December 2003 - cypherpunks-legacy

The ITAR, you don't leave home without it.
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

A funny thought just occurred to me. Micheal Froomkin was recently saying that the wonderful ITAR applies to American citizens regardless of country of location. Wouldn't this inane technicality apply to David Chaum in Holland? He is American, right? Ever get any problems at US customs David? The Digicash trial software certainly had crypto in it. I don't remember any export controls.

1 0

Re: Win95 password caching
by Joel McNamara 17 Dec '03

17 Dec '03

I was under the impression that MS used some variation of DES for encrypting the password lists (obviously much more secure than the nonsense XOR encryption used for the screen savers). Joel >This was not the question. He wants to prevent local Windows passwords >from being created for network-only users. This is a serious security >issue, because if a user enters her real network password for the Windows >password, and someone else later picks up the .PWL files, which are not >encrypted in a particularly secure way, then someone can get unauthorized >access to the network as the previous user(s).

1 0

Radiation Detectors from Aware Electronics
by Perry E. Metzger 17 Dec '03

17 Dec '03

There have been several requests for information on the company that makes the radiation detectors with RS232 interfaces that I mentioned. Here is how to reach them: Aware Electronics P.O. Box 4299 Wilmington, DE 19807 Phone (800) 729-5397 (302) 655-3800 Perry

1 0

Clinton Administration Plans 1.5 MILLION WIRETAPS
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Used with Permission From THE SPOTLIGHT 300 Independence Avenue, S.E. Washington, DC 20003 Subscriptions: (202) 546-5621 Technology & Liberty November 13, 1995 ADMINISTRATION PLANS 1.5 MILLION TELEPHONE INTERCEPTS By Clark Matthews clark.matthews(a)paranet.org Janet Reno's Justice Department and the FBI have directed U.S. telephone companies to prepare for up to 1.5 million simultaneous, electronic intercepts on Americans' telephones. The same directive requires the nation's phone companies to complete the necessary modifications to their equipment to create this massive surveillance apparatus from America's public telephone networks. Telephone companies are directed to have these capabilities in place by October 28, 1998, one week before the 1998 elections. The Clinton administration's claimed authorization for this massive high-tech domestic surveillance machine is the 1994 Communications Assistance for Law Enforcement Act (CALEA). The CALEA law is better known as infamous "Wiretap Access Bill", which has been discussed many times in these columns over the past 14 months. The CALEA law continues to be a hot topic because the proposed "Omnibus Counter-Terrorism Bill" of 1995 (H.R. 1710) contains provisions for setting up a national FBI surveillance center and paying for the national eavesdropping system with a 40% surcharge on all federal civil fines and property seizures. "CAPACITY REQUIREMENTS" The administration's eavesdropping diktats are buried in a set of technical "capacity requirements" that telephone companies are expected to meet in order to comply with the CALEA law. The capacity requirements appear on pages 53643-53646 of the Federal Register for October 16, 1995. Computer users can access this document electronically on the internet from the Electronic Privacy Information Center (http://www.epic.org) or by using wais (wais.access.gpo.gov) The "Capacity Requirements" published in the Federal Register correspond to a minimum of 540,000 and a maximum of 1.5 million simultaneous telephone "intercepts" in the United States. These electronic "intercepts" involve several different telephone surveillance techniques. They can record the telephone numbers you call and the numbers of people who call you, and then match the phone numbers in a special database "associating" you with your friends, relatives, acquaintances, journalists, activists, or businesses. They can also be programmed to monitor telephone conversations, intercept faxes, and record communications sessions between computer modems, including computer passwords and digital transactions. Here is a breakdown of the scope of the federal surveillance described by the capacity requirements: * Category 3 -- In 75% of the nation, phone companies must be prepared to activate federal intercepts on a maximum of 0.25% of all telephone subscribers, i.e. 250 telephones out of every 100,000. * Category 2 -- Is ill-defined. Phone companies in Category 2 areas must make their equipment capable of supporting federal interceptions on a maximum of 0.5% of all subscribers, i.e. 500 telephones per 100,000 * Category 1 -- Includes ill-defined "high interest" areas like major cities, where phone companies must be prepared to surveil 1% of all telephones, i.e. 1,000 phones per 100,000 WHAT THE NUMBERS MEAN According to FCC statistics for 1993, there were at least 150 million telephone numbers in our country -- and these figures omitted cellular phones, beepers, pagers, WATS lines, and other non-switched telephone services. Therefore Category 3 translates into 0.25% of at least 112.5 million telephones -- 281,250 intercepts nationwide. Assuming Category 2 equals 15% of the nation's phones, it translates into 0.5% of 22.5 million phones, another 122,500 potential wiretaps. Category 1 is 1% of the remaining 15 million phones: that's 150,000 more people. Add it up: 553,750 intercepts, minimum. And since "major cities" are "high interest" areas, the actual number is more likely to approach one million or more. Even these figures don't tell the whole story. The Justice Department directives have a built-in vagueness that allows areas to be re- defined. They can become "high-interest" hotspots at any time, under any circumstances. A currency crisis, for instance. Or a hotly contested election. Or perhaps a mysterious bombing provocation in the midwest. Furthermore, telephone companies do not have the luxury of meeting the minimum surveillance requirements. It's a technological reality that they must modify their equipment to meet the maximum requirements. That's because the FBI can re- define their surveillance responsibilities at any time, by branding their customers as "interesting". As the FBI's "interest" shifts from area to area, the whole country could rapidly come under the 1% surveillance directive. 1.5 million telephone intercepts. Or more. 'ONLY 1,157 WIRETAPS' The conduct of Clinton's law-enforcement leaders is especially outrageous, now that the true intentions of their KGB-like program have been revealed. When FBI Director Louis Freeh lobbied Congress for the Wiretap Bill last year, he cited FBI statistics claiming only 1,157 federal, state, and local electronic surveillance orders for all of 1993. In sworn Congressional testimony, the FBI director went on to say that his bureau had been thwarted in "several" attempts to intercept communications on specialized telephone equipment. Freeh cited obstacles like digital switches, digital loops, and similar privately owned, computerized business telephone switching systems, which he claimed prevented his agents from listening to telephone conversations, intercepting faxes, and capturing the data exchanged in computer modem sessions. The built-in interception capacity of at least 1.5 million phone subscribers is well over 1,000 times the 1993 wiretapping number given to Congress by Director Freeh. WRITE YOUR REPRESENTATIVES The Justice Department instructed America's telephone companies to respond by November 15th in writing (in triplicate) with comments on their new national telephone surveillance requirements. Why not ask your elected representatives to drop them a line, too? Your Senators and Representative may well wonder how Louis Freeh's 1,157 1993 surveillance orders and "several" failed eavesdropping attempts turned into a license to monitor over a million phones in the nation's telephone system in less than two years. I sure do wonder. The "capacity requirements" for the 1994 Wiretap Law (CALEA) were published in the Federal Register of October 16. They are listed on pages 53643-53646. The address for comments is: Telecommunications Industry Liaison Unit (TILU), Federal Bureau of Investigation, P.O. Box 220450, Chantilly, VA 22022-0450. The FBI expects your representatives to write in triplicate. .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

