December 2003 - cypherpunks-legacy

RE: using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: John Curtis \ Internet: (jbell(a)capecod.net) To: amp \ Internet: (alan.pugh(a)internetmci.com) Subject: RE: using pgp to make an otp JC> I was confused and answered a question you didn't ask. I guess you JC> can use PGP to generate a set of pseudorandom numbers. I'm not sure JC> that this would be different from using the IDEA cypher (the JC> underlying PGP cypher) to generate random numbers. I am also not JC> convinced that this would be quicker or cheaper than any number of JC> other mechanisms. JC> If I really wanted a true one-time pad, I'm inclined to explore the JC> thermal noise of a zener diode. isn't the noise generated by such a diode more accurately described as chaotic rather than random? i would think that there might be potential problems with using chaos as a random number source. it might be somewhat less random than you may think as most chaotic system's 'noise' operates within definable parameters. (like a lorenz system). i _would_ think that it would act as a most excellent prng, but exactly how _truely_ random it actually would be i couldn't say. while it may not be _truely_ random, it would most likely be cryptographically secure though. i think generating _true_ randomness is pretty difficult without measuring something similar to radioactive decay. the system that i proposed setting up is, admittedly, a p-otp at best. i'm much more convinced of this than i was when i initially proposed it. the comments i've gotten on it were most enlightening. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 November 9, 1995 11:41 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMKIvRIdTfgZXlXydAQG0zAf/Y0qX8X6mFa932Egm0PdBZr4RCBHqPccx 5Nb5KZi1jQPRFnoAoEgU6Z6P+SLWCGhZisn1UxvlD2eX6HbbPB/B0mHReoWw/qp2 hI7rWCn+JtSwUvxeno88zFmZ/AreAukm8LNi/PdJp+5lunDgclrOWoR5BklglqT8 iE2nxd6dhbUEKUYXzsN6yEXDRl/tUDiriEVev2YhttTZuyUg9krMa32VtyxyUCeB UfhidSjgwkNkSO3QQaHVHUCby8NHQJPRdKR4ym8tDfFjNXxieUQKwxi8r/0ofo5g 1UxtBwJICd+/LxOZovtKGYDqHJc4vPRqdY7x4VbTff0FM4i4W0ZpUQ== =6ty1 -----END PGP SIGNATURE-----

1 0

DUF_ibf
by John Young 17 Dec '03

17 Dec '03

Pal has provided a gopher-FBI paper: "Computer Crime Categories: How Techno-criminals Operate." By David L. Carter, a professor in the School of Criminal Justice, Michigan State University Types of Computer Crimes Computer As the Target Computer As the Instrumentality of the Crime Computer Is Incidental to Other Crimes Crimes Associated With the Prevalence of Computers Perspective on Legal Issues Special Problems with Computer-Related Crime Intellectual Property Malfeasance by Computer International Issues Conclusion Criminals have adapted the advancements of computer technology to further their own illegal activities. Unfortunately, their actions have far out-paced the ability of police to respond effectively. DUF_ibf (21 kb in two parts)

