December 2003 - cypherpunks-legacy

Re:US calls for measures against Internet porn
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>> WASHINGTON DC (Reuter) - The US called Sunday for improved >>management of the Internet to prevent people seeing pornographic >>material on the world computer network. I feel so much better, having the burden of deciding what I can see or read lifted from my weary shoulders. Maybe a ban on politicians appearing in the media? (Some might consider it an obscenity.)

2 1

Someone wanted to give PGP lecture at CSI conference
by Bruce Schneier 17 Dec '03

17 Dec '03

I'm looking, on behalf of the COmputer Security Institute, for someone who is willing to give a 1.5 hour PGP primer at their summer conference in SF. They don't pay, but they will give you free admission into the conference (and two bad hotel conference meals). I speak at their conferences; they're not a bad lot. Interested parties should email me directly. Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)counterpane.com **************************************************************************

1 0

FCC require ISDN?
by David K. Merriman 17 Dec '03

17 Dec '03

At 07:46 PM 01/2/96 -0600, Jim Choate bespake thusly: >The FCC is enacting a new regulation that will cause every phone company to >provide 100% of their service areas with ISDN (you should have received some >kind of notice last week, I did). This also sets some minimum standards as >well as to the type and quality of service the phone company must provide. Citation? Here in Amarillo, if it rains, the phone lines start caving in, and I'd like to beat up SWBT for ISDN service :-) Dave Merriman PS - sorry for posting this to the whole list, but couldn't get this past my ISP to Jim directly :-( ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: Massey, CEO of Compuserve, on Internet
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 23:03 1/2/96, John Goerzen wrote: >CompuServe is not location-dependant. The network operates exactly the >same regardless of calling location (indeed, the system doesn't even know >where you're calling from I believe). It is a worldwide CompuServe >Network that people use to access it. This network just allows dialups >and then gets the users connected to the CompuServe computers. The main >computers handle all traffic. They don't are location-independant, >making it impossible to block access based on location. CIS always knows where you are dialing in from. Here is the start of a typical connection (using the Mac Program NAVIGATOR). >0001NUH > >Host Name: CIS > >User ID: xxxxx,xxx/INT >Password: >[Navigator: Logged on] > >Welcome to CompuServe Information ServiceT01NUH @38400! > >Last access: Mon, Dec 18, 1995 23:11 >Connected to port CIS T01NUH @38400 That NUH identifies that I am calling in via a V34 Node in NYC and the T01 says I got the first modem on the Rotory. If CIS wanted to restrict access via the NYS nodes, that NUH would be an adequate flag to trigger this action.

2 1

Re: Starting an e-cash bank
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:25 1/3/96, Alex Strasheim wrote: >> What does it take to be called a bank? > >Is it necessary to be called a bank? To get a license for the bank software from DigiCash, you have to convince them that you are a major player in whatever country you are in or have to offer some exceptional additional value to the service. >I've got a storefront in Chicago. >What would prevent me from opening up a Mark Twain account and buying and >selling ecash on floppies, in person? You touched on a very important issue: the party converting currency into Ecash does not have to be the Ecash bank. There have been discussions that in the future one should be able to buy Ecash on floppy at the local supermarket, similar to today's prepaid calling cards. I certainly would like to see that happen rather sooner than later. It is my understanding that you would be welcome to issue MT Ecash for USD. Here is another business opportunity: MT Bank does not allow the purchase of Ecash by credit card, since they consider the risk of chargebacks unacceptable. This might be a market for a third party. >Do account holders have to agree >not to do that before Mark Twain gives them an account? Is it illegal? MT Bank doesn't mind. IANAL. <speaking only for myself> -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Windows Eudora and PGP
by jim bell 17 Dec '03

