December 2003 - cypherpunks-legacy

EFFy Wiretap Win?
by John Young 17 Dec '03

17 Dec '03

EFF what say you about this? Excerpts from WSJ, September 30, 1994, p. B5 Bill Would Ensure Law Enforcement Is Able to Tap Wires By Mary Lu Carnevale Staff Reporter of The Wall Street Journal WASHINGTON - The House Judiciary Committee cleared a bill that would require telephone companies to ensure that their networks remain accessible to law enforcement wiretaps. But key lawmakers agreed to changes aimed at appeasing local phone companies. The modifications largely spell out that phone companies won't be forced to pay to modify their existing networks to comply with the measure. They are expected to be included in the bill before it goes to the House floor, possibly as early as Tuesday. A similar measure sailed through the Senate Judiciary Committee earlier this week on a 16-1 vote. Though little time remains in the current Congress, the legislation could squeak through. * * * The agreement, details of which are being ironed out, also aims to protect individuals' privacy rights; prevent phone companies or law-enforcement agencies from installing or ordering unnecessary upgrades; and ensure that the changes have the least possible effect on phone rates and phone-company efforts to build advanced communications networks. The legislation is separate from the Clinton administration's controversial "Clipper Chip" proposal that would have mandated an encryption standard for computer and communications equipment. That failed proposal would have let law-enforcement agencies decipher any calls or messages that had been encoded. ------------------- END

3 2

Re: What privacy issues to discuss.....
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>Fellow C'punks- > What I want from you guys is pointers to papers I can use as >references, but stuff that's easy to explain to Joe/Jane College student. ftp.csua.berkely.edu /pub/cypherpunks/papers :-) > I would also like input as to how you folks think I should do it. >Should it be a discussion group, or should I just talk and then answer >questions? I think a discussion group might be better, but I'm not sure. > Split the difference: explain some of the details and such to them, and then let them work it out. Might help to use something like a phone bill to point out how data is collected that could easily be used by any kind of oppressive regime. It's my understanding (possibly in error :-) that European nations do *not* provide the level of detail in their telephone bills that we do here; the theory being that if who someone calls is unknown, then it makes any effort to do a guilt-by-association and witchhunt more difficult. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

PGP 2.6.2??
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I saw in alt.security.pgp recently that a new release of PGP was due in the next few days from MIT. Evidently this version will handle the generation of keys of up to 2048 bits. Can anyone substantiate this? -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCzAgUBLo0lxaACeR4xBXv5AQGeIwTwqopgv3fV9Xkhk/kD319nsRRnN0lt3qON omaQibl5mszx+dqnF2mxwxFLTVo2RuSEWq1YFbT6qmlrSR/Q0jvlbdSO6dnc/ufN E4SwKl7NF5vgMVxIJzCP9M/dL4dOEY2xOMvtxG7u+Y7hEawVEKKnoiINE+xhEja8 6zZEB5ab5t5vfY5uRirY1GN8Zb7CT+rg2pMmfZyjhonk5dXMfs8= =rH5c -----END PGP SIGNATURE-----

2 1

FWD: Safe-Tcl meets PGP!!!!
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