1 0

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 8 Nov 1995, Perry E. Metzger wrote: > anonymous-remailer(a)shell.portal.com writes: > > I wish that Detweiler could (seriously) go back to wherever he came from. > > What a fascinating statement to make, considering that you are > probably Detweiler. Fascinating. First, I'm accused of being noted computer viral expert, Dr. Frederick B. Cohen, (simply because he agrees with my assessment of the critical algorithm flaw in Netscape Navigator) and now I'm accused of perhaps being at the other end of the spectrum. Of being Detweiler, simply because he can take my signature and identity by signing an email, as Alice de 'nonymous or simply accusing me of posting in his "style". I see that the character assassination sport continues, and I am now a targetted. Hunter become hunted. I wonder why?? And why, by of all people, Perry? Is it perhaps because, I speak the truth, and the truth makes people very, very nervous. Is it because the flaw which is in the Navigator product is woven into the code fabric, and can't be *fixed*. Afterall, Netscape (and AT&T) have had, over THREE WEEKS to work on this problem or to make some form of public comment, and have done nothing, but put some of their programmers -- unofficially ... speaking for myself ... not speaking for the Company -- programmers on this list Meanwhile people are having their PGP keyrings collected, their passwords monitorred, and all of the information -- even information which they have NOT posted to Usenet, information that is simply on their personal hard drives, or on a private corporate network that is behind a firewall -- collected by anyone who actualy understands *how* to use Netscape Navigator's standard features to do it. And so the question is: Why am I having my character asassinated while this threat continues?? And while the loss and damage continues. Why are Netscape and AT&T not mitigating the damage? Is it because what I say is simple common sense stripped of the veneer of "technical language" and jargon?? And can't be *commented* on or *fixed*. Is this the fear which any truth teller faces, not only on the Internet, but in any forum where they try to challenge Goliath. Maybe, that's one reason to post anonymously. To clear the record definitively, I am neither Detweiler nor Dr. Frederick B. Cohen, and I am not the issue. I am simply myself, and I will _reveal_ my identity to the international public once the timing is appropriate. If anyone wants to know who I am, they can contact the PR department of AT&T or Netscape and ask. (Their address can be requested from either postmaster(a)att.com or postmaster(a)netscape.com, respectively.) Both companies have an email address for me, and would _likely_ *cough* forward any email enquiries to me without any editing. That way, everything is done clearly and out in the open. Nothing hidden, and nothing private, and none of my comments will become "their sole property to be used in their sole discretion". Neither company can accuse me of attacking them with daggers in the dark of night, from behind a shield of anonymity, when I advocate public open disclosure and commentary. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

True Random (short c-source)
by Frank Andrew Stevenson 17 Dec '03

17 Dec '03

I have written a short random number generator which appears to produce reasonable random numbers even in DOS, at the heart of the code is the short function fGetRand, the amount of entropy derived from this function varies from >1 to >>6 depending on system load, I haven't made any effort to whiten it at all. I am not making any claims about its usefulness. I am only trying to demonstrate the ease at which good random number may be obtained. Any comments and analysis will be mostly welcome, the source is hereby placed in the public domain: I have used WATCOM10 to compile and test under DOS/WIN95, where clock is running at 18hz. I have also tested on IRIX with impressive results. --- START ---- #include <time.h> #include <stdio.h> int fGetRand (void); main (void) { long vCount; FILE *out; int byte; int tick; out=fopen("random.bin","wb"); if(out==NULL) { printf("cant write to file random.bin\n"); exit(1); } for(vCount=1;vCount<=512;vCount++) { tick=fGetRand()&0x01; byte=byte+byte+tick; if((vCount & 0x7)==0) fputc((char)byte,out); fputc((char)tick,out); } fclose(out); } int fGetRand (void) { int count; clock_t tick; tick=clock(); while(tick==clock()) count++; return (count); } ----- END ----- PGP encrypted mail preferred, finger for key. The above views are ONLY endorsed by BoggleMind Inc. (not to be confused with MindBoggle Ltd.)

