December 2003 - cypherpunks-legacy

Santa uses PGP
by Hal 17 Dec '03

17 Dec '03

http://northpole.net is Santa's home page. For your kids you can order buttons saying "I emailed Santa", at $5 per. Afraid to send your VISA card number across the net? No problem - they use PGP. Key available by mail to button-info(a)shop.net, orders to buttons(a)shop.net. (I have no connection to this business - but it's nice to imagine a bunch of kids pestering Dad to get PGP so he can order them a button!) Hal P.S. Here's the key. pub 512/44C65CC5 1994/11/23 I e-mailed Santa Buttons <buttons(a)shop.net> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBNAi7S+50AAAECAMPk38olS7RWUpWm3JE+xqlswgmmHqkKP2hupMtrgCiEMe6B v+Qq+I15rTi3IDFH31lDJS643xdIULnZHETGXMUABRO0LEkgZS1tYWlsZWQgU2Fu dGEgQnV0dG9ucyAgPGJ1dHRvbnNAc2hvcC5uZXQ+ =nWwt -----END PGP PUBLIC KEY BLOCK-----

1 0

PGP DLL (revisited - kinda)
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Being a marginal (at best :-) C++ programmer, I snagged a copy of the DLL skeleton from MS's FTP site. Into that, I started stuffing Pr0duct Cypher's PGP Tools package. I've gotten it to where it will *mostly* compile, but I'm still having a couple of problems that I hope someone more skilled than I can resolve. Semi-details: I've got a *bunch* (20+) warnings, all about type mismatches (char:int, etc); and _2_ errors that I can't seem to locate. I've been chasing down the errors first, but as I said, can't seem to hammer the little buggers (pun intended :-). If there's another VC++ programmer out there (I've got 1.5 pro), I'd appreciate it if you could email me so we can work something out so I can send you a copy of what I've got so far, and see if you can't spot where the problems are. I don't *think* there's much left before it'll turn into a .DLL - but then, if I knew anything about it, I wouldn't be yelling for help :-/ Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Bobby Rae's Internet Address
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- According to the Toronto Globe and Mail, Sat. November 26/94 edition, we now have another politician to lobby online. Ontario Premier Bob Rae has publicly advised that his Internet address is premier(a)gov.on.ca I'm sure that all citizens of the Internet will welcome Premier Rae and his efforts to bring Ontario online and into the 21st century. And I'm equally sure the cypherpunk anonymous remailer system will get used more frequently.....:> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtgwJK+YbMzawbu5AQFDqQP+LyXrnQInpfnG4347XAXYL8JssUfMEZ1S zQl+tSN8rEkGHs85iw61R8rRfNVDXFpdlxHGZletDjSfA7aRNQ6zj/04tX4ODkX3 G10+deboLt6qZuZ6SdkMi66Brt0B6ULfIKqPMbdit7WZvYdX/tRfBKRpR7PQaWcQ t/Q/JaLhVGo= =icAy -----END PGP SIGNATURE-----

1 0

Re: bug-finder?
by sdw＠lig.net 17 Dec '03

17 Dec '03

> > ddt(a)lsd.com (Dave Del Torto) wrote > >>Anyone here know a source for a listening-device ("bug") detector? > > In my (very lkimited) experience this is NOT an easy thing to detect. I have > pulled apart some comercial bug detectors, usually the contain a 556 and some > LEDS witha speaker. One did actually have anoise diode and a little counter > so's to make things seemingly randmo and more real. > > In reality it is quite difficult to detect ALL bugs. Whilst at a guess most > will be FM (50-150 Mhz) there is still the possibility they use other > (prob. higher) frequencies. I good scanner might pick them up - provided it > is sensitve enough and can scan fast enough as there is quite alot of > spectrum to cover. > > Chris I thought the trick was to use a 'near-field' receiver. I saw one at the Dayton Hamvention a couple years ago for about $100. It'd receive Am audio or sync on FM (you'd here no-noise silence they said). You don't tune it: it relies on the 'near-field' effect which is something about how transmitters can induce the right harmonics in a certain type floating receiver within a short distance. The Rabbit TV extender and a stereo TV decoder used the same method: they sat on top of the TV and 'noticed' which channel you were on. sdw -- Stephen D. Williams Local Internet Gateway Co.; SDW Systems 510 503-9227APager LIG dev./sales Internet: sdw(a)lig.net In Bay Area Aug94-Dec95 OO R&D Source Dist. By Horse: 2464 Rosina Dr., Miamisburg, OH 45342-6430 Internet Consulting ICBM: 39 38 34N 84 17 12W home, 37 58 41N 122 01 48W work Newbie Notice: I speak for LIGCo., CCI, myself, and no one else, regardless of where it is convenient to post from or thru.

