December 2003 - cypherpunks-legacy

CAL_bak
by John Young 17 Dec '03

17 Dec '03

The Jan 6 Emist reports on the $488m callback game: Callback services exploit the fact that in many countries it costs more to make one international telephone call than to make two from America. By the end of the year more than 100 American companies will be selling the service. Places that have tried to stop the services include Saudi Arabia, Argentina, South Korea, China, Malaysia and Canada's North West Territories, where even local calls were cheaper by callback. The operators believe they are beyond the reach of local laws. Even if laws are passed, technology makes them hard to police. "It's a cat and mouse game," one says. "It's kind of fun." CAL_bak Thx to AS.

1 0

Re: Microsoft continues to mislead public about Windows security bugs (a bit long, with references)
by James A. Donald 17 Dec '03

17 Dec '03

At 07:15 PM 1/8/96 -0800, Rich Graves wrote: >As Microsoft well knows, this is completely untrue. [...] > > [...] > >Microsoft has not even admitted that this bug in both Windows 95 and >Windows for Workgroups affects Windows for Workgroups, apparently because >they have decided not to fix it. > > [...] > > We believe that it would be highly irresponsible to release the full > version of this hack, but we will soon release a crippled > demonstration-only version > > Is anybody listening? They will listen if you start to release full uncrippled exploits, after a reasonable delay. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

can we trust the government as custodians of private info?
by an466459＠anon.penet.fi 17 Dec '03

17 Dec '03

DOYLESTOWN, Pa. (ITN) * Carol Sandusky didn't want to hear how her biological father supposedly stabbed her mother with an ice pick and threw her out a window while pregnant with Carol. She didn't want to know she was beaten in the face with a saucepan and burned with cigarettes as a toddler. She didn't want to hear that her biological family members accuse each other of rape, murder, beatings and infidelity. Sandusky, 26, learned the details because a government caseworker violated her wishes -- and the law -- by helping a sister track her down. What's worse, she said, the same agency might have saved her from a tormented adolescence had it disclosed the abuse to Jeanne and Thomas Sandusky when they adopted Carol in 1973 at the age of 3 1/2. "The state made a decision to take me out of this environment, then they decided 20 years later to bring it back to me," Sandusky said. "My file was supposed to be really private." In telling her story and advocating privacy laws, Sandusky stands among the few trying to counter a movement promoting vigorous searches for birth families. She rejects the arguments of those, including her biological sister, who believe she's not dealing with her adoption and must hear the grisly details to heal emotionally. "They thought this information was going to help me. I wasn't even born yet. What's this information going to do for me?" Sandusky said. Sandusky, her parents and her husband recently filed a federal lawsuit against the Cumberland County Children and Youth Services, administrator Gary I. Shuey and the person she blames for improperly revealing sealed information, former agency caseworker Marlene Bohr. They contend the agency violated Sandusky's privacy and fraudulently withheld information that would have led her adoptive parents to seek therapy for her years earlier. In Pennsylvania, adoptees may obtain information about their birth parents with the consent of a court and the parents, but the law forbids agencies from opening records to siblings. Most states have restrictions on adoption records. Bohr did not return messages left on her home answering machine and Shuey didn't return calls to his office. Ruby D. Weeks, attorney for the youth agency, referred calls to county solicitor Hank Johnson, who said he had not seen the lawsuit and could not comment. Sandusky's ordeal started in February 1992, two months after her wedding. At 22, Sandusky had achieved stability after an adolescence marked by bulimia, suicide attempts and hospital stays for emotional problems. Along with a new marriage, she had a good job as a nanny. Her parents then got a call from Bohr saying the eldest of Carol's two older biological sisters was looking for her. The Sanduskys, who live in Newtown, Bucks County, refused to divulge their daughter's phone number but passed the message to her, along with Bohr's number. "I said, 'Throw the number out,' " Sandusky recalled. But her parents, who also have a biological son, 17-year-old Brad, encouraged her to call as a matter of courtesy. Talking on the phone with Bohr, Sandusky said, she learned that her sister "had a great need to see me because she protected me during infancy." Sandusky was put off by that great need and mortified when she learned the sister had located her biological parents and grandparents. "I didn't want to be involved with any of that," said Sandusky. "I said, 'No way.' " Sandusky did, however, agree to hear medical background information from Bohr. Instead, Sandusky said, she ended up with disturbing information from the caseworker and two years' worth of bizarre, harassing letters from the sister. First came the medical information from Bohr. "She said, 'It looks as if you were beaten in the face with a saucepan. It looks as if you have cigarette burns. It looks like you were tied to a chair and shot up with Thorazine. I have a picture right in front of me of your face with a huge hand print on it,' " Sandusky recalled. The abuse reportedly came at the hands of her birth parents and, later, her foster parents. "That wasn't what I expected to hear. That's not what I consider medical information, and I hung up the phone," Sandusky said. Two days later, she got the first letter from her sister, who is two years older. Many others followed, detailing not only family medical history but also family brutality. "It's unbelievable what this family life was like," said Sandusky. Sandusky and her husband eventually moved to a new home in Bucks County, fearful of visits from blood relatives. In the letters, the sister indicated Bohr had given her extensive details about Sandusky and other biological relatives. Sandusky's anger focuses on Bohr. In a thick file, she has letters from state lawmakers who agree that, by law, Bohr had no business calling on behalf of the sister. But District Attorney Michael Eakin, in a statement issued at year's end, said the two-year statute of limitation in the case had expired, giving him no legal avenue to press charges. He declined to comment further. Florence Anna Fisher, who helped found the adoptee search movement 25 years ago by launching Adoptees' Liberty Movement Association, advocates breaking laws that keep information from adoptees. She said she doesn't understand Sandusky's complaint. "Nobody can pressure you into staying on the phone and seeing someone you don't want to see if you're an adult," Fisher said. She agrees adoptees should be left alone if they want no contact, but she believes that all adoptees really do want to know about their past and owe it to their children and grandchildren to find out. "If they told me I had been burned, if they told me I had been abused as a child, I would rather know that than walk around a blank slate all (my) life," she said. Joanne W. Small, executive director of Adoptees in Search in Bethesda, Md., said the Sandusky case should not be used as a reason to keep records closed. "It must be considered atypical and aberrant," she said. But Mary Beth Style, vice president of the National Council for Adoption in Washington, D.C., the prime organization lobbying to keep adoption records closed, said she receives calls from people hysterical over unwanted contacts. One woman in Washington state reported that an intermediary had violated her wishes and revealed her identity to her birth daughter. It turned out the daughter worked for the mother's husband. "You're assuming that these adults cannot make decisions on their own, that they're in denial and you're going to help them," she said. "There is no way to protect the quality of the searches and I'm very concerned about that." Even initial contacts can be traumatic for people who thought they had put adoptions behind them, according to Style, who added that opening closed records also erodes trust among those considering adoption. For her part, Sandusky, who hopes to adopt someday, can do without the biological family reunion. "They almost killed me," she said. "I don't need to confront that situation." --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

