December 2003 - cypherpunks-legacy

Real-life example of why National ID cards won't work
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- #Date: Fri, 17 Nov 95 16:18:55 PST #From: medic(a)netvision.net.il #To: shomronnews(a)felix.dircon.co.uk #Subject: Update 755 SNS News Service "Interior Ministry Scandal" November 19, 1995..26 Cheshvan 5756..Number 755..Update from Israel ... Following a report released by Yediot Achronot Newspaper, Interior Minister (Labor) Ehud Barak has ordered an immediate investigation into allegations of wrong-doing by senior Ministry officials. The report states that falsified ID cards and other Ministry permits are being sold to Arabs. Among those mentioned in the newspaper story is Chaim Ben-Atar, the Director of the Ministry's East Jerusalem Office, a Member of Knesset, and past members of the Mossad and GSS (Shin Bet). The Yediot report also alleges that Police officials silenced investigations over the past two years (that may have prevented terrorist attacks) for the fear of revealing names of top officials involved in the Ministry false documentation scam. The investigations involved senior officers in the IDF Civil Administration, IDF officers, senior Ministry of the Interior officials and officials in the Jerusalem Municipality. Some of the allegations: 1) In the East Jerusalem Branch of the Ministry of the Interior, Arabs that are not entitled by law may still receive ID cards, travel permits to Jordan, and other official documentation in return for cash payments or "favors". 2) Senior officials in the security service of the State have abused their connections with the east and west Jerusalem Ministry Offices, and have offered permits to travel abroad in return for cash payments. The permits were given to Arabs that would not be able to obtain them legally. 3) Interior Ministry workers have received favors and cash payments from Arab and Jewish agents in return for issuing travel documents, ID cards and passports. 4) Chaim Ben-Atar, the Director of the East Jerusalem Interior Ministry Registration Office has provided five Arab residents of Gaza with ID cards stating they live in East Jerusalem. 5) Ben-Atar also employed an Arab woman during a four-year period whose brother is a "religious fanatic activist in East Jerusalem". The Arab woman who assisted Ben-Atar has access to highly classified information. She was released from her position one year ago for "personal reasons." 6) During an investigation into wrong-doing by the past head of the Allenby Bridge crossing, information pointing to wrong-doing by other senior IDF officers and Jerusalem Municipality workers was uncovered as well. The Ministry chose not to pursue the investigation against them. The cases against them were silenced by Interior Ministry officials. (Yediot Achronot ..11/19..Page 5). ...

1 0

Re: remailer abuse
by Corey Bridges 17 Dec '03

17 Dec '03

At 05:27 PM 11/19/95 -0800, Greg Broiles wrote: >... > If A wants to send >messages to B, but B doesn't want to receive them, should A be forced to >stop sending? My rambling $.02: I haven't thought all this through, but I have an emerging stance. Just this week I've started ploughing through the Cyphernomicon, and was smacked in the face with the eminently pragmatic Mr. May's statement that any law that cannot be enforced should not exist. Up until, say, this week, I'd always been in favor of Caller ID. I'd figured if anyone wants to call me, I have the right to know who it is. By default, I had adopted this position concerning email. Now, one day I will receive an anonymous email. Will I be offended? Maybe. Can I do anything about it? Not likely. Anonymous communication is only going to get easier. Current congressional prattling notwithstanding, the onus of responsibility will have to shift to the recipient. For example, I could configure my mail program to automatically throw away any incoming message with "anonymous" in the "From" header. (Or any message from *(a)pseudo.goldenbear.com, for that matter) If junk mail continues to bother people, it's only a matter of time until mail programs' filtering capabilities become much more sophisticated. (Of course, for all I know, there already ARE programs that do what I'm about to propose.) People can maintain a "do not accept from" list, containing every anonymous remailer they've ever heard about, or an "accept only from" list, containing just the people they wish to converse with. I think it's this second option that will become increasingly important. Sure it's your right to send me whatever the hell you like, just as it's my right to ignore you completely. Bringing this back to my hobby-horse of Caller ID, you end up with even greater protection than an unlisted number--let the whole world know my number--no one'll get through unless I already know him. And then in the brave unregulated future, if you make a new friend, you merely swipe his public-key business card through your PDA, which adds it to your "accept calls and emails from" list. And to take a stab at another pair of Greg's questions, if A is sending messages from his account on X's system to B, and B doesn't want to receive them, should B have the right to make X stop A? No. (Not that I think the law is going to realize that any time soon.) Should X have the right to stop A? Hell yes--it's his system. Let A find a more open-minded ISP if he doesn't like it. Corey Bridges Security Scribe Netscape Communications Corporation 415-528-2978

