December 2003 - cypherpunks-legacy

No Privacy Right in Indonesia ?
by James M. Cobb 17 Dec '03

17 Dec '03

Cypherpunks assume privacy is a good thing and wish there were more of it. --Welcome to cypherpunks Friend, An 11 17 95 Reuter Information Service newsstory headlined Politics, not sex, is Indonesian Internet's concern reports that In Indonesia, the quiet Internet revolution has not gone un- noticed by the armed forces. Here are more excerpts from the newsstory: Armed forces spokesman Brigadier-General Surwarno Adi- wijoyo told Reuters the military had suggested to the com- munications ministry the need for some sort of "toll gate" to "black out" news which could damage culture or affect security. It has also suggested registering uses and users, he said. ...nobody doubts the military is watching. Activists in Indonesia who use the Internet say it is a power- ful tool for distributing information in a society where self- censorship abounds, newspapers are tightly controlled, jour- nalists are jailed and unlicensed magazines banned. Internet users doubt the Indonesian government can legis- late or control the Internet, short of pulling the plug on the nation's soon-to-be-privatised phone system. Please note that the expression "legislate or control" means control by either fraud or force, whichever the military finds most convenient. If the military does one day pull the plug, will that validate or invalidate the statement in the "Welcome to cypherpunks" document-- Cypherpunks know that a widely dispersed system can't be shut down. A tangential answer is supplied by Indonesian activists: Despite the technical and administrative hurdles with cen- soring an increasingly large volume and web of contacts, Internet users point out such a scheme [of censorship, not plug-pulling] would not stop the increasing distribution of material within the country. For there are private as well as commercial networks in the country. Commercial providers' estimates suggest there are around 10,000 registered local users, with popularity of the Internet growing among Indonesia's technological and edu- cated elite.... Please note the expression "registered local users," and re- call the military's suggested registering [of] uses and users Uses? Perhaps that means those nominally private networks. Cypherpunks hope that all people desiring privacy will learn how best to defend it. --Welcome to cypherpunks Cordially, Jim NOTE. NandO News, which posted the above newsstory, can be accessed at: http://www.nando.net The story's online filename is: info733_8.html It's datelined: JAKARTA (Nov 16, 1995 - 01:06 EST)

2 1

CANADIAN PRESS REPORTS (was Re: CSE gets flak on TV)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 17 Nov 1995 anonymous-remailer(a)shell.portal.com wrote: > > Hmm, actually the news tape is reading a little strange here in Canada. > > Not AP, or REUTERS, but simply the Canadian Press newswire. [snip] > Taking three successive news stories from three days ... (press stories, > I've since pulled for my own reference) and pasting them together to > indicate some type of Machiaevellian?? (sp) exercise is simply "not done." I still feel such a sense of violation with what LD did, such an utter sense of helplessness at the character assassination I've suffered at his hands, that I feel that I must take some token action to "set the record straight". Something which clears my name. Here is the TRUE unedited story for the list which Deitweiler felt he had to TWIST to the nth degree. His attempt at making mountains out of mole hills will not succeed with this one. I won't have him attack me, and attack everything I'm trying to achieve on this list, through his games. It's a non-starter from the get go, LD. Here's what was truly written ... let the list decide for itself. COMMUNICATIONS SECURITY ESTABLISHMENT Canada spied on allies: ex-agent Top secret security agency accused of eavesdropping on South Koreans by former analyst The Canadian Press TORONTO Canada's electronic espionage agency has spied on friendly countries such as South Korea, Mexico and Japan despite Ottawa's denials, a former agent has told CTV News. "I have lived with this information for so long and I just think that it is time that Canada knows what CSE is doing, " Jane Shorten said in a report for broadcast late Sunday. Shorten, 38, worked as an analyst from 1986 to 1994 -- when she was laid off -- for the Communications Security Establishment (CSE), CTV reports. A separate entity from the better known Canadian Security Intelligence Service, CSE can be described as a technological peeping tom. It specializes in electronic espionage, monitoring radio and other transmissions for useful information. The Soviets and their allies were once the prime targets of such surveillance, but after the thaw in the Cold War, CSE shifted its attention to friendly countries, Shorten told CTV. The agency spied on Canada's allies and trading partners, eavesdropping on friendly embassies, consulates, diplomats in Canada and around the world, she said. Ottawa denies it. "Countries like Canada have understandings that they don't carry out these activities against each other, " Solicitor General Herb Gray said earlier this year in response to claims that the U.S. Central Intelligence Agency had spied on the Japanese delegation during auto trade talks in Geneva. Replies Shorten: "He does not know what's going on because CSE is certainly doing that ... I spied on the (South) Korean government for the Canadian government." CSE is part of the Defence Department but Shorten insists senior officials at the Foreign Affairs Department were fully aware of its activities and anxious for its information. "I know my reports went to the Ministry of Foreign Affairs," Shorten told CTV. "My reports were classified as Top Secret Umbra and that's as high as you can get, and these people were cleared to get that kind of information." Shorten, once described by a superior as a gifted intelligence analyst, told CTV she was aware her revelations could result in prosecution under the Official Secrets Act but felt the risk of prison was worth it. "I feel so strongly that it's time that people learned what CSE is all about," she said.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Thu, 16 Nov 1995, Scott Brickner wrote: >> >> You'd need a program which not only *accepted* the additional parameter, >> but also *needed* the second parameter. I confess I have some difficulty >> thinking of one. > >It's not too hard to think of a compression scheme that needs extra >information to be passed from client to server; the obvious example is >some sort of dictionary compression with external dictionaries (can be >very effective for short messages where LZW etc never get a chance to get >going). > >Another, more likely case, is where the object could have been compressed >by several schemes, and a scheme ID is needed to determine which >alogorithm to use. > >The real issue would appear to be intent, though. If it's obvious that >the real intention for the hook is to allow encryption to be added, >the State department can jump on it. I'm not a programmer, but it seems to me that if the goal is to minimize the "obviousness" of the provision for cryptography, the calling program could call the called program (which might be an encryption program, maybe not) and ask for a text header that is to be listed in a Windows-type window. Thus, the calling program would not have any references to "encryption" or "key" in its program or documentation; it would get that the first time it calls the called program. BTW, one function which obviously needs an additional argument to work is a CRC program, in which the particular polynomial to be used must be specified. And I guess that a CRC is basically the same type of thing as a hash function, too.

