December 2003 - cypherpunks-legacy

Anybody heard of "The SLED"? (long)
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

On ba.internet I got a pointer to something called "the SLED", a database of e-mail addresses, and requested the info file, which is appended. While the people offering the system seem to be interested in privacy, encryption, and PGP key service, there are some strange thing about it, especially where they require *you* to identify yourself to *them* when registering your address. My comments to the newsgroup appear at the end. -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com -------------------------------------------------------------- Date: Sun, 27 Feb 1994 18:56:21 -0800 From: Stable Large Email Database <sled(a)drebes.com> Message-Id: <199402280256.SAA10575(a)drebes.com> To: mcb(a)net.bio.net References: <199402280247.SAA16850(a)net.bio.net> In-Reply-To: <199402280247.SAA16850(a)net.bio.net> Subject: Sled Info ----------------------------------- SLED : Stable Large Email Database ----------------------------------- SLED is an attempt to provide a reasonable mechanism to maintain and search email addresses for individuals and companies that make up the on-line community. SLED is intended for those who have one or more mailboxes that are generally checked on a daily basis, and are addressable from the internet. --- What does it provide? --- I. Timely maintenance of current email address: Over a period of time a person may have many different email addresses, which come and go with the changing of jobs, internet providers, schools, and so on. Maintenance also means pruning the list for those who no longer interact on-line (and are perhaps dead). II. Realistic search parameters: Current email databases such as whois & netfind provide a search granularity that is useful only if you already know the person's email address. The data set is crafted by each individual user. It can contain entries for schools, occupations, research areas, nick names, and so on. See note below on how this data is kept private. III. Protection against the enemy: SLED is intended to provide a high quality data set which provides flexibility in searching, but yields protection against the enemies of large address books. The enemy can be one of the following. - Head Hunters/Body shops - Anonymous and Fake user accounts - Commercial Junk mailers IV. A repository for PGP public keys: SLED provides an alternative to the huge, very public "public key" rings on some of the foreign key servers. (If you don't know what PGP is, don't worry.) --- How? --- It costs a few $$, and it requires the use of snail mail ( USPS ) at least once. There are several reasons for charging a small (very small in this case) fee for this service. 1. Authoritative ID. For your data to be included in the database we require that you write a personal check. For the initial sign-up, we verify that the name on the check matches the name in the database. A signed check which clears the banking system provides very good authentication. A semantic note: we don't actually wait for the check to clear. We get the check, eyeball the data, update the computer and then send the check to the bank. If the check turns out to be bogus we go back and zap you. (So you see, there is a way to get a couple days of free time.) 2. By charging a small fee, we can help offset the cost of the resources used to maintain & back up the database. With the fee structure, no one will get rich or poor, but there is an increased likelihood that this database will be around for years. 3. By tacking on a few dollars to the initial fee, we hope to discourage people who would fail to maintain their data, and then drop out of the database, then re-join, then drop out, then re-join. 4. Every 5 months (or so), we email an invoice (typically for $5.00 US) for the next 5 months of service. This invoice must be printed and sent to us, with a check, via US mail. This procedure keeps all data reasonably current ( +/- 5 months), which is about as good as it's going to get for such a remote service. The point being, you can not just write a check for $50.00 and be covered for the next 4 years. --- Well, how much does it cost? --- Fee to add your data to the database: $4.00 US Fee to maintain your data: $1.00 US / per month --- Trivia --- - The database is meant to be hold REAL names, no aliases, anonymous, or otherwise bogus id's. - In order to