17 Dec '03

At 10:24 AM 1/3/96 -0800, you wrote: >At 09:43 AM 1/3/96 -0800, Jim Bell wrote: > >>(BTW, I use Eudora, and I have PGP. Could somebody explain how to PGP-sign >>messages, ideally EASILY?) > >I use Eudora as well. It is not as easy as I would like. You have a couple >of options: > >1) Use cut-and-paste into Private Idaho. Private Idaho will allow you to >paste back into Eudora. (Or you can send out from Private Idaho directly.) >This option is useful becuase it supports nyms and chaining of remailers. > >2) Get one of the standard Windows PGP shells and paste into that. After >signing, you will have to repaste into Eudora again. > >These seem to be the only options. I am not certain if there is a standard >DDE or OLE interface that could be used to feed message information back and >forth between Eudora and some other app. There have been a number of >promises of Eudora/PGP integration, but nothing has materialized yet. [sigh] Just what I thought, no easy solutions. Well, for now I'll just skip signing; I haven't had any problem (that I know of...knock on silicon) with forged messages, and my normal posts are so enthusiastically anarchical and inflammatory that the only way anybody could really embarrass me is to forge a message, ostensibly from me, saying I agreed with some governmental activity somewhere. >There are no easy answers I know of... > >If you need a copy of Private Idaho, I can point you to a web site or bring >a copy along to the meeting on the 20th. Please do...

1 0

crypto (semi-)export issue
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

It's been a while since this went 'round, and my memories are hazy of the details. Isn't it the case that there are loopholes or explicit exceptions in crypto export regulations that allow American businesses to supply their overseas operatives with tools for secure communication back home? We were discussing today some stuff about our web server, and there's some desire to provide secure access for our sales people to internal junk. Nobody was sure whether it'd be OK for our people in the Evil Empire (Europe) to have the 128-bit-RC4 Netscape for that purpose. (If so, I wonder if the exceptions apply to other munitions too? Like, maybe it's OK to take a medium-range missile overseas if you're just going to use it to blow up your manager's office :-) (No, I don't hate my manager.) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

New Mitnick Book
by John Young 17 Dec '03

17 Dec '03

Jonathan Littman, an investigative reporter, has published "The Fugitive Game: Online With Kevin Mitnick," Little Brown, 1996. 381 pp. $23.95. ISBN 0-316-52858-7. It is a dramatic recount of Mitnick's exploits; the pursuit by Shimomura, Markoff, telcos and Feds; the bust and Markoff's tales; The Well controversies aand disputes about what really happened; suspicions of Shimomura and Markoff - - their complicity with TLAs, their movie and book dealings, their disputes with hackers and journalists. What Mitnick was telling Littman while a fugitive. Littman ends with this letter from Markoff and Shimomura: October 8, 1995 Jonathan Littman 38 Miller Avenue Suite 122 Mill Valley, California 94941 Dear Jonathan, This is in response to your separate letters to us. We apologize for not being more prompt, Tsutomu was travelling on business and did not receive your September 5 letter until recently. As you know we have a contract with Hyperion for Tsutomu's account of his participation in the arrest of Kevin Mitnick, and at the request of our publisher we have decided not to participate in other books on the same subject. First, in response to your September 7 request to John Markoff, for permission to reprint his March 14 Well posting, he is not willing to give permission. However, we do think it is appropriate to respond to several points where you have received inaccurate information. Our responses are not intended to be a comprehensive answer to your list of questions, but only to protect you from including libelous material in your book. Tsutomu was not asked by any governmental, military or intelligence representative to assist in the capture of Mr. Mitnick. All of his actions were taken in response to requests for assistance from both The Well and Netcom to deal with extensive and persistent break-ins. Tsutomu's decision to tell John Markoff that he was travelling to Raleigh on Sunday morning was done without contact with any law enforcement agency. Markoff flew to Raleigh independently six hours later after discussing the possibility of a story with his editors at the New York Times. Markoff did not at any time assist or participate in any aspect of the investigation into Kevin Mitnick's activities; Markoff was there only as an observer in his role as a newspaper reporter. Moreover, in Raleigh on Sunday evening the Cellscope equipment was never placed in Markoff's car, and there was never any discussion about taking it out of the Cellular One engineer's van or about placing it in Markoff's car. Markoff parked his car near the cell site that night and then later drove back to his hotel. Tsutomu never told anyone from law enforcement that anyone had authorized or cleared Markoff's presence in Raleigh. Tsutomu was informed by the Justice Department that his actions on behalf of the Internet providers and the cellular telephone company during the course of the investigation were covered under their fraud detection and prevention exception granted to these organizations under the ECPA. Tsutomu did have discussions with the National Security Agency about funding computer security research, the results of which were to be placed in the public domain, however no research grant was ever made. Tsutomu was not aware of any statements made in the search warrant until many days after the arrest. Tsutomu did not lure Mitnick or anyone else into breaking-in to his computers. The attack was entirely unprovoked. No copies of any files allegedly stolen by Mitnick were provided by Tsutomu to anyone other than the legitimate owners. The first discussion of the possibility of a book on the subject of Kevin Mitnick's arrest took place on Thursday February 16, when John Markoff received a telephone call from John Brockman, a New York City literary agent, proposing a collaboration between Markoff and Shimomura. You will remember, we hope, that after his July 4, 1994 article about the hunt for Mitnick, Markoff did not wish to pursue the subject of Mitnick's life as a fugitive and referred a free-lance article on the subject proposed by Playboy to you. Also please note that you are inaccurate in stating that Tsutomu requested immunity before testifying before Congress on April 1993. We realize this is a delicate issue for you because of your involvement and communication with Kevin Mitnick during the period he was a fugitive. However, since your questions suggest you believe there may have been something inappropriate in Tsutomu's cellular telephone software development work, if you do include material in your book along this line, journalistic ethics require you to include the following: Tsutomu, unlike Mitnick, in all of his computer security research over a fifteen year period, has always, whenever he has found a vulnerability, made it known to the appropriate people, whether CERT, or a private company at risk, or the United States Congress. Sincerely, (signed) John Markoff Tsutomu Shimomura