This is from the Safe-Tcl list, which discusses a variant on tcl which provides a "safe" subset of capabilities appropriate for letting incoming mail bring in programs which can run autonomously on your computer. I mentioned this a few weeks ago and I've been on the list, although I haven't looked at it in much detail. Nathaniel Borenstein is very active in the email community so this may turn out to be an influential technology. He is using PGP to authenticate incoming messages and grant them more privileges as appropriate: > From hfinney(a)shell.portal.com Sat Oct 1 13:30:26 1994 > Date: Sat, 1 Oct 1994 15:44:46 -0400 (EDT) > From: Nathaniel Borenstein <nsb(a)nsb.fv.com> > Subject: Safe-Tcl meets PGP!!!! > Cc: Marshall Rose <mrose(a)dbc.mtview.ca.us>, > John Ousterhout <John.Ousterhout(a)eng.sun.com>, > Philip Zimmermann <prz(a)acm.org>, > Trent Jaeger <jaegert(a)engin.umich.edu> > > For over a year now, people have been asking me about extending safe-tcl > to make use of digital signatures so that it can grant more powerful > capabilities to programs from trusted senders. My position all along > has been "the hooks are there, but nobody has put all the pieces > together." > > Today, after a message from Trent Jaeger that got me to thinking about > this again, I took a new look at the situation, the first time I'd done > so since becoming a regular PGP user. It turns out -- amazingly enough > -- that integrating these technologies was almost trivial! I am happy > to report that I now have integrated safe-tcl, pgp, the Internet Draft > on MIME/PGP, and metamail, to do "the right thing". Best of all -- you > don't need to compile anything, the "hooks" all work. > > With this hack -- which works for all metamail-based mail readers, and > which I expect will be easy to replicate for mhn and others -- I believe > that Safe-Tcl now has the last bit of functionality where Telescript was > previously superior. We now have a completely open platform for sending > around programs with differential capabilities dependent on the level of > trust that the receiver has in the sender. > > Getting this working is trivial. The assumption here is that you have a > message with a content-type of "application/pgp; format=mime" which, > when after its signature is checked (and after it is decrypted if > necessary) contains a MIME entity with a content-type of either > "application/safe-tcl" or "multipart/enabled-mail" (or some other > multipart, with one of these two types nested inside it somewhere). The > basic scheme is to make the PGP-smart process put signature information > into an environment variable, PGP_SIGNATURE, which is then checked by > the safe-tcl interpreter. Obviously, if you implement this, you want to > make sure that you don't usually have PGP_SIGNATURE set in the process > you use to read your mail! > > Anyway, to make this work there are two steps: > > 1. In your .safetclrc file, add the following: > > catch { > global SafeTcl_Services > set SafeTcl_Services(authentication) $env(PGP_SIGNATURE) > } > > This will ensure that SafeTcl_Services is set properly if the > PGP_SIGNATURE variable is set. > > 2. Configure your mail reading tool so that it understands > application/pgp and text/pgp, and sets the PGP_SIGNATURE variable. For > metamail-based systems, this consists of adding the following mailcap > lines: > > text/pgp; decode-pgp %s ; needsterminal > application/pgp; decode-pgp %s mime; needsterminal; \ > test=test %{format} = mime > application/pgp; decode-pgp %s ; needsterminal > > and then installing the "decode-pgp" script on your search path. That > script is a twelve-line shell script: > > #!/bin/csh -f > set viewprog=cat > if ($#argv > 1) then > set viewprog=metamail > endif > set prog="pgp" > set infile=$1 > pgp $1 -o /tmp/outputfile.$$ |& tee /tmp/shotputfile.$$ > set PS=`grep "Good signature" /tmp/shotputfile.$$ | sed -e "s/Good > signature from user//"` > setenv PGP_SIGNATURE "$PS" > $viewprog /tmp/outputfile.$$ > rm /tmp/*putfile.$$ > > I think that's all you need to do! If I'd known it was going to be this > simple I would have done it months ago! > > As an example of how to USE this facility, you can put the following > code in your .safetclrc: > > proc readsharedfile {nm} { > set fd [open $nm r] > set result [read $fd] > close $fd > return $result > } > catch { > if {[regexp "nsb(a)nsb.fv.com" $SafeTcl_Services(authentication)]} { > declareharmless readsharedfile > } > } > > In this case, if you get a safe-tcl program that is signed (and, > optionally, encrypted) by ME, and I'm on your keyring, it will be able > to read any file YOU can read. Otherwise, the readsahredfile procedure > will be undefined in the restricted interpreter. > > Pretty cool, eh? I encourage folks to try it out. -- Nathaniel > > PS -- Assuming no problems turn up, I will probably put "decode-pgp" and > the relevant mailcap entries in the next metamail release, and will > build the few lines that set SafeTcl_Services based on PGP_SIGNATURE > into the stuff done automatically in the next safe-tcl release. -- > Nathaniel

