December 2003 - cypherpunks-legacy

Re: please stop the Mitnick stuff
by Perry E. Metzger 17 Dec '03

17 Dec '03

Gordon Campbell writes: > >When there are one or two small items posted on a topic thats no big > >deal. When its a lot of stuff, it becomes an enormous pain. Multiply > >the few seconds to read and digest enough of a message to know you > >should delete it by dozens of messages per mailing list per day and by > >a dozen mailing lists and you suddenly have an untenable waste of your > >time. > > I con't recall you speaking up against the various flame wars that have been > going on in here lately, Perry. Thats because I largely send people private mail. I try not to nag in public. Just because you don't see me say "this is irrelevant" doesn't mean I didn't notice. Perry

1 0

Re: S.652 (H.R. 1555)
by berkley＠ixl.net 17 Dec '03

17 Dec '03

Earlier today (Mon, 8 Jan 1996), you (Don Gaffney) expressed the following: >I'm not a lawyer, but from what I've read from the WWW site above, it >seems that only providing "indecent" materials to minors is prohibited. >I think this is already illegal. It is _not_ currently illegal, as the term "indecent," in all its vagueness, can be defined as anything from a "Bonnie's Busty Barnyard Buddies" video, to _Catcher in the Rye_, which has been deemed "indecent" by several of this nation's local legislative bodies. >Broadcasting or sending unsolicited "indecent" materials is also >prohibited, but that seems to have always been the case (except that >objectionable materials have been called "obscence" rather than "indecent"). And that is EXACTLY the point. You'll notice that the passage (I believe) in question: "(B) by means of a telecommunications device knowingly - "(i) makes, creates, or solicits, and "(ii) initiates the transmission of, any comment, request, suggestion, proposal, image, or other communication which is obscene or indecent knowing that the recipient of the communication is under ^^^^^^^^^^^ 18 years of age regard less of whether the maker of such communication placed the call or initiated the communication; goes deliberately beyond simply "obscene." Which means that if I were to send my 17 year-old cousin a digitized copy of some "indecent" song lyrics or possibly even information on the AIDS epidemic, I am now facing felony charges from los federales. >There are provisions, as I read it, that protect electronic >intermediaries from the acts of the actual publishers of the materials >(i.e. an ISP is not responsible for the material of other internet sites >not under their control). It seems... But if I let my friendly neighborhood service provider know I'm sending my cousin the electronic copy of Charles Bukowski's "Septegenerian Stew" he requested, no doubt we're both doomed. (...knowingly permits a telecommunications facility under his control to be used for any activity prohibited by paragraph (1) with the intent that it be used for such activity) >It sounds to me like the only real task posed is to authenticate those >accessing questionable materials as being >= 18 years old. Hmmmm. Don't >authentication & crypto go hand-in-hand? No question it is one of them, but the questionable materials are being defined too broadly. >Anyway, being rather foolish I suppose, I don't exactly see what the big >deal is - am I missing something??? Along the same freedom of speech lines, the pending legislation also would make it illegal to use a telecommunications medium to express anything "obscene, lewd, lascivious, filthy, or indecent, with intent to annoy, abuse, threaten, or harass an other person;" meaning if I sent e-mail to a spamming "Get Rich Quick-er" telling him to fuck off, I am now in violation of the CDA. The real bitch is that they can continue spamming (IMO, a worse crime) as I rot away in Lemon Creek Correctional Facility; however, I am not about to propose legislation to limit their ability to do that, either. There is also the matter of allowing the FCC to regulate the internet, which I find equally as disturbing, but I am sure there are people on this list who will be able to express concerns with this far more eloquently than myself. Sincerely, Angus Durocher. ____________________________ It should be an outrage for \_ Angus Durocher people who have never seen a \_ No one of much importance road to be so presumptious as \_ berkley(a)ixl.net to regulate those of us who drive.\________________________

1 0

Why I think the NSA should love Strong Crypto
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Perry writes: >Once SIGINT becomes much harder regardless of their previous attempts >to stop it, I suspect that the NSA will become a friend and not an >impediment. Well, I often think that institutions and their desire to maintain their funding can lead to strange decisions. On one hand, doing everything to slow the emergence of strong crypto allows the NSA to continue to vaccuum up signals from the world. That would seem to justify their existence. But there are many people who can do this without the assistance of the NSA. The FBI has a crack team. I'm sure every agency can learn to snoop on phone calls. The US Forest Service, for instance, is meeting plenty of resistence out in the American West. I wouldn't be surprised if they have their own internal security unit that has developed the ability to do this. Now, imagine a world with plenty of strong crypto everywhere. Suddenly, cracking messages is a very tough job that requires plenty of computer power and high-powered mathematicians. The Forest Service can't order that up from the Police version of Toys-R-Us. Even the FBI's relatively sophisticated team isn't ready for it. It just takes plenty of investment of time and education. That's why I say that Strong Crypto is really in the NSA's best interest. They haven't had a worthy adversary since the Soviet Union fell apart. But I'm just a wise guy. -Peter