1 0

Re: COE Recommendation No. R (95) 13
by viking＠pacifier.com 17 Dec '03

17 Dec '03

>>MS> However, if I have a wall safe and >>MS> they get a warrant to search it, can I be jailed for contempt if I >>MS> don't give them the combination? >> >> Well, IANAL, but yes, I believe that you can be. Or, worse, >>obstruction of justice. Especially if they cut it open and find that >>the knife was in the safe. > >So presumably the same would apply to the password that unlocks my >PGP private key. But there's an interesting twist. Once they open >up the wall safe, they can see for sure what is and isn't in it. This >ain't necessarily so for an encrypted file. Suppose my software has the >fiendish sophistication to disgorge different keys depending on what >password was given, and different pieces of cleartext depending >on what key was used. (Again, I apologize if this notion has already >been extensively discussed.) Is there a way to set it up such that >the cops couldn't be sure -- even using a logic analyzer -- that I >hadn't given them the complete set of keys, so as to read all the >cleartexts in the file? Assume that cyphertext files are guaranteed >to be larger, by some random factor, than the sum of all the cleartexts >in them, so the mere fact that a smaller quantity of cleartext was >disgorged than cyphertext supplied would tell them nothing. I guess this >is a kind of steganography, isn't it? Or at least something similar -- >the point would be that they couldn't tell genuine cyphertext from >camouflaging noise, without the key that tells them where to look. > >Which brings us, in turn, to the bottom line: the only things we >can be certain the bad guys _won't_ do, are the things they _can't_ >do. > > >--Michael Smith The interesting thing about PGP is that any incriminating cypher text one might have on his or her hard disk would, most likely, be in someone else's public key. So, even if they had your secret key the only thing that could be uncovered would be cyphertext that someone else had written to you. Granted, that this could be incriminating but, then again, not necessarily. I'm sure that for the purposes of conducting a criminal investigation, your own cyphertext would be far more incriminating than someone else's. (The above is only true unless you use the single key encryption option offered for personal files in which case your files would be readable.) What one should be more concerned with is sloppy handling of plain text files used prior to encryption. A good example of that is if you're using Windows based applications such as MS Winword. It has an auto-store function that generates a "Temp" file. Such files aren't wiped in the same fashion that PGP uses when it wipes a text file prior to encryption. I think that the paramount thing to consider is if you have something to hide then it is best to store it is inside your head. Any computer based storage system is bound to have certain limitations that may be bridged by a determined government agency. The other alternative is to ensure that potentially incriminating files be purged regularly to avoid such potential problems. Robert East viking(a)pacifier.com