search the database, users must themselves exist in the database. - The dataset you enter for yourself can never viewed as a whole. You are encouraged to enter data for previous & current schools, occupations & other organizations/institutions, but a match on a single item will not reveal the others. For example, you used to work at AT&T, and now you work for IBM. If an old friend was trying to track you down, they might search on parts of your First and Last Name and AT&T. If you were found, it would only show your one line entry corresponding to AT&T. The point being that although your data might be read as a personal resume, it won't be shown that way. Of course that won't stop your nosy friend from sending you email asking where you are working now. - People keep asking why the database doesn't have fields for phone & address. No! That kind of data is too personal for a large database like this. If you want someone's address, send them email and ask for it. - The searching criteria make it really hard to use this database for something like head hunting or generating a junk mail list (this is by design). --- Interface --- The interface is via email. This allows the database to span all services (cis, prodigy, aol,...) which have gateways to the internet. Also, it allows each user to craft their data with their own editor, in a flexible time frame. Searching the database via email, while very functional, is a bit more kludgy than is desirable. A searcher accessible via telnet will be put online once we get an idea of the bandwidth & cpu needs. It would certainly be cool to have interfaces to gopher and www also. Additionally, the future will make further use of PGP (ViaCrypt PGP in our case). --- How To Start --- Send Mail to: - sled(a)drebes.com subject 'info' for a (this) text - sled(a)drebes.com subject 'add' to add yourself to SLED - sled(a)drebes.com subject 'change' to alter your data - sled(a)drebes.com subject 'search' to search the SLED - bugs(a)drebes.com To report a bug. - comments(a)drebes.com To send a comment that isn't quite a bug. --- The End --- ------------------------------------------- From: mcb(a)umberto-eco.postmodern.com (Michael C. Berch) Newsgroups: ba.internet Subject: Re: NetPages Coming Date: 28 Feb 1994 03:07:20 GMT Organization: Postmodern Consulting, San Francisco, California USA Lines: 37 Sender: mcb(a)umberto-eco.postmodern.com Message-ID: <940227.185716.mcb(a)umberto-eco.postmodern.com> References: <mcculleyCLI2AI.DI9(a)netcom.com> <2k7a3b$lhp(a)usenet.ins.cwru.edu> NNTP-Posting-Host: remarque.berkeley.edu Summary: The SLED In the referenced article, cx132(a)cleveland.Freenet.Edu (Cliff Gillespie) writes: > [Response to Aldea NetPages] > Oatmeal! Not a flame, but this a pales in comparison to what the > folks running the SLED are doing. They have a setup where you > can store & search all sorts of stuff (where you sent to school, > where you used to live, jobs, books you've written, multiple > email addresses...), but only matched items are displayed. > You can send mail to sled(a)drebes.com with info in the subject > for a summary. I requested (and read) the SLED info file and was not that impressed. First of all, you have to PAY to be included in the SLED database. It is only $5 plus $1/month, which is not a whole lot, but the problem is that will so sharply limit the number of people who list there, so the value of the database is limited as well. And there is the pain-in-the-ass factor of having to pay them every few months or so. Plus, the SLED people seem to claim to be interested in subscriber privacy (by offering PGP [future?] and making the DB hard to make into a marketing list), yet seem to be totally anal-retentive about the DB being only "REAL NAMES", to the point of REQUIRING a real live personal check from you (not cash). There is also no provision for entering street addresses or voice telephone numbers, even if you WANT to, since they claim that is much too personal. Shouldn't users make that choice for themselves? This also makes the DB that much less useful, plus you have to search it BY EMAIL only, which is slow and clunky. Thanks, but NetPages sounds more useful to me. Or even "whois", for that matter. (The SLED people also claim that to use whois you have to know someone's email address, which is completely bogus.) -- Michael C. Berch mcb(a)postmodern.com / mcb(a)net.bio.net / mcb(a)remarque.berkeley.edu --- END ---

