December 2003 - cypherpunks-legacy

FOUR TIMES AROUND THE WHEEL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Today is my birthday. I've circled the Chinese zodiac four times--from Year of the Dog 1946, to Year of the Dog 1992. This has not been a good year. Write something nice to me. I need all the encouragement I can get. S a n d y "The Old Dog" S a n d f o r t ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

art encryption...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by lile(a)art.net (Lile Elam) on Mon, 19 Sep 0:11 AM >So, I have been thinking that a way an artist can >insure a viewer that the art they are viewing is really >that of the artist, the artist can *sign* their art >with their private key and others can check it with >their public key. Now, the art would be factered into >the key generated that others would check with the >public key. > >So, a image file (gif, jpeg, tiff whatever) would be >run through a encryption coding that would generate a >signage based on the artist's image and their private >key. The image would remain unchanged. Then viewers >could run the same encyription coding on the image and >apply the artist's public key to see if it really *is* >their work.... As a parallel to your inquiry I offer: Thanks to help from this list my firm uses PGP to encrypt, sign and verify CAD architectural documents exchanged with consultants and clients. We also conceal ID in the documents by a simple steganographic method using combined PGP and CAD posted here a few weeks back, which is not revealed to the recipients, as a check on authorized use and distribution. Any suggested improvements would be welcome. John

1 0

Re: DC-Nets and sheep
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Rishab Aiyer Ghosh <rishab(a)dxm.ernet.in> writes: >Doug goes on to suggest that to be immune from the "sheep^H^H^H^H^Hpeople" >DC-Nets will have to have millions of members. But if anon remailers were used >by millions, than they'd be immune too. All crypto is vulnerable to mob action >until it's widespread. I think that there is an important difference between the case of anonymous remailers and DC-Nets. Even if millions of people were using anonymous remailers, it would still be the case that the remailer itself would provide a single, isolatable target for control. Although it might not be politically popular to force the remailer out of operation, the actual mechanics of doing so could be relatively simple. The strength of DC-Nets lies in their distributed nature. There is no single target for control which can be isolated from the rest. Even without millions of members, a DC-Net gains strength through cooperation... to effectively target it, all of the members of the net must be targeted in some sense. Whether the actual technology used is a DC-Net or something fairly different, the basic principle of replacing single targets with large cooperating groups seems to hold promise. Doug

1 0

A Scenario
by Anonymous User 17 Dec '03

17 Dec '03

Anonymous User scripsit >> >> Let's say I have a digital cellular phone. I also have Anonymous Remailers, >> PGP, and over 100 BBS numbers (structured for which day and which hour each >> would be used) so that I can contact and talk to my "Friend." >> Please tell me how the LEA's can find me and understand the transactions >> between us? >You don't give us enough information. >Are your attackers looking for known parties? >How secure is your cellular? Do you operate from a known or a guessable >location? Is your "Friend" known? Suspected? His location, guessable? >Known? >If your location were known it would be a simple matter to monitor >the area, say put a van just outside your site and wait for cellular >activity of a strength that suggests your presence. How likely would it >be that someone else is using a cellular phone in your presence? Given >this, it is probably not difficult to obtain the billing/ESN number for >your phone, and then obtain detailed traffic information about your >transmissions. Given that it is a simple matter to conduct a lower tech >attack, say tempest, and pick up the conversation as you compose it, end >running the encryption so to speak. You think in too shallow a fashion. >Security is about more than communications security. >Even if yours is perfect, how about your friends. A tempest attack on >his site while he is using Word for Windows is just as effective as one >on you. >Modify this tactic to use a phone which uses several different ESN's at >random or move your location often and at random. >> >> If I have several encryption programs, can I 'layer' each document [I PGP the >> file, the I DES the PGP file, then IDEA for the final layer. >Worthless given the above attack. >> Does the NSA have to crack it one layer at a time, or can they bombard it, >> crack the layers in whatever order the supercomputer finds? >Again, unimportant given the cheaper low tech solution. >> If I am missing something, please let me know what I have missed. >Been there, did that. >-uni- (Dark) In the above scenario, I would never use my voice over the digital cellular [and I would be always moving {nothing done at home}]...strictly PGP/E-Mail. Even IF the parties are known, can they make their case? [How can they prove X sent Y if using PGP and anonymous remailers?] Of course, if one of them cooperates, that's different. Can Tempest be used as I'm driving/on a city bus? How expensive is it to maintain a Tempest surveillance in this fashion? This is a positive of portable computers and portable communications..no one can pinpoint [even remotely] where I'll compose/collect my pgp/e-mail. I am assuming that I'm covering my tracks smartly, and the only thing they have is what they can grab over the air, which is PGP, and that gets sent to some BBS [which they don't know] for my friend to pick up. The ESNs and the Keep Moving are really helpful, thanks.

