December 2003 - cypherpunks-legacy

Micropayments article?
by Lucky Green 17 Dec '03

17 Dec '03

Would somone please send me a pointer to the micropayment article? TIA,

1 0

Re: "Junk E-Mail"
by Chris Claborne 17 Dec '03

17 Dec '03

At 06:47 PM 11/19/95 -0500, you wrote: > > Is anyone else getting lots of junk e-mail lately? I'm getting all >kinds of direct marketing crap to both of my main accounts and I haven't >posted to usenet in months. On a related note, Compuserve had a note on their system last week from the sysop. Their customers are receiving unwanted e-mail advertisements from the Internet. Compuserve sysops are attempting to block the spaming but are finding it difficult because the advertiser is coming in via different routes. They are also attempting to stop them using the court system. The advertiser, according to the Compuserve sysop, threatened a mail-bombing if Compuserve tried to block them!!! This would be a just cause to call in the CSOF (Cypherpunk Soldier of Fortune) for a "measured response". ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

2 1

[NON-LIST] Re: reputations: discussions and meta-discussions
by Bill Stewart 17 Dec '03

17 Dec '03

(This really should be in private mail; keyid D072FC19 (still unnamed) can reach me using anon.penet.fi or alpha.c2.org or a reply-block remailer to get replies.... Or if you prefer, send me one-way remail and I'll post replies in alt.anonymous.messages.) At 02:17 AM 11/19/95 -0800, - keyid D072FC19 (still unnamed) wrote: >On Sat, 18 Nov 1995, Bill Stewart wrote: >> Here's the new entity's key, signed :-) I haven't added it to the >> PGP key servers; I'll leave that up to you... > >As we know, a public key certificate is a binding between the key and >some attribute, as asserted by the signer. In this case you have asserted >a binding between my key and the string "a new entity, as yet unnamed". >I don't understand why you did this. Would you please explain? >The only reason I can think of is that you wanted to provide evidence >for the key's creation date by timestamping it. If that was the case, >I thank you. But in the future, to avoid confusion, perhaps you can >create a new ID "timestamp" for the key and sign that instead. Are you asking why I used the string "a new entity, as yet unnamed", or why I certified it? If the former, it's because when I loaded the PGP key block into my public key file, that's who it said it was, and it matched the name in your cypherpunks posting. If you're asking why I certified a key used by a nym, I started doing that a couple months ago, as an experiment about what it means to certify keys and how to provide better continuity for keys used by nyms, and signing yours seemed like an appropriate thing to do (since you chose to name your key as belonging to the same string you signed your message with.) I have the policy of only signing one key for a given namestring with the key I use for signing nyms, so it gives a certain evidence of uniqueness as well as the timestamping effect. Since you also commented on cluttering up namespace, I didn't send the key to the keyserver myself; that's up to you. Has it been a wildly successful experiment? Well, no :-) But I've at least had to think about some of the issues more, and a couple of people have gotten their nym keys signed. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Virus attacks on PGP
by frantz＠netcom.com 17 Dec '03