1 0

Re: DNow2> Re: DNow2 Re: Hammill 1987 speech
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greetings to all from someone on the cypherpunks list. Please don't crosspost threads on cypherpunks + other mailing lists. This thread, in particular, has essentially nothing to do with cypherpunks at this point. Please eliminate cypherpunks(a)toad.com from the cc: on future responses. Thanks. Futplex <futplex(a)pseudonym.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPKyuinaAKQPVHDZAQFoYQf+PKbtkD4P5SmV0JchrkMNvKWfGXLik1mW /0WkUXTZ8rENwozWkrh3cUmzmR0YoMJBLAlJvmcJuzPVIpz8rjTLMhbp2VPeuQct 9/eTT7DOUqrekL0QWzlZP24wMYiHhTQEsMtbKlI3PT55ZMu95L4PJscZsdVG6OQY cX7rJD2xbLYcaxRF04KKm8ajltieDmTmH3/Lk3AOnnB/HFn5ZArCam5PJcWvXFWg kdPQjlW+iUFT+5kuXny5Jug9PTXL37zW8z9OBsKXMGARdeV8vDFiV8HX/ge4SAie qWpgPfuMqHXZbCc1doQdOMv1iuWCUhQH0f2azkNG6UiPurVxqwnCYg== =JcyK -----END PGP SIGNATURE-----

1 0

NSA and NT security
by Corey Bridges 17 Dec '03

17 Dec '03

PALO ALTO, Calif., Jan. 8 /PRNewswire/ via Individual Inc. -- Global Internet today announced that the National Security Agency has awarded them a contract to conduct a feasibility study on raising the security level of Windows NT 3.51 to B-level. Global Internet will analyze Windows NT's ability to meet B-level security requirements, as well as develop a software prototype that demonstrates a Fortezza-based cryptocard access control mechanism. The contract was granted by the NSA under the Multilevel Information System Security Initiative (MISSI), which has the charter to provide security services for information ranging from Unclassified but Sensitive up to and including Top Secret. Windows NT was originally designed with security in mind. A NSA evaluation team has determined that Windows NT 3.5 with Service Pack 3 satisfies all class C-2 security requirements. B-level of security strengthens the C2 level security features while providing stricter system assurances. Global Internet has a proven expertise with Windows NT. Centri TNT is the only network security solution that is fully integrated into Windows NT TCP/IP networks by complementing and extending Windows NT's inherent strengths, while maintaining 100% compatibility with existing applications. Global Internet also has extensive experience architecting, designing and developing high level secure operating systems. "This project addresses anticipated security requirements for DOD, as well as commercial customers using Windows NT," said Michelle Ruppel, a director of the Global Internet Software Group. "Our analysis will address compatibility issues with B-level security requirements and identify the changes necessary to provide this level of support." According to Outlink, Inc., a New York-based research and publishing firm focusing on the information security market, about 80% of the PC hardware market supports Microsoft's DOS and Windows 3.1. This combination, though popular, does not provide inherent security features such as secure login, access control, auditing and self-protection. Strong access control is a highly desirable function of the MISSI architecture. Trusted Operating Systems will play a role in the MISSI success. Windows NT is a modular OS and combined with its current security features that are based on the Trusted Products Evaluation Program (TPEP) C2 level of security and it's ability to operate on the majority of customer platforms while supporting DOS and Windows applications, the architecture lends itself to support B-level requirements. An operating system with few security features allows anyone to use the machine without validating their identity, while allowing access to all files, objects and resources. C2 level security includes: auditing to allow security-relevant events to be recorded and monitored, discretionary (need-to-know) access controls to mediate who can access (read or write) files and other objects and identification and authentication (login) to require users to identify themselves to the system before they are allowed to use the system. B-level security additionally includes: labeling of users, files and other objects with a sensitivity label, mandatory access controls to enforce a security policy based on the labels of the users and objects and trusted path that ensures users they are using the actual programs provided with the system. The Global Internet Software Group specializes in security software for Windows NT networks and other operating environments. The Software Group is a division of Global Internet, a full-service internetworking solutions company focusing on secure, reliable internetworking software and services. Located in Palo Alto, California, Global Internet is privately held and was founded in 1993. Global Internet Home Page: http://www.gi.net. /CONTACT: Jim Adams of Adams And Associates, 408-370-5390, or E-mail: jaadams(a)ix.netcom.com, for Global Internet; or Mark R. Kriss of Global Internet, 415-855-1700, or E-mail: mkriss(a)gi.net/