3 2

ecash speed
by Hal 17 Dec '03

17 Dec '03

A few days ago I got my ecash account set up with the Mark Twain bank. Presently only one merchant is officially listed at <URL: http://www.marktwain.com/shops.html>, Delorie Software. As I understand it, only people with merchant accounts are eligible to be listed here. However, you don't have to have a merchant account to receive ecash or to set up shop software. If anyone else has set up a shop to receive Mark Twain ecash using a user account, perhaps they could post here and we could keep a list of unofficial vendors. The other thing I wanted to write about is ecash speed. One idea people have had is to use ecash for micropayments, such as one cent to read a web page. The question is, is the current ecash software sufficiently fast for this? Maybe someone could set up a site using either Twain ecash or DigiCash ecash which actually charged you a penny for each page you browsed around. It would be interesting to see how much of an obstacle it presents in browsing the web. The impression I've had from the few times I've used ecash is that in fact it does slow things down way too much for this to be practical. But it would be good to actually do the experiment. One reason I was thinking about this is reading a new paper by Rivest and Shamir, <URL:http://theory.lcs.mit.edu/~rivest/RivestShamir-mpay.ps>. It is about a couple of proposed systems for micropayments, specifically oriented towards the penny-per-web-page model. They are offline systems, designed so that a minimum of calculation is done by the vendor, user and bank. So they should be very efficient. However, the big problem is that they are not anonymous. The cash tokens are recognizable by the bank when spent tokens are sent in by the vendors - the bank knows who spent them. Maybe for penny level transactions that is not a big deal, although if for-pay web browsing becomes common then it does seem like it would present a privacy threat. Every web site you visit (not the specific pages, but the overall site names) would be known by the bank - quite a significant piece of marketing data. The point is that if the anonymity afforded by ecash is too costly in terms of time, then we may end up stuck with a non-anonymous system simply because that is the only one efficient enough to work. It would be good to find out if that is a serious problem. Hal Finney

3 4

Re: PGP Comment feature weakens remailer security
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 8 Nov 1995, Raph Levien wrote: > On an unrelated topic... cypherpunks like to count bits, right? Mmmm, sometimes we do ... <g> Sometimes we even think, if I were a lil wa'bbit, where would I go hide ... especially when we do a bad Elmer Fudd impression of Bugs Bunny. <p> > What is the correct number of pseudorandom bits to use in a MIME > multipart separator? If the data has a line which matches the > separator, the message is corrupted. Of course, if you can take > multiple passes through the data, you can simply verify that it does > not contain a line which matches the separator. But if you're > restricted to a single pass, then the only way to do it is to use a > randomly generated separator. An interesting problem. If you are going to take multiple passes, and do top-down and bottom up analysis, then you can't really parse on the fly. It pretty much has to be a batch job, I think. You have to get your data, and then check it. You can't simply *trust* that there is not any corruption, and pass all of your data through. And if you're going to parse in a single pass, then we're back to the problem of monkeys sitting at typewriters and Shakespeare's sonnets. > I figure that 128 bits should _definitely_ be enough (that's what > is in the new premail code now). Even 64 bits should ensure that it is > unlikely that anyone will ever experience message corruption over the > expected lifetime of premail. However, it makes me nervous. What do > people think? Unfortunately, it's not quite that simple. The likelyhood of corruption is not based on each past run. It's just like rolling dice. The odds of rolling boxcars is 1 in 36 (I think) no matter how many prior times, you've rolled boxcars. Twenty passes doesn't influence whether you crap out or not on a single roll. Nothing *remembers* past performance to ensure that something doesn't happen (or happens) many, many times in a row. I guess, this is why Atlantic City, Baden Baden, and Las Vegas generally do as well as they do. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

"Industry Group Rebuffs U.S. on Encryption" (NYT 8Nov95, C3)
by John Gilmore 17 Dec '03

17 Dec '03

A group of 37 companies and trade and privacy associations sent a letter to Al Gore yesterday, complaining about Clipper-II and crypto export controls, and promising to send their own policy proposals to Congress and the Administration within six months. It's a short story. I'll leave the exact text to John Young :-). I've heard that there's a better story in the Washington Post today, too. I expect we'll see the letter itself within a day or two. John Gilmore