2 1

ecash as pgp
by sameer 17 Dec '03

17 Dec '03

This is really frustrating. I'm trying to figure out how to use this damn ecash software to setup a prototype ecash-accepting remailer. For one thing, there's no documention. Secondly, from what I can tell, it's like PGP. To integrate it into other software you have to do all sorts of nasty output parsing. why the hell can't it just produce nice, terse, informative, UNIX-like output? it's late, i'm tired, I'm going to sleep. (the party was fun, btw, thanks to everyone who showed up.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

3 3

Re: Recompiling PGP262i under microsoft.
by Joe Turner 17 Dec '03

17 Dec '03

For those that might benefit, I have included some notes I have gained through my wanderings through PGPland, towards an easy PGP-mail program for Windows. Below I have included sketchy details in compiling PGP under as an MS-DOS app, WIN16 DLL, and Win32 DLL. I won't be able to provide specific details, until I recover data from my backup tapes (I had a nasty drive failure, and have been lethargic in recovering). I finally get my IBM PC/RT configured for TCP/IP and my PC explodes. :<. If anything here is wrong, or fuzzy, feel free to post corrections, etc., as this is all from my alcohol soaked, nicotine riddled brain. Compiling PGP under MSVC 1.5 & 2.x ========= === ===== ==== === = === To compile PGP under MSVC 1.5 (I believe there is a supplied Microsoft C make file that was written for Quick C) you will need to create a project and add the files necessary. Be sure to include the already compiled RSAREF.LIB in the project files. Unfortunately, there is one very annoying problem with Microsoft Visual C, in which it will regenerate the dependencies from the source code files without preprocessing the #ifdefs. You will have to edit the make file and take out all of the UNIX sys/whatever stuff. I believe this is the biggest hurdle, but you might try using the Quick C make file, although I don't think it will work without modification (Microsoft seems disenchanted with compatibility, even between revisions of their own software). You may also have some trouble with type conversion, but I think its intuitive to overcome that. (its been a while...). If anyone knows of an easier way to do this, I will be more than happy to listen. Compiling RSAREF as a DLL under MSVC ========= ====== == = === ===== ==== This is easy, but you may have trouble with the dependencies again. The most important thing is to create a .DEF file and put all of the export declarations in there. Unless you plan on rewrite PGP to load the DLL dynamically, simply link against it so save a few headaches (remember you still need a .DEF file or you will get unresolved errors!). Compiling PGP as a Windows DLL ========= === == = ======= === I was able to find someone in Australia (sorry, the name eludes me at the moment) who managed to port PGP to a Windows DLL, under Borland C. I only installed Borland C++ 4.0 today, so much of my work/play has been targeted towards Microsoft Visual C++ 1.5/2.0 under NT (besides I was waiting on PGP3.0). If anyone wants these files (for Borland) I will send them out when I recover them (hopefully). It includes modifications to no more than three files, and includes both reentrant and non-reentrant entry points. I also have the mail program (MAPI) that this guy wrote in executable form. He was very careful about the Austrailian equivalent of the ITAR, so he would only send the modified files, which I will pass on for those who are interested. If you want to do the same thing under MSVC, the same changes apply. Hope that help some. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzCXvuAAAAEEALiDFkQgR9leZVf5X0HLPdUFmtfyp3X0nFMi7RjqIsv1pAh9 ZZFVwkBlo01APJcw4ncPrpjGKvu8P7t0a6nB+tIZliGGvmCt/SSVyc44RdTz1KV2 TlsA/NW1WF4yBARK1aCuHgrtwfOhV8hBqh88TlJ/DSMxDXCM1+w0jdWG+cPtAAUR tC9Kb2UgTi4gVHVybmVyIChpbnNlY3VyZSkgPHR1cm5lckB0ZWxlY2hlY2suY29t Pg== =sGFY -----END PGP PUBLIC KEY BLOCK----- -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659