PRIVACY: Private traces in public places
by Alexander 'Sasha' Chislenko 17 Dec '03

17 Dec '03

Most of the materials that are currently available on the Net and can be easily found through many search engines were created for other media, by people who were not aware that these materials may ever end up on the Web. Sometimes, it comes as an unpleasant surprise to a person who looks for web pages referencing his own name, and finds, among other things, many of his explicit or controversial usenet or mailing list messages, old resumes that may contradict the current one, critical remarks of his high school girlfriend and former colleagues, etc. Knowing that this information is easily accessible to his new girlfriend and prospective employer may make him more than uncomfortable. All advice to such a person you may see on the Net mentions Net laws that should have been passed and personal actions that should or should not have been taken. In both cases, it's usually too late. Fortunately, not that many people have been burned. We can bury them (or their reputations) and move ahead, vowing not to repeat their mistakes. From now on we, the prudent ones, will be very careful not to leave compromising traces where they can be uncovered by existing technologies and made public. It's called "learning from other people's mistakes". - No, it isn't ! The mistake those people made was not leaving traces that could be made public with *then* existing technologies. It was doing things that could be uncovered by technologies (like search engines) that at the time *did not exist*. If you want to learn from these mistakes, you should look at what information about yourself you are leaving behind that can be made public tomorrow. Let's look at what traces you leave. I do not want to consider time travelers from the future watching your life. - Just some already available technologies that are on the rise and will be cheap and ubiquitous tomorrow. - Your database records. - All letters to public officials that you ever wrote or that mentioned your name. - All mentions of you in any printed press. - All published photos where you can be recognized (including street crowds, demonstrations, football games) - they will all be scanned some day, and machines with image recognition will find you even where you wound't. - Your fingerprints. How many books, magazines and other things currently stored all over the world carry your fingerprints? It is possible to figure out what pages you read, after whom, with whom, etc. - Landfills: They are probably the richest source of detailed historical information that is not obtainable from any other source and can be used to reconstruct the detailed history of society, economy, technology and any single person with incredible detail. Besides thousands of your personal letters and documents, they contain data on the evolution of your intelligence, handwriting, habits such as nail-biting, samples of hair that you washed with different shampoos (or didn't) and millions of discarded little things identifiable by your writing, fingerprints or DNA samples. One may figure out where you drank a cup of Coke 30 years ago, and who you shared it with. And so on. The technology necessary to recover and index all this data is already available and will become very cheap in a few decades. How can people protect themselves from all this? Will people of the future all wear identical privacy suits, gloves and helmets and burn everything they have touched? Or they will just try not to do things they may later be ashamed of? (How do you know what you may be ashamed of 30 years from now?) ---------------------------------------------------------- Alexander 'Sasha' Chislenko <sasha1(a)netcom.com> Home page: http://www.lucifer.com/~sasha/home.html Great Thinkers page: http://www.lucifer.com/~sasha/thinkers.html