17 Dec '03

PGP can be vulnerable to virus attacks. (Similar attacks can be made on other cipher systems.) These virus attacks can either be "Get the Key", or "Subvert the System" attacks. Schneier's "Rubber Hose" attack and a class of attack which I will call "Black Bag" attacks are get the key attacks. With a black bag attack, victims do not know their keys have been stolen, and so continue to use them. (According to "The Puzzle Palace", NSA got the FBI to perform black bag attacks on embassies in Washington DC.) I don't think subvert the system attacks have any parallel in classical cryptography. Get the Key Attacks PGP has three keys: the secret key ring pass phrase, the secret RSA key, and the IDEA key. Getting any of them would constitute a successful attack. A virus that collects secret key rings and sends their contents somewhere, either via UDP like messages or by dialing the modem late at night doesn't seem to much harder to build than one that erases your hard disk. If it runs only once per machine, its chances of getting caught are fairly low. The standard IP error handling of "throw away the packet" means that it probably won't be caught by firewalls. It seems more likely that someone will catch their computer making an unauthorized 800 number call. This attack would allow an opponent to use a brute force attack on the pass phrase. Getting the pass phrase or the IDEA key requires that the virus infect something in the PGP environment. The infection could be to PGP itself, or to the operating system in which it runs. (N.B. Since Mac and PC systems have only one protection domain, all programs running in them are part of the operating system for the sake of this analysis.) Assuming PGP is infected, although similar arguments apply to the operating system, the possible mechanisms of infection are many: A infected PGP binary is installed A virus modifies disk copies of PGP The OS's loader is infected to modify PGP as it is loaded The compiler or linker is infected to modify PGP. Any of these forms of infection could send pass phrases, secret keys, or IDEA keys out via IP or modem. Subvert the System Attacks The mechanisms of infection are similar to those of the get the key attacks, but these attacks do not require that the virus send data outside the machine. Instead, these attacks act by reducing the size of one of the three key spaces, making it vulnerable to brute force attacks. For example, if the OS provides a "random number" service, then limiting the randomness of the numbers constitutes an attack. Making RSA key generation loosely connected to the date and time constitutes an attack. Defenses One standard defense in classical cryptography is to frequently change the cipher keys. The PGP web-of-trust makes changing keys difficult, and is perhaps the weakest part of the overall protocol. Standard defenses against viruses can help, but if the attacker is determined and competent, then the virus will not be detected by virus detection programs, and will not have bugs which cause noticeable ill effects on infected machines. Custom changes to things like random number utilities and the PGP code itself may increase resistance by preventing some of these attacks from identifying the modified code as its intended target. Auditing code, preferably object code, can detect infection. Having ALL the source code available is almost a requirement here. Maintaining a file of cryptographic hashs of the IDEA keys used and checking for duplicates can detect subvert the system attacks on IDEA key generation at the risk that the cryptographic hash is in fact invertible and can be used to reveal the IDEA key. Using operating systems which run in many small protection domains can limit the opportunity for infection. One such system I have been involved with for over 20 years is described at the following WEB sites: http://www.cis.upenn.edu/~KeyKOS/ http://www.webcom.com/agorics/allkey.html Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

7 7

Re: "Junk Email"
by Rich Graves 17 Dec '03

17 Dec '03

See http://www.valleynet.net/hypermail/html/ Hurry, they might turn it off. ROTFL -rich

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

The other anonymous poster was referring to Detweiler's belief that cryptoanarchy was a budding Nazism as one of his apparent motivations. After a little bit of amateur Detweiler study I can agree with this. His page at http://www.csn.net/~ldetweil/ has sections that emphasize his concern about cryptoanarchy as a kind of "neo-nazism". Thankfully the cryptoanarchist sentiments on this list are much different than nazism in the way it advocates complete disengagement from the political process, something that tended to make the Nazist agenda highly dangerous. Without that you just have a bunch of subversive guerillas. Like gnats, irritating but irrelevant. So as long as we stick with the non-political advocation, and stay disorganized, and don't ever amount to anything significant as far as visible political clout, I think Detweiler is generally going to continue to leave us alone, thank God.

2 1

Spam the Sign!
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

On September 27, Jeff Weinstein of Netscape (and others) wrote: > > > ... would be nice if we could get 128 bit keys, though ... (hint, > > > hint). > > > > We are working this issue with the government. As soon as we can > > make it available for download we will. > In other words, we will never see it in our lifetimes -- the > bureaucreeps aren't known for promoting the spread of strong crypto. >> Where did I imply that if the govt. ignored us or said no that we >> would meekly go away with tail between legs? Netscape has a cute little Times Square scrolling sign in their engineering dept. - you can leave a message for all to see at: www.netscape.com/people/mtoy/sign/index.html Drop by and ask Jeff where his tail is these days. };->