1 0

Zimmermann interrogated without counsel
by Philip Zimmermann 17 Dec '03

17 Dec '03

The following is a letter from Ken Bass, who is one of the lawyers on my legal defense team, to US Customs. It is mostly self-explanatory. It concerns the PGP investigation. For those of you unfamiliar with the PGP case, PGP is an email encryption program that is widely used around the world, and was published domestically in the USA as freeware in 1991. As the creator of PGP, I am under investigation by US Customs. They tell my lawyers that they suspect that I violated laws that prohibit the export of encryption software from the USA. If anyone wants to ask questions about this case, contact my lead defense attorney, Phil Dubois, at 303 444-3885, or dubois(a)csn.org. -Philip Zimmermann prz(a)acm.org =================================================================== Kenneth C. Bass, III (202) 962-4890 kbass(a)venable.com Venable, Baetjer, Howard & Civiletti 1201 New York Avenue, NW, Suite 1000 Washington, DC 20005-3917 (202) 962-4800, Fax (202) 962-8300 November 23, 1994 Mr. Homer Williams Acting Assistant Commissioner Office of Internal Affairs United States Customs Service 1301 Constitution Ave., N.W. Washington, D.C. 20229 Dear Mr. Williams: I write on behalf of our client, Philip R. Zimmermann, of Boulder, Colorado, to register a strong objection to the treatment given Mr. Zimmermann at Dulles International Airport on November 9, 1994, when he returned from a trip to Europe. Mr. Zimmermann was invited to Europe to speak on issues of public policy. When Mr. Zimmermann returned to the United States, he was diverted from the normal Customs processing, subjected to an individualized luggage search, and then interviewed extensively by Customs Special Agent Michael Winters. The questions posed to Mr. Zimmermann make it very clear that this encounter was not a routine, random interview, but was a pre-planned encounter. The interview was not restricted to matters relating to Mr. Zimmermann's re-entry into the United States and any proper subjects of inquiry regarding the personal effects he was bringing back with him, but ranged extensively over Mr. Zimmermann's European itinerary and public-speaking activities, as well as prior overseas trips he had taken. Of particular concern to us is the fact that Agent Winters questioned Mr. Zimmermann about possible exportation of PGP, a cryptography program developed by Mr. Zimmermann. This interview was conducted in the absence of Mr. Zimmermann's counsel, despite the fact that Agent Winters was very much aware of a pending criminal investigation involving Mr. Zimmermann who was advised in 1993 by an Assistant United States Attorney in the San Jose, California office that he was a target of a grand jury investigation concerning possible violations of the Arms Export Control Act related to PGP. Agent Winters made specific reference to this investigation in the course of his interrogation. This encounter is deeply troubling for two reasons. First, having such an interview in the absence of counsel when Customs is fully aware of the pending criminal investigation and the fact that Mr. Zimmermann is represented by counsel raises fundamental concerns about Government insensitivity to the constitutional rights of citizens, particularly citizens who are a target of an ongoing criminal investigation. The second major concern is the fact that Agent Winters told Mr. Zimmermann that he should expect to be subjected to the same search and interrogation upon every re-entry into the United States, at least until the criminal investigation is concluded. It is difficult enough for any individual to be the target of an open-ended criminal investigation that seems to have no clear direction, goal or foreseeable conclusion. It is quite another thing to be subjected to official interrogation, in the absence of counsel, about these matters. On behalf of Mr. Zimmermann, we ask that you make appropriate inquiries to determine who authorized this interrogation and why it was continued after Mr. Zimmermann expressed objection to being interrogated in the absence of counsel. With respect to Mr. Zimmermann's future re-entry into the United States, we would expect the Customs Service to strictly limit its contact with him to the conduct of such interviews, declarations and inspections as may be appropriate under 19 CFR Part 148 to determine whether he is subject to payment of any import duties upon his re-entry. As an American citizen he has a constitutional right to return to the United States and it is most improper to use such occasions as an excuse for conducting interviews that would not otherwise be undertaken in the absence of counsel or appropriate judicial process. I am sending copies of this letter to Agent Winters, the Assistant United States Attorney in charge of the criminal investigation, and Mr. Philip Dubois, Mr. Zimmermann's lead counsel in the investigation. If you require any additional information in order to respond to this request, please contact me directly. We would hope to resolve this matter quickly. Cordially, Kenneth C. Bass, III cc: Mr. Philip R. Zimmermann Mr. Michael B. Winters Philip Dubois, Esq. William Keane, Esq. -----