3 2

<fwd> Spiegel on CIS Censorship
by vin＠shore.net 17 Dec '03

17 Dec '03

Interesting, below, how CMU's lack of standards, Marty Rim's exploitive "scholarship," Time Magazine's sensationalistic schlock journalism (shades of "National Inquirer" there! remember!) and CIS's utter ignorance of free-speech principles set the stage for the symbolic Bravarian Censorship of the Net. You'll hear of a dozen other nations jumping in, with different standards, within the month. I find the tragic association of a "free" Internet and porn to be painfully common among cyberless adults even in my own community. Odds are, my state, Massachusetts -- arguably the most liberal of the US states -- would vote for Censorship Filter tomorrow if it were on a ballot. It's amazing how incompetent the liberal/libertarian side has been in this public debate. (So incompetent, in fact, that there has been _no_ public debate!) Everyone who wants to place control over any filter (any part of The Filter?) in the hands of the citizen is just another snuff/torture/kiddy porn addict. <sigh.> How have we let the image of the Net -- surely one of the most generous, selfless, sharing communities ever to come into existance (think of the freeware!) -- be reduced to such degradation. _Vin ---------- Forwarded message begins here ---------- From--michael_kunze(a)spiegel.de (Michael Kunze) Newsgroups--alt.censorship Subject--CIS censorship--The whole story Date--Sat, 06 Jan 1996 09:33:39 GMT Dear Nettizens, Some few fivehundred postings ago, I promised you let you have more details about the CompuServe censorship case investigated by the editorial staff of SPIEGEL online. It is not a story of evil but of people acting overambitious and ignorant. And it is not quite as simple as DrG might be wishing! To keep it short, here are the facts: In 1994, a Task Force called "AG EDV" was set up by the Bavarian Minister of Interior at the Police Headquarters in Munich. Initially, the Task Force was formed to search persons dealing with pornographic material via BTX the former online service of German Telekom and its work was limited to one year. For the moment, investigations of this Task Force ran successfully due to the assistance of Telekom. But simultaneously, people being suspected changed their ways of distributing either to closed BBS systems or chose more secret methods. So the Task Force was compelled to enhance their efforts and they raided Munich BBS systems. Furthermore, they studied computer magazines to find ads for pornographic CD-ROMs. During this operation they found what they were looking for, and "PC Direkt", a Ziff Davis publication, and some other magazine were forced to pulp some issues. All activities of the Task Force could not have happened, if they were not supported by a whole bunch of local prosecutors and judges. Sticking together, chatting, doing favours forms a part of the social life in Munich - in malicious words - the 'Munich swamp'. The prevailing opinion of the Task Force and of some prosecutors is that carriers of digital information could held responsible for the content of what they are spreading. This meaning matches exactly the content of the CDA. But this is only one point of view. Up to now, there doesn't exist any law or direction in Germany concerning responsibilities of ISPs or online services regarding contents they only do deliver. And so, judges decide from case to case. The German department of justice thinks that carriers could be held responsible if they deliver illegal content "deliberately". But then, could one call them "carriers"? Last summer, a kind of hysteria about Internet pornography broke out in German media. A few journalist had made their first steps in the Internet and discovered nasty postings in the alt.binaries.pictures.erotica Usenet hierarchy. A student of Erlangen University was seized because of spreading child porn via Usenet. Then, the "Time" article about Internet porn was published and quoted by nearly every German newspaper. I think at that time the Task Force planned to investigate the Usenet. Due to the facts that CIS had become a big ISP and their German office is located in Munich, CIS seemed to be a worthwhile target. Somehow the Task Force managed to get a search warrant to investigate the Munich CIS office on November, 22nd. However, the search was more or less like a visit. Let me quote the public prosecutor: CompuServe "was quite cooperative". "We sat together talking about chances to kick pornographic contents out of CompuServe's information system." The police officers just collected a copy of the CompuServe association contract and the address of the CEO. Two days later, CompuServe's German managers published that they "will do anything to support the work of German authorities fighting against pornography in Cyberspace". On December, 8th, CIS was handled a list of more than 200 newsgroups by the Task Force. In my opinion, interpreting the prosecutor and the CIS spokeswoman, this list was presented to CIS as containing "suspicious newsgroups". In the attached letter from the prosecutor it is said: "... it is left to CompuServe to take the necessary steps to avoid possible liabilities to punishment." So, if CompuServe should have ever had threats, it could have been only very small ones. But there is no reason to their German management to risk anything. CompuServe's approach is not to guarantee for "freedom of speech and information" but to make "money". When i interviewed the prosecutor, it soon became quite clear that his department had tried to bring CIS to court to get its legal position checked by some judges. Because of CIS servile tactics they had to give up their goal. The ominous list itself shows, how ignorant the members of the Task Force are about the Usenet. In my opinion, they just sampled all newsgroups containing words like "sex", "erotic", "gay" and so on and put the result onto the list. We have two in depth articles on the whole affair on our web server. One is an extended version of what i've posted here, the other deals with the CDA and the actual political and legal situation concerning the Internet. Unfortunately for US readers, these articles are in German because we didn't found the time to translate them. But i hope will can manage this until Monday 8th, 8:00 AM, EST. Then, you should point your browser to <http://hamburg.bda.de:800/bda/int/spon/online/excl03.html> or have a look at our complete online services at <http://www.spiegel.de> By the way, SPIEGEL online is the online department of the reputable German news magazin DER SPIEGEL. Greetings Michael -------------------------------------------------------------- Michael Kunze Tel.:+49(0)40-3007-0 Redaktion/editorial staff Fax :+49(0)40-3007-2986 Spiegel Online Brandstwiete 19 20457 Hamburg / Germany ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ std. disclaimer: diese Meinung meins, exclusiv und immerdar <*><*>< Vin McLellan + The Privacy Guild + vin(a)shore.net ><*><**> Heed, fellow citizens, Justice Felix Frankfurter (Butler v. Michigan): "The State insists that, by thus quarantining the general reading public against books not too rugged for grown men and women in order to shield juvenile innocence, it is exercising its power to promote the general welfare. Surely this is to burn the house to roast the pig.... The incidence of this enactment is to reduce the adult population of Michigan to reading only what is fit for children."

