December 2003 - cypherpunks-legacy

Recent articles
by Rich Salz 17 Dec '03

17 Dec '03

Jon Bentley's column in this month's Unix Review talks about protecting data. As with all this columns, it's short but manages to touch on a large number of issues; in this case, using page faults to guess passwords, threat models, and so on. Upside, "The Business Magazine for the Technology Elite" (http://www.upside.com) has an interview with Jim Clark that took place two weeks before the IPO. He discusses in a couple of places how using crypto over the Internet is critical for businesses that can't afford private nets, and how this is an important part of their business plan. (Prof Froomkin: Upside also has an article on "ITEF infighting" you might want to read.) /r$

1 0

Re: Whitehouse "dissident" and net monitoring
by Kari Laine 17 Dec '03

17 Dec '03

> From: lindat(a)iquest.net (Linda Thompson, American Justice Federation) > > The National Security Agency presumably can monitor > >subversive communication on the Internet without leaving any > >trace by "sniffing packets" at traffic nodes. Well they are just doing what their charter says they should be doing - gathering information. > > It turns out that computers from inside the White House have > >kept pretty good tabs on information available on Whitewater, > >Vince Foster, and Mena at a few key repositories on the World- > >Wide Web, a subset of the Internet. I think that's because White House workers has access to net and of course they are surfing like all the rest of us - they are just people you know :-) If that would be part of something hard level information gathering I assure you they would not leave so clear traces. > >Office of the President between August 28 and August 31. If the > >White House is showing a similar interest in other sites on the > >World Wide Web, that would amount to a monitoring operation of > >considerable magnitude. So are you saying White House by itself checked out those places or are you saying that *people* working inside the White House happened to be interested issues available on those sites and accessed them. And so what it is public information when it is on the WWW - isn't it? > > In light of this information, I have the following questions: My guesses are > >(1) Does this constitute "casual browsing" by White House staff, or > > is it, in light of the considerable time and effort spent during > > regular business hours, part of a monitoring or intelligence operation? Probably both > >(2) For what purpose is the information transferred to the White House used? Probably to read it and maybe learn something from it :-) > >(3) Does the White House keep information from these web sites on file, > > and does the White House keep a file on the persons responsible for > > these web sites? Hell I am keeping my own records and on the other hand I am in the process to get/buy/snatch/built a system where I could automatically scan all the newsgroups with some kind of AI system and to keep an eye on certain FTP, GOPHER,WAIS, WWW and so on to keep me bether informed. This partly because this information from interne is getting out of proportion AND quite a big part of it is just rubbish and wasting your time. > >(4) Is the April 9 statement by David Lytel of the White House Office of > > Science and Technology to Amy Bauer of Copley News Service that the > > administration does not monitor anti-Clinton activity on the web still > > operative? Probably they do and they really should. If I was Mr. Clinton (which I luckily am not) I would want my adjudats to prepare a report for me each morning summing up all the possible comments round subject Clinton and The USA from NET: That would be very precisious source of feedback to finetune your acts. And that information is real time. Totally another thing which somehow belongs to this subject should intelligence bodies watch for the net. I am middle reading Spycatcher book. Btw I don't understand all the hype rouund it and I would say in that book there is not enough substance to ban it's printing in certain countries. Anyway again in that book it becomes clear that the most riskiest part of the agent and therefore on of the best way to unweil them is to concentrate on their communications with the coordinators in that particular country or on the communication directed to country behind the operation. So clearly to make agents more succesfull their coummication is the one needing new techniques - how about internet? It is accessible almost everywhere and you can get an account without giving your real identity. By using certain sites you just call in from telephone box give few information or in some places none and you are ready for almost totally untraceable communication. I bet they are using it already a lot to replace clumsy readio communication. Don't get me wrong I vote for freedom of speech(whitch is getting slimmer), privacy (witch there is not much left), no regulation on encryption (which is not going to be) but I don't like these things used against my country's security and steal our intellectual property. Based on this I tend to think every self respecting intelligence organization must have those taps otherwise they are not doing their job properly. > "When even one American -- who has done nothing wrong -- is forced by fear > to shut his mind and close his mouth, then all Americans are in peril." > Harry Truman Truman might have been one of the best presidents US ever had but talk is talk and deeds are deeds. Comments and reasoning is totally my own imagination my employer would propably disabprove them and certainly not they don't represent my employers opinions. Be carefull out there ... Best Regards Kari Laine Kari Laine buster(a)klaine.pp.fi LAN Vision Oy Tel. +358-0-502 1947 Sinikalliontie 14 Fax +358-0-524 149 02630 ESPOO BBS +358-0-502 1576/1456 FINLAND