2 2

art encryption...
by John Young 17 Dec '03

17 Dec '03

My recent post on use of PGP in architectural documents is limited to those produced by an all-volunteer group that provides free services. This work is often controversial and needs privacy protection. My commercial work does not yet deserve such elegant dressing. If and when it does I will relish paying for PRZ's hard work through his market channels. John

1 0

Unfinished FAQ?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Tim, I was going through the FAQ and was puzzled by what appear to be cryptic notes to yourself, such as "quote from Wired, Whole Earth Review" in the definition of cpunk in the MFAQ, along with a number of questions without answers - "Who are Alice and Bob" in the MFAQ for example. Do I have an unfinished version (0.666!) or what? ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Profiling (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

At Lee's request, I'm forwarding this note to several relevant forums. - mech(a)eff.org Forwarded message: Date: Thu, 15 Sep 1994 06:15:37 -0600 From: ap524(a)Freenet.HSC.Colorado.EDU (Lee Knoper) Subject: Profiling Reply-To: 6564559(a)MCIMail.COM [...] Here's a situation in which "profiling" by a government agency is already causing a problem. Recall that recently on <eff-activists) there was brief discussion regarding the use of "profiles" in advertising efforts, in the context of interactive TV. Some participants favored what was perceived as a probable improvement in the efficiency of such advertising. Others saw distinct dangers, especially if profiles were marketed or traded among private sector entities, or if government became more involved. This particular situation is quite disturbing because it involves a state tax agency, and as everyone can appreciate, here is an example of where one is effectively presumed guilty until proven innocent, and is subject to asset seizure pending resolution as well as possible forfeiture. A correspondent is trying to defend himself against some aggressive actions by the AZ Department of Revenue. He has discovered that AZ Revised Statutes section 42-117 permits the DoR, at its discretion, to assess a personal income tax which is based on a "statistically valid sampling method." Although this option is seldom used, it is being applied in his case due to partial loss of records during a move. In other words, your AZ tax can be based on your profile, irrespective of your income or expenses. Worse, AZ DoR cites ARS 42-113 through -115 as requiring one to keep records for four years after filing. Yet it asserts that there is no statute of limitations for audits - it can audit a filing at any time, and can presumably apply the statistical sampling method retroactively if it so desires. Obviously, this situation goes well beyond profiling to determine who to audit. These and other, equally onerous provisions comprise a pit of despair. Ironically, DoR asserts that "all laws are presumed to be constitutional." The U.S. military is also involved in profiling, which is probably not much of a surprise because the military is often used as a test bed for social engineering experiments anyway. New ID is being issued to retired and current members of the military and their dependents, and to commissioned officers in the U.S. Public Health Service. The new ID is replete with a digitized photo, two bar codes and what amounts to a kind of PIN linked to the SSAN. It is intended to be machine-readable and linked to local and central databases. It's also a bit of an eye-opener to note that it is expected to replace ID used for -other- than official business as well, like club cards and health care access cards. If it's not in your profile or if the money is not in your account, you can't do_it/have_it. Moreover, you'll probably get automatically reported for followup investigation to determine willfulness and intent. Does unrestrained profiling start to look a little ugly by now? It ought to. If there's money to be made, or power to be wielded, neither Constitutional law nor existing statutory law holds much sway. Lee_K

