December 2003 - cypherpunks-legacy

ABA Draft Digital Signature Guidelines Open for Comment
by Michael Froomkin 17 Dec '03

17 Dec '03

The long-delayed ABA draft digital signature guidelines are now available for public comment. This is potentially an important document, and is worth some time for those interestested in the legal and economic effects of digital signatures. An internet version and more info can be found at: http://www.intermarket.com/ecl/digsgleg.html The comment period ends Nov 30, 1995, so don't delay. Due to the ABA's Section on Science and Technology's fear that its intellectual property will be ripped off, the document is in a strange "read-only" format, relying on the "Common Ground Mini-Viewer". The program has been designed to prevent users from printing their own copy of the document. Paper copies can be ordered from the ABA for $15 (see website for details). I would apologize on behalf of the ABA Information Security Committee for this user-unfriendly method of distributing the document (it certainly makes quoting from it in your comments difficult!), but the Chair of the Committee, Michael Baum, unilaterally removed me from the Committee a few days ago. I nonetheless urge you to read this interesting document. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's hot here. And humid.

1 0

Re: I want to learn!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

>>From: VINCENT810(a)aol.com >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > Me Too, I'm catching on but some help would help ! > Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu Okay, places to start. Go to the cypherpunks ftp site ftp.csua.berkeley.edu/pub/cypherpunks and look around. TCMay's "Cyphernomicon" FAQ is a must, although it's really really big. It's been Weblinked somewhere, but I fail to recall. It's also been ZIPped somewhere. Buy Bruce Scheiner's (sp?) "Applied Cryptography." Actually, don't. A new Second Edition is coming out next month. Read the list, hopefully not posting lame newbie messages like "I want to learn how to be a cypherpunk!!!!" Smile.

1 0

Re: I want to learn!
by Rob.Lowry＠on-ramp.ior.com 17 Dec '03

17 Dec '03

> >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > > Me Too, I'm catching on but some help would help ! > > > Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu 1)Read the FAQ (sorry.. don't have the address for it handy.. Tim, ya got it?<g>) 2)Read up on crypto, politics and economics.. mighty dry reading for most, but damn useful around here. 3)Practice safe encryption- Use PGP or any other encryption you are comfortable with. But be sure to always use it. (Wrap that data) 4)Develope a strong urge for privacy and then strongly fight to protect it. This means you may have to write letters to Congress and the Senate, may have to defend yourself to non-crypto orientated folks, and so on.. 5)Practice what you preach, and preach what you practice. Share the knowledge with anyone who is interested.. 6)Send $10.50 to me for the genuine 'Cypherpunks Starter kit' which includes a cheat sheet of really cool Jargon, a pair of black sunglasses, and high quality laser reprints of the FAQ.. mail that to: Cypherpunk PO Box 288 Rockford, Wa 99030 <g> RobL ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

Anonymity: A Modest Proposal
by John Curtis 17 Dec '03

17 Dec '03

I think that what you propose could be modeled as an anonymous remailing distributed process. If designed correctly, such a process could be made extremely difficult to shut down (even for us!) There are more than enough texts written on how to do this correctly; no need to reinvent the wheel.

1 0

Re: Postscript in Netscape
by Rob.Lowry＠on-ramp.ior.com 17 Dec '03

17 Dec '03

>> Obviously everyone should heed perry's warnings and emasculate >> their postscript interpreters before using them to view files >> of unknown origin. > >WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to >be secure - regardless of the user's use of their product. Otherwise, >the ads should read: > > "Netscape can be used securely by sufficiently knowledgeable > users who have emasculated their postscript interpreters before [SNIP] I have to disagree here.. There is such a thing as overstating the obvious. And a statement such as the one you propose is definately in that range. If the user is knowledgable about system ops that come from external apps, such as the PS interpreters, Java or whatever, then they should take appropriate security measures themselves. If they are not skilled or versed in such subjects, you can bet they will be after the first incident of 'cyber-vandalism'. Ignorance is not bliss, and you, and only you, are responsible for protecting yourself in 'cyberspace'. Heck, I can see it now: "Sex can be used by sufficiently knowledgeable users who have educated their partners before using them to attempt comply to acts of contortion, sustained physical activity, voluntary dehydration, and who have removed all other known, unknown, and/or undisclosed partners from their systems. Otherwise, sex unsafe and should not be attempted." Again, overstating the obvious... RobL ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

