December 2003 - cypherpunks-legacy

Re: PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995 anonymous-remailer(a)shell.portal.com wrote: > On Fri, 15 Dec 1995, Alice de 'nonymous wrote: > > > Can anyone tell me whether Ian Goldberg and David Wagner got their $25,000 > > from Netscape for finding the HUGE security flaws in Netscape's existing > > product line?? > > > > Alice de 'nonymous ... <an455120(a)anon.penet.fi> > ^^^^^^^^^^^^^^^^^^^^^^^^ > > Heh, hey Alice, you know this discussion a short time ago where you > claimed that you wouldn't use PGP for signing because it wasn't secure > or something, what's with the use of the penet address? Uhhm, actually, I said that I don't have a secure machine to run PGP on, and that I didn't feel that I should have to travel across town to use a secure machine to ask whether or not Ian Goldberg and or David Wagner got any moola from Netscape or AT&T for helping to make these companies a fortune. Did they get their $25,000, or a scholarship, or a Christmas week or two at the Halekulani in Honolulu?? They helped out these companies, and here it is, less than ten days to Christmas, and what have these companies done?? Nothing ... nothing at all ... but freeload ... > Surely a penet address offers even less protection for your id? > > Or have you done something nifty like create the penet address with a > nymserver address? Yep, something like that ... you must be paying attention, my friendly "spoofing" shadow. The Penet address is simply to prevent huge email from being mailed to me. I don't want AT&T or Netscape to mailbomb me for simply writing the truth about them. Penet gives me some protection. I'm not looking to Penet to protect my "identity". All I want Penet to do is provide a way for people to write to me if they want to. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

What ever happened to... Cray Comp/NSA co-development
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- O.K. I'm new... however... I remember reading an article about this news release in mid '94 (I believe it was the NY Times), about the time that Cray Computer Company (Seymour's unsuccessful spinoff company) was actively seeking bank financing. Anyone remember? The article was about an NSA contract award to Cray Computer. In some background: The Supercomputer industry had been struggling for a while with reductions in purchases from the U.S. government due to cutbacks on research spending and the 'end of the cold war'. The situation at MasPar had gotten to the point of court reorginization or worse. In June (of '94) Cray was in such a cash squeeze that it took out a $17.5 million secured loan to fend collapse. During July, Cray announced that it was seeking a "partner" to make an investment in exchange for technology access. Guess who shows up with plans to build "the ultimate spying machine"? Now, Seymour's a nice guy, but money is tight, so he buys in on the hopes for more a lucrative future relationship. The plot thickens. The contract calls for Cray to put up $4.6 million to cover the initial development (didn't they just take out a loan?) of which about $400,000 will go to the NSA for so called "software consulting services". It makes one wonder what the "real" contract was worth (such as producing this surveillance system in quantity)? There was some speculation in the article about what this system could be used for, such as DEA operations outside U.S. borders (Columbia perhaps) or foreign military communication or enhancement processing of spy satellite photos. What caught my attention was the architecture. A "hybrid design linking two supercomputer processors with an array of HALF A MILLION inexpensive processors" that were designed by the U.S. government laboratory affiliated with the NSA. The same chip house that brought us Clipper. I've not kept up with the "ultimate" demise that eventually befell Cray Computer Company, but the October 16 FBI filing on capacity for Digital Telephony got me thinking back to this article. 1% seems like a rather huge need for horsepower. And what if GAK doesn't fly? And the widespread use of hard crypto just keeps increasing? This kind of machine could, in theory: 1) Implement ALL Clipper(II) based Key Escrow functionality in silicon (the easy part) AND allow for simultaneous decrypt and surveil of 'who knows how many' Clipper based data streams. 2) Implement general RSA based Prime Factoring functionality in silicon (the not so easy part) AND allow massively parallel decrypt and surveil of 'who knows how many' RSA/etc. based data streams. 3) Implement it all, AND 'on-line' transaction based surveillance via the FBI's 1% capacity infrastructure. Chilling... Who needs key escrow (or RSA private keys) when you've got a massively parallel prime factoring machine. What if GAK was to become a 'non-issue'? How fast do you think a machine such as this could factor RSA 129? Makes you wonder if 2048 bits will be enough (my guess.. it won't). But then, I'm sure that when Cray Computer finally folded (has/hasn't?) all that tech just got sold for scrap eh? Anitro - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMNSadioZzwIn1bdtAQEgYwF+Nf5Azpeore6OPMNU94CpCawxPcPg8g7T kLQDY9I5Upk7vCe1dCpHm14g8jRYdSDx =vjJA -----END PGP SIGNATURE-----