1 0

pgp and multiple recipients
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hi, pgp allows to encrypt a message for multiple recipients by listing all recipients at the command line arguments. If there are no recipients at the command line, pgp asks for the recipient. Is there any way to give multiple recipients to this question? pgp doesn't separate on comma or space. I need this for calling pgp in a script where it is difficult to put the recipients into the command line. Thanks Hadmut

3 2

standard for stegonography?
by marc＠tanda.isis.org 17 Dec '03

17 Dec '03

Jef Poskanzer <jef(a)ee.lbl.gov> writes: > Is there a standard for stego yet? I just added stego and de-stego Given that the whole object of steganography is to hide the very existence of a message, wouldn't a standard be counter-productive? Cheers, Marc --- Marc Thibault | Any warming, global Automation Architect | or otherwise, is Oxford Mills, Ontario, Canada | welcome. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQA9AiyT2YcAAAEBgKVboQejsR2t2U70HoWOXTIqlWUCRGkTht8Yn/4kuzWby/e3 Z9tT8RHJbAx9us7QZwAFEbQdVGFuZGEgTWFpbCA8bWFyY0B0YW5kYS5vbi5jYT4= =aFhG -----END PGP PUBLIC KEY BLOCK-----

1 0

shame on the NSA!
by Carl Ellison 17 Dec '03

17 Dec '03

>From the Independent reposting by Banisar: > After nearly 50 years of electronic eavesdropping, the NSA is finding >that some widely available codes are impossible to crack. Time was when the NSA wouldn't allow such a claim to be made in the press much less make it themselves. What's happened to national pride here? Let's go back to the time when the NSA acted smug in the face of civilian encryption. Give me back my good old Amurrican Supermen! - Carl

1 0

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

i see a few problems with the use of the clipper chip. first, once in place, how will they replace it once it is compermized second, how much more will this cost the "honest" tax-payers? third, if they only use it for the trapping of and evidence of criminal type folks, what will the do with all the other neat info they are sure to pick up? fourth, if both halves, in a one key system are in the hands of the gov't what reaaly provents them from using them, without our knowing about it. also a few comments. once in place, i could do several things to make it hard to catch me i could write everything i send out in a seperate code, only send snail mail, only talk in person, steal the code keys, take the chip out of all the systems i have access to. and lets see, i could tell you i have a chip that looks liek the clipper chip, that on the first test try works. but it is really a fake, and mass produce it and sell it. without your knowing hey anything is possible. someone pointed out that the keys once used, would become less secure use by use. why not a revolving key system, or is that to hard and why did the spend over 8 million of our tax dollars, on something that congress hopefully will shoot down?? talk about balanced budgets i think there is another oxymoron to add to the list now i wish i had not voted for the ditz in office. charles the monster maker ^i am a father, you have a kid you'll know.

2 1

Re: Blacknet worries
by Duncan Frissell 17 Dec '03

17 Dec '03

D.>With all due respect....the U.S Government has PLENTY D.>of tools to go after those deemed to be violators of D.>various rules and regs...with or without Blacknet, D.>with or without encryption. D.>What other tools can be used, well... D.> D.>1. Imputed income. Try to do this some time. It is very expensive to 'net worth' someone. The CIA didn't manage in their recent case. There are 114 million 'taxpayers' in the Naked City.. D.>2. Criminal conspiracy. Elements are D.> a. two or more people D.> b. a preparatory act If they can decrypt your conspiratorial communication. Conspiracy charges are rare in the absence of an overt act. D.>3. CCE (Continuing Criminal Enterprise). If they can find out something is happening and connect disparate encrypted activities to you. D.>4. IRS-1040, Schedule B, Part III, Foreign Accounts and Trusts. D.> Except for one relatively minor loophole, if you fail to D.> report a foreign bank account, it is considered prima D.> facie evidence of tax fraud. Sound like a really bad D.> day in the making? Prosecutions are rare and are dependent on linking you to the accounts, proving the balance of the accounts, and in any case only apply to US citizens/residents. D.>5. If you have more than $10,000 in US Dollar value in D.> an offshore account, you are required to fill out a D.> special form for the IRS giving your account numbers; D.> unless you want to declare that you have more than D.> 20 such accounts, aggregating to more than $10,000. Likewise. D.>6. RICO. They got Mike Miliken using this...indeed, Barron's D.> magazine did an interesting report on RICO, with the D.> conclusion that a determined Federal Prosecutor could D.> use the law to convict a ham sandwich. Mike was not convicted under RICO. He plead to two counts of stock parking and something else. D.>7. Did you know that Federal prosecutors have a better than D.> 90% conviction rate? In the several thousand annual prosecutions out of a US population of 256 million. D.>8. HOW does one spend "magic money"? If you have bunches of D.> cash offshore, and bring it in, records are created. If D.> you buy something, potential witnesses are created. Can D.> you really expect that the clerk in wire transfer at XYZ D.> bank (who makes $6.50/hr) won't tip off someone when you D.> wire in the $20,000 to buy ...whatever? Since much of future commerce will be online anyway, why not just spend it for telecoms time, software, living expenses in a VR environment, other non-physical services. Use it overseas. Expat yourself (see the current issue of Forbes for an article on expatriation as the ultimate tax shelter. Or just get cash from your local ATM. D.>9.. Spies, criminals, and others often get in trouble due to their D.> own and others' lack of discretion. Can we really expect D.> users of a hypothetical blacknet would never drink too much, D.> never wish to impress someone, never trust someone unwisely? Lost in the noise with millions of 'violators' extant. D.>I'm all for more of it; but, I really don't think it will D.>be anything more than a minor inconvenience for law enforcement D.>and prosecutors if people engage in wholesale criminal acts. Studies show that where the perceived risk is low, people are fairly willing to violate mere regulations. Most people can tell the difference between murder and tax evasion. The Common Law recognized this difference calling one malum in se (wrong in itself) and the other malum prohibitum (wrong because it has been prohibited). In any case, since US tax laws don't apply to non resident non citizens of the US but these sorts of people will be able to fully participate in the US economy over the nets, either US citizens and residents will have to fiddle their regulatory compliance or they will lose out in competition with foreigners who can undercut them or do things Americans are prohibited from doing. Sell strong crypto par example. DCF 1993 - Perhaps the first year in American history in which the Justice Department killed more people than the Defense/War Department. --- WinQwk 2.0b#1165