50 attacks on Netscape - please send the check
by fc＠all.net 17 Dec '03

17 Dec '03

50 Attacks: a.k.a. Why Not to Run Hot Java in your netscape (or other) browser: Concept 1 - Hot Java code that, once started, takes and retains control of the viewer. It includes hot buttons, etc. that let you use common resources on the net, store favorite places, etc. When you push any button in this window, it simulates Hot Java within its own code, but all reads and writes contain code to restart the program (such as the "remember favorite places" button, etc.). Attack 1 - It records all entries and sends them to an unfriendly. This includes credit card numbers, etc. Attack 2 - It reroutes all traffic through a known site to record information about all of your accesses. Attack 3 - It selectively multiplies dollar values on purchases up by a factor of 10 when you authorize purchases through their store. Attack 4 - It reroutes all purchases through their intermediary and adds 20% for the service, thus becoming the middle person in all your transactions. Attack 5 - It replaces select information from select sites with false or misleading information - particularly about the competition. Attack 6 - It reports certain sites as down, thus damaging the reputation of those sites. Attack 7 - It sends requests to sites and ignores their answers to increase hit rates on key vendors that pay for their W3 sites based on usage. Attack 8 - It gets dirty pictures using your credit card information and sends it to another recipient. Attack 9 - It implements an anonymous remailer for smut, thus making you the smut capital of the network. Attack 10 - It waits till you save another Java code from the net and replaces the code with its own code and a pointer to the code you thought you got. Attack 11 - It waits till you save a file and overflows your disk with garbage. Attack 12 - It sends displays that flash on the screen at a rate that causes epilectic seizures. Attack 13 - It puts up subliminal messages to cause you to accept its subsequent request to overwrite a .com file onto your disk. Attack 14 - It analyzes your typing style to determine psychological factors and stores that information in a database. Attack 15 - It analyzes your typing style to determine psychological factors and, if you are a child, connects you to child pornography rings. Attack 16 - It sends requests for URLs to numerous addresses on your network, records results, and returns a network map to the attacker. Attack 17 - It uses spare time when you are not computing to participate in codebreaking activities, including the breaking of netscape codes. Attack 18 - It sends massive quantities of email to mailing lists creating the impression that you are not a nice person (a spammer) Attack 19 - When it recieves incoming email, it sends copies to newsgroups who now have access to all your personal incoming mail. Attack 20 - When you send outgoing email, it sends copies to newsgroups who now have access to all your personal outgoing mail. Attack 21 - When you send outbound email, it adds insulting or abusive humor to the end of your signature line. Attack 22 - It is used to send and receive email as part of a right wing group's coordination activities aimed at overthrowing the government. Attack 23 - It slowly fades your screen till you think the display is going bad, forcing you to buy a new display. Attack 24 - It slowly degrades performance causing you to think you need a faster computer. Attack 25 - It sends threatenning email to the President under your name, getting you arrested. Attack 26 - It sends embarassing email to the New York Times getting you fired. Concept 2 - Hot Java code that sends all of your messages through my computer and gets the results back from my computer by rewriting URLs on-the-fly. Attack 27 - Attack 3 from above, but with more intelligence so that amounts are changes less obviously. Attack 28 - Attack 4 from above, but it also changes the costs on incoming information so that you can't detect the price change in the process. Attack 29 - Attack 5 from above, except that it is more sophistocated - like creating misspellings or poor formatting or moving the locations in maps so that when you push on one part of a map, it sends a different part to ther server. Attack 30 - Attack 6 from above, except that instead of reporting servers down, it makes them seem very slow, or misses lines of pictures, etc. to make them look bad but without causing trouble reports. Attack 31 - Records all credit card transactions and forward information to services that pay to know what you buy. Attack 32 - Determines whether you look at dirty pictures and, if so, sends the information to criminals to use against you in shakedowns. Attack 33 - Replaces legitimate calls to children's pages with child pornography - including solicitations for where you can become a star. Attack 34 - Adds subliminal messages to sound files that cause you to enter a murderous rage (as in the claims about acid rock a few years back). Attack 35 - Adds dirty pictures to video files causing you to become sex-crazed and commit sex crimes and have bad dreams. Attack 36 - Causes simulated waviness on the screen, resulting in dizziness and increased sick time at work. Attack 37 - Introduces high frequency buzzing that irritates people and causes them to become more violent and less cooperative. Attack 38 - Introduces low frequency beating (similar to the tactics used against the Branch Dividians and in Viet Nam) to weaken your resolve and then asks you to confirm the upload of a program. Attack 39 - Creates subliminal feedback to your use of the Web to get you to tend toward particular services and away from others. Attack 40 - Adds background advertising to all your pictures. Attack 41 - Replaces the background information provided by Web sites with the attackers background advertising. Attack 42 - Shifts frequencies of sound files from select other sites so they seem off-pitch and don't reflect well on those companies. Attack 43 - Reroutes all of your Web requests through the NSA and CIA so they can do better intelligence. Attack 44 - Causes select Web sites to require User ID and Password information before use (particularly company Web sites) so as to get you to reveal your UIDs and passwords. Attack 45 - Renames Web sites so that your remembered sites only work for a few days and then the pointers appear to go away. Attack 46 - Puts a lot of really interesting things on your screen, thus making you believe that the Web is really great, and then removes them from accessibility when you try to get them again. Attack 47 - Universally replaces the work AND with OR in all Web information. Attack 48 - Randomizes all 5-digit numbers sent via the Web, thus confusing all zip codes contained in address fields. Attack 49 - Sends a series of high frequency sounds combined with screen flashes designed to cause permanent brain damage. Concept 3 - There is a chosen plaintext attack against the RSA (published in the 1980s in a Crypto conference (IACR?). Attack 50 - Use your Hot Java capability to sign selected message after message till the attacker derives your private key. I think this takes one or two messages per bit of private key. Bonus Attack (no extra charge) - If they use your PGP random number information, they get your PGP key too! Netscape: Please send your check for US$50,000 to the address below. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