1 0

Re: Oklahoma University: Is this legal?...
by sethf＠MIT.EDU 17 Dec '03

17 Dec '03

Going on my past experiences with this sort of situation, I think the problem is a) Oklahoma University is public (seems true from http://www.uoknor.edu/) b) The state of Oklahoma has an "open public records" law so c) someone decided that everything stored on the University's computer system was therefore a "public record" (since the computer is "owned" by the public), and thus had to be accessible by law. This seems to be approximately what's going on: "Drafted by Associate Chief Counsel Kurt Ockershauser a year ago, the policy will make a legal statement that e-mail is running on state property, Colaw said. He said the policy is not an invasion of privacy." http://www.uoknor.edu/okdaily/issues/fall1995/dec-7/1-email.processed.html Someone needs to explain to him that what he is doing is not legally required, and perhaps violates the ECPA. ================ Seth Finkelstein sethf(a)mit.edu

1 0

[NOISE] Screening of Unauthorized Access
by stevenw＠best.com 17 Dec '03

17 Dec '03

Saw this in the net. I know nothing about the movie personally. Perhaps someone on the list can comment? >Unauthorized Access, the documentary on the computer hacker underground from >an insiders point of view is screening in San Francisco!!! > >What the critics say: > >"Unauthorized Access lets you see and hear from those people that big >corporations and the government are so afraid of..." - The Seattle Stranger > >"If you want to know what a hacker really is, this is a must" - EXE Magazine > >"To see the hacking world from the Inside, try watching Unauthorized Access... >it shows hackers as they see themselves without the media's usual hype..." - >The New Scientist > >"As a cultural piece, it's what we've been waiting for. Many of us have long >suspected that modern-day hackers have a unique and rich culture. >Unauthorized Acess is something we can point to to prove it." - 2600 - The >Hacker Quarterly > >"Annaliza Savage has made a fascinating documentary about the sick world of >criminal hacking..." Mich Kabay - NCSA > >"It's a kafka-esque expose of the computer underground, a must see for all >security experts. This made me want to go out and become a cop." - Cult of >the Dead Cow > >Question and Answer session after the screening.... > >Unauthorized Access is screening at: >Artists Television Access in San Francisco >Thursday, December 21, 1995 - 8:30 pm >922 Valencia Street (at 21st) SF, CA 94110 >(415) 824 3890 > >For more info on Unauthorized Access http://bianca.com/bump/ua/ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Re: BosniaLINK
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ Irrelevant crap deleted ] Don't post irrelevant stuff here. I've noticed an awful lot of crap posted from the replay remailer to this group over the last few months. Wish I could figure out who this jerk is. Gary - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMNSQ+CoZzwIn1bdtAQHrHQF8DyOXYfMYV5czKkMXDqJtMYWaReg1IYiX QSG801r5LE3hMDa7ooSrQH6LwgDwPAYs =r8dB -----END PGP SIGNATURE-----

1 0

Re: Is ths legal?.. (fwd)
by Robert 17 Dec '03

17 Dec '03

Sun, 17 Dec 1995 10:18:50 -0500 (EST) Black Unicorn <unicorn(a)schloss.li> writes: > > On Sun, 17 Dec 1995, Jay Holovacs wrote: > > Electronic Communications Privacy Act of 1986 (ECPA) (18 U.S.C. ss 2510 > > et seq.). "It shall not be unlawful under this chapter for an > > operator of a switchboard, or an officer, employee, or agent of a > > provider of wire *or electronic* communication service, whose > > facilities are used in the trans-mission of a wire communication, > I disagree. Instead it implies that interception and administrative > review of content will be tolerated where it is "a necessary > incident to the rendition of his service or to the protection of the > rights or property of the provider of that service." Note that it > will be the provider who makes the definition in the ex ante application. > Even worse, the protection that is given is for "a provider of wire > communication service to the public." I also disagree because I would interpret it as "It shall not be unlawful...to intercept, disclose or use that communication...except by utilizing *service observing* or *random monitoring*." That indicates to me that specific monitoring is fine, but random monitoring must be used for quality control. And how do you become specific without being random? QC could be whatever the providers deem it to be, the public be damned. "..anything not specifically allowed is expressly forbidden..." RDHeffren(a)gnn.com RobertH677(a)aol.com id=0x95AA98CD

