December 2003 - cypherpunks-legacy

No Subject
by frantz＠netcom.com 17 Dec '03

17 Dec '03

David Plotnikoff, in his regular (WWW oriented) column in the San Jose Mercury News, writes: DOES YOUR BOSS KNOW WHERE YOU'RE SURFING? The SIMBA Media daily reported recently that a Maryland-based software publisher called Charles River Media has introrduced a $30 electronic fink program called "Internet Watchdog" that keeps an eye on where you've been hanging out on the Net. the program doesn't block or censor sites, but it does maintain a handy record of cyber-footprints that the parent, teacher or employer who controls your Net access can peruse. ----[end]---- Anyone know more about this program? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: ex encrypted script
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

] > >| Is there a way to encrypt a script yet still allow it to be runnable? I >| know that the simple answer is to write it in C and compile it but I don't >| have the means of doing that at the moment. (i.e. there is not compiler on >| the system) >| >| I thought of a few simple protections but they all involve decrypting before >| running. > > Ever hear of chmod? chown? >Adam The vendor also has superuser access.. chmod chown won't protect it.. :( ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

3 2

GAK boycott, What are legal implications?
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is a question for all of you cyber legal types out there. This question presupposes: The NIST will complete its work on the GAK standard. But no law will be passed (yet) regulating the use of encryption in the U. S. (The GAK standard is an attempt to create an environment in which such laws can be passed.) In the U.S., Big Company INC will start marketing a GAKed encryption product domesticly. A bunch of cypherpunkish types will immediately try to organize a boycott against BIG COMPANY. What are the cypherpunks legal risks? I seem to remember that back in the 70s, the NAACP lost a big case with respect to their boycott in a southern city. As I recall there were people in the street begging money for the NAACP because there was a > 10**6 $ judgement against the NAACP and they needed that much just to appeal. - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNnJ8/BUQYbUhJh5AQGbsgP/T0n31SqeuHt+7AbizymcEhu/78DUuym5 sj+MO3ruA9WcEBQUXfabuf/PgOwlrtUAcC3dISPvXwGbdygc9oHBfxSglLi48g7d dvDS4wziRHF7N8sBsYn0ee9YyKhPd9U7Ci0ovOc5frFGSZ2Bt4hU703d7bR+6cB+ iHHqsPaAa6o= =EPoj -----END PGP SIGNATURE-----

3 2

Telcom bill report
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's the additional info from Reuters. As usual, Clinton is being a coward. For additional Cypherpunks relevance, anonymous remailer operators in the US may need to watch out. -Allen Reuters New Media _ Thursday December 21 2:11 PM EST _ Congress Reaches Compromise On Telecom Reform WASHINGTON - Congressional conferees have agreed to a sweeping reform of telecommunications law that would open competition by allowing the telephone, cable and broadcast industries to invade the others' turf. Vice President Gore says President Clinton will sign the bill. Before the agreement, the president had been threatening for months to veto the bill if Republicans in Congress did not retreat on a long list of issues. They retreated. Vice President Al Gore said "This will unleash a new era in the telecommunications revolution and speed completion of the information highway." The bill would also impose tough new restrictions on sexual material on online services. It has been bitterly opposed by civil rights groups who say the controls on sexual content constitute censorship. The legislation would impose fines of up to $100,000 and prison terms of up to two years on people who make "indecent" material available to minors over computer networks. That could pose big problems for companies that provide online information services. The "cyberporn" issue was championed by conservative religious groups, including the Christian Coalition, and is certain to provoke a new courtroom battle over Constitutional rights to free speech.

2 1

Telcom bill report
by John Young 17 Dec '03

17 Dec '03

Responding to msg by EALLENSMITH(a)ocelot.Rutgers.EDU ("E. ALLEN SMITH") on Thu, 21 Dec 6:12 PM > The "cyberporn" issue was championed by conservative > religious groups, including the Christian Coalition, and is certain to > provoke a new courtroom battle over Constitutional rights to free > speech. In the NYT the sentence above was followed by: "Indeed, the measure includes a provision that requires a Federal court in Washington to take up the issue almost as soon as someone challenges its legality."