2 1

Web Proxy Servers
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:26 PM 9/12/95 -0400, hallam(a)w3.org wrote: >If they ever want an anonymous proxy server they are wellcome to use ours. So where's a pointer to it? Others might be interested. Even willing to pay. DCF

1 0

Dirty Pix Ad
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

Financial Times, Sept 13, 1995. Scientist urges action on Internet pornography By Clive Cookson Pornography accounts for about half of non-academic use of the Internet, the global computer network, the British Association science conference heard yesterday. Prof Harold Thimbleby, professor of computing research at Middlesex University, said most parents, politicians and educators had no idea how easy it was to find graphic descriptions of horrific perversions, through any personal computer linked to the net. "If you want to know about any perversion, you can find full details," Prof Thimbleby said, "and they are described in deceitful and evil ways." He was particularly upset by Internet porn sites that masquerade as victim support groups, such as those for child abuse that tell paedophiles how to entrap children. "I have found text, film and sound material that I find extremely disturbing, for example instructions for killing minors for sexual gratification." Prof Thimbleby has been researching the pattern of traffic on the Internet since the beginning of the year. It is impossible to monitor how more than a tiny fraction of the estimated 30m to 40m users utilise the net. But Prof Thimbleby analysed a representative sample of "bulletin boards" and of searches made via so-called "web crawlers" which act like telephone directories for the World Wide Web, the fastest growing part of the Internet. He said his conclusion - that pornography accounted for about 50 per cent of the searches - tallied with recent US findings about the dominance of porn on the net. "There is no reliable way, technical or otherwise, to detect or intercept pornography," Prof Thimbleby said. Censorship of the Internet was impossible, because pornographers could easily disguise their material. And censoring programs such as SurfWatch and Internet Filter could not cope with all the fast-changing pornographic material. Because censorship was technically and politically impractical, Prof Thimbleby suggested that a better response was to dilute the pornography with other material. "The Internet has very little interesting material for the non-specialist user. It needs more," he said. "When it has more, it is just possible that pornography will slip into its statistically appropriate place, one aspect of humanity but not the most prominent on the Internet." -----

1 0

Software vs Money Laundering
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:48 AM 9/13/95 -0400, John Young wrote: > Can artificial intelligence be used to combat crime by > ferreting out money laundering? Officials at law > enforcement, defense and intelligence agencies like to > think so. They have suggested creating a sophisticated > computer program to screen records of the more than > 700,000 electronic money transfers involving U.S. > institutions each day and to flag suspicious ones for > further investigation. By using AI, they hope to stop > some of the $300 billion in profits from drug deals and > other illegal activities that they estimate is laundered > world-wide each year. But in a report issued yesterday, > the congressional Office of Technology Assessment says > any such plan would face considerable obstacles. > [Cyberian Joel Reidenberg, an OTA advisor, is quoted.] > Not the least of which is that money launderers can use "AI Software" to generate a stream of real and dummy money transfers that emulates "normal" money transfers. Not to mention the fact that monopoly money transfer networks that can be surveilled by the Feds (FEDWIRE and SWIFT) are not long for this world. They will be replaced by encrypted, open, net-based systems. DCF "Yes Virginia, one *can* have an encrypted, open system. In fact, that's the best way to have an open system."

2 1

Re: GAK/weak crypto rationale?
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Brain Davis writes: [...snip...] > Particularly effective were the court-approved video and audio > tapes of the Speaker taking a bribe in exchange for certain action > on legislation [...snip...] > Wiretaps, hidden microphones, and hidden cameras put corrupt > politicians (I know - redundant) out of business. Encryption does little to protect you from hidden cameras and microphones (or informants!). If you already know your target then you can probably get around encryption (sure it's not as simple as a wiretap, but hey, nobody said it had to be easy). Encryption prevents 'fishing expeditions' and unauthorized monitoring; this is what the LEAs don't want to admit. andrew

