December 2003 - cypherpunks-legacy

Re: GAK Flap Happening at a Good Time--Journalists Read!
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

Sameer wrote: There was no Netscape (or RSADSI, for that matter [an RSADSI employee showed up, but it was on his own time]) representative at the recent Bernstein hearing in SF. I think that shows how much they really care. Actually, this is not entirely correct. An attorney for a firm which is outside counsel (crypto-related) to Netscape did attend the Bernstein hearing. Lee Tien

1 0

Re: Use of PGP as an export?
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

Actually, the ITAR contains specific provisions for "defense services," and it is possible to "export" "defense services." Lee Tien From: Bill Stewart <stewarts(a)ix.netcom.com> Date: Sat, 02 Dec 1995 19:24:24 -0800 Subject: Re: Use of PGP as an export? At 09:09 PM 12/2/95 -0800, Ted Cabeen <cabeen(a)netcom.com> wrote: >I think this has been brought up before, but I could only find one reference >to it in the archives and it wasn't too helpful, so I'll ask again. If a >university provided a copy of PGP for use on their unix machines and a >non-resident, non-citizen *used* the copy of PGP on the server, but did not >download it onto their own machine, but instead just ran PGP on the server >alone, would it be a violation of the ITAR? My school is interested in >putting a copy of PGP on the university server and wants to know if they >should somehow restrict access to citizens and legal residents only. Thanks. That's not giving technical data to the foreigner, that's providing a service; the ITAR doesn't seem to restrict that. It's not an especially secure way to operate, but that's an inherent problem with multi-user systems or file servers. One way to implement it that would be only mildly insecure would be to put PGP on a file server, with execute-only permissions; users of client machines still could be attacked by somebody faking out NFS, but they wouldn't have to send their passphrases across the net the way they would in a telnet session. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 Lee Tien Attorney tien(a)well.sf.ca.us (510) 525-0817 voice (510) 525-3015 fax

1 0

Re: News on Congressional Debate on Exon
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:31 PM 12/6/95, attila wrote: > well, there goes the neighborhood. > > guess I better clean up my www front page which meets the Exon rules on >indeceny, pisses on ITAR, and is probably seditious as well. might as >well get a start on it before the eager beavers hemorrhage! In case anyone's worried about the short-term implications, you'll all have plenty of time before enforcement starts. The conference committee has to OK the final form, voting, etc., then the Prez has to sign it (or pocket veto it, which is unlikely in the extreme). I'm no longer current on schedules as I was in high school civics class, but I think it will take effect some weeks or months after being signed into law. And even then I think prosecutions will take a while to get rolling, as cases are considered. It's not as if overnight the cops will be raiding sites. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Secret Clearance
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hal9001(a)panix.com" "Robert A. Rosenberg" 6-DEC-1995 12:50:58.52 The problem is that they are subject to blackmailed/bribed/subversion ONLY because the employer will use the info as an excuse for firing/restricting the employee. If someone has a "skeleton in the closet" such as being gay, so long as the employer does not discrimate against gays who INFORM the employer of their sexual orientation or if the employer does not care about the person being gay (ie: removes it a potential blackmail threat) there is no problem so far as I can see. It is only when there is something that is WORK RELATED which would affect the person's performance if not known that the question of a background check is relevant. ------------------- Unfortunately, this only works if one assumes that work is the only thing that is valuable in the person's life. Blackmail can easily be used against someone who is afraid of some information emerging to their family, for instance. This perspective still isn't an excuse for disallowing gays, however... the person who should be held responsible for such problems is the person who responds negatively to the revelation. In other words, if the person's family would react negatively to the person being gay, that's the family's problem, and should be treated as such. -Allen

1 0

unsuscribe
by Mary Rose 17 Dec '03

17 Dec '03

unsuscribe

1 0

Note on "Barring Netscape"
by Richard Charles Graves 17 Dec '03

17 Dec '03

The Microsoft Internet Explorer sends the user-agent "Mozilla 1.22 (compatible" to hte server, which triggers an incorrect response from, e.g., www.c2.org. This little fraud has the potential to make you look silly if left unexplained. If you get the string "compatible;" (or Compatible;?), you should instead pop up Netscapisms that show that Microsoft is lying. Or maybe Billisms. <font face="Symbol">, which affects only MSIE, might be appropriate. -rich

3 2

Re: PGP
by DANIEL CHARPENTIER 17 Dec '03

17 Dec '03

> you really ought to be more thoughtful about what and how you write on > the cypherpunks list... The how is referring to not double spacing isn't it. Sorry, I've been up for the last couple of days and didn't even realize it. What do you mean what I write about? > > anyway, the PGP code from MIT should compile on nearly all unix > machines. i'm not sure it will compile with a g++ compiler though. all > unix type machines should have uncompress, tar, (g)cc. just get the > source from MIT. I am not an idiot. I must have downloaded PGP from about 20 million different places. They are all either missing files, some times the darn code won't compile, or when I "tar xvf" half of the files bring up an error and the computer says it can not create the file. I'll try the address that you've sent. Hopefully I will have better luck. In the persuit of constructing a stable cryptographic program that uses PGP what features should be included. Obviously all of the ones that PGP has and encrypting/decrypting e-mail but what else?

