December 2003 - cypherpunks-legacy

NONE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Fri, 25 Nov 94 20:20:01 CST Gary Jeffers <CCGARY(a)MIZZOU1.missouri.edu> wrote: What follows is an advertisement by the Privacy Digest people. These people have been around longer than 10 years. [ snip ] Since these people are in Costa Rica, it will take more postage than [ snip ] The copied text follows: [ long advertisement for photocopied reports deleted ] I am hoping for a reply from Tim May (who's been absent for some days now?) and especially Black Unicorn; I know neither but have a gut feeling one of them would have a comment or two. My own 2 cents: 1. As a rule, while lots of Cypherpunks are no doubt interested in related themes (privacy in general, for instance, or liberty) please do not point entire texts to the list. Instead, sum it up and explain where those of us with a yen to see more can get the full information. This is not a flame to you personally, Gary, but please heed it. Otherwise you are flooding us... 2. Dealing with your post specifically, I have to ask for your qualifications. I happen to know this particular neck of the woods fairly well, as does Mr Unicorn, and I know that Williams in Costa Rica has not been around for 10 years. In fact, on the same address and phone number, he has not even been around for 1! (He did have other phones there before, granted). 3. While not wanting to single out Williams (the "Privacy Digest people" as you call them) because I have nothing more than a hunch, I want to let the list know that there has been at least one US Government sting operated out of a Costa Rica front address. Also, another sting used the corporate name of Financial Engineering as Arnie (Offshore) mentioned about a month ago. 4. The stuff that Williams sells -- and that you advertised to the list -- is not worth a lot of money. His services, if they are for real and not a sting, are good, but they are not organized efficiently and they are slow (I actually opened a test account with him so I am qualified) which means that even if he is not in bed with Sam you probably still ought to take your cash elsewhere. 5. If you do go ahead and decide to buy his programs, be aware that their lega advice is highly "inventive" and that much of their information is untrue or at least misleading. On more complex subjects (such as 2nd "banking passports" he whips up 20 halfbaked pages of false info where in fact the subject needs to be treated in at least 200 pages, thoroughly researched. And where the leading authority in this field is in fact on his 9th edition now, totalling 400+ pp. 6. Finally, some of Williams stuff is out of date. Worse, at least one report does not exist - and that is the one that would point to most government heat if you order it. Just out of idle curiosity, I had my foreign lawyer order so that was how I found out. If you order it (and if Williams is a front, or just if the Evil Empire is watching his mail; which IMO is even *more* likely) this mere fact will trigger an extensive immediate FBI investigation of who you are. While I hate to say it, there is currently to my knowledge no easy turn-key one-stop-stop "Where to go to break the law" foreign operators that I would trust. If you want true privacy, carve it out for yourself, don't rely on someone who advertises a lot and sells photocopied reports to give it to you. BTW, the services Williams are offering are sorely needed -- when they can be trusted. (Fiduciary accounts for everybody is one service, anonymous foreign credit cards is another, and several of his services could come under the heading of benevolent moneylaundering). One day you will see them coming from somewhere else, with a more professional twist and from guys who earn their bread off the fees, not off photocopies. I can outlike how such a private 'parallel-bank' is going to work if asked. For now, I prefer to post anonymously. I would be interested in getting a pseudonymous account of the kind described by 'Nobody' on Friday but would want a better place that mg5n to set it up. "Capt'n Bob" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAy7W3GoAAAEEAMQqHR+mHowjb7JsVxkCRCg0iM3uitOS2cIcctVIuXVJW6ou iumOw2zMURT5LFgGD2XHr7sre8jm9VUGWwFAaRTJB85Kj4Vy2/dGId2kK7Z/YsrE tVQDw75I8UYa3//PS5C2xCZROz5YHVEjvGcl3QqRLw8xVsgG+OZrkMibcPMNAAUR tBpUaGUtQ2FwdGFpbiAoIkNhcHQnbiBCb2IiKQ== =yrC+

1 0

NYT on Satellite Radio
by John Young 17 Dec '03

17 Dec '03

Peter Passell writes longish article today on the company CD Radio and other ventures to sat-cast digital radio nationwide. One excerpt: "with digital technology, satellite broadcasters can stuff dozens of channels of CD-quality, interference-resistant programming into a narrow ban of frequencies." Has there not been discussion here before about the use of this technology in lieu of hard-wire for the Net? For e-mail copy send blank message with subject: SAT_rad

1 0

DC-nets
by tim werner 17 Dec '03

17 Dec '03

------- Start of forwarded message ------- >From: rishab(a)dxm.ernet.in >Date: Thu, 24 Nov 94 00:03:28 IST Writing about Brad Templeton's fears: >He'd have been even more shocked if you told him about other future >technologies such as DC-Nets... Of course if faced with a situation he'd >probably try to claim 'conspiracy'. What's a DC-net? thanks, tw