1 0

RE: S.652 (H.R. 1555) ("obscene, lewd, lascivious, filthy, or indecent...et al")
by blanc 17 Dec '03

17 Dec '03

You know, you all are worrying too much about this War of the Offending Words. What the governing types are really trying to prevent is communication which is succinct, direct, penetrating, & to the point. What needs to do is to learn to speak like politicians. Learn to go around the subject, make indirect reference, make vague allusions, be indirect & wavering, ambiguous & obfuscating, evasive & hypocritical; never openly offending, never possible to be held liable for having said anything of consequence. Of course it will still be annoying, but how can they criticize their own style & manner. .. Blanc

1 0

A little skepticism over $60 billion
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 08, 1996 21:16:20, 'Bill Stewart <stewarts(a)ix.netcom.com>' quoted dang(a)netcom.com's post about a S.F. Examiner story, to wit: >> >>NEW YORK U.S. companies will lose as much as 30 percent of the $200 >>billion in U.S. computer system sales expected > B. Stewart went on to remark: >OK, so crypto export laws will cost.... The phrase "as much as" does not mean "will," as in: "Lose as much as 14 pounds this month with the newly discovered miracle diet...." or "Studies show as many as 1 in 4 students will be raped while ...." The phrases use weasel words that say little about the real nature of the real world. How much money will companies *likely* lose, how many *likely* pounds lost, how many *likely* rapes? None of the "studies" say. Assuming the studies are reliable in the first place, the only thing the weasel words state accurately is the potential maximum, E.G. "You can starve yourself all you want and the universe will die a heat death before any human being will ever lose more than 14 pounds on our diet and you may not lose anything...." or "No matter how much we fudge with the English language's definition of 'rape' for political reasons, we can't get estimates above 1 in 4 ...." Now we know that U.S. companies will lose something off the government's anti-export policies. But will we really see 30% of sales lost by purchasing agents saying "Gee, we'd like to buy IBM mainframe's and Dell micros and Windows and unix but we won't because there is no secure encryption program in the world that will run on the IBM or U.S. micros or under the U.S. OS's"? Let's fight the export laws over exporting quality crypto without accepting advertising hype from any industry. -- -- tallpaul -- Any political analysis that fits on a bumper sticker is wrong.