1 0

Re: Political Cleanup program
by jim bell 17 Dec '03

17 Dec '03

At 02:04 PM 12/17/95 -0800, Detweiler wrote: > >JB: >>Politics is traditionally corrupt, it appears, because donors to politicians >>and political campaigns expect a quid pro quo for their donations. Various >>unsatisfactory solutions include campaign spending limits, etc. > >I have an unusual view that I've never seen elsewhere: the problem with >our government is not that money or PACs are involved, but that the system >does not handle or resolve the conflicts between them very well. in other >words, in contrary to the current view that all PACs are evil, I think the >problem is not that we have PACs, but that our current system does not >balance their demands in some sensible manner. the system is >susceptible to corruption. it is conceivable however that there would be >a system that involves money and politics but still avoids corruption. Here's a question I have never heard anyone else ask (or answer!). "What is the purpose of a PAC? To be more specific, a PAC simply seems to be a funnel through which individual donations flow; why do we need a PAC? Is it to keep records of "who's naughty and nice"? Any contribution that can be made by a PAC could just as easily be made by one individual. >>It occurs to me that it would be a major advance if a system could be set up >>that would "blind" campaign donations as to their source: The donor could >>be satisfied that his donation gets to the candidate or cause, but the >>candidate couldn't know who actually paid the money (and the donor would be >>unable to prove that he made a donation, for example). Admittedly there are >>a lot of details that need to be worked out, but if this could be >>accomplished it would change politics as we know it. > >what you describe would allow anonymous bribes. Which, I suggest, is better than a non-anonymous bribe. > the giver could always "always"? Are you sure about that? >identify his cash donation "out of band" to the receiver. It is exactly this that the system I'd propose would prevent. I realize that you may not be able to imagine such a system, but that doesn't mean that such a system could be designed. (Before 1975, most of us would not have been able to imagine public-key encryption, for example.) A giver could CLAIM to make any sort of donation at all; but if the system were properly designed he could simply be lying to the officeholder. > moreover, other observers >would not be aware of the relationship. Not IMMEDIATELY, perhaps, but eventually the books could be opened, perhaps as much as years later. (Let's say, 3 months before the end of the term of the politician. And the amounts donated could withheld, with only the total donated reported every 3 months or so. (And perhaps only to 1 or 2 significant digits of accuracy.) For example, a Senator will be told on January 1, 1996, that up until that point he's received "about" $1.4 million dollars of donations. He would not be able to link these donations with any particular claim. Somebody could claim to have given him "$2000" of donation, which wouldn't even show up to the accuracy of the amount told the politician. Further techniques could be used to disguise the rate of giving. >why do you think this would be an improvement? Easy. It would remove much of the reason for a politician to treat one citizen differently from another citizen. >to the contrary our current system works hard to require >the disclosure of who donated what to a candidate, so the candidate's potential >hidden agendas and ulterior motives can be revealed. seems reasonable to >me. _EVENTUAL_ public disclosure of such information is not inconsistent with my idea. >you are probably barking up the wrong tree here on cypherpunks, however, >because most of the key "insiders" here are convinced that democracy is >a proven failure, and that in fact government is invariably corrupt and >oppressive, no matter what the implementation. the "solutions" advocated >here are chiefly withdrawal and subterfuge. I don't disagree with that assessment. However, that does not mean that I don't want to make life as difficult for the politicians as possible until they are swinging from a rope. >needless to say I disagree with this. I wonder if some day someone will >invent a "killer app" that doubles as a political governing system. >it seems to me politics is one of the last most intractable areas of >human interaction when many others have been harmonized and systematized >by the information revolution. I suspect it will eventually succumb to >technological ingenuity as well. the end result would be a government >that is not perfect, but is at least as good as the population that >drives it, and no worse. (in contrast today we seem to have a government >that is no better than the least common denominator). > > >JB, I have to wonder however how your ideas about campaign reform tie into >your prior advocation "Prior"? It's not "prior." I haven't changed my previous position one bit. > of political assinations as a legitimate form of >citizen power. have you given up on the idea of murdering politicians as >a means of political reform? Not "political reform." Political ELIMINATION. I want to eliminate the entire concept of a heirarchial government. > or are you now just coupling that idea with >campaign reform to put some new bells and whistles on >your overall ideological package? I repeat my previous statement. I'm happy to see them squirm before they are led to the gallows. Making life as difficult as possible for them is my goal. Using technology to disable their normal methods of corruption would be an excellent start.

