December 2003 - cypherpunks-legacy

Re: Why Netscape employees should not leave...
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Of course given the great market success of the other Clipper products, I wouldn't be counting my stock options before they hatch. Browsers are not that complicated. Nor are HTTP servers. A US-only, truly secure system would be easy to build. SSL is designed to be expanded to include new algorithms. It's pretty good in that respect. If I were considering launching a Clipperized Browser, I would really consider the negative effect it would have on its marketability and its stock price.

2 1

Use of PGP as an export?
by Ted Cabeen 17 Dec '03

17 Dec '03

I think this has been brought up before, but I could only find one reference to it in the archives and it wasn't too helpful, so I'll ask again. If a university provided a copy of PGP for use on their unix machines and a non-resident, non-citizen *used* the copy of PGP on the server, but did not download it onto their own machine, but instead just ran PGP on the server alone, would it be a violation of the ITAR? My school is interested in putting a copy of PGP on the university server and wants to know if they should somehow restrict access to citizens and legal residents only. Thanks. _____________________________________________________________________________ Ted Cabeen cabeen(a)netcom.com Finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." cococabeen(a)aol.com

1 0

Transatlantic Agenda
by John Young 17 Dec '03

17 Dec '03

If anyone knows where to get a copy of this document -- especially those surely secret concordances that address the agenda of this list -- please whistle: MADRID, Dec 3 (Reuter) - U.S. President Bill Clinton and European Union leaders signed on Sunday a so-called New Transatlantic Agenda intended as a blueprint for Euro-American relations into the 21st century. The document encompasses cooperation on trade, security, human rights, aid, democracy, health care and crime-fighting among other subjects.

1 0

Fight.comp.crime.like.a.paranoid.FBI.psycho
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Coming to Terms with Computer Crime Computer Crime: A Crimefighter's Handbook David Icove, Karl Seger, and William VonStorch O'Reilly and Associates Inc., $24.95; 800-998-9938 ISBN: 1-56592-086-4. By Don Willmot If you tend to be a paranoid type of person, Computer Crime: A Crimefighter's Handbook will keep vou up at night pondering the incredible number of computer crimes that people can commit and the difficulties involved in stopping them. The book, split into sections that deal with defining computer crimes. preventing them, and handling them, is loaded with fascinating facts. When you stop to think about it. the number of different types of crime is alarming: sabotage. revenge, vandalism, theft, eavesdropping, even "data diddling." For each type of attack, the book suggests preventive measures and strategies, all in commonsense style and plain English. You'll feel like an FBI agent as you read the personality profiles of different types of computer criminals. Hackers, crackers, and vandals are all psychoanalyzed, and interesting charts of "vulnerabilities" and "countermeasures" will help you make plans to keep your organization safe from outside attack. The book includes discussions of everything from choosing locks and keys to interviewing personnel, setting up "concentric circles" of defense perimeters, and forming a crisis-management team to handle the fallout from a successful computer crime. There's even an entire page devoted to all the passwords you should never use. Almost one-third of the book is given over to the actual text of federal and state laws used to prosecute computer crime. This section is meant not to be read but to be used instead as a reference.

1 0

Suggestion for CP browser
by fc＠all.net 17 Dec '03

17 Dec '03

I think a CP browser is just the ticket to change the way the world works. How about this: - CP writes a browser with PGP or better quality crypto. - CP makes it freely available to any individual - CP licenses it to corporations for $1 per copy - Funds produced go to support worthy causes, support a permanent home for CP, and support anti GAK efforts (lobying, etc.) I think the CP browser should include an embedded language (not Java - maybe a version of LISP) that does a far better job than Java of assuring limitations on what programs can do. It should also support faking the source of a browser request (for privacy of the user), all forms of digital cash, firewall-type forwarding, pseudonyms, and all of the other things that CPs fight for. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1

INTERNET SECURITY RISKS FOR CONSUMERS OVERBLOWN
by OpsAn＠gnn.com 17 Dec '03

17 Dec '03

Just got this and found it interesting. You may have seen it already...published in today's issue of Investor's Business Daily. INTERNET SECURITY RISKS FOR CONSUMERS OVERBLOWN Fear of Internet crime is well-founded among businesses whose corporate networks may be compromised by curious hackers or malicious crackers, but "By and large, consumers have very little risk using and doing business on the Internet," says the chairman of Open Market Inc. While it is possible to break an encryption code and crack a secured phone line to discover an individual's credit card number, it's much easier to copy them off of discarded carbons. "If someone wanted to steal a credit card number, all they would have to do is go to any gas station and look on the ground around the pumps," says the CTO at Internet security firm Terisa Systems. (Investor's Business Daily 30 Nov 95 A8)