1 0

Re: Market Value of Web Pages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 13:28 11/9/95 -0800, Timothy C. May wrote: >With all due respect to Bill--his mention of agorics tells me he knows >something about computational ecologies and markets--, there is no >reasonable way to say what price is "closer to the current market value of >the page content," except by what the market will bear! Tim is absolutely correct that the market determines the current market value. I mentioned some low value items in the current market and he mentioned some high value ones. However, there is not really a problem in paying for high valued web pages (like the $400/photo consultant report he mentions). The various network payment schemes that have been proposed and implemented will handle these quite adaquatly. What concerns me is building systems that can support low-cost high-volume markets. If I have to pay a penny/page, I am going to ask whether Netscape can use a whole gigabyte disk for its cache and have basically a pay/copy system. If the cost is low enough, I will pay/view and avoid stale data in the cache problems. However, there are very few systems where the transaction costs are low enough to support low-cost high-volume markets. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

ACLU Cyber-Liberties Update: Nov. 8, 1995
by ACLUNATL＠aol.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- November 8, 1995 ACLU CYBER-LIBERTIES UPDATE A bi-weekly e-zine on cyber-liberties cases and controversies at the state and federal level. ----------------------------------------------------------------- IN THIS ISSUE: * ACLU Statement and ACTION ALERT on Federal Wiretap Bill * ACTION ALERT on Federal Online Indecency Legislation * State Utility Commissions Consider Online Access and Privacy Issues * News on Electronic Access to Public Information in Washington State * John Perry Barlow Launches Cyberspace Lecture Series Co-Sponsored by the ACLU of Washington * ACLU Student Chapter President at Georgetown University Law Center Writes About Marty Rimm Controversy * Conferences * Online Resources from the ACLU National Office and State Affiliates ----------------------------------------------------------------- FEDERAL PAGE (Congress/Agency/Court Cases) ----------------------------------------------------------------- * ACLU Statement and ACTION ALERT on Federal Wiretap Bill Last week, the ACLU emphatically urged the FBI to withdraw its proposal for greatly increased wiretapping powers. "Given the government's own statements on the usefulness of wiretaps, we can only guess at the FBI's motives," said Laura W. Murphy, Director of the ACLU's National Washington Office. "But if Congress were to allow this system to go into place, we'd have a national surveillance apparatus that would pale in comparison to the infamous security state of the former Soviet Union." "This proposal, Murphy added, "would make the KGB look like privacy advocates." "The proposal would dramatically reduce the privacy rights in the United States because it would -- no matter what the Justice Department says -- result in significant increase in the number of innocent third party conversations intercepted by law enforcement officials," Murphy said. "Already too many innocent conversations -- nearly two million in the last year alone -- are intercepted by federal and local law enforcement wiretaps." According to the government's own statistics, 1,800 innocent conversations are intercepted each and every time a wiretap or other form of electronic surveillance is placed. Just last week, the ACLU joined with the National Rifle Association and a broad coalition of other gun advocates and civil liberties organizations in calling for Congress to institute a 24-point reform plan for federal law enforcement. In a letter to Congress, the groups said that the excesses of Waco and Ruby Ridge demonstrate that Congress and the Administration must begin to reign in the powers of federal police authorities. [The 24-point reform plan and related documents are available on America Online, at keyword ACLU, under "federal law enforcement reforms." For an e-mailed copy of the reform plan, send a message to infoaclu(a)aclu.org with "fed law enforcement reform" in the subject line.] URGENT ACTION NEEDED: -Call the FBI at 202-252-7296 and urge it to withdraw the proposed wiretapping system. You can also find the phone number of the FBI's local field offices at the FBI web site at http://www.fbi.gov. -Call the Attorney General at 202-514-2001 and urge her to order the FBI to withdraw its wiretapping proposal. -Call your members of Congress and tell them to urge the Justice Department and the FBI to withdraw the wiretap proposal. Urge your representatives to oppose any funding for this wiretap scheme. You