2 1

PRIVACY DIGEST
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Sat, 26 Nov 94 17:47:51 NetSurfer <jdwilson(a)gold.chem.hawaii.edu> wrote: [ commenting on the Privacy Digest post by Gary Jeffers ] The prices they were listing were comparable to shareware. This looks to fall under the "if it seems to good (cheap?) to be true, it probably is" category, based on price alone. [ end ] The copied sheets put out by Williams in Costa Rica falls into that group. I have read many xeroxes from lots of sources in my time and some most useful information have even been given to me anonymously. The problem with the entire list of what Williams is selling (and I have some 90+ per- cent of his crap) is that his very homespun assessment of U.S.A. law and case law is inventive, to say the least. He seems to be influenced by some of the kooky writers in the tax revolt movement. Thus, it really matters little if he is a sting or not. As a rule, I am always cautious when entering into a new relationship and that has kept me out of serious trouble so far. When going offshore, I always assume the worst until I have grounds for believing otherwise. And like Sandy Sandfort, I - too - have been to Costa Rica. Lots of small time villains from the States call that country their home, full- or part-time. Best to be careful about who you confide in. Getting back to NetSurfer's post: I agree that inexpensive information is often too cheap. The best way to learn the ropes are not books, reports nor newsletters and the reason for that seems to be that the best information never finds its way into print. In the world of private placements, few of the big players feel a need to spend their weekends putting out newsletters. Even if they do, they will never incriminate themselves. This is because most either live in the U.S.A. or do at least visit the U.S.A. often. In ten years, if PGP is still legal and if PGP and remailers become easier to use (embedded in wordprocessors) this may change - not the part about them going stateside often, of course, but the part about their willing- ness to speak up about how to use the tools of their trade. Meanwhile, I have found one source to be consistent, reliable and surprisingly alert throughout its several decades of publication. It is a little green news- letter called 'The Harry Schultz Letter', published by Harry D Schultz, a libertarian privacy-advocate / gold bug in Monaco. It runs around $300 a year, however, and so proves NetSurfer's point. No free samples either. For books, get yourself a free catalog with page after page of informative summaries of the books put out by a U.K. firm called Scope Int'l Ltd. They also publish a newsletter every other month or so, free for the asking, even if you never buy a book. Their newsletter deals with international cooperation agreements, offshore and privacy, second passports legally. A useful part is a 3-page long section of small classified ads from all over the globe. Sorry, I have no e-mail address for these people, but be sure to ask them when you call (/fax/write), then post the address to the list. They are: Scope, Forestside House, Forestside, Rowlands Castle, Hampshire PO9 6EE, England, Tel: +44 705 631751, Fax: +44 705 631322. There is also the 'Money Laundering Alert' newsletter put out by a Florida lawyer, ostensibly so that banks can stay on top of what is happening on the legal scene all over the world, where regulations are tightening and so on. Most readers seem to be of the Spanish-speaking variety, however. Well, I guess they have banks in Spain, too... Dadum... For now, I prefer to post anonymously. I would be interested in getting a pseudonymous account of the kind described by 'Nobody' on Friday but would want a better place than mg5n to set it up. "Capt'n Bob" P.S. to Sandy Sandfort - Sorry that I can't quite place you, I am a latecomer to the list. But I seem to recall your name from somewhere in the real world. I have even seen your C.V. somewhere a couple of years ago (sent to Europe, I think). If memory serves you are a journalist with financial experience and have written for something in Florida and for the Tico Times, too? Quite an extensive list, mostly trade magazines/newsletters. You were with some interesting guys in the late 80's, but that is all I remember from the list. Sorry. No offense meant by the P.S. above, but I am getting older and my brain is rotting, also I never keep physical files of any kind. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAy7W3GoAAAEEAMQqHR+mHowjb7JsVxkCRCg0iM3uitOS2cIcctVIuXVJW6ou iumOw2zMURT5LFgGD2XHr7sre8jm9VUGWwFAaRTJB85Kj4Vy2/dGId2kK7Z/YsrE tVQDw75I8UYa3//PS5C2xCZROz5YHVEjvGcl3QqRLw8xVsgG+OZrkMibcPMNAAUR tBpUaGUtQ2FwdGFpbiAoIkNhcHQnbiBCb2IiKQ== =yrC+ -----END PGP PUBLIC KEY BLOCK----- --bob--