1 0

Questions
by rmarquis＠umich.edu 17 Dec '03

17 Dec '03

Hello. I was wondering if anyone would be able to help me out. I am writing a research paper and I need some interviews for it. If you could answer any of these questions about security, I would greatly appreciate it. Thanks for your time. --Bob Marquis Please send responses to rmarquis(a)umich.edu - How can PGP help secure something like e-mail? - Are there any encryption schemes which are "unbreakable"? - What would someone need to do to send an e-mail message which cannot be read or altered by anyone else, or is it not possible? ____________________________________________ Robert Marquis, Jr. University of Michigan - Dearborn e-mail: rmarquis(a)umich.edu www: http://www.umd.umich.edu/~rmarquis

2 1

Remind me why we're so mad at Netscape
by Matt Blaze 17 Dec '03

17 Dec '03

Could someone please remind me what it is we're mad at Netscape about? As far as I can tell it's some combination of the following offenses: (a) - Jim Clark made a speech in which he revealed that he thought the government would be a player in determining the way cryptography ends up being deployed on the Internet. He was quoted in the trade press, but it was unclear exactly which words were actually his. Asked to clarify, he said that Netscape would implement mandatory government access across its product line only if required to by law, but he observed that things seem to be moving in that direction. I share his pessimism, unfortunately, unless we find a way to shift the winds. (b) Netscape contracted with the government to produce a ``Fortezza'' version of their browser for government use. They negotiated to get a lot of money for this (maybe something like $5 million). Good for them. Personally, I *like* the Fortezza interface; the API seems to provide a good abstraction for hardware and software crypto, it's easy to replace the module with something else (like software 3DES with no key escrow), and it's easy to defeat the key escrow features. Of course, maybe I'm just defending them out of guilty self-interest here, since I've played around with the Fortezza interface quite a bit myself, although they never sent me my $5 million. (c) No one from Netscape attended Bernstein hearing. I wish someone had let me know beforehand that that was to be the litmus test for the right to claim cryptographic correctness, or I would have flown right out. I guess I blew it, too. (d) Their stock price is very high, many times greater than their profits and physical assets would seem to justify. I'm not sure I understand the implication here. Maybe that this is proof that in exchange for selling out (by committing sins (a), (b) and (c), above), the secret NSA stock-price-manipulation cabal rigged the market to overvalue their stock? Wow. Don't get me wrong here; it may be useful to make clear that the market (to the extent that any of us can claim to represent any market they would be interested in) won't tolerate vendors who put the government's desires ahead of their customer's security needs. But I have yet to see any actual evidence that that's what's happened here, and I'd hate to see Netscape loose a lot of good people who could go a long way toward deploying real security on the net over something that turns out to have been a false alarm. Disclaimer: I'm employed full time by a soon-to-be-tri-vested major player in the military industrial complex, and us sellouts like to stick together. -matt

