December 2003 - cypherpunks-legacy

Re: "Strongly Voluntary" Key Escrow
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:10 12/15/95 -0500, Jim Ray wrote: >"Government Key Certification" might be an OK compromise-term compared >to "key escrow," but we should [IMNSHO] continue to stick to "GAK." As >you know, I prefered the term "FUCKED," but now we must be "decent" in >our communications. <sigh> I suggest Forced Key Deposit (FKD) (when some non-governmental entity e.g. an employer forces you to send copies of your keys to some depository), and Voluntary Key Deposit (VKD), when you chose to deposit a copy of your key with some third party. I love the way GAK sounds, so I support it even the whole concept is really FUCKED. Whenever I hear, "Government Key Certification", I think of digital signatures, not communication privacy. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Re: Pornographic stories
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

jadestar(a)netcom.com (JaDe) writes: > > > > Daniel Miskell <DMiskell(a)envirolink.org> writes: > >>>I'm sure. > > > I too fail to see the cryptorelevance of this thread... Unless > > alt.sex.stories is used for steganography... Alice wants to send a > > secret message to Bob, so she posts a porn story to alt.sex.stories, > > where the key phrase is "That was the best sex I've ever had", which > > sounds like a mild hyperbole to most people; > > I like the stegonography angle. However I'd encode the > actual message contents into the typos. Filter out the > typos to retrieve your crypto-text. Wouldn't text with a lot of typoes look suspicious? For ultimate silliness, I've put together the following program to encode 8 bits at a time in an R-rated sentence: #include <stdio.h> #define BIT(c,n) ((c>>n)&1) const char*bits[]={ "Senator Exon", "L.Ron Hubbard", "made passionate love to", "had great sex with", "Hillary Klinton", "J.D.Falk", "experienced", "gave her", "six", "twelve", "in", "during", "one", "a single", "night", "weekend"}; void stegaporn(int c) { printf("%s %s %s and %s %s orgasms %s %s %s. ", bits[BIT(c,7)], bits[2+BIT(c,6)], bits[4+BIT(c,5)], bits[6+BIT(c,4)], bits[8+BIT(c,3)], bits[10+BIT(c,2)], bits[12+BIT(c,1)], bits[14+BIT(c,0)]); } int main(void) { int c; while (EOF!=(c=getchar())) stegaporn(c); return(0); } > Ultimately I think that the whole issue of legal cryptography > actually boils down to this: > > If you illegalize strong crypto than criminals will > simply resort to steganography and "hidden" channels > of communication (in which they can also embed/tunnel > the crypto-text of their strongly encrypted data). > > Therefore all you've done is create a lesser crime > for the real criminals and make people with valid > (non-criminal) uses of the technology into criminals. > > Unfortunately this reasoning doesn't help at all with our > (U.S.) legislature. There is some hidden aggenda as to > why "they" really want strong cryptography to be difficult > for the average user to obtain. I have a uniquely hard time > believing that "they" are merely concerned that "we" might > be pursuing simple privacy (even if cryptography were already > illegal I could use it for years and never get "caught." > so long as I was using non-broadcast channels and communicating > with "trusted" associates (fellow "crypto-criminals") > > In fact I've suggested to several people that we start > a dial-up uucp revival for this and related reasons. (If > the number of users/webpages and the bandwidth usage continues > to increase at the recent rates -- without a corresponding > improvement in the infrastructure we'll probably all want to > go back to uucp for mail and news anyway. Old fashioned dial-up > may be faster than T1 access in a few years and direct point-to- > point uucp over ISDN is probably faster already. > > So: > > What is the "real" reason for opposition to > strong crypto? Who "really" benefits? (and please > don't mention the LE types 'cause I don't believe it). > > and: > Anyone else want to participate in the great '90's > uucp revival? I'm in Santa Clara and could use > some feeds and some help with the setup. I'm all for it. My site is connected to the rest of the world via dial-up UUCP, I haven't touched the setup in 5 years, and am not planning to. It might be interesting to have a variation of dial-up UUCP where site 1 passes encrypted stuff to site 2 and doesn't quite know what site 3 they're supposed to go on to. Sort of like the remailers with encryption. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 2

Re: ADDRESS DATABASE?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jpp(a)software.net" "John Pettitt" 14-DEC-1995 16:34:23.37 >On the name database side the PO runs somthing called National Change of Address which tracks who moved where and allows direct marketing companys to clean their lists. Almost everybody sells address change data (utilities, the PO, credit companys) - I'm getting tons of "welcome to the neighbourhood" mail since I moved. -------------- The basic method for getting around this is to have the mail forwarded to a post office box. They still know you've moved, but not to where, and the connection between your physical location (for stuff like gas bills, etcetera) and the name & address that they did have is loosened. -Allen