1 0

Alta Vista caches queries
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here's one more reason to worry about the implications of web search engines: I just stopped in on Digital's new Alta Vista page, and was surprised to find that the query field was filled in--with a search I ran 3 or 4 days ago. I doublechecked my end pretty thoroughly (scrubbing all the files that Netscape 2.0b3 [Mac] generates--caches, global history, etc., and eventually reinstaling Netscape from scratch). And it look an awful lot like Alta Vista cached by query according to my IP address. Maybe dynamically assigned IPs ain't such a bad idea after all... Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNoVRb3g0mNE55u1AQEWxAIAiknajMTLiPzKxl4Wz3hoJsE4ntsXQJiV zNoz9LAW16+7+oFKKPwcjQCTi7heMstT9dP0GjCHmYuCl2cFcmQRbQ== =HQ12 -----END PGP SIGNATURE-----

3 2

No Subject
by floyddb＠alpha.c2.org 17 Dec '03

17 Dec '03

andr0id(a)midwest.net (Jason Rentz) wrote: >> >>Whats the current thinking on the security level of 900Mhz digital spread >>sectrum cordless phones? Clearly it's not a basic scanner job but how much >>more equipment is needed to monitor one ? > >Well when you listen into a spread spectrum conversation what you will hear >is open squelch white noise. The spread spectrum radios that I know about >send information on several deffrent frequencies throughout the >conversation. [snip] > Dr0id > > >( Computer Consulting & Management ) >(P.O. Box 421 Cambria, IL 62915-0421) > [snip] There is a company called Optoelectronics that markets a radio reciever called the Interceptor. This is a broad band (several hundred MHz) device designed to lock on to the most powerful signal around, regardless of frequency. As supplied, it only has a rubber duck antenna, but a broadband, directional antenna (Log Periodic?) could be attached. There are AM and FM versions that output audio and a version called the Scout that controls a scanner. These could have outboard devices hung on to them to decode digital signals, record the conversation ... all for less than $1000. Floyd D. Barber floyddb(a)alpha.c2.org Key fingerprint: 8A 98 1F 6B 70 7A FE 24 35 D4 48 CF 9D F6 B0 91 PS Sameer, thanks for the nym.

1 0

Navy hacked by Air Force?
by fc＠all.net 17 Dec '03

17 Dec '03

Following is the actual text extracted from iw(a)all.net - I doubt if the U.S. DoD will want to release all the details, but we can ask! >From: iw(a)all.net Subject: IW Mailing List iw/951221 --------------------------------------------- Moderator's Note: Subject: Navy hacked by Air Force I talked to some people I know about the perported IW attack on a battleship by the Air Force, and I thought I would help debunk this story, which my contacts tell me is "wildly inaccurate", but looking at a few facts. Let's start with the title: > War of the microchips: the day a hacker seized control of a US battleship There are NO active US battleships!!! And there weren't any last September. So, at a minimum, there are factual errors. ... > BY SIMPLY dialing the Internet and entering some well-judged keystrokes, > a young US air force captain opened a potentially devastating new era in > warfare in a secret experiment conducted late last September. His > target was no less than gaining unauthorised control of the US Navy's > Atlantic Fleet. According to my sources this was not "SIMPLY dialing the Internet and entering some well-judged keystrokes". It was a controlled experiment with participation of both Navy and Air Force, and involved a great deal of planning by a large number of people. It was performed using DoD owned and properly keyed cryptographic devices designed to be allowed to communicate with the systems being attacked. ... > He was armed with nothing other than a shop-bought computer and modem. > He had no special insider knowledge but was known to be a computer > whizzkid, just like the people the Pentagon most want to keep out. 100% wrong - he was an insider, he had a great deal of assitance, he had cryptographic devices and keys, and he had special insider knowledge. If he was an Air Force captain, he could not have been all that young. Whizzkids are usually considered teenagers. Anyone know of any teenaged AF captains these days? ... > A few clicks and whirrs were the only signs of activity. And then a > seemingly simple e-mail message entered the target ship's computer > system. ... > targeted ships surrendered control as the codes buried in the e-mail > message multiplied inside the ships' computers. A whole naval battle > group was, in effect, being run down a phone-line. Fortunately, this Not quite. This was not an email sent from some Internet site and email messages did not multiply inside the ships' computers. Furthermore, the total bandwidth of a phone line is nowhere near enough to "run" a naval battle group, or probably even a naval kitchen for that matter. > The exact method of entry remains a classified secret. The first (only?) really true part of the story. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