1 0

Can GAK be made "not interoperable" with PGP?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:34 PM 9/13/95, Hal wrote: >I think this is setting up the rationale for software key escrow. One of >the big loopholes in this idea has always been that it would be easy for >bad guys to superencrypt or otherwise bypass the legal encryption. The >response has been that the systems will be designed so that compliant >systems will not interoperate with rogue systems. And the counter-response ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >to that was that criminals (and privacy advocates) would use software >which would operate compliantly with conventional programs and maintain >privacy when talking to other rogue programs. But is this even possible, to make a GAK system "not interoperable" with, say, PGP? Unless the GAK system has some sort of entropy analyzer, and can recognize high-entropy sources which it presumes to be encrypted data (*), one can of course PGP-encrypt a text file and then GAK the resulting file. Many of us are already using PGP mostly in this way, i.e., writing files in text editors, PGP-encryting and getting an ASCII file back, and then sending. GAK will still have to deal with this mode. (* On the idea of entropy analyzers. This is implausible, for many reasons. Any high-entropy file could have the entropy reduced by padding with low-entropy sources. And there would be "false positives." Some ostensibly plaintext posts are so incoherent (;-}) they might be "rejected" by such a GAKalyzer.) So, is any conceivable GAK escrow system possible that cannot be used with other crypto programs? Text is text, unless the GAK program purports to accept or reject the text based on entropy considerations. And I can't imagine that part of the GAK program would be robust against hacking. >This new line will be used to respond to this argument, I think. Even if >it is admitted that there is no way for the government to be able to tell >what the criminals say amongst themselves, it will still be useful to be >able to tell what they say to other people. Therefore software key >escrow will be argued to still be useful even though it can be defeated. But such traffic analyis is made moot by remailers, as we all know. What I think we may be facing, if the folks pushing GAK are really serious about all this, are restrictions on *who we may mail to*!!! For if Alice is "allowed" to send a message, GAKked or not, to a remailer.... (I can speculate about laws saying only "internationally registered" sites can use e-mail, but this seems impractical in the extreme...lots of issues.) The GAK advocates need to realize that superencryption will be as easy as it is today to use PGP, and that even traffic analysis will be defeated if remailers are used. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Scientology tries to break PGP - and
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Henry W. Farkas <hfarkas(a)ims.advantis.com> writes: >On Tue, 12 Sep 1995, S. Keeling wrote: > >> I would just like to point out that, when a LEA comes to you >> to get at the contents of your computer, (s)he is not going to >> patiently wait while your system wipes the offending evidence off your >> hard disk. ... >> they can work from the copy. Besides, you do have backup tapes laying >> around all over the place, don't you? > >They have to decrypt the file sometime if they want it's "contents". > >I use the -w option when encrypting. After encryption, the "dummy" file >(would be) embedded and the plaintext is wiped. ... And the idea is that on decrypting with the 'wrong' key, it outputs the dummy file rather than the real plaintext, correct? > ... Don't back up plaintext and what is the problem here? >Where will they get the "real" data from? What does it matter where the >decryption takes place? ... Why would they use your copy of the program to decrypt the file? They could just use a version that lacked this 'feature'. Of course, they still couldn't get at the real plaintext unless you gave them the key, but you are right back to the same old standoff where they say, "Give us your key," and you (try to) say, "No." -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

