December 2003 - cypherpunks-legacy

Re: The NSA Visits Compendium
by strick at Jihad 17 Dec '03

17 Dec '03

> So, send me your examples. Supply as much detail as you can, including > company names if possible. I'll accept "unnamed sources" if they are > _primary_ sources, but no "friend of a friend told me that...," unless the > details look very convincing. Tim, a friend comments that if you're serious about getting reports this way, you should contact one of the human rights groups (Amnesty International, Article 19...) that gathers reports which are generally believed to be accurate under much more threatening situations. I thought it a good comment. I've worked for amnesty before, and know of their reputation, but now how they attained it... strick

1 0

Re: Sun speaks out - but not to the cypherpunks
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <v02110101acaf51651ef9(a)[204.156.156.4]>, Todd Glassey <todd(a)lgt.com> wrote: [ lines marked > > are from fc(a)all.net (Dr. Frederick B. Cohen) ] > Pardon the flame but I really have just about heard enough of this BS... [...] > >> The area where we can (must) build trust is the computing base. > >> Traditionally, this has been the OS, but in the case of java, it is > >> the java interpreter (such as netscape 2.0 and hotjava). The browser > >> is now the TCB (trusted computer base) for all practical purposes... > > > >Read: The Java interpreter is supposed to be a TCB. [...] > >Who here truly believes that the implementations of Java meet the > >requirements of a TCB? [...] > Dr. Fred, you seem to spend a lot of engery slamming Java and HotJava. [ ... flame deleted ... ] No, here I think Dr. Cohen's comments are right on the mark. The Java interpreter *is* supposed to be a trusted computing base. Do we have any reason to believe that this trust is well-placed? (If you don't agree, go through the Orange Book evaluation criteria, and pay special attention to the assurance sections...) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMIwG2CoZzwIn1bdtAQEpowGAgHiyk0tTQk5SO/3TR5EZRMFmUy/TjQmu NbYIt0R/Tf0g9xWbolm5XN0alu947uJs =UZH0 -----END PGP SIGNATURE-----

1 0

Info: Elementrix POTP
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Forwarded from sci.crypt: In article <45t9oh$6vd(a)newsbf02.news.aol.com>, whmurray(a)aol.com (WHMurray) writes: > In article <45qkp5$8rh(a)netaxs.com>, grendel(a)netaxs.com (Michael Handler) > writes: > > >It > >looked somewhat like a stream cipher that generates its key by measuring > >packet lag over TCP/IP. General consensus was that any key determined > >from public information wasn't secure. > > It uses a new symmetric message key for each message. The key for message > n is a function of that for message n-1 modulated by the content of > message n-1. However, it operates at the message layer, not the TCP/IP > layer. In a given population, everyone in the population can begin with > the same key. As messages are exchanged between any two parties in the > population, they end up with a key which is unique to them. The system is > synchronous. If any traffic between two parties is lost, they must > re-synch; keys between each of the parties and other parties will not be > affected. > > The idea is novel and useful. It will be resistant against most > attackers. It is much less resistant to attacks by nation states that > could have a record of all traffic among all parties. Of course it is not > an OTP nor is it more secure than other modern systems. If anything, it > is a little less so, at least against those who have all of the traffic > and to the extent that more than two parties start with the same initial > key. Of course, its strength is to permit all members of the population > to begin with the same key while ensuring that members of the population > are safe from each other. It also ensures that compromise of the initial > key is not sufficient to read traffic. One must have all the intervening > traffic. Thus, if one comes to the party late, learning the initial key > will not enable one to read current traffic. > > >OTOH, I saw a press-release on Cypherpunks a week or two back that > >claimed Whitfield Diffie and David Kahn had both examined the algorithm > >under NDA, and both were blown away by it. OTOOH, I don't know how much > >Diffie and Kahn know about TCP/IP. > > Diffie knows enough; Kahn less. However, both are geniuses and know what > they need to know. As to their being "blown away," I tend to doubt it. > The idea is useful but not revolutionary. > > >We'll know for sure when they release the details of the spec. And, if > >they go to the logical conclusion of all this secrecy and they *don't* > >release the spec, it won't be worth a bucket of warm snake oil. > > If they have applied for a patent and if the effectiveness of the scheme > does not rely upon secrecy of the scheme, then of course there is no > reason for secrecy. They sent me an evaluation copy of the program and > have been fairly open in discussing it. (No one has suggested an NDA or > even that there were any secrets involved.) While for security I would > rather have Lotus Notes or Secure Exchange, for ease of administration > this program has advantages. > > The product is interesting and less bogus than your meters might lead you > to believe. Few of us would like to have our products evaluated strictly > on the basis of press releases and reports. > > I believe that the scheme infringes patents of which I am aware. > > >