1 0

Re: COMMUNITY CONNEXION BECOMES FIRST INTERNET PROVIDER TO ACCEPT ECASH
by Jay Campbell 17 Dec '03

17 Dec '03

>COMMUNITY CONNEXION BECOMES FIRST INTERNET PROVIDER TO ACCEPT ECASH > >Community ConneXion today announced that it has become the first and >only Internet Service Provider in the world to allow for payment using >ecash, a digital cash system developed by DigiCash bv, of Amsterdam, And, er, we're second. Ditch that 'only' part :) -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Wed, 15 Nov 1995, Howard Melman wrote: > Vladimir Z. Nuri wrote: > > attempts to get secure credit card number transfer on the internet are > > not an end in themselves. they are the first steps toward an entirely > > new transaction system. those who see a single step and criticize it > > as feeble in the context of past systems are missing the point and > > apparently can't think past the present nanosecond of their lives. My grandfather used to say, that the first horse to break from the gate, isn't necessarily the first to cross the finish line. Often, he'll be pulling up the rear. > You'll have a hard convincing folks that they need something > better than what works perfectly well today. In my humble opinion, the present system can't really be characterized as "working perfectly well". Far from it. While not as familiar with the US system as the Canadian, I can give as a simple example, the bank clearing system for paper checks. In Canada, we can clear a check from one side of the country to the other overnight. We have 24 hour clearing. While this is far from "perfect", our existing paper systems allow for a degree of efficiency which I don't believe is engineered into the US clearing system. Perhaps someone can correct me, if I have erred but I think it takes far longer than 24 hours to clear a check drawn on any US bank, and deposited to any other bank's credit in the United States. It may work "functionally" ... but certainly far from "perfectly" nor "efficiently". > Here's another point that I didn't see in your list. Today it might be > just as safe to send your CC# over the internet as giving it to a clerk, > etc. This is mostly because the number of CC#'s sent over the net vs > the whole traffic is small. It is therefore not very cost effective to > try to steal credit card numbers over the net vs other means (searching > through dumpsters, taping a phone line near LL Bean, etc.). A very good point. But then, dumpster-diving attacks could be moderated by simply implementing carbonless forms. No carbon, reduces a lot of the risks. It's basic risk management. All of this becomes a part of the cost/benefit analysis, and is part of the function of security policy. It's very much like all the talk on another thread on this list about Java security. There is no point in even discussing Java security in Netscape, when Netscape PRESENTLY has existing security holes written into the very fabric of the existing installed codebase. Holes which Netscape and AT&T refuse to address, correct or even comment on. Sun's security approach misses the point. Putting dead-bolts on houses while leaving all of the windows open, just doesn't address the problem. It really misses the mark. > If CC# purchases became common over the net, it would become much more > valuable to try to steal them from the net and more people would. It > would then become much less secure, not for any technical reason but > because there will be more crooks exploiting the existing flaws. This is also unfortunately true. Information on how to "break" a system does propagate. As more people know how to exploit a system, or as more people learn how to utilize the "letter of the rules" (the "code") rather than the "spirit" (the "intent") the degree of exploitation grows. Ask any executive in the Gaming Industry about this. Black-Jack card-counting went through an evolution in exactly this fashion. Many casinos lost a veritable "fortune" to good card counters. They lost to organized "teams" of card counters. Counters who literally broke the bank. Systems always have exploitable features. And new systems will always present new opportunities for exploitation. A completely new set of risks which are additive to those already in place, even those which may not yet be in a state of active exploitation. A pertinent network example: credit card numbers. Credit card numbers are not just a set of random digits. Only particular patterns of numbers can be valid. This existing "security provision" -- check digits -- actually ends up opening a security hole when we look at transmitting credit card numbers via the Internet. The security feature on one side of the ledger makes it far easier to differentiate between what is a random set of numbers, and what is in fact a valid CC number. Simple pattern analysis allows to search for valid numbers. It makes the potential "crooks" job much easier and its already engineered into the system. The "credit card number" risk though is accidental, while the Netscape Navigator risk isn't accidental at all, it's willful. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Thu, 16 Nov 1995, Vladimir Z. Nuri wrote: > but one distinction I do realize has to be made in all this is the > difference between "fraud" and "breaking a system". the latter is > a far more potentially serious problem with cryptographic security than > the former. in fact cryptographic security attempts to deal with all > fraud by making "breaking the system" impossible, and succeeds to the > degree it accomplishes this. I think this is extremely important to consider. The functions which define relationships between large numbers of variables, (such as say the world economy) -- these functions are not "idiot proof". They can collapse. And, yes Virginia, the system can be "broken". To suggest that cryptography can address this issue is to misunderstand the problem, and is part of this whole mindset that "security" is cryptography. Our economies are, if anything, less resilient than they were in the not to distant past. They are far more vulnerable. The introduction of new business practices, such as the reduction in most firms inventories, and the ever greater reliance on "just in time" approaches has made us far less able to sustain any interruption. The headlong introduction of "new variables" and new vectors into an unstable system has never been "sound policy". I guess it's sort of like what happened when rabbits were introduced into Australia. An eco-catastrophe. Perhaps, we can all agree that existing systems are best "not destabilized". Then again, I'm not the one who gets his jollies by rocking the boat. I get mine elsewhere. I guess here then is the real question, what is the fallback plan when something does go catastrophically wrong?? What then, hand-wringing, and saying that it "exceeded our theoreticians predictive capabilities" just does not suffice. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 15 Nov 1995, Bill Stewart wrote: > >>Does anyone know the ostensible justification for this? > > Isn't the NCSA government-funded? If so, they've probably got > less slack in what they can get away with than private citizens; I think that government-funding does give a certain degree of control -- the control that comes with the budget axe. Private citizens alternatively, get to face a different type of tool. They get to face stuff like RICO provisions, which "effectively" -- as they are presently used, rather than as they were written and intended to be used -- tend to allow the government to "influence" private citizens. > the NSA's got more leverage over their funding, especially if > "Supercomputer Applications" are often military or civilian-govt. I doubt that the NSA approves the NCSA's budget. Far more likely would be for the NSA to use a rogue programmer at the NCSA. Someone who might hide some very damaging code into one of the existing applications without anyone (else) knowing about it. I could even see an independent doing this simply to profit from it. I could see someone doing something like that. It's no different really than the "free" programs that were given away years ago which appeared to be useful but actually contained "poison code". > Not only do they have to worry about ITAR as law, they have to > worry about their continued cash flow. Like I said, I don't believe in the "grand conspiracy" model. I tend toward "contained" enterprises. All the more reason though, NEVER to use black-box code, and all the more reason for public open review of code. NSA and ITAR aside ... safe computing is safe computing and is in everyone's collective interest. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: No Privacy Right in Indonesia ?
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:54 PM 11/17/95 -0500, "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> wrote: >An 11 17 95 Reuter Information Service newsstory headlined > Politics, not sex, is Indonesian Internet's concern ... > Activists in Indonesia who use the Internet say it is a power- > ful tool for distributing information in a society where self- > censorship abounds, newspapers are tightly controlled, jour- > nalists are jailed and unlicensed magazines banned. The primary difference between Indonesian and Singaporean censorship is that the Singaporeans are a lot more urbane about it, and generally don't have crowds of protestors to shoot at. Reporting on the East Timor activity is an especially good way to get kicked out of the country; I know people it's happened to. Uncensorable communications can be a substantial help, though rubber-hose cryptanalysis is still fairly effective, and it's the type of place that would use it. A certain amount of US activism on the East Timor problems is Internet-based; I don't know how connected it is to Indonesia or East Timor, which is too underdeveloped to be very active on the net, and has the added problem that activists are heavily watched. The Indonesian military recruitment process is unfortunately not something that crypto can affect much, except by keeping political activist's identities private so they're not targets. Basically, the draft board knocks on your door and says "Uncle <whoever> wants _you_", and they're authorized to shoot you if you don't cooperate, though they're also authorized to not shoot you. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