2 1

Re: Radiation Detectors from Aware Electronics
by sharborth＠hai-net.com 17 Dec '03

17 Dec '03

So what does this have to do with this mailing list?? Skip ______________________________ Reply Separator _________________________________ Subject: Radiation Detectors from Aware Electronics Author: perry(a)piermont.com at internet Date: 02-11-95 23:45 There have been several requests for information on the company that makes the radiation detectors with RS232 interfaces that I mentioned. Here is how to reach them: Aware Electronics P.O. Box 4299 Wilmington, DE 19807 Phone (800) 729-5397 (302) 655-3800 Perry

3 3

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

> On Fri, 3 Nov 1995 clarkm(a)cnct.kom wrote: > > > Thanks for this item! Two little excerpts jump out at me. > > Gee, I hope they didn't spook you too badly when they jumped out at you > like that. I can tell you're a little jumpy. Hi Rich! Thx for changing my domain, I'm sure it fooled SAIC. > > So what is it? 1,154 wiretaps? Or 20,000? > > Easy: both. 1,154 wiretaps, and 20K to 25K intercepts, which includes both > wiretaps and other interceptions, i.e., recording which phone numbers you > call but not actually listening to the conversations. > > Get out of Dodge. You get out of Dodge. 1,154 electronic surveillance orders, about 7,000 pen registers & trap/trace plus 500 FISA warrants, all 1993 if memory serves. Figures as supplied to EPIC, and from memory. > By whom is the FBI being sued? What is the case number? Who are the > lawyers? What are their Bar numbers? How many times have they been > disciplined for bringing frivolous suits? EPIC. Quick!! Fire up your index! > > What's so special about the year 2002? > > Obviously, it is two elections from now, when the UN will invade the US > to impose the rule of the Anti-Christ. > > Oops, I wasn't supposed to say that. But now that you have... Check out the wiretap stats and FOIA responses at http://www.epic.org and come back & quibble some more. .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