can reach the Capitol Switchboard at 202-224-3121 for the Senate and 202-225-3121 for the House of Representatives. -Call Rep. Bob Barr (R-GA), a former federal prosecutor and leading opponent of funding effots for wiretap: Rep. Bob Barr U.S. House of Representatives 1607 Longworth Building Washington, DC 20515 (202) 225-2931 -Call your own telephone companies, both local and long distance, and urge them to oppose the wiretap proposal and to stand up for the privacy rights of their customers instead of becoming the snooping arm of a prying government. ----------------------------------------------------------------- * ACTION ALERT on Federal Online Indecency Legislation The conference committee on the telecommunications bill will soon consider whether to remove provisions that would make "indecency" a crime in cyberspace. On Monday, November 6, we distributed an action alert urging individuals to call Congress to express opposition to any measures to censor the Net. THIS MAY BE YOUR LAST CHANCE TO STOP UNCONSTITUTIONAL RESTRICTIONS ON YOUR RIGHT TO FREE SPEECH IN CYBERSPACE!! [You can find the action alert on America Online, at keyword ACLU, under "threats to civil liberties in cyberspace," or on the Internet at http://www.vtw.org/] In addition to the call to action for individual Net users, the ACLU and People for the American Way obtained signatures from over 75 organizations to a letter opposing the federal online indecency provisions. The letter will be sent to Senator Pressler and Representative Bliley on the conference committee later this week. [After 11/13, you can find a copy of the organizational letter on America Online, at keyword ACLU, under "threats to civil liberties in cyberspace." To receive a copy of the letter via e-mail, send a message to infoaclu(a)aclu.org with "organizations opposed to online censorship" in the subject line.] The ACLU continues to prepare for a constitutional challenge to the online censorship provisions if they become law. Please contact Ann Beeson, beeson(a)aclu.org, if your organization is interested in being a plaintiff in this ground-breaking litigation that will define First Amendment rights in cyberspace. ----------------------------------------------------------------- STATE PAGE (Legislation/Agency/Court Cases) ----------------------------------------------------------------- * State Utility Commissions Consider Online Access and Privacy Issues Many state utilities commissions are considering issues that can affect your online access and privacy rights, from approving caller ID to defining universal access. Online users are urged to stay informed and involved in utilities commission decisions in their states that may affect cyberspace rights. Consumer Project on Technology has put up a list of information about state utility commissions. The list includes contact information for all 50 state utility commissions, and also lists utility consumer advocates in 40 states. See http://www.essential.org/cpt/isdn/contacts.html ----------------------------------------------------------------- * News on Electronic Access to Public Information in Washington State A Washington State task force has been examining the issue of electronic access to information maintained by government agencies. The ACLU of Washington submitted comments commending the task force for requiring some form of free electronic access, and limiting all fees to incremental costs. But the task force was criticized for not paying sufficient attention to privacy, especially increased threats to privacy presented by accumulation of information on individuals from diverse sources. Also in Washington State, King County Superior Court Judge George Finkle ruled that Geographical Information System databases are public records and must be made available to the public for nominal copying fees. (GIS systems are databases that contain information associated with a physical location, such as the location of utility cables, public buildings, roads, demographic information, zoning info, or traffic density.) As in many locations around the country, the City of Bellevue had attempted to charge far higher fees for GIS databases, which were created for government use but also have commercial value. This ruling reaffirms the notion that public information should be available to all, not just those with deep pockets. ----------------------------------------------------------------- * John Perry Barlow Launches Cyberspace Lecture Series Co-Sponsored by the ACLU of Washington The ACLU of Washington began a series of talks in Seattle to explore the impact and implications of the technology revolution on art and culture. John Perry Barlow, former Grateful Dead lyricist and co-founder of the Electronic Frontier Foundation, launched the series on November 