1 0

Ponzi Web
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, 11-20-95, front page. If Medium Is the Message, the Message Is the Web By John Markoff San Francisco, Nov. 19 -- The Associated Press was formed in the mid-19th century when a group of newspapers decided to invest jointly in a newfangled medium -- the telegraph -- to speed the collection and dissemination of information. Last week, A.P. announced that it would adopt a newer-fangled medium -- the World Wide Web -- to begin distributing its articles and photographs over the global Internet. It was simply the latest, but perhaps most historically significant, move yet by an old-line media organization into the World Wide Web, the Internet multimedia information-retrieval system that appears on the verge of becoming a mass medium itself. If the medium is the message, then the message these days is the World Wide Web. In short order the Web, which three years ago was little more than a research tool for physicists and computer hobbyists, has flourished. It is being embraced by media concerns, consumer-product companies and businesses of various stripes that are creating thousands of so-called Web sites each month, with the number of computers playing host to one or more of these sites already exceeding 100,000. Conservative estimates place the number of people who have used the Web in the millions, and it is not hard to find more breathless estimates in the tens of millions. Capable of letting people use computers to send and receive text, sound, still images and video clips, the Web incorporates elements of the various print and electronic media that have preceded it. And yet, the Web is poised not to replace its predecessors but to take a place alongside them as a social, cultural and economic force in its own right. Its complementary role is already evident: many radio stations and all the major television networks have Web sites promoting their programs and stars. Newspapers, including The New York Times, are devising cyberspace editions. And few movies anymore are released without a promotional Web site, including "Goldeneye" the James Bond film that opened this weekend at theaters everywhere and on the Web at the address http://www.mgmua.com/bond. The site offers the movie's theme song performed by Tina Turner, more than a dozen video clips from the film and illustrated biographies of the cast members. Prime-time television commercials by Toyota and other advertisers now routinely include a Web address. And Procter & Gamble, whose advertising has long helped underwrite the mass media, has even staked out prime Web real estate by reserving addresses that include flu.com and toiletpaper.com. "We are poised on the edge of a new medium," Clay Felker, director of the magazine program at the University of California at Berkeley's graduate journalism school, said. "It's going to change the nature of how we acquire information." As with each mass medium that has arrived before it, the Web has reached this threshold through a confluence of a key technology, a ready audience and a stream of corporate backers willing to bet that profitable businesses can be built on it. But few experts are willing to declare that the Web has taken its place in the mass media pantheon because the profitable business formulas have yet to be found. Newspapers and magazines make money by selling individual copies, subscriptions and advertising space. Radio and television stations sell air time to those with money and a message. Movie theaters sell tickets. But on the Web so far, despite seed-money by adventurous advertisers and some tentative efforts to charge for access to sites or services, there is no certainty that this medium will achieve the critical mass that capitalism demands of its mass media. "How do you make a business out of the World Wide Web?" asked Norman Pearlstine, editor in chief of Time Inc., which has an experimental Web site called Pathfinder that offers selected contents from the company's magazines (http://www.pathfinder.com) But because ad revenue alone is not carrying the freight, Time Inc. will begin testing ways to charge visitors to its site. And