1 0

Re: Blacknet worries
by Duncan Frissell 17 Dec '03

17 Dec '03

D.>With all due respect....the U.S Government has PLENTY D.>of tools to go after those deemed to be violators of D.>various rules and regs...with or without Blacknet, D.>with or without encryption. D.>What other tools can be used, well... D.> D.>1. Imputed income. Try to do this some time. It is very expensive to 'net worth' someone. The CIA didn't manage in their recent case. There are 114 million 'taxpayers' in the Naked City.. D.>2. Criminal conspiracy. Elements are D.> a. two or more people D.> b. a preparatory act If they can decrypt your conspiratorial communication. Conspiracy charges are rare in the absence of an overt act. D.>3. CCE (Continuing Criminal Enterprise). If they can find out something is happening and connect disparate encrypted activities to you. D.>4. IRS-1040, Schedule B, Part III, Foreign Accounts and Trusts. D.> Except for one relatively minor loophole, if you fail to D.> report a foreign bank account, it is considered prima D.> facie evidence of tax fraud. Sound like a really bad D.> day in the making? Prosecutions are rare and are dependent on linking you to the accounts, proving the balance of the accounts, and in any case only apply to US citizens/residents. D.>5. If you have more than $10,000 in US Dollar value in D.> an offshore account, you are required to fill out a D.> special form for the IRS giving your account numbers; D.> unless you want to declare that you have more than D.> 20 such accounts, aggregating to more than $10,000. Likewise. D.>6. RICO. They got Mike Miliken using this...indeed, Barron's D.> magazine did an interesting report on RICO, with the D.> conclusion that a determined Federal Prosecutor could D.> use the law to convict a ham sandwich. Mike was not convicted under RICO. He plead to two counts of stock parking and something else. D.>7. Did you know that Federal prosecutors have a better than D.> 90% conviction rate? In the several thousand annual prosecutions out of a US population of 256 million. D.>8. HOW does one spend "magic money"? If you have bunches of D.> cash offshore, and bring it in, records are created. If D.> you buy something, potential witnesses are created. Can D.> you really expect that the clerk in wire transfer at XYZ D.> bank (who makes $6.50/hr) won't tip off someone when you D.> wire in the $20,000 to buy ...whatever? Since much of future commerce will be online anyway, why not just spend it for telecoms time, software, living expenses in a VR environment, other non-physical services. Use it overseas. Expat yourself (see the current issue of Forbes for an article on expatriation as the ultimate tax shelter. Or just get cash from your local ATM. D.>9.. Spies, criminals, and others often get in trouble due to their D.> own and others' lack of discretion. Can we really expect D.> users of a hypothetical blacknet would never drink too much, D.> never wish to impress someone, never trust someone unwisely? Lost in the noise with millions of 'violators' extant. D.>I'm all for more of it; but, I really don't think it will D.>be anything more than a minor inconvenience for law enforcement D.>and prosecutors if people engage in wholesale criminal acts. Studies show that where the perceived risk is low, people are fairly willing to violate mere regulations. Most people can tell the difference between murder and tax evasion. The Common Law recognized this difference calling one malum in se (wrong in itself) and the other malum prohibitum (wrong because it has been prohibited). In any case, since US tax laws don't apply to non resident non citizens of the US but these sorts of people will be able to fully participate in the US economy over the nets, either US citizens and residents will have to fiddle their regulatory compliance or they will lose out in competition with foreigners who can undercut them or do things Americans are prohibited from doing. Sell strong crypto par example. DCF 1993 - Perhaps the first year in American history in which the Justice Department killed more people than the Defense/War Department. --- WinQwk 2.0b#1165