3rd. "Cyberspace is largely about conversation that ultimately could include everybody on the planet . . . . Cyberspace can be the greatest venue for freedom of expression humans have ever had," said Barlow. Barlow talked of the spiritual dimension of cyberspace, which he sees as an egalitarian ecosystem with the potential to link "every synapse on the planet." For him cyberspace must be a place where anybody can say anything they think without fear of reprisal. But he tempered his lyrical vision of cyberculture with a warning of the dangers of censorship from elected officials who do not appreciate -- or even understand -- how new forms of communication function. "When I visit Congress, I feel like Tom Paine in the Court of King George," Barlow quipped. ----------------------------------------------------------------- * ACLU-Georgetown University Law Center President Writes Articles on the Marty Rimm controversy Alan Lewine, President of the ACLU student chapter at GULC, has written a series of articles for the Georgetown Law Weekly on the Georgetown Law Journal's involvement in the controversial publication of Marty Rimm's purported study of net porn. They are available at http://www.tripod.com/userland/A/alewine/index.html ----------------------------------------------------------------- CONFERENCES ----------------------------------------------------------------- Nov 8, 6 pm: "Regulating the Internet: Should Pornography Have A Free Ride on the Information Superhighway?" Benjamin N. Cardozo School of Law, 55 Fifth Avenue, New York, New York. Panelists include Nadine Strossen, National President, ACLU; Bill Burrington, Staff Counsel of the Electronic Frontier Foundation; and Barbara Bennett Woodhouse, Professor of Law at University of Pennsylvania Law School. Sponsored by the Cardozo Arts & Entertainment Law Journal. Nov 16, 5 pm: Nadine Strossen (National President, ACLU) speaks on "Defending Pornography: A Feminist Perspective on New Technologies and Old-Fashioned Sex," GULC, 600 New Jersey NW, 12th Floor Ballroom, Gewirz Hall. Co-sponsored by ACLU-GULC and the Student Bar Association Speakers Fund. ----------------------------------------------------------------- ONLINE RESOURCES FROM THE ACLU NATIONAL OFFICE ----------------------------------------------------------------- Stay tuned for news on the ACLU's world wide web site, under construction at http://www.aclu.org. America Online users should check out our live chats, auditorium events, *very* active message boards, and complete news on civil liberties, at keyword ACLU. ----------------------------------------------------------------- ONLINE RESOURCES FROM ACLU STATE AFFILIATES ----------------------------------------------------------------- Florida: ACLU of Pinellas County Florida http://www.stpt.usf.edu/~greek/aclu.html Illinois: Illinois Civil Liberties Union http://www.aclu-il.org/ Champaign County, Illinois ACLU Chapter http://www.prairienet.org/cc-aclu/ (The chapter also maintains an Illinois Civil Liberties Alert List. To subscribe send a message to cla(a)prairienet.org) Indiana: Indiana Civil Liberties Union http://www.inetdirect.net/iclu/ South Carolina: ACLU of South Carolina http://www.cris.com/~katrinan/aclu/index.html ----------------------------------------------------------------- ACLU Cyber-Liberties Update Editor: Ann Beeson (beeson(a)aclu.org) American Civil Liberties Union National Office 132 West 43rd Street New York, New York 10036 To subscribe to the ACLU Cyber-Liberties Update, send a message to infoaclu(a)aclu.org with "subscribe Cyber-Liberties Update" in the subject line of your message. To terminate your subscription, send a message to infoaclu(a)aclu.org with "unsubscribe Cyber-Liberties Update" in the subject line. For general information about the ACLU, write to infoaclu(a)aclu.org. ----------------------------------------------------------------- **PLEASE REPOST WITH HEADER INTACT**

1 0

This is an Architext Document: Read Carefully!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:54 PM 11/8/95, Kevin S. Van Horn wrote: >A small point of information. I work for Architext, the company that provides >the excite service. We only keep the last two weeks of USENET news around, >and don't keep any archives going further back than that. USENET is just too >damn huge for us to go to the trouble of keeping comprehensive archives around >without good evidence of demand for it among our target audience. Small world. "Architext" is also the hypertext program I use to cross-index many articles. I'm surprised the new company, also called "Architext," picked a name which will increase confusion. ("Architext," BrainPower, Inc., Agoura Hills, CA.) No Cypherpunks relevance, except to show how name collisions can occur. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0