6 5

Digital Signature Guidelines
by Patrick Horgan 17 Dec '03

17 Dec '03

It seems that your embedded viewer doesn't want to work on my UNIX box. It makes it quite hard to comment on your guidlines. Apparently, from the way you're presenting this you have no real desire to get any industry consensus. Perhaps you only want people that use Windows to have an oportunity to comment. Mac users and Unix users not welcome. I find the whole need to have yet another viewer annoying. Haven't you guys heard of industry standards? Annoyed, Patrick J. Horgan -- _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Re: Anonymity: A Modest Proposal
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 6:53 AM 10/18/95, Hal wrote: >Now, since I have set it up this way, which was about two years ago, I >have not received a single complaint about operating the remailer at >alumni.caltech.edu. Nobody sends me mail saying "your system is >accepting objectionable messages." Instead, all the complaints I get are >about the Portal remailer (averaging one per week, probably). People >complain when they receive a message or newsgroup posting that they find >objectionable. They don't care if some system is accepting messages. >They care about the system which is sending them. > >This has always been the weak link in the remailer system: the last >remailer in the chain takes the political and legal heat. If there is >ever a libel or copyright infringement suit, or criminal prosecution, >against a remailer it will almost certainly be against the last remailer >in the chain. Those are the source of the complaints and those are the >ones which people try to shut down. Well, when some folks want to circumvent this kind of last-link accountability (even if they are the _only_ link), they simply forge their headers--so why not incorporate that tactic into the remailer net? Also, maybe apropos...It seems to me that there should be a way, within the remailer net, to synthesize forged-path strings with the "Human ID through insecure channel" remarks you made a few days ago. Ted