3 7

[ecash] Re: Multi-issuer questions
by Patiwat Panurach 17 Dec '03

17 Dec '03

On Tue, 19 Dec 1995, Marcel van der Peijl wrote in the ecash mailing list: > Q: If user A signs up with bank A, and merchant B signs up with bank B, > can user A buy at merchant B? > > A: In theory: > > Bank A and bank B need to have an interbank clearing agreement. User > A sends his money to merchant B. Merchant B contacts his own bank, > bank B. Bank B recognizes the money as being issued at bank A, > contacts bank A, and clears the coins there. Bank A credits bank B's > account at bank A, bank B sends an acknowledge to merchant B and > merchant B sends the goods to user A. I dispute this even on theoretical grounds. Am I right in assuming that the only reason Bank B has in contacting Bank A is to confirm that the ecash hasn't been double spent? Once that is confirmed, there should be no need for contact between the two banks. Bank A should not have to credit Bank B's account as there has been no transfer from Bank A to Bank B. The transfer has been the deposit from Bank B's customer to Bank B. Bank B is allready "credited", i.e., its (e)cash researves have increased, the moment Bank A confirms that the ecash is valid. But this also makes a second assumption: that ecash is truly an open standard, i.e., that ecash is a "widely acceptable means of payment." Any ecash issuing bank must be obligated to accept customer ecash deposits with one and only one condition: that the originally issuing bank must validate it. Now what if this weren't so? What if Bank B said "I didn't originally issue this ecash and thus, I wont accept its deposit." Now this puts the "cashness" of ecash into some jeopardy. It doesn't immediately make ecash useless, but it puts an auxiliary condition to it. This concerns the difference between Validation and Acceptance. Validation is when Bank B checks the ecash with its original issuer to see if it has been double spent. Acceptance is actually accepting that ecash as a deposit. If Bank B refuses to Validate any non-Bank-B ecash then ecash pretty much fails. Period. How would Bank B's customer be able to handle commerce with non-Bank-B buyers? By having multiple accounts with multiple Banks? What if the number of ecash issuers mushrooms into the hundreds? In anology, would you want to have to have accounts in 500 banks if your customers also used 500 different banks? The other alternitive for the ecash case would be if Bank-B's-customer could bypass Bank-B by validating the ecash directly with Bank A. If it passes, then he must now look at the matter of Acceptance. Now Bank-B's-customer knows that the ecash is valid. He keeps it temporarily in his hard disk. But will Bank B ever Accept it as a deposit? If it doesn't, then Bank-B's-customer needn't worry that much. He can just use that ecash for transactions purpases. Just because you can't deposit every cent of cash that you earn doesn't mean that your cash is worthless. The fundamental test of ecash is whether merchants/customer will accept it. Of course, there is also important value in checking if Banks will accept deposits of it, but I consider that secondary. So some concluding topics include: + independant verification of ecash. some formal system for ecash merchants (sellers) to check directly with the issuing bank that the ecash hasn't been double spent. OR + interbank verification of ecash. formal interbank system for the cleints bank to check the issuing bank to see if the ecash hasn't been double spent. AND + interbank acceptance of ecash. formal acceptance of verified ecash deposits, no matter the issuing bank. The type of verification doesn't really matter that much. Some sort of distributed method of resolving ecash issuers has to be standardized (say like the DNS, each ecash coin has some information as to the issuer. person/bank that wants to verify just transmits that ecash to its original issuer and then receives a reply saying: verified (usable) or not (double spent). The interbank acceptance issue is more important, but digicash (the company) has some power here. If they really aim at ecash beeing true cash (instead of checking), then they gotta force all issuing banks to accept ecash deposits nomatter the original issuer. Like the Real Life cash system: all banks accept cash, even though it is the federal researve that was the original issuer. ------------------------------------------------------------------------------- Patiwat Panurach Whatever you can do, or dream you can, begin it. eMAIL: pati(a)ipied.tu.ac.th Boldness has genius, power and magic in it. m/18 junior Fac of Economics -Johann W.Von Goethe -------------------------------------------------------------------------------

1 0

Newsweek Nerd 50
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Okay, while you other cypherpunks were grousing about how you weren't going to give Newsweek your hard-earned currency, I bought a copy. My pain, your gain (on a significantly smaller scale than that messiah figure some of us celebrate next week.) Cypherpunk Notables on the List: "Newsweek's Epithet" Phil Zimmerman: "Crypto Creator" Marc Rotenberg: "Privacy Advocate" Sameer Parekh: "Protector of Privacy" Johan Helsingius: "Crusader" and Steven Levy, who sometimes posts here has the byline on the "Year of the Net" feature. PS to Newsweek -- Prof. Hoffman should be called a "Data Goddess" not a "Geek" for exposing those bogus factors the marketdroids want to use to control their survey data back up to the population level. Happy Holidays Piss off Ralph Reed, Defend the 1st Amendment. Bill Humphries

1 0