2 1

Can you break my encryption protocol ?
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

I'm trying to put together a simple protocol for encrypting confidential but typically low-value data (i.e. I don't want people to be able to read it, but in most cases it wouldn't be catastrophic if they could). I want it to be completely license-free, so I can't use RSA or other patented algorithms. It also would only be used inside one organisation, so key management isn't so much of a problem, and the main attack it has to defend against is packet-sniffing on the Net. It also has to support variable-length keys for ITAR.. The idea is as follows.. Client and server both have copies of a passphrase, of any length. When starting the connection, client sends 128 random bits to the server. Both ends take this data, append the passphrase, and use MD5 to generate a session key. If a key of less than 128 bits is required for legal reasons, then the appropriate number of bits are retained, and the rest replaced with bits from the random data that was sent in the clear. That is, if you're only allowed 40 bit security, you take the first 88 bits that you were sent, and append the last 40 bits of the generated key to give you the session key to use. You then go off and encrypt the session (probably using 3DES or Blowfish). Can anyone spot any flaws in this system ? The only potential problem I can see would be that by cracking a number of sessions you could work out the passphrase. However, I think the number required would still be infeasible. Also, are there any known problems with using Blowfish for encrypting a data stream ? I'm assuming it's OK as it's used in PGPfone. Mark

2 1

Eavesdrop Law
by John Young 17 Dec '03

17 Dec '03

As variation on the recent discussion of employee e-rights, WSJ today: New eavesdropping law creates labor-management tussle in Illinois. The Illinois AFL-CIO is going to court to fight a provision in a bill Gov. Jim Edgar signed last month that the labor group says allows employers to listen in on employees' conversations "for virtually any reason." A spokesman for the Illinois Retail Merchants Association, the provision's prime backer, says such fears are "wild speculation." Critics say the provision's language, allowing monitoring for "service quality control or for educational, training, or research purposes," is far too broad. The retail merchants association notes that employers are responsible for the conduct of employees who deal with customers over the phone.

1 0

Re: S.652 (H.R. 1555)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:32 AM 1/9/96 -0500, Don Gaffney wrote: >On Mon, 8 Jan 1996, Harry Bartholomew wrote: > >> >> http://www.cdt.org/policy/freespeech/12_21.cda.html >> >> This title may be cited as the "Communications Decency Act of 1995". >> >> Perhaps some of our more lawyerly types can decipher whether >> it is getting better or worse as the conference committee chews. >> Not I. >> > >I'm not a lawyer, No kidding. > but from what I've read from the WWW site above, it >seems that only providing "indecent" materials to minors is prohibited. >I think this is already illegal. No. For example, the San Francisco Chronicle can be sold or given to minors without restriction and yet it has published the word "fuck" on several occasions. This is considered "indecent" but not obscene. Likewise other newspapers, magazines, and books. The Supremes have upheld time, place, and manner restrictions on over-the-air broadcast of indecent material (The Seven Words You Can't Say on Television), but these restrictions do not apply to cable or even to broadcast later at night. >Broadcasting or sending unsolicited "indecent" materials is also >prohibited, but that seems to have always been the case (except that >objectionable materials have been called "obscence" rather than "indecent"). Obscene is different from indecent. What Congress is attempting to do is apply conventional broadcast TV and radio regulation to the Internet and other computer networks in spite of the fact that they are not like those systems and in any case those systems are supposed to be in the process of being deregulated themselves. >There are provisions, as I read it, that protect electronic >intermediaries from the acts of the actual publishers of the materials >(i.e. an ISP is not responsible for the material of other internet sites >not under their control). But the protections are phony because ISPs have to bend over backwards to block their systems from being used to transmit indecent material. It just deputizes them as cops. DCF "Frankly, my Dear. I don't give a damn." -- Indecency, 1939 style.

1 0