1 0

Dorothy Denning
by Anthony D Ortenzi 17 Dec '03

17 Dec '03

Well, since everyone seems to be talking about Dorothy Denning, I just thought I'd throw a few things out for discussion. Number 1, if someone is an encryption expert (as has been truly/falsely(?) claimed on this list), then why would they endorse anyone but the recipient being able to decode the message? Wouldn't the true belief in privacy be what would lead one to learn about such things? Or is it just a toy, as is surveillance? Number 2. People on this list have said that she's an expert in cryptography. When I read that damned Newsday article posted on cypherpunks, I thought that she was just a whiny college bitch. The argument was just very, well, flimsy is the word I guess. I believe that Clipper is wrong, but someone could at least write a paper that would influence more by pointing out its merits, rather than just saying that the government should start spying on all of us to stop drug deals.... Anyone know: A) Is she an expert in cryptography? B) Is she a college graduate? C) Was she dropped on her head a lot as a baby? D) Has she considered the alternatives that suicide offers? Just kind of annoyed at this whole Big Brother thing, probably because I'm reading 1984 right now... really a good idea if you haven't yet, and if you read it, they're is no way you'll possibly think that Clipper is a good idea... Also, I've gotten a message through to Ross Perot about our fight against Clipper, and how to reach me, so if I get a response, I'll let you guys know. Anthony

4 3

I have FOIA'd the Clipper Key Escrow databases
by hughes＠ah.com 17 Dec '03

17 Dec '03

Should John's FOIA request for the clipper key database work, it creates a wonderful hole in the entire key custody system. It would require a legislative act to plug the hole. This is extremely significant, since the whole clipper strategy is based on unchecked and unbalanced actions by the executive branch. No laws were passed to create clipper and no judicial review has taken place. John's request will be denied, no doubt, and will go to court. Should he prevail in court, the executive branch is bound by that decision. A key custody database which was public would make the system insecure and unusable. The executive branch could not change this. Only the legislature could. Now, how many legislators do you know that are going to make a public record by voting in favor of Big Brother? We are witnessing the genius of framers of the USA Constitution here, folks. Eric

1 0

DES Question
by Matthew J Ghio 17 Dec '03

17 Dec '03

When using DES to encrypt email addresses, the total amount of data to be encrypted would be only 3 or 4 eight-byte DES blocks. My question is: Would CBC or CFB really be effective for such a small amount of data? Or would it be better to encrypt multiple times with transpositions in between (ie '4x3' DES as was described earlier in cypherpunks)? Second question: The DES code that I have (not written by me) has a comment section which describes filling all 16 subkeys seperately, thereby allowing a 128 byte key. Is there any significant advantage to doing this? Is there any reason that I should not do it? What is the purpose of the initial and final permutations?

3 3