1 0

Feds & Ecash! Yikes!
by vvallopp＠eniac.seas.upenn.edu 17 Dec '03

17 Dec '03

Anyone have any enlightening info about this????? <forwards deleted> Path: netnews.upenn.edu!news.amherst.edu!news.mtholyoke.edu!world!mkj From: mkj(a)world.std.com Everybody knows that Al Gore is hot on this "National Information Infrastructure" thing. What many people may not fully appreciate -- or at least, what I'm just discovering myself -- is the sheer enormity of the disaster going on as we speak, under the banner of the "Information Infrastructure Task Force" (IITF). If you haven't already done so, I highly recommend an enlightening browse on the iitf.doc.gov site (ftp & gopher at standard ports, http at port 70). ^^^^^^^^^^^^ (NOTE: Individuals in fragile health should always consult a physician before exposing themselves to detailed information about their government's activities. Have you ever felt like an ant in the path of a steamroller? YOU WILL ...) Although I've barely scratched the surface, I've already run across a number of items which might be of interest to folks here. The DOE, for instance, reports that they are working on "Developing electronic cash systems that would maintain the privacy of individuals from merchants and banks, but would allow law enforcement to trace the flow of the electronic cash, given proper court orders." Other spectacularly dubious achievements include the report of the Privacy Working Group, which never once acknowledges any individual right to privacy, and in fact devotes most of their report to various ways to increase the "willingness" of the public to divulge personal data; and the draft report of the Intellectual Property Working Group, which with a straight face characterizes most current Internet activity as illegal, and then goes on to outlaw the rest of it, while blandly noting that the public will require "education" in these matters. Also, of course, there are any number of hints of NII projects involving various intelligence agencies. Enjoy. --- mkj ------------------------------+---------------------------------------------- Vinod Valloppillil | Even if you're one in a million, Telecom/MIS/Strategic MGMT | there's still a thousand more of you Engineering/Wharton | in China..... vvallopp(a)eniac.seas.upenn.edu | ------------------------------+---------------------------------------------- "It is often easier for our children to obtain a gun than it is to find a good school." -- Joycelyn Elders "Maybe that's because guns are sold at a profit, while schools are provided by the government." -- David Boaz

1 0

Cpunk list check
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Haven't heard anything out of the list for a while, so just sending this out to see if the list is still up. Sorry. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

H.E.A.T. BEAT
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H.E.A.T. seeking C'punks, "Code Name: Assassin" In this episode, we see the return of H.E.A.T. archnememis, Neil Strake. (For those who haven't seen Acapulco H.E.A.T., Strake is played by James Healing who does an extremely bad imitation of bad (French?) actor, Louis Jordan.) Anyway, forget the plot, it is even more Byzantine and illogical than usual. Suffice it to say that Strake shoots Mike--on Mike's birthday--in an attempts to kill him. Mike is in a coma through most of the show. The special cartridge has "Happy Birthday" written on it; the bullet is inscribed, "Mike." (Wow, talk about a bullet having your name on it.) This episode was unique in the number of flashbacks and fantasies it offers: (1) Mike goes into cardiac arrest on the operating table. Instead of having the currently popular NDE (near death experience; dark tunnel, white light, life review, etc.), Mike has a fantasy dream of fighting in a boxing match. (He gets knocked out.) (2) When the Team fingers Strake, Ashley has a flashback to the previous Strake episode, thus practicing the parsimony of recycling. (3) Later at Mike's bedside, Ashley has another flashback about the two of them. She then sweet talks him in his coma and tells him not to die. (4) After Ashley talks to him, Mike has another fantasy dream boxing match in which he KOs his opponent. (5) Finally, Strake goes to a disco for no apparent reason. There he first dances with a beautiful quadroon. He drops her for an Anglo-looking woman. During his dance with the Anglo, he fantasized that she is Ashley (he has an obsession with Ashley). The dance is meant to be erotic, but it's just silly, even when they virtually fornicate on the dance floor. Here are the crypto/techno elements: (1) The cartridge is a ".223 nitro express," which is made by only one man, a guy named Sabross. (2) Krissie uses the H.E.A.T. computers headquarters to "patch" into the surveillance camera system of the prison in which Strake is supposedly incarcerated. This takes her all of 10 seconds. (3) The person in prison is not Strake, but an imposter whose appearance has been altered by plastic surgery to look, sound and act just like Strake. (4) Strake plants a radio controlled bomb at Mike's "funeral" (don't ask), which the Team discovers in a sweep of the chapel. There were several good lines in this episode. In a face-to-face encounter between Ashley and Strake, he says something about how he sees the world and Ashley says, "Don't they call that schizophrenia?" To which he replies, "Only the people who get paid to put a name on it, then get paid even more to cure it. While Strake is putting his bomb together he opines, "I love the smell of C4 in the morning." During the funeral, Strake pulls out the radio detonator and says, "One flick of my finger and you're all taco meat." (Don't laugh, have you ever eaten a taco in Mexico?) There were tons of bikinis in the beech scenes (strangely, there were only beautiful women on the beach). The disco people looked hot, and there was no Fabio! Tune in next week--same H.E.A.T. channel, same H.E.A.T. time--for the further adventures of Acapulco H.E.A.T. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Nom de guerre public key
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm new at both remailing and PGP, but having read the Cyphernomicon (OK, skimmed it) and various other FAQs, I haven't seen this issue addressed: I've created a pseudonym and a PGP key pair for that pseudonym. Now, how do I secure signatures for my public key, given the fact that (a) to sign it, you should be sure that it really belongs to me, and (b) I have no intention of revealing who "me" actually is? You can't call me on the phone, or meet me face to face, or do any of those other standard practices for confirming the key before signing it. But I sure don't want to use an unsigned, untrusted public key, since I want to make and keep a reputation and I can't risk someone spoofing my public key. ======================================================================= Crim Tideson Privacy is its own justification. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ My public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy51e6kAAAEEAMLIkYRAJqKnrQL7Xxmu7hNycUU06YZuR2i3WVxN9Jc6vnoF i7gT6/u7zVI4gmZCTA6mF6SYEFeOiENHaz0wyBNe+8AOIgdaezUsPODMh7UC64k0 YVQTNOiPN9jQAnyCGjPrplSliWT4gHGC796whwJ8CFkwPdpQf6vOblMnt4MdABEB AAG0DENyaW0gVGlkZXNvbg== =pwyo - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLo3MxqvOblMnt4MdAQH0jwQAvzbd7b7KpcKdaeGzWUx8aav4WxWJWD9W qwYaVF/WNFFg89+m0K8TztTEcc9QVz3wYvKz1ojOx7IOJl10ZUBXbXrChaDYhbKJ YTU3QeOHN7o8VdzJ3o7z6lK9QqLZhhzQd4VgF9VxR++8LcBVS8AYaVWsfGLv7L2q W+4h4FIR0GE= =Vu2X -----END PGP SIGNATURE-----