1 0

Re: "Got a subpoena?"
by btmoore＠iquest.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:09 PM 12/1/95 -0600, Al Thompson wrote: >At 06:57 PM 11/30/95 -0500, JHupp(a)Gensys.Com wrote: > >> And at that point, you shut down the remailer and log each and every >>bounce. >> >> Now, they could get an order forcing you to run a remailer ~ but that >>would open up a whole new can of worms i.e. can you be forced, under >>court order, to commit a crime? > >That's not how they do it. They will tell you that unless you cooperate, >you will >be charged for the "crime" you have been committing. Where do you think >confidential informants come from? They're just people who have been caught >or set up by the cops, who are trying to save their own ass. > There are times when all that can be said is Amen!!! Most of these people have absolutely no clue to the way the government REALLY works! The feds will set up a "little" fish in order to catch what they consider to be a "big" one. Ask Randy Weaver! They weren't really after him... they were after the Aryan Nations. They wanted Mr. Weaver to infiltrate for them... So they attempted to encourage his enthusiasm... How? They set him up on a bogus gun charge... when that wasn't successful... They killed his family! The problem is people still live under the mistaken notion that there are rules! When the congress and the courts passed laws allowing the confiscation of property without due process and further allowed the proceeds from the sell of that property to fund the coffers of the agencies that took those properties, they assured our descent into a totalitarian state. We are like the walking wounded, soon to be the walking dead. We are dead and don't know it! Unless the tree of Liberty is watered soon... it seems we are doomed! Benjamin T. Moore, Jr. btmoore(a)iquest.net (Jian #AJF IRChat) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMD7YISAJOVFNaChAQGolwf+IBbGrWn5HvRwHpIuAu+GbVgOgIP3ZIyo CVt8EgvoAiq11Qo6B/aRawGhwxgmLCEZWbFaW/QrHQTsOWspqPmKd8N0h5ZIhn73 c84NOxjXEOcOUHwtmGgDL5kK1hvaqClmTXG3DjmCVoYgXIbHm73JB1liKwGsHn2E TXAT4jEDUp2wBWiDNc2/z2dPzPgm/l+0xwzLZYPNMkL2/vgCrfSVewwBKXmk1oDZ lYysKonja02NgYWUy2Ujz9gr69kfriZgdz4SIO+mbakhbPBqJZUEQg8fwZnz8fgU hRmFoVFudRPRn1qyU65tzLbGurpXT8hxYbWwv895qaDfLHdQ2IH0iQ== =On3V -----END PGP SIGNATURE-----

