December 2003 - cypherpunks-legacy

Re: Guerilla Internet Service Providers
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

m5(a)dev.tivoli.com (Mike McNally) writes: > Dimitri Vulis writes: > > > For how long ... ? > > > > For as long as they're able to provide information and services that > > customers want, which are not available via "generic" small ISP's. > > But don't you think it likely that AOL & Compuserve will soon see the > economic advantage of making their services available (for per-use > fees) to the Internet as a whole? If not AOL & Compuserve, then > certainly the actual content providers themselves. (The NSA may be a > different matter.) > > I don't see why content providers would not be willing to make stuff > available via the internet; they don't have to do it for free. OK, I'm sure we have the nice folks from the National Computer Security Association on this list. Why don't they set up their forum so it's not necessary to have a CompuServe account to access it? --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Errata for _Applied Crypto_
by Wink Junior 17 Dec '03

17 Dec '03

Bruce Schneier <schneier(a)counterpane.com> has an errata file for the second edition of _Applied Cryptography_ available on request. Hopefully he will also make it available via the Web. Hats off to Bruce for making this information available in a timely, cost-effective manner. Wink -- "Dilute! Dilute! OK!"

1 0

[Local] Portland OR Cypherpunks anyone?
by Alan Olsen 17 Dec '03

17 Dec '03

I am considering getting regular Cypherpunks meetings going in the Portland, OR area. If anyone is interested in such a thing, please drop me e-mail. I have gotten some interest from a few friends and so I am sending out the request to the rest of the list to see who else is interested. Ideas for a local meeting place would also be appreciated, as my apartment is way too small. (And not the same time and place of the 2600 meetings. I am alergic to video cameras.) It would also be a chance to meet some of the people I see on the list who I know post from Portland... | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Unmuzzling the Internet
by John Young 17 Dec '03

17 Dec '03

The New York Times, January 2, 1996, p. A15. Unmuzzling the Internet [OpEd] How to evade the censors and make a statement, too. By Jaron Lanier (Visiting scholar at the Columbia University department of computer science.) If President Clinton signs the telecommunications bill drastically restricting private as well as public speech on the Internet, he can expect a rollicking cat-and-mouse game. It can be comical when politicians try to control something they do not understand. Such is the case with the bill's censorship provision, which not only outlaws the transmission of material over the Internet that would be allowed in most newspapers, but also makes owners of computers on a network liable for the speech of others. (As Compuserve demonstrated last week when, to satisfy a German court, it blocked American subscribers' access to sexually explicit material, regulation of the Internet can threaten both commercial and constitutional freedoms.) The other day, I came up with a way to easily evade the proposed American restrictions. My simple idea would be to create a computer program, dubbed "Unmuzzle," which would deposit incomprehensible fragments of any forbidden material in different foreign computers (though maybe not Germany's). The contraband communication would only be reassembled into a coherent whole when downloaded in the home of the user back in the United States, where it would become protected speech, as in any other medium. I had no intention of actually building "Unmuzzle," but I mentioned the notion in E-mail to a friend, and within days I was hearing from people I didn't know who were busy creating the program with the idea of distributing it freely. Fine with me. Such a program would make an mportant statement. Speaking as someone who has been involved with computers for most of my life (I coined the phrase "virtual reality" in the early 1980's and created much of the technology for it), I find that many Internet users have been reacting to attacks on freedom in cyberspace by slumping into a separatist, angry mood. They feel that they are being denied the rights that others enjoy. On the Internet, separatism is expressed by encryption: an encrypted message can be read only by the party it is intended for. Therefore, in the spirit of the First Amendment, I suggest Unmuzzle as an alternative method: it may break up images or text into a hundred pieces, but they are still accessible to the public. The idea of censoring the Internet should be unthinkable, especially in the United States. Aside from the question of free speech, there's the economic imperative as well. The Internet is not a plaything: it is the infrastructure of our information technology industry. The young have the most to lose from the new restrictions, in spite of the fact that such limits are purportedly meant to protect them. Schools and libraries will find it extremely difficult to offer vital Internet services in the face of a mine field of criminal liabilities. It is members of Congress and the President who need to show some maturity, by rejecting free-speech restrictions in the telecommunications bill. [End]

1 0

Re: Guerilla ISP's... (fwd)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:20 1/1/96, sameer wrote: >> Prosecution followed by conviction is what will happen to the owner of the >> computer on which the OS was running. > It's hard to jail a corporation. Pretty hard. That's why the corporate officers will be jailed instead. Not that this would be necessary to stop the corporation from operating. The authorities can just confiscating all the equipment and thereby put the corporation out of business. Saves time and trial costs. They just haul off the computers and declare that they are now property of the government. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Guerilla Internet Service Providers
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:14 1/1/96, Mike McNally wrote: >Lucky Green writes: > > But how many of them [ IP providers ] will be willing to forward > > certain newsgroups if doing so carries a mandatory 10 year prison > > term? Hint: count the number of narcotics dealers that advertize > > in your local yellow pages. > >But an IP provider doesn't have to know that it's "forwarding" *any* >newsgroups; all it has to know is that IP packets are moving between >my PC and the outside world. It doesn't have any way of knowing what >those packets contain and doesn't want to. Some site in physical space has to host the nntpd, the ftpd, and the httpd. That site will be subject to search, seizure, and arrest and conviction of owner. If you don't have a host, there won't be any packets to forward. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