yet, the technological prerequisites are firmly in place. The Web is an outgrowth of the Internet, which began as an academic research experiment in the late 1960's. For more than two decades the Internet remained largely inaccessible, used mainly by computer scientists and Pentagon researchers, university scholars and students. Then came the World Wide Web. Like the Internet, the Web began as a tool to let scientists easily and quickly share information. Conceived in the late 1980's by Tim Berners-Lee, who was then a software designer at CERN, the Swiss physics research center, the basic Web technology was first put to use in 1990. The big breakthrough came in 1992, when student researchers at the National Center for Supercomputing Applications in Illinois created Mosaic, a simple software tool called a Web browser. Mosaic permitted access to information anywhere on tke World Wide Web by letting the user point and click a computer mouse on highlighted words or images on the screen. The browser, which became available in commercial versions like Netscape Communications' Navigator, not only made Web sites easily accessible, it prompted businesses, organizations and even individuals to create new Web sites by the thousands. Thus did the Web quickly become a standard and accepted way for the growing millions of the computer-literate to communicate and to entertain and inform themselves. And unlike each previous mass medium, the Web does not require its audience to be merely passive recipients of information. For very little money, and with a modicum of computer skills, virtually anyone can create his or her own Web site. Anyone with a modem is potentially a global pamphleteer. One consequence of this democratization is that the Web can be a remarkably anarchic forum compared with the old-style mass media. "Think of this as television colliding with the telephone party line," said Paul Saffo, a computer industry consultant at the Institute for the Future, a Menlo Park, Calif., research firm. "In terms of social consequences, the Web is a great experiment. It's going to deliver us community with a vengeance -- and we may find we don't want it." ----- NYT, 11-20-95, Business Section. Losses From Computer Breaches Are on the Rise, a Study Finds By Peter H. Lewis Financial losses from computer break-ins and other security breaches are on the rise, according to a survey of corporate computer-security managers, with nearly half of all companies reporting losses as a result of hackers, viruses, sabotage, corporate spies and incompetent employees. At least 20 of the 1,290 companies responding to the annual security survey from Information Week magazine and the consulting firm Ernst & Young, reported losses of more than $1 million last year. But the poll also found that companies were more aware of the risks arising from growing reliance on computer networks, and were taking stronger steps to protect their information systems. "There is definitely increased awareness on the part of senior management," said Daniel White, national director of information security at Ernst & Young's Chicago office. But Mr. White said that despite increased vigilance by computer security officers, the lack of security tools made it risky to conduct electronic-document interchange and other sensitive business operations on the Internet. "Lots of organizations are using the Internet in a thoughtful way for marketing and information dissemination," Mr. White said. "But do I really want to use it" for an electronic-document transaction? "Not yet." Details of the survey, the third annual one, are in the Nov. 28 issue of Information Week, available this week. Among other findings were that nearly 80 percent of companies surveyed had at least one full-time information-security officer, a slight increase from last year. Of those, 45 percent report directly to the corporation's chief information officer, reflecting the growing recognition of the importance of computer security, Mr. White said. Nearly 70 percent of those responding said their companies had sustained a serious virus attack in the last year, a sharp rise from 54 percent two years ago. -----