3 2

Re: Political Cleanup program
by jim bell 17 Dec '03

17 Dec '03

Well, I don't consider these two ideas mutually exclusive. As I pointed out to Detweiler (under his alias "Nuri") I'm happy to see the politicians tortured before they are killed. At 02:48 PM 12/17/95 -0800, you wrote: >Good ideas, but you're getting soft. I liked the death lotto much better. > > Mike > >> Politics is traditionally corrupt, it appears, because donors to politicians >> and political campaigns expect a quid pro quo for their donations. Various >> unsatisfactory solutions include campaign spending limits, etc. >> >> It occurs to me that it would be a major advance if a system could be set up >> that would "blind" campaign donations as to their source: The donor could >> be satisfied that his donation gets to the candidate or cause, but the >> candidate couldn't know who actually paid the money (and the donor would be >> unable to prove that he made a donation, for example). Admittedly there are >> a lot of details that need to be worked out, but if this could be >> accomplished it would change politics as we know it. > >

1 0

Re: Encrypted telnet...
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 95 12:48:41 CST, you wrote: An alternative to writing an entirely new proggie might be to write an add-on DLL for Windoze telnet clients that support add-ons... EWAN comes to mind here. >I am looking for an encrypted telnet (or rlogin/etc) package >that supports a Windoze client. >It looks like all the normal ones that I can find >(SSH, SRA telnet, SSLtelnet, etc) are just under Unixoids. >Don't get me wrong - I would prefer to use Unix, but I am >headed off to locations, where I know all I'll have access to >is Windows, with a PPP stack to some ISP. >I'ld write it myself, - pasteing different packages together, >but I need it working in a day or two. Can anyone help me here? >Thanks, >Dan >------------------------------------------------------------------ >Dan Oelke Alcatel Network Systems >droelke(a)aud.alcatel.com Richardson, TX

1 0

IETF draft on data protection via crypto API
by Rich Salz 17 Dec '03

17 Dec '03

A Revised Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Working Group of the IETF. Title : Independent Data Unit Protection Generic Security Service Application Program Interface (IDUP-GSS-API) Author(s) : C. Adams Filename : draft-ietf-cat-idup-gss-03.txt Pages : 35 Date : 12/14/1995 The IDUP-GSS-API extends the GSS-API [RFC-1508] for applications requiring protection of a generic data unit (such as a file or message) in a way which is independent of the protection of any other data unit and independent of any concurrent contact with designated "receivers" of the data unit. Thus, it is suitable for applications such as secure electronic mail where data needs to be protected without any on-line connection with the intended recipient(s) of that data. Subsequent to being protected, the data unit can be transferred to the recipient(s) - or to an archive - perhaps to be processed ("unprotected") only days or years later. Internet-Drafts are available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-cat-idup-gss-03.txt". A URL for the Internet-Draft is: ftp://ds.internic.net/internet-drafts/draft-ietf-cat-idup-gss-03.txt Internet-Drafts directories are located at: o Africa Address: ftp.is.co.za (196.4.160.8) o Europe Address: nic.nordu.net (192.36.148.17) Address: ftp.nis.garr.it (192.12.192.10) o Pacific Rim Address: munnari.oz.au (128.250.1.21) o US East Coast Address: ds.internic.net (198.49.45.10) o US West Coast Address: ftp.isi.edu (128.9.0.32) Internet-Drafts are also available by mail. Send a message to: mailserv(a)ds.internic.net. In the body type: "FILE /internet-drafts/draft-ietf-cat-idup-gss-03.txt". NOTE: The mail server at ds.internic.net can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e., documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. For questions, please mail to Internet-Drafts(a)cnri.reston.va.us.

1 0