vs the individual at home with their own pc trying to access the internet & send email. But you all write code: you have ideas on how to deal with this, right? Do you think that having created a means to an end, that it will be impossible to retain ownership and control of it? In the present political atmosphere, there are many ownership issues being threated. The government's position is to take away the means to an end, thereby preventing the whole problem of having to think about who has the right to use it or not. Do you think that preventing companies from implementing their own key escrow schemes, this will eliminate the problem of having to fight with the government over the keys? Blanc

2 1

(fwd) Re: Surveillance Equipment... (fwd)
by Jim choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: Just say NYET to kneejerking
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199407291601.JAA28808(a)sleepy.retix.com> joshua geller writes: > > The Internet is a wild and exciting place. You want your children to > > get to know it. But you would also like a way to build little fences > > between them and some things that they are just too young to deal with. > > How do you do it? > > I don't guess I rightly care how you raise your kids as long as you > don't to interfere with what I want to do in the process. if you don't > have sufficient authority over your children to prevent them from doing > that which you do not want them to do, sorry, this is not my problem. My little fences are on my land. If you cross over my little fences, so are you. I think that what I was trying to politely suggest is that the proper place for the proposed access restrictions is not out there on every system on the Internet, but instead on your own system. Politeness rarely does any harm. -- Jim Dixon

1 0

No Subject
by xentrac＠enzu.unm.edu 17 Dec '03

17 Dec '03

Path: lynx.unm.edu!jobone!newsxfer.itd.umich.edu!europa.eng.gtefsd.com!howland.reston.ans.net!usc!elroy.jpl.nasa.gov!decwrl!waikato!auckland.ac.nz!news From: pgut1(a)cs.aukuni.ac.nz (Peter Gutmann) Newsgroups: alt.security,comp.security.misc Subject: SFS 1.08 beta released Date: 18 Jul 1994 13:41:41 GMT Organization: University of Auckland Lines: 76 Sender: pgut1(a)cs.aukuni.ac.nz (Peter Gutmann) Message-ID: <30e0ql$743(a)ccu2.auckland.ac.nz> NNTP-Posting-Host: cs13.cs.aukuni.ac.nz X-Newsreader: NN version 6.5.0 #7 (NOV) Xref: lynx.unm.edu alt.security:17535 comp.security.misc:10445 I've just released the latest beta of my encrypting filesystem software. Hopefully this will be the final beta before the full release. It's available from: ftp.informatik.uni-hamburg.de (134.100.4.42) as: /pub/virus/crypt/disk/sfs_108.zip Version 1.08 fixes a number of minor problems which cropped up in the 1.07 beta. The SFS release announcement follows. Peter. SFS (Secure FileSystem) is a set of programs which create and manage a number of encrypted disk volumes, and runs under both DOS and Windows. Each volume appears as a normal DOS drive, but all data stored on it is encryped at the individual-sector level. Encrypted volumes can be loaded and unloaded as required, and can be quickly unloaded with a user-defined hotkey, or automatically unloaded after a period of inactivity. They can also be converted back to normal DOS volumes, or have their contents destroyed. The documentation includes an in-depth analysis of various security aspects of the software, as well as fairly complete design and programming details. SFS has the following features: - The current implementation runs as a standard DOS device driver, and therefore works with both plain MSDOS or DRDOS as well as other software such as Windows, QEMM, Share, disk cacheing software, Stacker, JAM, and so on. - Up to five encrypted volumes can be accessed at any one time, chosen from a selection of as many volumes as there is storage for. - Volumes can be quickly unmounted with a user-defined hotkey, or automatically unmounted after a certain amount of time. They can also be converted back to unencrypted volumes or have their contents destroyed if required. - The software contains various stealth features to minimise the possibility of other programs monitoring or altering its operation. - The encryption algorithms used have been selected to be free from any patent restrictions, and the software itself is not covered by US export restrictions as it was developed entirely outside the US (although once a copy is sent into the US it can't be re-exported). - SFS complies with a number of national and international data encryption standards, among them ANSI X3.106, Federal Information Processing Standard (FIPS) 180, Australian Standard 2805.5.2, ISO 10116:1991 and ISO 10126-2:1991, and is on nodding terms with several other relevant standards. - The documentation includes fairly in-depth analyses of various security aspects of the software, as well as complete design and programming details necessary to both create SFS-compatible software and to verify the algorithms used in SFS. - Reasonable throughput and size. One beta-tester has reported a throughput of 250 K/s for the basic version and 260 K/s for the 486+ version on his 486 system when copying a file with the DOS copy command from one location on an SFS volume to another (I get about 160 K/s on my vanilla 386 box). The resident portion requires 6.5K of memory, and can be loaded high if desired. - Direct access to IDE and SCSI drives is available for better performance and for drives which aren't normally accessible to DOS (for example systems with more than 2 hard drives). SFS 1.1 is a maintenance release which fixes a few minor problems in 1.0, and adds a number of features suggested by users (the current release is a the 1.08 beta). More details on changes are given in in the README file.

