December 2003 - cypherpunks-legacy

Re: Signing nyms' keys (Was: Report on Portland Cpunks...)
by jim bell 17 Dec '03

17 Dec '03

At 06:49 PM 1/24/96 -0800, Alan Olsen wrote: >Person X commits treasonable act A. All of the persons who are signed on to >his key could be considered to be co-conspirators. The same applies to >nyms. The difficulty with prosecuting nyms is finding the link to the real >world individual. Anyone associated with him/her/it will be considered to >be guilty by reason of key signage or a way of determining who the real >person is... > >The only way I see getting around this is only signing nyms with nyms or >having some sort of zero knowlege proof on a key signing authority. >Something where you can issue some sort of proof to the signing authority >that you are who you say you are without giving any information about your >"real" identity. I know of no foolproof way of doing this... > >I guess we are stuck with the "Web of Guilt"... Doesn't all this stuff give you a headache <G>?

1 0

Re: V-chip?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:33 AM 1/25/96, Mike Duvos wrote: >As I understand it, the basic concept behind the V-Chip is to >allow selective blocking of material a particular viewer might >find offensive based on content information transmitted along >with the program. As long as the program material itself is >transmitted unaltered, and there are multiple non-governmental >providers of content descriptions catering to the spectrum of >human likes and dislikes, this sounds like ideal Cypherpunk >technology. > >Concerned Parent can set the V-Chip to read from the Children's >Television Workshop content service, available for a small >monthly fee, and be certain that graphic violence and sex are >pixelated on screen, and that bleep words that the child might >practice in front of Grandma are garbled. > >Mr. Islamic Fanatic can filter out all blasphemy against Allah >and his one and only prophet, pork commercials, and women showing The V-chip described heretofore is considerably less nuanced than this, having only a few states (roughly corresponding to MPAA movie ratings). No switch settings to block Democrat programs, or Feminist programs, or Mormon programs. Just your basic "indecency," with "violence" as lagniappe. And most Cypherpunks would tend to reject it because it is not voluntary (unless you think "so don't buy a television" is a viable voluntary choice). It will add to the cost of t.v.s and VCRs, and possibly interfere with the computer-based options to come. And it's easily defeatable. For one thing, most households have multiple t.v.s or VCRs, any one of which without the V-chip will defeat the system. Also, it is likely that the households "most in need" of this chip--using the logic about unattended children watching violent programs while their parents are away--will be the least likely to buy the brand-new sets and VCRs that have this chip. (I would guess that most families will have existing sets and VCRs for at least the next decade or more.) >What are the dangers of this new technology? > >First, the government might want only one description of content, >which it controls. My notion of what is offensive probably >differs greatly from that of Jesse Helms, for instance. This is mostly the case. My objection to ratings systems imposed by government is a general one. If video and music is to be rated, why not articles and Usenet posts? The principle is the same. Anyone telling me I have to rate my work, or submit it to a ratings agency, is aggressing against me. Now, if others rate my work (which is already happening with digest services such as "CP-Lite"), this is their business, not mine. But the V-Chip precedent is a precedent for the government to insist that all sorts of content be rated. This should be fought in a free society. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: German home banking (fromn RISKS)
by jim bell 17 Dec '03

17 Dec '03

At 07:34 PM 1/24/96 -0600, Andrew Loewenstern wrote: >> Don't high speed modems transmit and receive on the same frequencies, >> using echo cancelation to decode the receive signals? Does that >> make it impossible to eavesdrop on high-speed (i.e. V32bis) modems? > >No, and a lot of crackers and phone phreaks found out the hard way. You can >buy protocol analysers off-the-shelf that will give a dump of the entire >communication by just passively listening in (or possibly playing back a >recording). Assuming it were possible, it would have to have a rather good quality, although DAT should be adequate, I should think. > I have seen units that could decode all of the popular Blue Book >protocols for consumer equipment such as faxes and high-speed modems as well >as ISDN, T1, DS3, ATM, Hey! Justa sec! ISDN is basically digital (broadband), so (obviously) is T1, likewise DS3 and ATM. Except for ISDN, unidirectional signals (at least at one time...), I think. This is NOTHING compared to the difficulty of doing simultaneous bidirectional analysis in a 3 khz bandwidth of 28 kbps each way! Maybe you're far more familiar with what equipment is available for telephone analysis than I am, but I have serious doubts that the capacities you list above are even close to what the other guy asked about. etc... Most are programmable and some are full-blown >computers running stripped down versions of Unix and can also be controlled >over the network from RealComputers. With multiple analysers and a little >custom software you could easily perform MITM attacks. The hardest part is >getting in the middle. > >Modulation, comm-protocols, and compression techniques are not a replacement >for honest to goodness crypto. Agreed, but let's not underestimate the amount of effort involved. This is important, because of that "Digital Telephony" bill crapola they're trying to foist on us. Their argument will be, we presume, that "we've gotta be able to bug all these lines because of all the drug dealers talking on the phone. Well, unless the government is proposing installing the capability of bugging data the vast majority of data calls (including those that, hypothetically, use Clipper) then they're NOT going to get any traffic they claim to want to hear. We should ask, "How much will it cost to even UNDERSTAND a data phone call, let alone decrypt it, and if it's too high let's give up while we're behind."