1 0

PRIVACY DIGEST
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Sat, 26 Nov 94 17:47:51 NetSurfer <jdwilson(a)gold.chem.hawaii.edu> wrote: [ commenting on the Privacy Digest post by Gary Jeffers ] The prices they were listing were comparable to shareware. This looks to fall under the "if it seems to good (cheap?) to be true, it probably is" category, based on price alone. [ end ] The copied sheets put out by Williams in Costa Rica falls into that group. I have read many xeroxes from lots of sources in my time and some most useful information have even been given to me anonymously. The problem with the entire list of what Williams is selling (and I have some 90+ per- cent of his crap) is that his very homespun assessment of U.S.A. law and case law is inventive, to say the least. He seems to be influenced by some of the kooky writers in the tax revolt movement. Thus, it really matters little if he is a sting or not. As a rule, I am always cautious when entering into a new relationship and that has kept me out of serious trouble so far. When going offshore, I always assume the worst until I have grounds for believing otherwise. And like Sandy Sandfort, I - too - have been to Costa Rica. Lots of small time villains from the States call that country their home, full- or part-time. Best to be careful about who you confide in. Getting back to NetSurfer's post: I agree that inexpensive information is often too cheap. The best way to learn the ropes are not books, reports nor newsletters and the reason for that seems to be that the best information never finds its way into print. In the world of private placements, few of the big players feel a need to spend their weekends putting out newsletters. Even if they do, they will never incriminate themselves. This is because most either live in the U.S.A. or do at least visit the U.S.A. often. In ten years, if PGP is still legal and if PGP and remailers become easier to use (embedded in wordprocessors) this may change - not the part about them going stateside often, of course, but the part about their willing- ness to speak up about how to use the tools of their trade. Meanwhile, I have found one source to be consistent, reliable and surprisingly alert throughout its several decades of publication. It is a little green news- letter called 'The Harry Schultz Letter', published by Harry D Schultz, a libertarian privacy-advocate / gold bug in Monaco. It runs around $300 a year, however, and so proves NetSurfer's point. No free samples either. For books, get yourself a free catalog with page after page of informative summaries of the books put out by a U.K. firm called Scope Int'l Ltd. They also publish a newsletter every other month or so, free for the asking, even if you never buy a book. Their newsletter deals with international cooperation agreements, offshore and privacy, second passports legally. A useful part is a 3-page long section of small classified ads from all over the globe. Sorry, I have no e-mail address for these people, but be sure to ask them when you call (/fax/write), then post the address to the list. They are: Scope, Forestside House, Forestside, Rowlands Castle, Hampshire PO9 6EE, England, Tel: +44 705 631751, Fax: +44 705 631322. There is also the 'Money Laundering Alert' newsletter put out by a Florida lawyer, ostensibly so that banks can stay on top of what is happening on the legal scene all over the world, where regulations are tightening and so on. Most readers seem to be of the Spanish-speaking variety, however. Well, I guess they have banks in Spain, too... Dadum... For now, I prefer to post anonymously. I would be interested in getting a pseudonymous account of the kind described by 'Nobody' on Friday but would want a better place than mg5n to set it up. "Capt'n Bob" P.S. to Sandy Sandfort - Sorry that I can't quite place you, I am a latecomer to the list. But I seem to recall your name from somewhere in the real world. I have even seen your C.V. somewhere a couple of years ago (sent to Europe, I think). If memory serves you are a journalist with financial experience and have written for something in Florida and for the Tico Times, too? Quite an extensive list, mostly trade magazines/newsletters. You were with some interesting guys in the late 80's, but that is all I remember from the list. Sorry. No offense meant by the P.S. above, but I am getting older and my brain is rotting, also I never keep physical files of any kind. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAy7W3GoAAAEEAMQqHR+mHowjb7JsVxkCRCg0iM3uitOS2cIcctVIuXVJW6ou iumOw2zMURT5LFgGD2XHr7sre8jm9VUGWwFAaRTJB85Kj4Vy2/dGId2kK7Z/YsrE tVQDw75I8UYa3//PS5C2xCZROz5YHVEjvGcl3QqRLw8xVsgG+OZrkMibcPMNAAUR tBpUaGUtQ2FwdGFpbiAoIkNhcHQnbiBCb2IiKQ== =yrC+ -----END PGP PUBLIC KEY BLOCK----- --bob--

1 0

Need program pointers
by storm＠marlin.ssnet.com 17 Dec '03

17 Dec '03

Hey all! I'm looking for some program recommendation and locations pointers. Both for MS-dos. First, a good secure delete program. These I know exists, which are good? Second, I don't know if this exists. I've never heard of one but it should! I want a program to go through a DOS hard drive and zero out all the unused sectors. It would also be nice if it zero'ed the tailing disk block after the end of a file. Suggestions? Thanks, Don -- America - a country so rich and so strong we can reward the lazy and punish the productive and still survive (so far) Don Melvin storm(a)ssnet.com finger for PGP key.