[BOOK] "SPYWORLD" (was: Re: CSE gets flak on TV)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >On Tue, 14 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > >> Electronic snooping part of the game >> >> OTTAWA (CP)--Intelligence experts say it's no big secret that Canada's >> high-tech spy agency snoops on friendly countries for financial gain. > >No big secret?? It was news to me. ;-) [elided] Dear Alice, To the few on the list who have not already had the pleasure, I'd put "SPYWORLD" in the "Puzzle Palace" category of must-reads. Before recently leaving our own Wunderland for a course in advanced bird-watching off in the Canary Islands, Michael Sattler was kind enough to loan me his hardcover of this pithy little 1994 history/expose on the Canadian spook community by one of their first key propeller-heads, "Mike Frost." After being unceremoniously dumped by the Canucks a few years back, he decided to "share" about it all to work out his frustrations. Though I assume it was 'tidied up' by various government censors in pre-publication, and according to the inside page was printed and "bound in the U.S.A." ;), I must say it was nevertheless an arousing read, albeit a bit nit-sloppy with the ghost writing/editing here and there. It paints a colorful picture of the TLA gang-bang that resulted in the conception of the Canadian black budget intercept operations. The potent schtuppingvermachen of the American and British, each waiting patiently for sloppy seconds is, to say the least, pruriently fascinating. "Frost" manages to (un)cover, in pleasurably lurid detail, some of the tools used, and policies openly violated, during such intercepts as "Stephanie" in Moscow. There are even some descriptions of the scenes behind the green doors of the NSA and CIA. Frankly, all it really lacks is a nude picture of the American Ambassador in Ottowa pulling his pants up _before_ drawing the shades for the last time. If you do read it, use protection. ;) "SPYWORLD" Subtitle: Inside the Canadian and American Intelligence Establishments By: "Mike Frost" as told to Michel Gratton ISBN 0-385-25494-6 Publisher: Doubleday Canada Ltd. 105 Bond Street Toronto, Ontario M5B 1Y3 dave PS: Don't worry, Mike, none of the pages stick together. :) _______________________________________________________________________ "If you're ever robbed of your virtue, trust me: it was an inside job."

1 0