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:06 1/24/96, Andrew Loewenstern wrote: >Why not just print out all of the source code to Navigator (crypto and all) >in a nice OCR font? Paper is exportable. Then you would 'only' have to scan >it back in and debug it. That would be giving away the store to the competition. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:07 1/24/96, Peter D. Junger wrote: >The ITAR are regulations, not a law passed by >Congress. The ITAR regulations relating to the export of cryptography >are probably not authorized by any law (as well as being >unconstitutional). The reason for all the silly twists and turns >under the ITAR is that the censors never succeeded in getting any law >forbidding the use of cryptography, and it is not at all certain that >they could get such a law passed. They couldn't get a law passed _then_. Nor did they need to. They also don't need one now, because they have rubber regulations at their disposal. They will be able to get a law passed, should their interpretation of the regulations be thrown out by a court. Passing such a law will be *trivial*. Just put in the exceptions for the powerful special interest groups, such as banks. The vote will be near unanimous, as it always is in similar cases. See Digital Telephony. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:11 1/24/96, sameer wrote: >> example, CyberCash has a development office there. >> > "has a development office" is a bit of an understatement. Would you like to share? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Hack Java
by Rich Salz 17 Dec '03

17 Dec '03

This illustrates the difference between a language with no dangerous constructs, and one where you must trust the implementation. >From some internal OSF email: ---------- Begin Forwarded Message ---------- class Data { // an object storing 16 bytes byte word[16]; } class Trick { Data data; long tricky_pointer; } Now suppose, I fake a compiler (or I have a malicious compiler) and I generate by hand malicious byte code such that in the symbol tables, tricky_pointer and data have the same offset. Then if I have the code tricky_pointer = 10000; for (; tricky_pointer < 50000 ;) { dumptofile(trick.data) tricky_pointer += 16; } what I am doing with this code is that I am actually setting the data object reference to point to address 10000, then I am core dumping the contents of memory upto address 50000, 16 bytes at a time! The byte code is completely legal, I have cheated with the field offsets so that I can access to the same memory as two different types. In order to detect that the byte code verifier must verify that all the fields of an object do not overlap in their memory layout. That's what has to be checked. ----------- End Forwarded Message -----------

6 5

(FWD) UUNET Offers Web Security Services 01/22/96
by an146908＠anon.penet.fi 17 Dec '03

17 Dec '03

FAIRFAX, VIRGINIA, U.S.A., 1996 JAN 22 (NB) -- UUNET Technologies (Nasdaq:UUNT) is offering a World Wide Web hosting service that includes a full range of security services for commercial and private applications, including use of PGP (pretty good privacy) encryption. The company says the introduction of secure Web services supports served-based SSL (secure socket level) encryption that works with Netscape browsers to transmit sensitive data such as credit card numbers. The inclusion of PGP also allows companies to encrypt and forward data they have received on the Web, which can then be redistributed to other system, such as credit bard billing systems, via e-mail or FTP (File Transfer Protocol). UUNET says the combination of security measures is available for UUNET's standard, premium, and new dedicated Web hosting services. Alan Taffel, UUNET vice president of marketing, said the new measures are "a significant step toward the goal of making Web-based electronic commerce a reality. Previously, companies wishing to take advantage of available secure server technology had to undertake a challenging and lengthy process. UUNET's secure Web service alleviates the hassle associated with deploying a secure server." Customers choosing the secure service will get the same Internet service as regular customers, says UUNET. Also, UUNET will take care of details such as applying to Verisign for a company digital identification. UUNET is also now offering a dedicated server option for high volume and high value customers. This service includes a dedicated 130 megahertz (MHz) Pentium machine, a gigabyte (GB) of storage and up to 5GB of traffic per month. The price involves a $3,500 startup fee, and monthly fees beginning at $2,000 per month. UUNET's standard service starts at $300 a month and includes T1 bandwidth. Premium service (10 megabits-per-second connectivity) starts at $900 per month. For standard service, the security service cost an additional $200 in startup fees and $200 per month above the normal fee. There is no startup fee for premium service, but the monthly surcharge remains. FTP hosting service is available for $100 per month for up to 2.5GB per month in traffic. (Kennedy Maize/19960122/Press Contact: Alan Taffell, 703-206-5600) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: Crippled Notes export encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:25 AM 1/25/96, Lucky Green wrote: >The big companies are fighting? Where did you get that idea? IBM/Lotus just >gave the feds the keys. Not a single one of the major players has >challenged the government in any meaningful way. Sure, they make a lot of >noise as to how they dislike the regulations, but they certainly aren't >making a sincere effort of trying to change them. I have several pieces of evidence which suggest to me that the government is leaning on companies in ways which are not always apparent. (I can't share all of the evidence I have...I know this is unsatisfying. I'm not asking you to "trust me," just noting that this is what I have either heard from usually reliable sources or from direct participants.) I am reluctant to ascribe malice to any of the players in this drama, just differing goals (in the Great Game). --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

[noise] Re: Crippled Notes export encryption
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:24 PM 1/24/96 -0500, you wrote: >In article <9601242357.AA02688@alpha>, Mike McNally <m5(a)dev.tivoli.com> wrote: >>This sounds fishy to me. I don't recall reading anything to suggest >>that export of cryptographic software (or any other munition) requires >>that the stuff be *used* outside the US for an offense to be >>committed; why should export of a cryptographer's wetware be any >>different? Either the expertise leaves the country or it doesn't, I'd >>think. > >Here's section 120.17 of ITAR: > >@ 120.17 -- Export. > > Export means: > > (6) A launch vehicle or payload shall not, by reason of the launching of such >vehicle, be considered an export for purposes of this subchapter. However, for >certain limited purposes (see @ 126.1 of this subchapter), the controls of this >subchapter may apply to any sale, transfer or proposal to sell or transfer >defense articles or defense services. So we could launch Jeff Wienstien in a rocket without violating ITAR as long as we do not sell him. "Hey Jeff... Want a ride?" ];> Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ National Security uber alles!

2 1