2 1

SciAm Bye-Byes Privacy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Scientific American, November, 1995 Rights of Privacy Technology has its eyes on you Privacy, as George Orwell pointed out, rests on some level on a bargain between people and their machines. Long before 1984, communications technology had the potential to become surveillance technology. Now it is. Not, as Orwell might have predicted, because Big Brother wants to keep his subjects in thrall but simply because most people want it to be. By giving up some protective anonymity, people get safety and service. A majority seem to think the bargain a very good one -- which is why everybody should look very carefully at the fine print. Somewhat ironically for the nation that gave birth to Orwell, Britain is leading the way in creating the kind of society that he taught the world to fear. More than 300 British city streets are wired for 24-hour surveillance by closed-circuit television cameras. From control rooms, police and private security officers scan everything that moves, or doesn't, and dispatch police officers to investigate anything suspicious. More cities are getting wired all the time, often by popular demand. Whatever qualms Britons have about privacy, they are more concerned about crime. The cameras do seem to reduce crime -- at least in the areas underneath the cameras. Academics point out that surveillance seems to have no impact whatsoever on the overall level of crime, which is rising, but people just don't seem to care about where the muggers go when they leave their neighborhood -- particularly when their neighborhood wasn't too good to begin with. Safety is not the only reason to embrace surveillance. At the Olivetti Research Laboratory in Cambridge, for instance, Andy Hopper and his staff have for years worn tiny badges that inform their computers where they are each minute. The point is convenience. Computers automatically bring to the screen the work of the person sitting in front of them. Calls are forwarded to the telephone nearest wherever they happen to be -- unless the computers detect three or more badge wearers gathered in the same office, in which case they are assumed to be in a meeting, and calls are forwarded to their voice mail. To make life more convenient still, Hopper is trying even cleverer technologies. Some chairs now contain compasses that monitor whether they are pointed at a screen, and, if not, the screen is dimmed to save power. Such devices, Hopper reckons, are crucial to making computers effortlessly easy to use. As he puts it, "You can't have personalization without identification." But the search for personalization in a high-tech world may create an uncomfortable situation in the global village. Villages are safe places but not very private ones. Mrs. Grundy, peering from behind her lace curtains, did stop housebreakers. but she also tried to halt many other things of which she disapproved. There are signs that Grundyism is returning to Britain. Many of the crimes recorded by surveillance cameras are worryingly petty. Arrests for urinating in public have soared. For better and for worse, cameras that can see in the dark now line romantic walks to the beaches in seaside towns. In Britain, as elsewhere, technology and politicians are about to deepen the privacy dilemma. Cameras are being linked to smarter computers that can identify people. Some drivers receive tickets without human intervention. Video cameras check their speed and read their license plates. Along with a ticket, the owner is sent a photograph of the car and driver at the time the speeding was clocked. A number of companies are touting technology that can recognize faces by matching video images to digitized photographs (from, say, drivers' licenses). The British government, like many others, is also discussing plans for a national identity card that would, by giving everyone a number, make it easier to keep track of personal data. The selling point is convenience. Much of the work of filling out forms in bureaucratic Britain is simply to give one branch of government information that another part already has -- or to correct information that bureaucrats have got wrong. Convenient though it may be in theory, the combination of national identity schemes and surveillance cameras promises to give governments many of the powers of an all-seeing God. And there are many reasons to worry that mere humans would not be as merciful or as competent. Two aspects of surveillance will prove crucial in determining the practical terms of the new privacy bargain now being struck: choice and reciprocity. Unlike the subject of video surveillance, the wearer of one of Olivetti's badges can remove the device and disappear from the system. His electronic identity is entirely a voluntary one: if he wishes to forward all the telephone calls the old-fashioned way, by hand, there is nothing to stop him. Surveillance becomes less intrusive if it is optional. But choice cannot be a cure for all the potential ills of surveillance. As electronic personalization makes electronic identification more important, that choice becomes harder to manage. One problem is forgery. If electronic identities can be taken on and off like sweaters, the risk that fraudsters will be able to put on somebody else's identity rises. Besides, as such identification becomes more important, the sheer effort required to live anonymously will render choice moot. Anonymity will simply become too much work. Real village traditions offer hope for the lazy and the identifiable. In village life, surveillance was reciprocal: if Mrs. Grundy knew a lot about you, you also knew a lot about her -- and you knew what she knew about you. Technology should further extend this reciprocity. The badges in the Olivetti lab provide a way of locating any badge wearer. But they also allow badge wearers to track anybody who is trying to locate them. There can indeed be no personalization without identification, but there is increasingly little excuse for identification without notification. The same computers and networks that send faces, names and numbers whizzing around the world could also be required to send notification back to each of those identified, each time they have been spotted. Even as the world becomes more personalized and less private, there is no reason for the electronic global vilage to become less personable than a thatched one, or less fair. Photo caption: Video cameras will scan the crowd at the 1996 Olympic Games in Atlanta. The security system can transmit images for identification. --John Browning ---------- The issue also has a brief report by Paul Wallich on "Meta-Virus: Breaking the hardware species barrier," which reviews recently-publicized security flaws in the Net, with quotes by William Cheswick of AT&T Bell Labs on the issue and Hot Java.

1 0

Re: I want to learn!
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Wed Oct 18 12:55:39 1995 In article <199510181437.HAA00477(a)jobe.shell.portal.com> anonymous-remailer(a)shell.portal.com writes: > Date: Wed, 18 Oct 1995 07:37:30 -0700 > > >>From: VINCENT810(a)aol.com > >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > > Me Too, I'm catching on but some help would help ! > > Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu > > Okay, places to start. > > Go to the cypherpunks ftp site ftp.csua.berkeley.edu/pub/cypherpunks > and look around. TCMay's "Cyphernomicon" FAQ is a must, although > it's really really big. It's been Weblinked somewhere, but I > fail to recall. relevant sites: Home: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/Home.html Archives: http://www.hks.net/cpunks/index.html Cyphernomnicon: http://www.oberlin.edu/~brchkind/cyphernomicon/ -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMIUxjIJYfGX+MQb5AQGURQP/dLUUkrY8H5cHhP5T4K58R0u5yjpN8qWa 9eX64STHz+MEl7favlTWiGXcAZdI0lV6Z9UMdt1FWfo30DrJne1TK8Zm3e/BIzUQ Vglxr7LbV4GckXIiM6zKXNIOlTipKTq6QLjLzS7n4Al2ElC8F1pPkAZNLUsrn4n5 95sbh0Cv2xg= =5EjT -----END PGP SIGNATURE-----

1 0