1 0

Can you break my encryption protocol ?
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

I'm trying to put together a simple protocol for encrypting confidential but typically low-value data (i.e. I don't want people to be able to read it, but in most cases it wouldn't be catastrophic if they could). I want it to be completely license-free, so I can't use RSA or other patented algorithms. It also would only be used inside one organisation, so key management isn't so much of a problem, and the main attack it has to defend against is packet-sniffing on the Net. It also has to support variable-length keys for ITAR.. The idea is as follows.. Client and server both have copies of a passphrase, of any length. When starting the connection, client sends 128 random bits to the server. Both ends take this data, append the passphrase, and use MD5 to generate a session key. If a key of less than 128 bits is required for legal reasons, then the appropriate number of bits are retained, and the rest replaced with bits from the random data that was sent in the clear. That is, if you're only allowed 40 bit security, you take the first 88 bits that you were sent, and append the last 40 bits of the generated key to give you the session key to use. You then go off and encrypt the session (probably using 3DES or Blowfish). Can anyone spot any flaws in this system ? The only potential problem I can see would be that by cracking a number of sessions you could work out the passphrase. However, I think the number required would still be infeasible. Also, are there any known problems with using Blowfish for encrypting a data stream ? I'm assuming it's OK as it's used in PGPfone. Mark

2 1

Re: Microsoft continues to mislead public about Windows security bugs (a bit long, with references)
by James A. Donald 17 Dec '03

17 Dec '03

At 07:15 PM 1/8/96 -0800, Rich Graves wrote: >As Microsoft well knows, this is completely untrue. [...] > > [...] > >Microsoft has not even admitted that this bug in both Windows 95 and >Windows for Workgroups affects Windows for Workgroups, apparently because >they have decided not to fix it. > > [...] > > We believe that it would be highly irresponsible to release the full > version of this hack, but we will soon release a crippled > demonstration-only version > > Is anybody listening? They will listen if you start to release full uncrippled exploits, after a reasonable delay. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

RE: S.652 (H.R. 1555) (\"obscene, lewd, lascivious, filthy, or indecent...et al\")
by John Young 17 Dec '03

17 Dec '03

Responding to msg by blancw(a)accessone.com (blanc) on Tue, 9 Jan 8:41 PM >What needs to do is to learn to speak like politicians. > Learn to go around the subject, make indirect >reference, make vague allusions, be indirect & >wavering, ambiguous & obfuscating, evasive & >hypocritical; never openly offending, never possible >to be held liable for having said anything of >consequence. > >Of course it will still be annoying, but how can they >criticize their own style & manner. Ah, you've godiva'd le roy, and guttered moi.

1 0

Re: PRIVACY: Private traces in public places
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)got.net (Timothy C. May) on Wed, 10 Jan 0:9 AM >I'm not trivializing the issue of search engines and >archiving systems turning up articles written, old >posts, etc. Every couple of weeks, sometimes more >often, someone sends me a copy of one of my postings >and claims that someone else must be forging my name >(recent posts on racial issues, for example--while I'm >not a racist, I despise quotas, setasides, and >preferential treatment for lazy people, of any >race...this obviously makes some people "ashamed for >me" :-}). http://nytsyn.com/live/News3/006_010696_101827_2723.html Last summer the first case in Britain of a libel on the Internet was settled out of court when Laurence Godfrey accepted undisclosed damages from another nuclear physicist, Philip Hallam-Baker, over remarks made in 1993 on Usenet, an electronic conference with 16 million users. And Peter Lilley, the Social Security Secretary, sent a stiff letter to the vice-chancellor of Leeds University after one of its students used a faculty computer to make defamatory allegations about him.

1 0

Re: The LOGIC of Navigator 2.0 ?
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:12 PM 1/8/96 -0500, you wrote: > The [new] browser can use programs that are stored on cen- > tral computers on the Internet, making a personal computer's > operating system less important. > > > And thereby making GOVERNMENT LOGIC more important? I think they are refering to Java scripting in this article. (You have to remember that such articles are phrased for those who have little or no technical knowledge.) I find it amazing though that they claim a two week release date when I have not heard of a Java version for the Mac as of yet. I would think that they would have put it through at least one beta first. (But then again, this is netscape we are talking about...) [Note to Jeff and other Netscape employees: I realize you have gotten better. Lets hope it stays that way. (And I won't make *any* comments about "tech support".] Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

1 0