2 1

Re: Re: Chaum's cash: backup?
by Jiri Baum 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Marcel van der Peijl, > From: "Marcel van der Peijl" <bigmac(a)digicash.com> > Date: Tue, 24 Oct 1995 14:10:58 +0100 Sorry about taking so long to reply... I'll quote more than usual to make up for it. > > > I could give a hint: your random state initializer is not the too-often > > > used srand( time( NULL ) ) but user-chosen during installation. > > This sounds great... Will the bank be running crack against the proto-coins > > it gets? (Say, at the behest of a LEA?) > It is not the bank's intention to screw the clients, but mostly the > other way around. I was referring to the claim that the system is payer-anonymous. Thinking of it again now, what's to stop Eve the eavesdropper from spying on the proto-coins, running crack against it, and then (later) eavesdropping on the bank-signed coins and unblinding/depositing them before Alice/Bob does? (No, being encrypted by the bank's public key is not enough.) > If the bank wants to screw the clients the easiest > way is to change their account balance. Remember, you trust them with > your money. That's why they're a bank. Yes, but is the bank really interested in protecting privacy? > > Is there any way for the user to re-initialize the random state? > > > Write that initializer down and you can re-generate all coins. > > ... > > That's going to be one hell of a valuable piece of paper. > > (Certainly to your enemies/prosecutors - it reveals the blinding factors > > for every coin you ever spent.) > You may choose to burn it or change random state and have no > recoverability. What do you value more? Your privacy or your money? > Each user will have too choose. a) It would be nice if the protocol didn't require this choice. b) This choice should be made explicit to the user. c) As I noted above, wouldn't it also strongly reduce security? See you! Jiri - -- <jirib(a)cs.monash.edu.au> <jiri(a)melb.dialix.oz.au> PGP 463A14D5 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMJnEeCxV6mvvBgf5AQF2BwP/XdMn6ktMGjToDltqo014kT1i3Z/GGXPr HPW1gBN3RT3Ba9F2Ac+24IVVFqauo1sT+Ecc872UrlQzoF8S524oZfhjh3IW5xRF mpZX48tnQn5nJE/U4XgvcuQ6yw5JOhc2eEVPs2PnKT+RdUogNb9UDAXOKn6+EILc nqosNXK+aMU= =geHb -----END PGP SIGNATURE-----

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by carolann＠censored.org 17 Dec '03

17 Dec '03

This story broke on ABC radio news 26 hours ago. It is still running as lead story. Love Always, Carol Anne...still amazed it's lead story -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Transcript of Bernstein hearing is now available
by John Gilmore 17 Dec '03

17 Dec '03

We received the transcript of October 20's oral hearing from the court stenographer. It's up on the EFF Web site at: http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/951020_hearing.tra… This is from Dan Bernstein's case, which is trying to get the crypto export laws invalidated as unconstitutional. This particular hearing is about the government's motion to throw the case out of court because the courts don't have jurisdiction to decide the issue. Some of it is deep legalese, and some of it is quite readable. There's still no news from the judge on what her decision is, or when she will decide. John Gilmore

3 2

Hit-and-Run Anonymous Posts (Re: "Dr." Fred)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:22 AM 11/1/95, Dr. Frederick B. Cohen wrote: (quoting an anonymous poster) >> The difference, of course, is that its almost impossible >> to have sympathy for Dr. Fred. His hustle is for a hell >> of a lot more than subsistence. He was also never actually >> a master of his field, a fact that becomes increasingly >> obvious as our exposure to him goes on. Now he's reduced >> himself to trying to collect someone else's winnings. > >Sour grapes, and from an anonymous poster too. Oooo - I'm insulted. > >I have been thinking about the issues of anonymity for some time, and I >have been convinced for some time that you can't have both integrity and >anonymity. I thought there might be ways to accomplish this, but the >cypherpunks have convinced me it isn't true. Show some integrity and >tell us who you are. I've also found that anonymous persons are usually the most prone to hit-and-run attacks and flames. I usually only briefly scan anonymous posts and then delete them. Some people hide behind anonymity to launch scurrilous attacks. Best to just ignore them, in my opinion. Exceptions are the cases when an anonymous source has something "sensitive" to contribute, such as the release of the putative MD4 code, and the like. And there have of course been thoughtful anonymous essays. Anonymity is under some assault today. I think it important not to throw out the very basic advantages of allowing anonymity just because some abuse occurs. (The issue is not that "allowing" it is good, but that "banning" it would require drastic and draconian enforcement measures.) Pseudonyms are another matter entirely. Some are classy (Pr0duct Cypher, Black Unicorn, Lucky Green), some are oafish (S Boxx), some are ephemeral. Persistence of the identity, as when backed by digital signatures, is important. (Though not essential, yet.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1