2 1

Re: Massey, CEO of Compuserve, on Internet
by Michael C. Peponis 17 Dec '03

17 Dec '03

> On Wed, 3 Jan 1996, Robert A. Rosenberg wrote: > > > CIS always knows where you are dialing in from. Here is the start of a > > typical connection (using the Mac Program NAVIGATOR). > > > > >0001NUH > > > > > >Host Name: CIS > > > > > >User ID: xxxxx,xxx/INT > > >Password: > > >[Navigator: Logged on] > > > > > >Welcome to CompuServe Information ServiceT01NUH @38400! > > > > > >Last access: Mon, Dec 18, 1995 23:11 > > >Connected to port CIS T01NUH @38400 > > > > That NUH identifies that I am calling in via a V34 Node in NYC and the T01 > > says I got the first modem on the Rotory. If CIS wanted to restrict access > > via the NYS nodes, that NUH would be an adequate flag to trigger this > > action. > > Wouldn't this require some software routines added to check for this? I > expect the decision to build or buy is what CIS is now weighing. Also, I > would imagine that a German could always call a POP outside the country if > they wanted to pay for it..... (note that I am still not in favor of the > action, but these are probably CIS's considerations.) Well, this could be away for compuserve to cover it's rear in a realy slick fashion. If they chose to do it this way. Most CIS subscribers use their proprietary interface, which puts a GUI front end over what is going on with them modem, what they amount to are scripts. Anyways, CIS could add a script that would check the NUH identifier, if it is in Germany, it goes to one newsfeed, if it's outside of Germany, it would go to another newsfeed. They could even market the service here in the US to those who like censorship. What could be "Accidentaly" leaked is a different version of the same file, that would not contain the check. That way, Compuserve could claime that the offending parties tampered with the software, and they can not be help responsible for the tampering. I highly doubt that Compuserve would go for such a resolution, but it's worth throwing into the mix Regards, Michael Peponis PGP Key Avalible form MIT Key Server Key fingerprint = DD 39 66 3D AE DE 71 C2 B6 DA B2 3F 47 2A EB AC

1 0

Re: Massey, CEO of Compuserve, on Internet
by Steve14571＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-01-03 00:34:25 EST, you write: >CompuServe is not location-dependant. The network operates exactly the >same regardless of calling location (indeed, the system doesn't even know >where you're calling from I believe). It is a worldwide CompuServe >Network that people use to access it. This network just allows dialups >and then gets the users connected to the CompuServe computers. The main >computers handle all traffic. They don't are location-independant, >making it impossible to block access based on location. I see two possible ways to censor German users only (but I still believe censoring anyone is wrong). First, the "main computers" could be told where they are, and "censored" material could be filtered at that level before it is sent to individual users. Or CompuServe could release a software update for German users. The software would not recognize banned newsgroups. How difficult could that possibly be?

1 0