1 0

Internet Security Review
by Doug Hughes 17 Dec '03

17 Dec '03

Just got a copy via mail today. Boy, Dorothy Denning seriously dings Tim May in this issue. Interesting reading to know what the other side is up to nonetheless. She uses some reasoning that will be compelling to many. Doug Hughes Engineering Network Services doug(a)eng.auburn.edu Auburn University

1 0

(Fwd) DIGITAL CASH IN AN ELECTRONIC WORLD -Reply
by Kawika Daguio 17 Dec '03

17 Dec '03

Sir, I am still lurking on the Information Railroad(TM) I am still trying to preserve privacy while maintaining accountability for all parties. Technical solutions are insufficient, no matter how innovative. My greatest problem today is the lack of sophistication of decisionmakers. Very few people understand the technology, economics, and politics of electronic commerce. Keeping governments from making the wrong decisions is difficult. Keeping bankers from doing the same is even more difficult. Most of the discussion occurs between bank marketing and R&D types. Compliance, operations, security, risk management, and legal counsel units within banks are often uninformed about the efforts of the technology delivery groups. It is also difficult to offer financial services to the new world. It is not easy to "know your customer," evaluate risks, and price the risks when you cannot verify their identity or reach them easily. Bankers prefer orderly environments to anarchy. So do governments. ****Extremely Personal Observation***** So do I. I like privacy, I do not need true anonymity nor do I wish to engage in significant interaction or be exposed to anonymous persons. IF SOMEONE WEARING A HOOD OR A MASK COMES TO MY DOOR THEY WILL BE AUTOMATICALLY VIEWED AS AN IMMEDIATE THREAT. I may classify non-anonymous persons as threats after evaluating available information. Banks and governments will similarly look askance at those who wish to wear masks when engaging in commerce. Respectfully, Kawika Daguio THE ABOVE ARE MY PERSONAL OBSERVATIONS NO ONE IN SHOULD ATTRIBUTE THE SENTIMENTS EXPRESSED TO THE ASSOCIATION OR OUR MEMBERS. >>> Timothy C. May <tcmay(a)got.net> 10/22/95, 11:19pm >>> I saw this on the Cyberia list. Those of you near Washington, D.C. may find this worth attending. By the way, one of the speakers, Kawika Daguio, was once on this list (and may still be, though I haven't seen posts from him in a while). --Tim May >Date: Sun, 22 Oct 1995 17:04:32 -0400 >Errors-To: thardy(a)mail.wm.edu >Reply-To: cyberia-l(a)warthog.cc.wm.edu >Originator: cyberia-l(a)listserv.cc.wm.edu >Sender: cyberia-l(a)warthog.cc.wm.edu >Precedence: bulk >From: "Cleveland Thornton" <thornton(a)legalbits.com> >To: Multiple recipients of list <cyberia-l(a)warthog.cc.wm.edu> >Subject: (Fwd) DIGITAL CASH IN AN ELECTRONIC WORLD >X-Listserver-Version: 6.0 -- UNIX ListServer by Anastasios Kotsikonas > > >For those in the Washington, DC area, you may find the following >meeting of interest, > > > >------- Forwarded Message Follows ------- >Date: Sat, 21 Oct 1995 21:54:36 -0400 (EDT) >From: Andrew Grosso <agrosso(a)access.digex.net> >To: Cleveland Thornton <cthornto> >Subject: Please Post > > THE FUTURE OF MONEY: > DIGITAL CASH IN AN ELECTRONIC WORLD > > The evolution of money has now completed >a one hundred eighty degree turn from the point >where our economy began: from a barter marketplace; >to paper currency; and, today, to pure information >exchanged globally over telecommunications lines. >Money is digital, and can be created, utilized, >and transmitted by individuals and companies, as >well as by governments. > > On Thursday, November 2, at noon, the >Computer Crime Subcommittee of the ABA will host >a luncheon program which will examine the birth >and promise of digital cash. The speakers repre- >sent all three of the important organizations >participating in this venture: designers, bankers, >and governments: >