4 3

An opportunity not to be missed
by David C. Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It has occurred to me with the approach of the presidential campaign in the US (and its attendant press frenzy), that there is an an unprecedentedly vast opportunity to bring certain items on the cypherpunk platform into the public spotlight. There are two planks of this platform that I believe: 1. would benefit from this exposure; 2. would be relatively easy to inoculate among the press and/or the candidates (actually, inoculation of the candidates, with subsequent propagation by the rabid campaign press). The first of these has to do with net.censorship, and formal recognition under law of ISPs' common carrier status. The second concerns remailers. I'll deal with each in turn. I believe that, given the hunger of the candidates for as much exposure as possible, that one of them might be persuaded to take a part in the Scientology fracas. (This would have to happen fairly soon, since it looks like the Church <spit> is losing some major battles lately - the brand new news from Denver re:FACTnet and the ruling in VA concerning Arnie Lerma and the Washington Post). The desirable features of such a candidate might include: a certain amount of current power, marginal current press exposure, fairly deep pocketed financing, an anti- regulatory stance, and a smidgeon of net awareness. It should be fairly straightforward to convince such a candidate that: 1. there would be tremendous increase in exposure due to the songs of praise from netizens (whose influence is most likely to be overly discounted by campaign strategists, IMHO, at this point in time), and from the mainstream press (especially Time magazine and the Washington Post, for obvious reasons). 2. that the exposure would be worth the peril of inviting the wrath of the Church <spit>. The payback of the press coverage of such a candidate would be infection of John Q. Public with the idea that ISPs are no more responsible for content of carried messages than the phone company, and an anti-censorship stance that does not make him (John Q.) pro-porn. This last is a huge flaw in the current battle for free speech on the net, IMO. (Thank you Marty Rimm.) If this issue could be refocused, I think that John Q. (and Jane) would find it much easier to support. The second plank that could be potentially advanced is anonymity. Anonymous remailers in particular, but the benefits of anonymity to users of the Net in general as well. I propose that we get some likely candidate (actually, a similar candidate to the one above) to advocate the benefits of anonymity on the net. The "spin" that would have to be used would depend on the particular candidate, but let's for example we have: Candidate Posturing Required Spin ----------------------------------------------------------------- Pro-business, tough on crime anonymous crime tip e-mail a la Fed whistleblower stuff, and the SPA Pro-choice, womens' vote anonymous support services Of course, there are many more examples, but we'd have to see which postures this campaign's candidates are going to pick. Of course, I am somewhat cynical in my advocation of the particular "Required Spins" (the SPA support, especially), but I feel that the threats to privacy and public use of strong encryption (which walks hand in hand with the use of the remailers, naturally) are worth the potential risk on other fronts (the burgeoning software patent silliness, eg). You may ask why these candidates would be interested in this type of thing, and my response is that they can be forced. The religious right has no problem bringing their agenda into the public spotlight and forcing their issues onto candidates because of their willingness to use hyperbole and fanaticism (not to mention pressure on advertisers and other sponsors). I believe that netizens in general, and cypherpunks in particular can bring similar, and more reasoned, pressure to bear. I think that our job is easier than the religious right because it should be trivial to enlist the support of the mainstream press on these issues, and to direct the anti-federal ire that has been building in the US. In addition, Democratic candidates that are currently in office would love to have some way of attacking the Republican plans for this session of Congress. An attack on net.censorship via the CDA and the telecomm bill could be seen as the ideal place to attack the Republican agenda, and thereby the success of Republican candidates in the presidential race. <whew.> Let the flames begin. - - David C. Lambert dcl(a)panix.com (finger for public key) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFcB+qpplsfgM88VAQFdewP9G0aHVTweUeCMa7J7Xhtu2R4cID6yP/J3 7WS5OicRWfl/hPRXj1Db74A9tDrkStEfobbL/2H6CsO9N4wZNgcDLQAa5MjX8ujf 0EF6v57nlcANb1qLJ5kmwfGj96PUMDtw00409tin3KssRAL0uz/lL9SWP/Mhj9q5 emZHYW3VC3c= =bTsO -----END PGP SIGNATURE-----

2 1

Re: Whitehouse "dissident" web site monitoring?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:03 PM 9/12/95 -0400, Brian Davis wrote: >Unbelievable!!! To add to this distressing truth, I have learned that >the White House also subscribes to a number of newspapers and periodicals >which are reviewed for things of interest to the Administration and to >the President. I I I I I I ammmmmmmmmm shocked! The government, as you no doubt know, sometimes operates under different rules. Thus when the "Red Squad" (Intelligence Division) of the New York City Police (located in that big building on the North side of Vandam between Greenwich and Houston BTW) was sued for maintaining files on "lawful protest groups" they entered into a consent agreement to refrain from this sort of thing. Later, the courts said that this agreement meant that the cops couldn't even listen to WLIB radio (NYC's favorite radical African-American station) to find out in advance where rallies were going to be. Since the White House is doing this reading of sites with public funds and since that institution is the most powerful in the world --- it can nuke its enemies, for example --- people are naturally interested to discover if they are the subject of an investigation. This is a demonstration of the unintended effect of electronic surveillance technology. The fact is that it can do more harm to the authorities than to the public. The Nixon Tapes/The Thompson Square Park Riot Video/The Rodney King Video. Since those in power are more interesting than ordinary people, they represent a more "target-rich environment." Information about their activities has greater commercial value and is thus more likely to see the light of day. DCF "There are more of us than there are of you."

2 1