1 0

NYET to censors, REPOST
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

For those of you who didn't read it all last time... Copyright 1994, Nathan Zook. All rights reserved. Intelectual copyrights pending. NYET-- Non-Youths Exhibit Temperance. Before I start, it may be informative to consider that I consider myself to be a hard-line member of the Christian Conservative movement, and a hard- line advocate of electronic privacy. I am a PhD candidate in mathematics at the University of Texas of Austin, and I got the Electronic Privacy language added to the 1994 Republican Party of Texas platform. I am a member of Trinty Evangelical Free Church, and am twenty-seven years old. As the Internet community continues to grow, the differences of conviction that exists generally in the world find their way into the community. Some demand that newcomers to the net adapt to the mores of this society. Some demand that the net, as a newcomer to the world, adapt to the outside. As recent events have demonstrated, the less reasonable, on both sides, may be endangering the integrity and availablity of the net. Calls for net censorship, it may be expected, will continue to grow unless the net can find some way to police itself. Yet "police itself" is a term that sends the net into fits. My solution, NYET, is for the appropriate users to directly censor the data that they might legitmately lay claim to censoring--data that flows to minors over which they have legal authority and responsibility. Specifically, this is a plan to create two sorts of accounts to the net-- adult and minor. Adult accounts may only be obtained by persons of age eighteen. Minor accounts may only be obtained as adjuncts to adult accounts, refered to as supervisor accounts. Adult accounts would have full access to anything on the net. News readers, telnet, ftp and like software being operated from a minor account would check a file in the adult account to allow access. Newsreaders, in particular, would censor any posts crossed from a non-allowed account. The control files in the supervisory accounts would default to allow-only mode, but could be selected to deny-only. The legal framework that I see important in aiding such a system is as follows: State Level: 1) Declare to hold harmless those BBS operators for charges of Contributing to the Delinquacy of a Minor that obtain and verify the age of account holders, and maintain a NYET system of access for minors. Certain acceptable verification methods specified, with authority to add methods delegated to a regulatory agency. Emphasis to be on ease and speed of verification. Special consideration for in-house systems. 2) Make it illegal to misrepresent age and name data to a BBS. Require BBS operators to maintain a record of age and name of account holders for thirty days after opening of account for hold harmless agreement, and allowing deletion of said data afterwards. 3) Declare aiding in tampering with NYET system to be "Contributing to the Delequency of a Minor". Federal Level: Pass paralell laws for BBSs operating with local numbers from two or more states, or for BBSs operating with 800 numbers. I believe that such a system would protect the full free expression currently enjoyed by the net, while reaffirming parental responsibility in the upbringing of their children. The burden of controlling access devolves all the way to the parents, making charges against BBS operators patently frivolous. Porno charges would then be MUCH more difficult to press, since a jury could be told that specific steps were being taken to prevent access to minors. If parents complained that they didn't want to go to the trouble of spelling out what their children could access, the response is clear: "Oh, so it's not worth the effort to you?" Despite slurs in this group to the contrary, I believe that the proposed us.* heirarchy may well be the first in a series of attempts to censor the net. Remember, we already have had a censor for TV, movies, and radio. It is not really a question of _if_ but _who_ and at _what level_ will this censoring take place. Nathan (Adjusting flame gear)

4 3