5 4

In Search of Computer Security
by John Young 17 Dec '03

17 Dec '03

The New York Times, January 2, 1996, p. C15. Special section "Business World Outlook '96." In Search Of Computer Security By John Markoff Computer security is making a transition from the university and the research laboratory to the real world. So far it is proving to be a rocky evolution. Last year, a series of embarrassing gaffes and shortcomings undermined the faith of potential computer users in the certainty that their data are secure. The flaws have led to a growing realization that computer security systems are largely untested and that in complex environments like the Internet, they do not always respond the way their creators had intended. Paul C. Kocher, a computer security expert who discovered one potential flaw, said, "Many of the security systems that I am examining are good enough to keep out casual snoopers, but they're failing catastrophically when it comes to protecting data against determined attacks." The problems are emerging as the computer industry increasingly relies upon an arcane mathematical discipline that is intended to hide the secrets embedded in digital information behind a veil of imposing math problems. Cryptography, the science of writing secrets, was for centuries largely the province of kings, soldiers and spies. But that has changed in the 1990's as the world has rushed to use personal computers and computer networks as the basis for electronic commerce, communication and entertainment. Data scrambling has become the key to a vision that it will be possible to have private electronic conversations and secure financial transactions. In principle, data coding protects information by scrambling it to keep it out of the reach of everybody but those with a supercomputer and tens or even hundreds of years to crunch the data. But computer researchers have begun discovering flaws, sometimes subtle and sometimes glaring, that can help criminals take devious shortcuts to obtain the mathematical keys used to scramble the data. In August, a French computer hacker proved that it was possible to use a network of work stations to guickly find the secret key created by a coding system developed by the Netscape Communications Corporation, the leading developer of World Wide Web software. The feat cast doubts on the security of a system whose security had been scaled back to meet stringent United States Government export controls. The following month, two computer science graduate students at the University of California at Berkeley reported a flaw in the Netscape that would permit a technically skilled attacker to steal data by circumventing the complex calculations needed to break the code. In October, a team of Berkeley researchers, including the two computer science students, detailed security weaknesses in the fundamental software of the Internet that make it difficult to protect data that is sent between computers. And last month, Mr. Kocher explained a potential flaw in a widely used data coding approach known as public-key cryptography. The flaw could allow eavesdroppers to infer a secret key used to protect data in Internet security software, electronic payment smart cards and related systems by carefully timing how long it takes to compute the secret key. Mr. Kocher said that while he believed that trusted electronic security systems would ultimately emerge, there should be no urgency to rush their deployment. Banks have spent several hundred years perfecting systems for protecting money, he noted, but they have far less experience with the new computerized systems designed to protect information that represents money. One of the pioneers in the mathematics underlying most public key systems agrees that prudence is required in developing digital commerce. "Paul's discovery is one more piece of evidence that designing security mechanisms is tricky," said Whitfield Diffie, a Sun Microsystems researcher who was one of the co-inventors of the original public key technology. "Given the trust that we will be placing in systems for electronic commerce," he continued, "we should be putting all the effort we can into getting them right." [End] ---------- [Box] 1996 Will Be the Year When: "Congress will pass a law restricting public comment on the Internet to individuals who have spent a minimum of one hour actually accomplishing a specific task while on line." Andrew Grove, Intel Corp. CEO

1 0

COP_box
by John Young 17 Dec '03

17 Dec '03

1-2-96. WaPo: "Undercover on the Dark Side of Cyberspace. On-Line FBI Agents Troll for Those Who Prey on Children." The FBI unit now has more than $1 million worth of equipment, including high-speed modems and large data storage devices. In cases where suspects' computers have been seized, the agents have run up against password-protected and encrypted files, which sometimes have taken FBI technicians hundreds of hours to decode. 1-2-96. FiTi: "Pobox and the magic cookie." Which company will have the greatest effect on the development of the Internet this year? My answer is neither Microsoft nor Netscape. It is a tiny new company called Pobox.com. Its product consists of a simple forwarding service that is an electronic equivalent of a post office box. This service allows people to give out an e-mail address that is independent of where they work or where they choose to buy Internet access. COP_box

1 0

Unmuzzy Explained
by Laszlo Vecsey 17 Dec '03

17 Dec '03

So is the idea beyond this that if file or a group of files were to be distributed over many computers (possibly hundreds or more) then none of the computers would be "responsible" for their content? I would think that any participant in the network would have to claim full responsibility for the content, assuming the file(s) could be accessed from any of the participating servers. I'd be interesting in joining the Unmuzzy (programmers) mailing list, does anyone know what the email is or where the home page is? A net search returned nothing.

1 0

Re: Foiling Traffic Analysis
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:02 1/2/96, Jon Lasser wrote: >When the group of packets arrives at a given station, it replaces its >current encrypted packet with a new packet; if it doesn't have any new >packets to send, it puts up a garbage packet that is indistinguishable >from a normal packet. It then scans all the other packets and attempts to >decrypt them with its private key. Any it can read, it does; all the >packets are forwarded to the next station in the ring. All participants in this network are clearly guilty of conspiracy. Their assets will be confiscated under RICO. As Brian mentioned, the law enforcement agencies are creating a surplus by such seizures. The costs associated with more prosecutions are more than offset by the revenue generated. Your computer will make a welcome addition to their budget. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0