1 0

Re: News on Congressional Debate on Exon
by Peter Trei 17 Dec '03

17 Dec '03

> (Controlling Web page accesses is a much tougher problem, of course. so I > wouldn't expect much action on this at first.) > > By the way, I recently discovered a new twist on "age credentials": the use > of credit cards to prove age. One image site is asking for a "valid credit > card number" to be given...not to use for charges, but just to do a quick > verification (they claim a few minutes or less) that the card is valid and > in the name of the person accessing their site. > Timothy C. May | Crypto Anarchy: encryption, digital money, Actually, I've been thinking about this quite a bit recently. I'm building an SSL enabled server, and clent-side authentication may provide some help. I could see a user getting his or her public key certificate signed with different CA keys which assert any number of conditions, such as: Key holder was born before (some particular date). Key holder has access to sales data for XYZ corp. Key holder is an adult who takes the first amendment seriously. ... and the server would recognize different CA signatures as permitting different levels of access. If your browser permitted you to select the key certificate used in setting up the encrypted link (and different certs or sets of certs could be protected with different passphrases), then Mom or Dad could use their I-am-an-adult credential to read www.xxx.com, while Junior could not. There *is* a loss of anonymity in this scheme, however. I realize that digital credentials are old hat on this list. The point I am making is that the pieces for doing this are here - we just need to assemble them. (This is not to suggest that I am in favor of Exon/Coates in any way - I am not. ) Speaking for myself alone.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Inherent Insecurity of Internet Commerce! (was RE: Secret Clearance)
by Pete Loshin 17 Dec '03

17 Dec '03

OK, I'll try again. First, as I recall, SECRET clearance is actually not very high: when I got it, I had to answer a bunch of questions (do you abuse illegal drugs? are you now or have you ever been a member of any organizations? have you ever been _arrested_ for anything?) and fill out some forms and get fingerprinted. They probably did a credit check, and that was about it. Nobody I knew got any calls asking about my habits (that is reserved for higher clearances). So now I'll rename the thread again: "Inherent Insecurity of Internet Commerce" -- <sarcasm>maybe now the NYT will feature me on the front page for "discovering" this inherent flaw in the Internet.</sarcasm> My purpose in renaming the thread in the first place was to start another thread relating to the types of security in places like, say, Netscape or Spyglass or CyberCash or First Virtual or Interramp or any other ISP or software company. Because I want to know how susceptible these companies are to hiring the wrong people. So, here's the "bug": if some agency of crime/espionage wants to subvert any of these systems, all they need do is employ the same blackmail/bribe techniques used to recruit actual spies on some employees of these companies. They then slip in some hacked versions of the software with the good ones, or modify distribution servers, or slip code into servers that forwards every tenth credit card number somewhere. Or how about getting a janitor to plug a wireless tap into one of the major Internet backbones to sniff for cc#s as well as interesting e-mail? Also, since there's enough noise here already (and even I don't see that much crypto-relevance) I won't post again on this topic, but I am very interested in hearing concrete examples of how Internet companies are protecting themselves, and also in hearing about specific instances of security failing (e.g., has anyone ever found a tap on a backbone?) -Pete Loshin pete(a)loshin.com

1 0

Re: News on Congressional Debate on Exon
by Kevin S. Van Horn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tcmay(a)got.net (Timothy C. May) wrote: > >I just heard (12:15 EST) that the House has adopted language similar to the >original Exon-Coates language in the Senate I consider it unlikely in the extreme that this passed without Gingrich's sanction. So I guess the Newt's much-publicized opposition to the Exon amendment was just a show. - --------------------------------------------------------------------------- Kevin S. Van Horn | Uncle Sam needs YOU! vanhorn(a)atext.com | But not vice versa. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMYBmCoZzwIn1bdtAQE9lwGA1w4SUuzkxqcrIWu2EJq65rspqg7PVL6Y FcMbibELAnFrZOUKNVtQNXxtpfaItIGR =QI3W -----END PGP SIGNATURE-----

1 0