1 0

Re: Talking to Jim
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 2 Dec 1995 anonymous-remailer(a)shell.portal.com wrote: > > The market seems to "think" that it's a better present judge > > of what Netscape has than he does. It's almost as though > > the "market" has developed a "mind" of its own. > > Well, of course! Markets are the most efficient integration of the minds > of the participants, hands down. Hands down efficient integration?? Not especially. First you have to really wonder what and who the "participants" in this market are. As an example, year-ends have certain particular momentums. So do capital gains considerations. All part of the mind of Buddha, as some of the fruitcake players might say ... and all part of the known interplaying "participants". > > It's own particular neural network. > > Exactly. Literally. And huge, too. Except that this one doesn't listen to any of its sensors or input devices. It's learned to ignore all of *that* information, because all of *that* information is inherently untrustworthy, so it simply listens to it's very own dialogue. Sort of like feeding off of a feedback loop. > > It's almost as though there is automated software at work. Just like October, 1987. It simply listened to itself and kept telling itself that it was "actually" making money all the way down. Portfolio Insurance be damned, it was doing "OK". > There is: Wetware. Massive concurrent processing, heavy parallelism, > inefficient I/O. Distributed, redundant memory. Inefficient but infinitely > adaptable interprocessor routing. Capable of handling any degree of > outage. All elements individually expendable. Self-replicating processors > that have significant lead time but integrate smoothly into the net. > Designs and builds its own outboard peripherals and interconnects. Best > damned planetary computing system in this star system. But I diverge... IMHO, there is very little wetware left in the market. This is now the 90's. Time to get with the programs. > It's not always right (though self-fulfilling prophecy is often a big > part of the equation), and it often misses the anolamies, but because it > IS an integration is precisely why it may mean something different than > you suggest. Oooo ... duelling programs ... especially one which is designed to ignore the other one and not listen to any of its "blather" ... this oughta be interesting to watch ... Luckily, I'm outside this theatre of operations. > Netscape's share price more directly reflects the personal involvement and > upward view of real people with respect to the Internet/WWW than anything > else we have. "Personal" involvement and "real" people have very little to do with a market that is driven by institutions and other vectors. Institutions which have to "show" what their exposure to the "technology and Internet" sector is when they file their portfolio reports will want to show something on their book. And they'll look for a safety in numbers thing, and will flock to the "darlings". "Real people's views" also won't count for much if Netscape defines an entire new economic sector -- the ground floor of the Internet. "Real people" don't factor in if it becomes part of the S&P 500 and every index fund "has" to -- by definition -- buy it. "Real people" also have very little impact on the blow crazed trader who's on a run and actually actively managing and turning-over the pension funds or mutual funds of some group. (Or even a sector fund, whose by-laws won't allow it to sit on cash, as it flows in the door.) These guys have far more influence than the aggregate of individuals who might buy or sell "small" lots at the market. "Real people" don't impact nor control the communications networks of block trading reports. And they don't impact systems which *must* put their money out, and put it to work. Real people are really just noise in the flow. The idea that individual supply/demand is what moves prices is a fallacy. It's not the "reality" behind the shell game. Buying or selling pressure doesn't ever function as a price mover, because for every "buyer" there is a corresponding "seller". Zero-sums type of stuff. It no more reflects the inherent strength of the Internet, than the Dutch Tulip craze reflected the inherent strength of Tulips. > Remember, there are still naysayers out there, declaiming in places > from books to columns to TV, while the reality is that computers are > now outselling televisions, and a key new form of synergistic human > communication is exploding in exponential growth. Humans deal on a > personal level only moderately well with linear processes, and > poorly with geometric processes -- it's understandable that the > growth of the Internet/WWW and the implications of thereof would be > late in being recognized and be incorrectly understood until > sometime AFTER the changes have rocked the society. Nonsense. (No offence, btw ...) We're back to the man who simply closes his eyes to what's happening, or the ostrich sticking its head in the sand. We've already got the experience to understand how these things work. They've got the "play book", and are following it step by step. > Capitalize ME to the tune of $5 billion, for instance, and I may > be influential not only during the course of your life but the lives of > your great-grandchildren. Capitalize how? Balance sheet? Or market? A $1 Billion or $2 Billion rights issue might be one thing, but this one is another. > Selling Netscape short may or may not be a wise move -- selling market > processes short is usually a fool's exercise in self-delusion. It really depends on what and how you use that tool, doesn't it?? As an example, short sales are excellent ways of "creating" stock in thin markets. They can work to create a virtual share. This might sound strange, but it's a feature of the "market". "Shorts" usually sell borrowed stock hoping to buy it back cheaper at some later date. A broker goes out and "borrows" the stock from another broker, and then that stock is sold to a buyer. The two legs of the short sale actually work together to create a "virtual" share of the corporation. This creates "volume" by trading a "virtual share". At some point, these used to be called derivative plays, before that word became dirty in and of itself. To explain. Let's say that XCO owns 100 shares of Spyglass. And YCO "shorts" 100 Spyglass. What actually happens is that YCO has simply signed a note saying that they "owe" XCO's broker 100 shares of Spyglass. If YCO now sells that stock to ZCO, then there are actually now 200 shares of spyglass out there. 100 actual ones owned by XCO, and 100 virtual ones owned by ZCO. (And a note to someone that says ... I owe ya, a 100 Spyglass.) But the "virtual" stock is indistinguishable from the "actual" stock. Of course the generally known risk is that with price movements that YCO could loose a lot of money on its short. Especially in a "squeeze" play. But if YCO and ZCO are actually "friendly" then all they have to do is shift a lot of money around as the price gyrates. Back-to-back credit facilities usually suffice for this purpose, since all that they really need is a "note" from their banker saying that they're "good people" and are "good for the money", if something does go wrong. That their credit is good in the casino. (And mathematically in fact ... they are good for the money ... cause they don't have a market "position" or opinion, even though they can trade one heck of a lot.) In this case, the short can't be "squeezed" cause he's actually covered. But it can lead to some really interesting optics. And these programs do listen to optics. Especially if YCO and his ZCO friend are up against ACO and his BCO friend. I think it's all just a virtual war at that point. Something to watch via Quotron. But then you'd need a Quotron for that, wouldn't you?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. > > We Jurgar Din > (that will have to suffice: I do not yet live in a free country) > > +"The battle, Sir, is not to the strong alone. It is to the+ > +vigilant, the active, the brave. Besides, Sir, we have no + > +election. If we were base enough to desire it, it is now + > +too late to retire from the contest." -Patrick Henry 1775 + > > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQBVAwUBMMCsBEjw99YhtpnhAQE04QH8C+jk59lxyAqkVlfhd2VLw3TJKnECdXXJ > fNE7S0QZyd5eqFnZ4wTyHeX18YfTg+xiFZPPfxpRCdgO/x2K8sxFWQ== > =/2cN > -----END PGP SIGNATURE----- > > > > > > > >

1 0