1 0

Privacy Rights Alert
by JWRCLUM＠aol.com 17 Dec '03

17 Dec '03

From: American Civil Liberties Union of Massachusetts jwrclum(a)aol.com Re: Privacy Rights Alert Date: November 20, 1995 c 1995 ACLUMA We at the American Civil Liberties Union of Massachusetts want to alert you to the fact that the right to medical privacy of all Americans is imperiled by a bill just introduced in the U.S. Congress. This bill, which is claimed to be a "Medical Records Confidentiality Act," in reality may turn out to be profoundly destructive of your right to privacy. Although Part I does contain certain aspects which could help privacy, Part II undercuts the very fabric of patient- doctor confidentiality. First, it preempts many state law and common law protections which currently exist. Second, it pushes the further computerization of medical records, and will bring about the creation of "Health Information Services" --- corporate entities which would receive, process, and serve as libraries for actual on-line medical records forwarded from hospitals, clinics, and individual doctors. It appears that this will take place without any requirement for individual patients' authorization or consent. As we all know, computerized data bases are not immune from being accessed by both unauthorized "outsiders" and unauthorized "insiders." Centralization of data storage, especially in electronic form, simplifies its being accessed. But aside from that, the bill would actually authorize access to the medical records in these data bases by a host of government and non-government entities. Each of our medical records would thus become part of a computerized "lending library" --- an internet of medical records. For example, the bill would permit release of your medical records from "Health Information Services" (the on-line data base holders) and "Health Information 'Trustees'" (providers, hospitals, health plans, employers, insurers, and health oversight agencies) to the following (among others): - Release to researchers (along with your medical history, it is possible that identifying information including your name, address, and phone number would be sent). - Nearly-automatic release, to the opposing party in a lawsuit, of your entire medical history, if your health, physical or mental, has been raised by you as an issue in that lawsuit. - Release to law-enforcement authorities under certain circumstances. - Release to Public Health Agencies under certain circumstances. - Release based on Judicial Warrant --- you would be notified by mail within 30 days after execution of the warrant (90 days or more with the government's ex parte option). - Release based on Judicial Subpoena, Grand Jury Subpoena, or Administrative Agency (e.g. Social Security) Subpoena --- you would be notified on or before the date of its execution (or within 90 days thereafter [or longer] with the government's ex parte option). -A special variant of this, where the identity of the patient is "unknown," would allow the search of records (plural) in order to identify the person being sought. [In essence, this would allow "fishing" expeditions, using a computerized net, into the private lives of Americans.] In some of these situations, you, the patient, will only be informed after the records have been released. You may, in some circumstances, have the legal right to "attempt to quash" the subpoena (etc.) by seeking a court's intervention. However, the standard by which the court is to reach a decision on this will be mandated by this bill to be a consideration of whether the government's interest in obtaining the information outweighs the privacy interest of the individual. We would encourage you to pull up a copy of the actual bill and view it yourself. This can be done through the Library of Congress internet site at http:\\thomas.loc.gov (104th Congress, Senate bill number S 1360 ). Alternatively, a hard copy by mail can be requested from the U.S. Senate Documents Room, by faxing to 202-228-2815 a note containing the bill number and your mailing address. All our voices need to be heard in order to help make certain that this bill is not passed by Congress. Possible actions include: (1) Letters to your Senators and congresspersons, and to the House and Senate leadership. (2) Letters to local newspapers and other media. (3) Forwarding the contents of this message to places where you feel it will be of interest and have impact. This document may be re-distributed freely, provided it remains in its entirety. If you value your right to privacy, the time to act is now....