1 0

QUERY: e-politics mailing list
by gibo＠ripco.com 17 Dec '03

17 Dec '03

Does anyone know of a mailing list organized around political issues regarding electronic networks, virtual community, the changing roles of the city and the corporation, and especially issues of class in a "wired" world? Much thanx, pls pardon the spam. PS - be careful about replying to all recipients - this message went to a couple different lists. =========================================>>>http://pages.ripco.com/~gibo "I drink coffee for taste only. You just can't make coffee strong enough to compete with pharmaceutical speed, so fuck it." -- Dave Fischer

2 1

NET - HLR on highway privacy (fwd)
by Jon Lasser 17 Dec '03

17 Dec '03

I hadn't seen this cross the list yet... ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key. ---------- Forwarded message ---------- Date: Mon, 11 Dec 1995 05:59:53 -0600 From: FringeWare Daily <email(a)fringeware.com> Subject: NET - HLR on highway privacy Sent from: hlr(a)well.com (Howard Rheingold) We Need Privacy Protection On Intelligent Highways -- By Howard Rheingold Ominous steps have been taken recently, steps that perhaps move us all closer to a global surveillance state, but few people are aware of them. Governments around the world are installing "intelligent highways," whose snooping capabilities ought to concern every driver. I recently remarked to my friend Peter, as he drove me around Geneva, that he is scrupulous about obeying the speed limit. He told me in reply that he had on a previous occasion received in his mailbox an envelope containing a photograph of his automobile, the radar detector readout superimposed, along with a notice of his fine. On key Swiss roads, radar detectors automatically videotape speeders, computers automatically recognize the license plate number, check it against a database, and issue mail to the home address of the owner. It happens in Japan, too, and more and more locations around the world.. If my Swiss friend had not told me that story, the hair on the back of neck would not have started to stand up when I read, the next day, in the October 9, 1995 edition of the International Herald Tribune, that Kansas became the tenth state to adopt electronic toll collection. Electronic transponders installed in vehicles automatically communicate with toll collecting machinery via radio, and tolls are automatically deducted from the driver's account. The following day, October 10, the same newspaper reported that Singapore had announced contracts to wire up the road system of the entire city-state. Singapore, never known as a bastion of civil liberties, will be able to track the location of every vehicle, and identify most drivers, on a minute-by-minute basis. A government and private industry initiative now underway proposes multibillion dollar investments in "Intelligent Vehicle Highway Systems" (IVHS) in the US. These systems, combining massive numbers of embedded sensors, video cameras, chips embedded in vehicles, and even satellite global positioning signals, are now under construction in every industrialized country. IVHS promise greater convenience and perhaps safety by monitoring highway traffic, routing around jams, and automatically collecting tolls. If these systems are not designed with the privacy of citizens in mind, however, we might be buying a heap of surveillance capabilities for future secret police. This is a technology policy issue where informed groups of citizens can have an impact if we act now. It isn't a matter of banning the technology. It's a matter of making sure today that these systems are designed with the privacy of future citizens in mind. One of the best sources of information about the social impact of IVHS comes from Professor Phil Agre at the University of California, San Diego. Agre stated recently: "Society may decide that it wishes to provide law enforment with generalized abilities to track citizens' movements, but this would clearly be a grave decision - one that should be discussed well in advance rather than building the technical capabilities into ITS systems with virtually no public discussion." There is a technical fix, however. Encryption techniques make it possible to transmit account information from an automobile without disclosing the identity of the owner. However, it is critically important that the early majority of transponder manufacturers build encryption capabilities into their devices. Making privacy a standard will work far better than attempts at legislative regulation after the market has settled on a standard. Agre's reports can be found on the Web at http://communication.ucsd.edu/pagre/rre.html. To access his whimsically-named but extremely useful "Red Rock Eater News Service," via e-mail send a message to rre-request(a)weber.ucsd.edu, Subject: archive help. We still have time to do something about this one. We need to ask manufacturers now to consider the importance of building privacy protection into their technology. I support Agre's statement that "People need to use roads to participate in the full range of associations (educational, political, social, religious, labor, charitable, etc) that make up a free society. If we turn the roads into a zone of total surveillance then we chill that fundamental right and undermine the very foundation of freedom." END

1 0

Motorola Secure Phone
by dan＠milliways.org 17 Dec '03

17 Dec '03

I saw a new cordless phone made by Motorola in a retail outlet today that is supposedly "Secure from eavesdroppers." I asked the salespeople for more technical info, but they weren't very helpful. Does anyone have any information on this? I didn't notice any "Not for Export" stickers on the box, and the ITAR does cover spread-spectrum technology. So is it analog or digital? Is it just doing simple analog tricks, or is it encrypting a bitstream? Clipper maybe? I doubt it. Any info appreciated. Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