1 0

Visual Basic 4.0 encryption prog.
by Eric Anderson 17 Dec '03

17 Dec '03

I just scored a copy of visual basic 4.0 and I was wondering how feasible it would be to write a program for Window$ 95 that would use RSA or IDEA and the Win95 exchange interface. I plan on buying Applied Cryptography probably on Fri. when I get paid. My requirements/goals are: 100% compatibility with M$ Exchange, ease of use (Point & Click/ drag & drop) and last but not least, STRONG public key encryption using "off-the shelf code. So my ??? Is this: Is it possible? Or should I just go out and buy a C++ compiler. I don't really care about ITAR or any of that other BS, I just won't put MY name on it.

1 0

RE:
by Eric Anderson 17 Dec '03

17 Dec '03

---------- From: anonymous-remailer@shell.portal.com[SMTP:anonymous-remailer@shell.portal.com] Sent: Friday, November 17, 1995 7:31 PM To: cypherpunks(a)toad.com Subject: Shoe-horning Mondex onto the Internet -- still won't fit >+ According to inside sources, is grossly vulnerable to replay attacks >(offline multi-spending to different parties) >-- Mondex has security holes >-- Customers who defraud Mondex-using banks have legal deniability in a >court of law: they can simply request banks to produce the security >protocols as evidence; if they refuse the case is thrown out of >court (precedent: UK and US phantom-ATM withdrawal cases) HEY-sounds GREAT to me, I'm ALL FOR IT!!!

1 0

Cypherpunks in Sydney (Australia) Meeting
by Greg_Rose＠sibelius.sydney.sterling.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I mentioned some time ago that if there was sufficient interest I'd organise a Sydney Cypherpunks get-together. It was supposed to be in mid-November :-(, but you can't have everything. In the absence of consultation with anyone, I've booked a small suburban chinese restaurant for the venue. This seems in keeping with other cypherpunks meetings (not that I've ever been to one...) Date: Wednesday December 6th. Time: 7:00pm Place: Mee Ton Restaurant 139 Concord Road Concord The restaurant is easy to get to, only 20 minutes by car from the city and easy to park. If driving out from the city along Paramatta Road, you just have to be careful not to turn onto the freeway. Concord Road is *second* and crosses back over the freeway. The restaurant is about 400 metres north of Paramatta Road, on the eastern side. It's also only a short walk from North Strathfield station. If enough people are using Public transport I can organise a pickup from (the main) Strathfield station (a little more convenient in terms of frequency of trains). I'm anticipating maybe ten-fifteen people. They have a nice, light banquet menu for $12 per head, everything included except alcohol. RSVP, please, by Friday the 1st, and tell me whether you are interested in a PGP key signing at the same time. I will post this to aus.org.auug, sage-au-nsw, sci.crypt. Any other suggestions appreciated, and don't hesitate to pass around the details. - -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMLAX/6RQkCwJ0+ZNAQFU1AP/Y4d6RUieAKMoz4MJCeX5OXyhCNfTfrMp /szVqe2ICn+9F+T+Ggad1XKSsO3NBk1Lmo478NUYHuCDuMODSgM0YRxRo7SuEd9d joFtpUIAjBAs+e0beO7DI934XFSvDQini+YT2NxDtUtEM0c4fVh96oQyJguSnWP2 Mx8ZubrzoDs= =R65K -----END PGP SIGNATURE-----

1 0

Re: remailer abuse
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 22:43 11/19/95 -0800, Timothy C. May wrote: >Yes, anonymous communication is getting easier, and the costs of trying to >stop it are becoming impossibly high. It would essentially require a police >state to stop, and even then it probably couldn't be stopped... Considering that there are well known ways of spoofing IP addresses, if you really want to, you can be anyone. (They must be well know. I know at least one. <grin>) >2. Sender pays the costs of transmission. That is, if someone wishes to >send 10 megabytes to a site, at least _he_ (or _she_) pays the freight. >This is of course the way things now work with the U.S. postal system, with >"Postage Due" no longer common... I think we lack direct charges for network traffic because detailed accounting for use of each net-link is too expensive. The situation is similar to that of the telephone system in the 1950s, where the switches which connected local calls did not have enough smarts to do charging, and so started the tradition of "free" local calls. When lots of people start sending full motion video over the net we may see ISPs develop use based charging schemes. I should add that one of the reasons I use Netcom is that they do NOT charge for connect time or network traffic. There is a market for known, fixed costs too. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: Mbone seminar 21st Nov 16:15UTC: FIREWALLS AS A NETWORK SECURITY
by Danny Cox 17 Dec '03

17 Dec '03

Piete, I read variuos bits about using the MBone for conferences etc including this one, and I'd like to be able to listen to them. Can you point me to any tools which I can use to access it and give me some pointers as to how to use them ? Thanks, Danny Cox

1 0