1 0

"Dear Newt" Letter...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

My, *this* looks interesting... Cheers, Bob Hettinga --- begin forwarded text Date: 20 Nov 1995 11:21:01 -0800 Subject: please fwd to cpunks if you To: "Bob Hettinga" <RAH(a)shipwright.com> The Ad Hoc Taxpayer Coalition for Computer Privacy November 8, 1995 The Honorable Newt Gingrich Speaker of the House of Representatives H-232 The Capitol Washington, DC 20515-6502 Dear Mr. Speaker: We are writing to express serious concerns about the Administration's efforts to continue to restrict the ability of computer users at home and abroad to protect their personal and private information over electronic networks through the use of encryption technology. The Administration seems determined to ensure government surveillance of all electronic information and communications. It began with President Clinton's "Clipper Chip," but has not stopped. Consumers aren't happy with these proposals, and neither is the business community nor civil libertarians. In fact, it's hard to find anyone supportive outside the Administration except for the few that would benefit from the Administration's "proposed relaxation" of the nation's export policy. The Administration refuses to let American computer hardware and software companies sell products with good encryption worldwide unless the U.S. Government is guaranteed access to a key that unlocks that information. The Administration is trying to leverage these companies' need to export -- they derive more than half their earnings from sales abroad -- and desire to develop a single product worldwide, to force them to include a feature in products they sell in the U.S. and abroad that will allow government access. Administration officials also have said that if American companies do not "voluntarily" include such a feature, then they will seek legislation making such a feature mandatory. The Administration's approach is the wrong policy for today's marketplace. It's anti-consumer. Computer users will not entrust their sensitive information to computer networks unless its security and privacy are assured. Without good privacy protection, there simply will not be a Global Information Infrastructure -- and America won't be in the lead. It's anti-marketplace. There is no consumer demand for encryption products that give the government easy access. The Administration has come forward with a typical big-government approach -- a government designed solution for a government problem. This completely overlooks the realities of a free-market. It is anti-American business. The Administration's current policies are seriously harming the continued competitiveness of one of our fastest growing and most successful industries -- the computer hardware and software industry. Computer users are demanding good encryption but American companies are not allowed to supply it. Yet there are hundreds of foreign encryption products manufactured and encryption programs are widely available on the Internet. Finally, it is anti-progress. Wishing that there was no encryption available will not make it so. The technology is widely understood and available -- you can't put this genie basic in the bottle. Government policies should not encumber the American computing industry as it leads the world technology revolution. We strongly urge you to oppose attempts to limit the ability of Americans to use whatever encryption they wish and to support the immediate relaxation of harmful export controls on American products and programs with encryption features. The Ad Hoc Taxpayer Coalition for Computer Privacy Americans for Tax Reform Association of Concerned Taxpayers Competitive Enterprise Institute Citizens for a Sound Economy The Business Leadership Council The Small Business Survival Committee Citizens Against a National Sales Tax/VAT Virginia Postrel, Editor, Reason magazine Sheldon Richman, Senior Editor, The Cato Institute Tanya Metaksa, Executive Director, Institute for Legislative Action, National Rifle Association Kellyanne Fitzpatrick, The Polling Company Donna Matias, Institute for Justice =+=+=+=+ This information is provided as a service of the National Rifle Association Institute for Legislative Action, Fairfax, VA. This and other information on the Second Amendment and the NRA is available at any of the following URL's: http://WWW.NRA.Org, gopher://GOPHER.NRA.Org, wais://WAIS.NRA.Org, ftp://FTP.NRA.Org, mailto:LISTPROC@NRA.Org (Send the word help as the body of a message) Information may also be obtained by connecting directly to the NRA-ILA GUN-TALK Bulletin Board System at (703) 934-2121. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

4 6

Re: Java & Netscape security [NOISE]
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Joseph Malcolm <jmalcolm(a)alter.net> writes: > Dimitri Vulis writes: > >m5(a)dev.tivoli.com (Mike McNally) writes: > >> Frederick B. Cohen writes: > >> > This is baloney. When you work for Netscape or Sun and speak about you > >> > company's products, you are representing the company whether you > >> > disclaim it or not. > >> > >> Baloney. > > > >Fred is right. I used to work for Goldman Sachs & their internet usage polic > >stated that when you write to Internet or Usenet from a GS account, it will > >reflect on the firm no matter how you disclaim it. > > Dr. Cohen is I believe maintaining it doesn't matter where you write > from. Note that the Sun employee's message that sparked this was sent > from a Netcom account. If that's what Dr. Fred said, then I strongly disagree. (Sorry, I haven't been following what Dr. Fred said very closely. Can you blame me? :) Btw, Goldman has a very reasonable Internet use policy that encourages employees to get accounts on commercial internet providers. Btw^2, didn't Sun fire someone a couple of years ago for posting a homophobic joke to Usenet? --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0