1 0

CP lawyers?
by merriman＠metronet.com 17 Dec '03

17 Dec '03

I seem to recall that some of the postings to the CP list indicated that the authors were lawyers, and it got me to wondering: If true that some on the CP list are lawyers, have they (or would they consider) providing pro bono representation of someone charged with an ITAR, or similar, violation? It would seem like one way (though not the best :-) of pushing back some of the limitations on crypto..... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Re: PC MSDOS hardware key proposal
by cwedgwood＠cybernet.co.nz 17 Dec '03

17 Dec '03

Jyri Poldre <jp(a)pitsa.pld.ttu.ee> wrote: ______________________________________________________________________ Frgiv me if i am a bit off theme, but it just seemed as a good idea. As I am going to have some off-time tonight I might forget that and on the other hand maybe someone can use it in protecting his/her intellectual property and this would certainly be linked with our topic. The idea came to me after seeing some incredibly small piece of code doing some unbelievable damage. Like 3 kbytes of com making hardware key useless. I started to play with idea of having something more reasonable for PC SW developers. For start it is not possible to use any type of key checking, because dos is open system and allows everyone to intercept and disable it. The lock must be a part of program itself. Also one must concider the dataflow and power consumption, meaning you cannot have second floating point unit in printer/serial port.You cnt put it into slot , cause it should be reasonably cheap. My idea for such device is the following: Have the HW unit calculate the If-then-else conditions in program flow. it is not reasonable to do it everywhere, but just in some places( depends on the money/time one used to devolop product and similar relation of expected hacking ) . For that purposes you could collect all results into flags and present them to this Hw unit. It calculates the condition as boolean function of input variables. If you want more entropy you could involve state machine in this unit. Also some delay, what would be built into ( one cannot just send data through printer port with 32 Mbytes /sec.) although for user it would be unnoticed , but using brute force and 32 bits of data this would make our friendly hacker quite old. Another alternative is to understand the dataflow in program but from binary to get the idea... no , this is a bad idea. so - just when it comes to ITE you present printer port with 3-4 bytes calling some procedure what reads flags from global variables and returns carry - to go or to stay. that's it. An attack might also concider just listening the device and writing down the values but you would have to go through all checkpoints using all possible flag values and that would take some and also involve understanding of program dataflow. One good point using that system is that it would possibly not always crash- it would just for starters give you wrong answers. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Doesn't work, atleast in some form. I have removed hardware dongle protection that does just that by watching what the hardware does for a long period of time (logging it) and then writing interception/emulation code. A better idea I think is something like digital signatures. Get the hardware to produce a digital signature or some random data. If random isn't available then a reasonable pseudo-random algorithm would suffice provided it was implemented carefully (well seeded). SmartCards can probably do this with say ESIGN [see Eurocrypt '93 (or maybe 92?)] If you do want to make a delay in your dongle (or whatever) then it should ONLY delay for wrong responses or for patterned responses (hard to detect) that might indicate an attempt to brute force it - like many modern UHF car alarms and garage door openers. Extensive control of program flow might be very difficult to program and quite cumbersome. Another thing - how practical is this hardware? If it is implemented on a micro-controller then it can be disassembled is the code inferred via other means. PAL and GAL chips can also be read - and if the no-read bit is set and the complexity of the device low enough (as is likely for in-expensive devices) then you can infer whats inside these also (although usually it not a NP-complete soln time wise....) Chris

3 2

Privacy Digest - Blk Unicorn , Frissell, Sandfort
by Gary Jeffers 17 Dec '03

17 Dec '03

Dear Cypherpunks, "Captain Bob", posting as anonymous, subject NONE, has posted a most disquieting post in reference to my original Privacy Digest post. Urgently needed are the opinions of Black Unicorn, or possibly Sandy Sandfort or Duncan Frissell as to whether or not the Costa Rican reference I gave is a "STING". Cap't Bob says that the Privacy Digest people have not been around very long. However, If I remember right, Eden Press referred to them in their book PRIVACY more than ten years ago. Bob asks me what are my qualifications? Well, I'm not an expert but if you look at me from the correct angle I look like an expert. I posted the original Privacy Digest to other groups as well, so I would like to send any criticisms of my post to these other groups. Yours Truly, Gary Jeffers