3 2

How to not have to trust CAs
by norm＠netcom.com 17 Dec '03

17 Dec '03

I have been reading RFC1422 which describes the hierarchy of authorities (CA = Certificate Authorities) proposed for distributing public keys for PEM and such. One must trust the CA which is a leaf of this hierarchy. If higher elements of the hierarchy are corrupted there is also danger but perhaps it is less. One interesting thing that I learned is that RFC1422 specifically allows for "personas" as in pseudonyms. Their treatment of CRLs (Certificate Revocation List) is most of the complexity and hard to understand and implement. It is a hard problem. Here is a different scheme that involves such a hierarchy but does not require one to trust anyone in the hierarchy except concerning denial of service. The scheme allows one to check the hierarchy. I ignore the revocation problem in this note. The idea stems from an idea that came from Belcore I think. The Belcore idea posits a tree of nodes where each node holds the secure hash of each of its children. The secure hash of the root node is published in the Sunday New York Times and a few other places. There are weekly editions of the tree. If I may want to prove to you in the future that some certain piece of data exists this week, then I arrange to put a secure hash of that data in some leaf of next weeks edition of the tree. If I should ever need to present proof, I display the contents of each of the nodes between my leaf and the root. (I got that list a few days after I submitted my secure hash.) You can compute the hashes of each node and observe that they each occur in the superior node. You compare the secure hash of the root node with what is in the Times. The only plausible explanation is that someone had the data at the date of publication. My CA scheme is a variation of the above. A certificate is a (name -- public key) pair. The names are stored in a tree in alphabetical order. Each node in the tree holds a pair (first name in child node, secure hash of child node) for each of its children. (This is much like a B-tree.) The tree is available thru an untrusted CA. When you request the public key from the CA corresponding to some name, all nodes from the leaf with that name, thru the root are returned. You verify the secure hashes as in the Belcore scheme. You also verify that name stuff in the intermediate nodes is correct. The later is to prevent the CA from showing one public key to some requesters and another key to others. My secure mail agent queries the data base upon each new edition to ensure that my own public key is reported correctly. (Besides being published in the Times, the hash of the top node is transmitted once per minute in video blank time on NBC.) Since the data base can't tell different requesters different things, the agent can be sure that all requesters will be informed of my correct key. I would prefer to change my public key at most once per month and then only with a month's notice. This gives me time to verify that the CA is telling the truth about my PK and warn correspondents otherwise. This avoids the attack of the CA publishing a bogus public key to which it knows the private key in order to decipher mail intended for me. In all, changing public keys may be more dangerous than not! This system still has several flaws. There is a single point of failure. Failure is not immediately catastrophic as old keys can continue in use. If you mistrust the CA you must inform your correspondents quickly, (via a signed message). If there are several such hierarchies then each user with a public key must subscribe to each lest one of the hierarchies lie about his public key. I think that revocation is better solved (easier code and smaller data) by Blum filters but that is another story. The policy revocation problems are still difficult.

1 0

phone security
by Rick Busdiecker 17 Dec '03

17 Dec '03

We have a neighbor who likes to use a scanner to listen in on portable phones, baby monitors, etc.. While I've never used portable phones, I've gotten into a number of discussions with other neighbors about appropriate ways to deal with the situation -- most people don't appreciate my suggestion that they simply stop broadcasting their private conversations (!) Anyway, in a conversation on Saturday I said that without encryption, you basically have no privacy with a portable phone. Several people said that ``900 MHz'' portables are safe from scanners. Does someone know more about this situation? What would be required to eavesdrop on one of these phones? Also, my understanding of the legal situation is that listening in on cellular phones is considered wiretap (at least assuming that intent can be demonstrated), but that most other broadcasting phones are not protected, i. e. my nosy neighbor's actions are merely slimy, not criminal. Is my understanding accurate? Rick

1 0