1 0

HAPPY BIRTHDAY (H.E.A.T.) TO YOUUUUUUUUUUUUUUUUUU
by Blanc Weber 17 Dec '03

17 Dec '03

~ ~ ~ ~ ! ~ ~ .!. ~ ~ . ! . ~ ~ / / \ \ ~ ~ | | | | ~ ~ \ \ / / ~ ~ :: ~ ~ | ~ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | %~~~~~~~~% [------------------] [------------------] [-----------------------------------------] [-----------------------------------------] [-----------------------------------------] May your light burn bright, and long. May you have many chocolate cakes & gourmet cookies. May you have many double tall mocha nutmeg lattes. May you find love & happiness. May your spirit & your finances both soar into the stratosphere. May you make many friends who write in parced sentences. May the Bluebird of Paradise visit your apartment. May you achieve total anarchy and maximum privacy. May this email totally embarrass you. X X X ~ Blanc

1 0

Re:Profiling
by frissell＠panix.com 17 Dec '03

17 Dec '03

> In other words, your AZ tax can be based on your profile, irrespective > of your income or expenses. But the AZ D of R can't use a profile to actually *find* your money or, indeed, to determine that you are a resident of Arizona. > It's also a bit of an eye-opener to note that it is expected to > replace ID used for -other- than official business as well, like club > cards and health care access cards. If it's not in your profile or if > the money is not in your account, you can't do_it/have_it. Moreover, > you'll probably get automatically reported for followup investigation > to determine willfulness and intent. I *love* it when the government decides to use automation to cut people off from permissions/benefits if they don't "toe the line." Since I would like them to cut *everyone* off from permissions/benefits, every step closer to that situation is an improvement. Apparently, "Seaquest, DSV" had a little automated punishment example on yesterday's show. A guy on a motorbike was speeding and his plates were scanned on the fly and he was notified, while still driving, that his "Social Security Account" had been docked for some $700 in fines. Note that all they accomplish by such things is to convert people into "outlaws." If government benefits and permissions are withdrawn from you then the incentive for you to play their game is reduced. Automated punishment also weakens the hold of the government even on those who obey the law because they knwo that they can lose their government "benefits" at any time and so they value them less. In a strictly practical sense, such punishments encourage those punished to learn how to live outside the government's reward/punishment system. Note the non-compliance rates in New York City for driver's license, insurance, and registration rules. The DMV computers automatically suspend someone's license (even if he's never had one) and he keeps driving anyway. People accumulate hundreds of suspensions. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

1 0

EMBARRASSED, I?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks (did I ever tell you, it's pronounced "spunks"?), Blanc Webber made me feel like JFK being sung to by Norma Jean. The part I didn't understand, though, was when she wrote: May this email totally embarrass you. Hell, Blanc, why should it embarrass me? You're the one with the dirty picture. It's a candle? Sorry, my mistake. (But it looks just like my... oh, never mind.) Thanks Blanc, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rom owner-cypherpunks Mon Sep 19 13:30:56 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA02563; Mon, 19 Sep 94 13:30:56 PDT Received: from mail.crl.com by toad.com id AA02557; Mon, 19 Sep 94 13:30:50 PDT Received: from crl2.crl.com by mail.crl.com with SMTP id AA23474 (5.65c/IDA-1.5 for <cypherpunks(a)toad.com>); Mon, 19 Sep 1994 13:29:20 -0700 Received: by crl2.crl.com id AA12797 (5.65c/IDA-1.5 for Cypherpunks <cypherpunks(a)toad.com>); Mon, 19 Sep 1994 13:29:19 -0700 Date: Mon, 19 Sep 1994 13:29:01 -0700 (PDT) From: Sandy Sandfort <sandfort(a)crl.com> Subject: THE BEST MINDS IN CYBERSPACE To: Cypherpunks <cypherpunks(a)toad.com> Message-Id: <Pine.3.87.9409191301.A12756-0100000(a)crl2.crl.com> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-cypherpunks(a)toad.com Precedence: bulk ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I'm always telling people how smart the Cypherpunks are. Now I have proof. Paul Robichaux wrote: I suggest we all kick in $10 or so and hire Alison Armitage to jump out of a cake or something. Seems like the least we could do. It's like he read my mind--especially the "or something" part. Thanks Paul. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0