2 1

re: money laundering
by khijol!erc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think that most people forget that as soon as that sort of money enters the banking system, it can be tracked. "Wire $20K to XXX" presumes that that $20K came from somewhere, and unless you're careful about where it came from and where it's going, you could be buying yourself a whole lot of unwanted attention, even if it's a prefectly legitimate transaction. Coming in with a suitcase full of money is bound to get you talked about, and writing a check... well... It's getting rather difficult to move large sums of money around nowadays if it either enters or leaves the US banking system, and if it's a friendly nation (which Canada is), if the Feds have a reason to look at you, an international border isn't going to prove much of a drawback. - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi ** PGP encrypted email preferred! ** "What's the use of distant travel if only to discover - you're homeless in your heart." --Basia, "Yearning" -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLtfAYSS9AwzY9LDxAQHtHgP/bKm9+giQ9R4rOAOfCTKmdSHlPiVXUsNu PeMNgvzrIrMo8SFmJg5xj8jzHUstbEQZ+ZZJyl7Xp5Fnv2GTTrz/pQYUZha0fm+v B50kUgWVvNtEmlmvOpQcFDobkoYxh8SiflvLTRsoUgvphqUZGOsJ8FkUFNkEm8nf ME2Cv1e2B5c= =Xt7m -----END PGP SIGNATURE-----

1 0

WWW "remailers"
by Hal 17 Dec '03

17 Dec '03

We have had some discussions here about privacy of accesses on the World Wide Web. Presently servers get a variable amount of information about the people accessing their sites, depending on the particular software being used and how it is configured. This is potentially harmful to the privacy of WWW users in that their access information can be recorded, etc. Here are some things you can do to reduce this problem. First, try connecting to: http://www.uiuc.edu/cgi-bin/printenv This just displays environment variables, which shows what information about you is being received by servers. Look particularly at the lines reading HTTP_FROM and REMOTE_HOST. These may contain your user name and computer address. You may be able to remove your user name information. Some clients, including, I am told, NetScape and version 2 of Mosaic for Mac/Windows, allow you to set your email address, which is handy, but then they send it along to servers, which is harmful to your privacy. You might want to consider not setting this field and using other programs for sending mail. Also if people complain about this then perhaps the makers of this software will add an option to suppress sending the info. Even if you don't see your name in HTTP_FROM it still may be possible for somewhat more sophisticated programs to log your access if the REMOTE_HOST information is correct and you are running on a Unix system or something similar. This is done via the identd service if that is running on your computer. The server can use this service to ask for your user name once you are connected. One way to see if identd is running on your computer is to telnet to your own computer on port 113 and see if anything is there (telnet <your-computer-name> 113). If so then this is potentially another privacy exposure. I have recently been experimenting with using "proxy servers" to remove even the REMOTE_HOST information from the server's view. Proxy servers are servers which basically receive WWW connections and pass them along. Then when the data comes from the remote site they pass it back to the originating user's site. Because the proxy server is in the middle the remote site never sees the host name of the originating user. In this respect they are somewhat similar to our cypherpunk remailers, hence the title of this article. (The purpose of proxy servers has nothing to do with this function; they are designed to allow easy WWW access from users who are on firewalled sites. But they happen to serve our purposes as well.) Interestingly, the standard nntpd (nntp daemon, the master server which runs on a site which offers web pages) from CERN includes proxying capability automatically! All you have to do is to add a few lines to the configuration file. If this idea proves sound, perhaps some people running nntpd will enable proxies and serve as "remailer operators of the web". Normally proxy servers are configured to pass connections only from the machines they are there to serve (at least, they can be configured that way; I don't actually know how careful people are about this). But luckily I have found that the CERN proxy server itself accepts connections from anybody (at least, it accepts them from me!). So this is useful for doing experiments. And, the great part is, almost all web clients are set up now for proxy support. The way you enable it varies from client to client. I believe most of the Mac and Windows clients have a preferences box which allows you to put in the address of your proxy server. On Unix, you can set environment variables. Here is the suggestion from the web page at CERN: #!/bin/sh http_proxy="http://www.cern.ch:911/"; export http_proxy ftp_proxy="http://www.cern.ch:911/"; export ftp_proxy gopher_proxy="http://www.cern.ch:911/"; export gopher_proxy wais_proxy="http://www.cern.ch:911/"; export wais_proxy exec Mosaic This is a little shell script which runs Mosaic, first setting four environment variables to "http://www.cern.ch:911/", which is the proxy server I was referring to, the one which accepts connections from the rest of the world. For the purpose of the experiment, only http_proxy needs to be set. Try setting that one and then run lynx or mosaic on your unix workstation, and connect to the printenv URL above. Compare the information that is shown from what you got earlier without the environment variable. Similarly, on other machines, try the printenv test with and without proxy serving enabled using the CERN proxy. I find that the proxy server does in fact prevent the remote site from seeing my computer's address, and without that the IDENTD can't be used to reveal my name. This technique has many ramifications. For example, if a US proxy server were available, ftp could be done via Mosaic to sites which only allowed connections from American computers. People have been talking about writing special IP redirectors for this, but here it turns out the capability has been around all along. I got my information about proxies by reading: http://info.cern.ch/hypertext/WWW/Proxies/. Specific information on configuring CERN nntpd as a proxy server is in: http://info.cern.ch/hypertext/WWW/Daemon/User/Proxies/Proxies.html. Modifications to the proxy server code would be necessary to provide some additional features, such as support of encryption between user and proxy server (via the SHTTP protocol extensions, perhaps; this way you could get local privacy even when connecting to servers which did not support encryption), or possibly chaining of proxies. I think this is a fertile area for discussion and further work. Hal