6 9

Nom de guerre public key
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm new at both remailing and PGP, but having read the Cyphernomicon (OK, skimmed it) and various other FAQs, I haven't seen this issue addressed: I've created a pseudonym and a PGP key pair for that pseudonym. Now, how do I secure signatures for my public key, given the fact that (a) to sign it, you should be sure that it really belongs to me, and (b) I have no intention of revealing who "me" actually is? You can't call me on the phone, or meet me face to face, or do any of those other standard practices for confirming the key before signing it. But I sure don't want to use an unsigned, untrusted public key, since I want to make and keep a reputation and I can't risk someone spoofing my public key. ======================================================================= Crim Tideson Privacy is its own justification. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ My public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy51e6kAAAEEAMLIkYRAJqKnrQL7Xxmu7hNycUU06YZuR2i3WVxN9Jc6vnoF i7gT6/u7zVI4gmZCTA6mF6SYEFeOiENHaz0wyBNe+8AOIgdaezUsPODMh7UC64k0 YVQTNOiPN9jQAnyCGjPrplSliWT4gHGC796whwJ8CFkwPdpQf6vOblMnt4MdABEB AAG0DENyaW0gVGlkZXNvbg== =pwyo - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLo3MxqvOblMnt4MdAQH0jwQAvzbd7b7KpcKdaeGzWUx8aav4WxWJWD9W qwYaVF/WNFFg89+m0K8TztTEcc9QVz3wYvKz1ojOx7IOJl10ZUBXbXrChaDYhbKJ YTU3QeOHN7o8VdzJ3o7z6lK9QqLZhhzQd4VgF9VxR++8LcBVS8AYaVWsfGLv7L2q W+4h4FIR0GE= =Vu2X -----END PGP SIGNATURE-----

1 0

Cyphernomicon
by Black Unicorn 17 Dec '03

17 Dec '03

Could someone give me a current pointer to the Cyphernomicon? -uni- (Dark) -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1