1 0

Internet Security Review
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: Internet Security Review Date: Mon, 23 Oct 1995 15:20:23 PST A1-type: DOCUMENT Importance: normal >Just got a copy via mail today. Boy, Dorothy Denning seriously dings >Tim May in this issue. Interesting reading to know what the other side >is up to nonetheless. She uses some reasoning that will be compelling to >many. >Doug Hughes Engineering Network Services >doug(a)eng.auburn.edu Auburn University Doug, Could you possibly expand on this a little bit? I don't usually see this publication. Thanks! Connie

1 0

Re: Internet Security Review
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:36 PM 10/23/95, Doug Hughes wrote: >Just got a copy via mail today. Boy, Dorothy Denning seriously dings >Tim May in this issue. Interesting reading to know what the other side >is up to nonetheless. She uses some reasoning that will be compelling to >many. This makes me laugh out loud. I have Wit Beer coming out of my nose. My poor trackball's going to take a major Windex job now, boy. Denning *doesn't* go for a fellow(?) Certified Cryptographer(tm), probably because her credentials are all but shot now. She *doesn't* go after someone *paid* to go after *her* in the policy arena, like Banisar & Co., who could beat her with "half his brains tied behind his back". She wouldn't *dare* go after the politicians like (sorry again, Rush) Mr. Newt, who *are* thwarting her monomaniacal campaign to sperm^h^h^h^h^h<insert bodily fluid here>-sample the population for biometric purposes, she goes after *Tim* *Freakin'* *May* for chrissake. Gotta watch that "corrupting the youth of Athens" stuff, Tim, 'cuz Big Bad Ol' Dottie D's gonna get ya! Feh. Hemlock anyone? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