2 2

NYT on Hiding Cash (Re: Privacy Digest)
by John Young 17 Dec '03

17 Dec '03

Sorry to fall asleep at the switch, but Gary Jeffers posts on The Privacy Digest and those of Black Unicorn and Critias jogged me to note that The New York Times had two articles on Friday about a UN conference on control of money laundering and the flight of German capital to Luxembourg banks to escape high taxes. Both articles describe the resistance of banks to government snooping, and how laws are being modified to try to keep up with increasing demand for cash havens and/or laundering. ------------------- Here's an excerpt from the first, "Laundering of Crime Cash Troubles U.N.": ". . . the skillful manipulation of dirty street money through former Soviet replublics, offshore banks and major stock exchanges, until it emerged as legitimate cash for buying and selling of a hotel in Bogota. As outlined today by officials in Naples at a major United Nations conference on organized crime, it is not just the growers, smugglers and assassins who make the worldwide drug trade a scourge, but a new breed of skilled money-managers, lawyers and other professionals in the pay of the mob. Devising ever more complex ways of laundering money, they handle an estimated $750 billion every year. . . . By long tradition, banking secrecy and numbered accounts were associated primarily with such financial bastions as Zurich, Vienna and Luxembourg, and the money came mainly from the drug trade. But, United Nations officials say, as these banking centers slowly yield a few secrets to narcotics investigators, a whole new array of less reputable banks are springing up across the former Soviet Union . . . . . . The world's increasingly coordinated and sophisticated crime syndicates, by contrast, now deal in everything from organs for transplant to nuclear materials; with their money laundered, they put their investments into legal business." For an e-mail copy of this article send blank message with subject: UN_nab ------------------- >From the second article, "Germans in Tax Revolt Embrace Luxembourg", these excerpts: "Since 1993, when the Finance Ministry in Bonn imposed a 30 percent withholding tax on interest income for residents, Germans by the thousands have used Luxembourg to carry out a quiet but powerful tax revolt. Carrying suitcases and plastic bags of cash, they have deposited $150 billion in Luxembourg bank accounts, placing it beyond the reach of the tax authorities in Bonn, and behind the screen of Luxembourg's rigid bank secrecy laws. . . . [Description of Germany's proposal that all European Union banks agree to withhold taxes on interest income for the various governments and the banks' demurs.] 'People think they are overtaxed and so they are looking at every way possible to avoid paying taxes,' said a banking lobbyist in Bonn who insisted on anonymity. 'We assume that if people deposit their money in Luxembourg, they will pay taxes. If they don't, that is a political problem for the government, not the banks. We are not policemen.' " For an e-mail copy of this article send blank message with subject: LUX_out

1 0

Re: CP lawyers? Pro Bono work...
by adam.philipp＠ties.org 17 Dec '03

17 Dec '03

>I seem to recall that some of the postings to the CP list indicated that the >authors were lawyers, and it got me to wondering: > > If true that some on the CP list are lawyers, have they (or would they >consider) providing pro bono representation of someone charged with an ITAR, >or similar, violation? It would seem like one way (though not the best :-) >of pushing back some of the limitations on crypto..... Speaking as the Pro Bono Legal Advocates vice-chair of my school and as a future attorney, this might be possible, but consider the costs involved besides the relatively minor ones of attorney's fees. I can't really give a reliable estimate (Phil Karn, any idea how much of you appeal was spent on hourly fees as opposed to expenses?). Although attorneys on this list may be generally sympathetic the expenses of federal lawsuits can be quite discouraging as pro bono oppurtunities. Personally I find most pro bono volunteers will work in local settings for indigent clients (Domestic Violence cases, AIDS related legal issues, guardianship of minors, juvenile defendants, small claims mediation, and other situations where expenses are low). Any attorneys out there want to take this up? Black Unicorn? Others? Should that be the topic of my next handbook? Adam Philipp -- PGP Key available on the keyservers. Encrypted E-mail welcome. SUB ROSA: Confidential, secret, not for publication. -Black's Law Dictionary GJ/CS d H S:+ g? p? au+ a- w+ v++ c++ UL+ UU+ US+ P+ 3 E N++ k- W++ M-- V po- Y++ t++ 5+ jx R G' tv+ b+++ D++ B--- E+++ u** h-- f++ r+ n+ y++--

1 0