5 4

Re: Secured RM ? (source)
by Josh M. Osborne 17 Dec '03

17 Dec '03

In message <Pine.LNX.3.91.800121064335.1068A-100000(a)HellSpawn.gate.net>, root w rites: > >OK ... here we go.. Based on discussion on this list this is what I >hacked out to (hopefully) more securely remove a file under unix. >I'd really apreciate any input, but my main interest is in the security of >the protocol in general and not the sloppy and embarassing C >programming.. :) Well it seems to assume that it only needs to write 1024 bytes past the end of the file. You either don't need to write any bytes at all past the end, or you need to write one "block" past the end (normally 8K, but it varies), you can use fsstat(2) on many systems to find the block size for a filesystem. Secondly you need to flush the data out to the file (use fflush(3), and fsync(2) if available, otheruse call sync(2) *twice*). If you don't some small set of Unix systems may notice that you are writing to a file that no longer exists, and not do the writes at all. Thirdly you should make several passes over the file, writing diffrent patterns on each pass (and remember the flush & sync after each pass - while it is uncommon for Unix systems to supres writes to unlinked files it is extreamly common for them to detect multiple writes to the same part of a file, and only do the last one). Forth - and this is the kicker - there is no gaurentee that the filesystem itself won't keep a copy of the old data for some reason. Three examples: * a compressed filesystem may write the new data elsewhere because it compresses diffrently from the old data - you should be able to defeat this by filling the disk several times with random paterns * the log structured filesystem (LFS) *will* write the new data elsewhere, and the space the old data is on will not be overwritten untill the cleaner comes and examines the part of the disk it is on - again filling the disk several times with random patterns should cause an overwrite * NetApp's NFS appliance ("the toaster") can (and normally is) configured to take "snapshots" of the filesystem at various times, this makes the blocks the file is currently on read-only, and any ovewrites will merely allocate new space. The old copy of the file will be readable for some peroid of time (frequently up to a week) under a diffrent name - here you will be unable to fill the disk (unless you are the NetApp admin - then you can delete the appropriate snapshots and fill the disk...) While we are at it you probbably want to use stat(2) to find the length of the file, and you can get far more I/O if you allocate a sizeable chunk of memory (say 1K, or 8K) and use writev(2) to shove multiple copies of it out per syscall... and some indenting on the code would make it more readable (and simpler for you to write as well). >While we're here.. I havn't been able to find anyone on the planet who's >seen or heard of a linux un-remove, which makes testing my code very >tricky. If anyone can point me at it I'd apreciate it. Hell, if someone >can definitively say they've /seen/ such a thing it'd be nice. So far >i've found one person who insists that his system admins sisters >boyfriends cousin from Saint Petersburg has been using un-rm for unix for >years. *sigh* I don't know of a real un-rm. In "the old days" there was a fsdb (filesystem debugger) that could be used to alter the filesystem at a low level. If you knew enough you could "un-rm" a file. It had to be a very valuable file to be worth it!). At some sites they alias rm to do something like "mv $1 .$1.deleted", making an un-rm is left as an exercize for the intrested reader.

1 0

Alien Abductees, Flat Earthers, and other Fringoids
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:37 PM 12/15/95, Giles Bowkett wrote: >Does anyone know of a mailing list organized around political issues >regarding electronic networks, virtual community, the changing roles of >the city and the corporation, and especially issues of class in a "wired" >world? > >Much thanx, pls pardon the spam. Don't mention it! After all, all right-thinking Cypherpunkz are intensely interested in these mailing lists you sent this to: abducted(a)hyperreal.com (many Cypherwonks are alien abductees!) flat-earth(a)zikzak.net (where the "edge" culture meets the edge of the Earth) email(a)fringeware.com (yes, we're at the fringe) So nice to know that we're lumped in with these folks. --Tim "Dr. Bob" May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

personal privacy
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

Well, as of about two days ago IL passed a bill that says employers can listen to their workers phone calls all they want. Dr0id

1 0

Re: Netscape announces position against GAK
by jim bell 17 Dec '03

17 Dec '03

At 01:16 AM 12/9/95 -0800, you wrote: >http://home.netscape.com/newsref/ref/encryption_export.html > >> NETSCAPE PRESENTS POLICY ON ENCRYPTION EXPORT TO KEY MEMBERS OF THE >> ADMINISTRATION AND CONGRESS >> >> ---------------------------------------------------------------------- >> >> This week Netscape representatives attending a government presentation >> of the administration's proposed Key Escrow Policy for Export detailed >> the company's firm opposition to the proposed policy. Netscape is >> opposed to this type of proposal for a number of reasons including its >> failure to adequately address the issues of acceptability by foreign >> governments and corporations, significant personal privacy concerns, >> and the mandatory nature of tying the Exportable Key Size to the Key >> Escrow Proposal. [rest of position deleted] While this may be a reasonably good start, what I would have preferred that you say is that if any kind of GAK system is adopted, either foreign or domestic, you as a corporation would ENTHUSIASTICALLY do everything in your power to (_legally_) circumvent, undermine, sabotage, neutralize, and counteract whatever goals the US government has with reqard to implementing GAK. In other words, while you might stay barely within the letter of the law, you would tirelessly exploit every possible loophole (both legal and technical) to ensure that the government NEVER gets its way. I feel certain that with a few imaginative lawyers and programmers (both foreign and domestic), it should be possible to turn this into a "nightmare scenario" for the government.

1 0