bank wiretapping law
by an224850＠anon.penet.fi 17 Dec '03

17 Dec '03

a law that allows government interception of banking data for intelligence/counterespionage purposes without notification... Date: Sun, 22 Oct 1995 03:11:05 -0400 (EDT) From: The Gate <gate(a)id.WING.NET> Subject: Foreign Intelligence To Become Alien Intelligence To: snet-l(a)world.std.com The following post make me think. What if the goverment could decide to interpret the meaning of the word foreign however they wanted. They could then say that anyone dealing with extra-terrestrials were foreigners, or that anyone not aligned with their thinking was a foreigner. I think that's the direction they're taking. Lee On Sat, 21 Oct 1995, Brad Dolan wrote: > > > ---------- Forwarded message ---------- > Date: Fri, 20 Oct 1995 18:07:35 -0700 > Subject: Lack of secrecy in U.S. Banks > > > I ran across an interesting fragment of the U.S. Code. > > Apparently, the Federal Government may access any banking records > whatsoever if the Director of the FBI (or the Director's designee) > certify that the information is sought for "foreign intelligence > purposes." Further, it is illegal for anybody to disclose that the > records were turned over to the government, or even sought. I do not > know the penalties for disclosure. > > The Attorney General appears to set guidelines for the dissemination > of the information obtained through this law. Note that if banking > privacy is violated for reasons which are not related to > counter-intelligence operations, the victim is unlikely to be in a > position to seek relief from the courts because the privacy violation > is likely to remain secret. > > I've enclosed the law below. I'm not a lawyer, so it raises more > questions than it answers. Perhaps the more skilled readers on the > list will be able to deduce the implications. > > The U.S. Code is available at http://www.pls.com:8001/his/usc.html > > This particular law is available at the improbable URL: > http://www.pls.com:8001/cgi-bin/taos_doc.pl?unix+0+uscode+17566+query+a+Gov… > > Here is the law itself: > > -CITE- > > 12 USC Sec. 3414 01/24/94 > > -EXPCITE- > > TITLE 12 - BANKS AND BANKING > CHAPTER 35 - RIGHT TO FINANCIAL PRIVACY > > -HEAD- > > Sec. 3414. Special procedures > > -STATUTE- > > (a)(1) Nothing in this chapter (except sections 3415, 3417, 3418, > and 3421 of this title) shall apply to the production and > disclosure of financial records pursuant to requests from - > (A) a Government authority authorized to conduct foreign > counter- or foreign positive-intelligence activities for purposes > of conducting such activities; or > (B) the Secret Service for the purpose of conducting its > protective functions (18 U.S.C. 3056; 3 U.S.C. 202, Public Law > 90-331, as amended). > (2) In the instances specified in paragraph (1), the Government > authority shall submit to the financial institution the certificate > required in section 3403(b) of this title signed by a supervisory > official of a rank designated by the head of the Government > authority. > (3) No financial institution, or officer, employee, or agent of > such institution, shall disclose to any person that a Government > authority described in paragraph (1) has sought or obtained access > to a customer's financial records. > (4) The Government authority specified in paragraph (1) shall > compile an annual tabulation of the occasions in which this section > was used. > (5)(A) Financial institutions, and officers, employees, and > agents thereof, shall comply with a request for a customer's or > entity's financial records made pursuant to this subsection by the > Federal Bureau of Investigation when the Director of the Federal > Bureau of Investigation (or the Director's designee) certifies in > writing to the financial institution that such records are sought > for foreign counterintelligence purposes and that there are > specific and articulable facts giving reason to believe that the > customer or entity whose records are sought is a foreign power or > an agent of a foreign power as defined in section 1801 of title 50. > (B) The Federal Bureau of Investigation may disseminate > information obtained pursuant to this paragraph only as provided in > guidelines approved by the Attorney General for foreign > intelligence collection and foreign counterintelligence > investigations conducted by the Federal Bureau of Investigation, > and, with respect to dissemination to an agency of the United > States, only if such information is clearly relevant to the > authorized responsibilities of such agency. > (C) On a semiannual basis the Attorney General shall fully inform > the Permanent Select Committee on Intelligence of the House of > Representatives and the Select Committee on Intelligence of the > Senate concerning all requests made pursuant to this paragraph. > (D) No financial institution, or officer, employee, or agent of > such institution, shall disclose to any person that the Federal > Bureau of Investigation has sought or obtained access to a > customer's or entity's financial records under this paragraph. > (b)(1) Nothing in this chapter shall prohibit a Government > authority from obtaining financial records from a financial > institution if the Government authority determines that delay in > obtaining access to such records would create imminent danger of - > (A) physical injury to any person; > (B) serious property damage; or > (C) flight to avoid prosecution. > (2) In the instances specified in paragraph (1), the Government > shall submit to the financial institution the certificate required > in section 3403(b) of this title signed by a supervisory official > of a rank designated by the head of the Government authority. > (3) Within five days of obtaining access to financial records > under this subsection, the Government authority shall file with the > appropriate court a signed, sworn statement of a supervisory > official of a rank designated by the head of the Government > authority setting forth the grounds for the emergency access. The > Government authority shall thereafter comply with the notice > provisions of section 3409(c) of this title. > (4) The Government authority specified in paragraph (1) shall > compile an annual tabulation of the occasions in which this section > was used. > > -SOURCE- > > (Pub. L. 95-630, title XI, Sec. 1114, Nov. 10, 1978, 92 Stat. 3707; > Pub. L. 97-320, title IV, Sec. 432(b), Oct. 15, 1982, 96 Stat. > 1527; Pub. L. 99-569, title IV, Sec. 404, Oct. 27, 1986, 100 Stat. > 3197.) > > -REFTEXT- > > REFERENCES IN TEXT > Public Law 90-331, as amended, referred to in subsec. (a)(1)(B), > is Pub. L. 90-331, June 6, 1968, 82 Stat. 170, as amended, which is > set out as a note under section 3056 of Title 18, Crimes and > Criminal Procedure. > > -MISC2- > > AMENDMENTS > 1986 - Subsec. (a)(5). Pub. L. 99-569 added par. (5). > 1982 - Subsec. (b)(2). Pub. L. 97-320 struck out ''of'' after > ''financial institution''. > > -SECREF- > > SECTION REFERRED TO IN OTHER SECTIONS > This section is referred to in sections 3402, 3409, 3421 of this > title. > __________________________________________________________________________ > > --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: The NSA Visits Compendium
by Rich Salz 17 Dec '03

17 Dec '03

perhaps we can get epic or eff to archive copies of export requests? Perhaps companies would be willing to file copies of "we asked to export this" after the decision was made?

1 0

robo remailer
by ROBO Anonymous Remailer / Mail Server 17 Dec '03

17 Dec '03

robo remailer is functional again sorry for inconveniences my account is back up this remailer will not be shut down anytime in the foreseeable future my thanks to sameer for not deleting the account while it was inactive and for maintaining c2.org -- ROBO Anonymous Remailer / Mail Server <ROBO(a)c2.org> PGP Key = 8717D1DD PGP Fingerprint: 08 A6 47 EB A2 C6 02 36 35 9A 0E C4 D9 A7 94 4D Send mail with subject: HUMAN to have it redirected to the operator Mail with subject: HELP will be replied to with a help file

1 0