December 2003 - cypherpunks-legacy

Re: PGP in Eudora and other mail programs
by bea＠algonet.se 17 Dec '03

17 Dec '03

At 11.54 96-01-25, Timothy C. May wrote: >At 2:13 PM 1/25/96, Clay Olbon II wrote: > >>Seriously, this just illustrates the idiocy of banning "hooks" in software. >>How does... [snip] > >And yet how many of these programs actually can transparently >(automatically, push-button, etc.) support PGP? I've been a user of Eudora >for several years, and have pressed for PGP hooks. The company, Qualcomm, >once told me it was on their list of things to do, but.... > >A few years later, still no PGP-in-Eudora. One would think that this would >be a powerful way of distinguishing their product from other mail packages. > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) > >Food for thought. > >--Tim May Why don't try Raif Naffah's MacPGP Control, now in version 1.0b2, version 1.0b3 soon to be released. It covers whatever the Windoze interfaces does and actually they don't even play in the same league. Bjorn A. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Bjorn E. Andersson <bea(a)algonet.se> or <bjorn_andersson(a)macexchange.se> PGP key available at Public Key-servers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

V-chip?
by oO F145C0 Oo 17 Dec '03

17 Dec '03

Apparently the US government is planning on starting up its V-chip program again, which will allow public/cable TV to be censored at will. What does everyone thing about this ploy? And whats next? Chips in my radio, to prevent music, or a chip in my phone to make sure i dont call anyone bad? The V-chip is just as much a privacy/1st amendment violation as the clipper chip is/was. I believe the worst part of the V-chip plan, is to force all new TV's manufactured or imported to the US, to have this new chip. Could this chip even be part of a Chinese lottery? ......fiasco

3 3

Re: Secrecy of NSA Affiliation
by Peter Trei 17 Dec '03

17 Dec '03

Tim writes: > Also, much other evidence points to the NSA having "gone public" much > farther back in time than 18-30 months ago. Former DIRNSAs on the > MacNeil-Lehrer Newshour were always introduced as former directors of the > NSA. As early as the mid-80s, as I recollect. I think Bamford's book pretty > much outed the name, though it was widely known before that, of course. Datapoint: My 1967 HB copy of The Codebreakers discusses the agency, and includes a photo of the HQ. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Remailer stats
by Bruce Baugh 17 Dec '03

17 Dec '03

The following is the result of my own experiments, performed when a) I started noticing that my remailing times didn't seem to match the ping lists available and b) another local guy posted a format that seemed useful, so I swiped it. I mailed through each of the remailers listed below ten times over the course of eight days (10 Jan 96 to 18 Jan 96) - posts went out spread across all hours of the day and night, to compensate for congestion at high-traffic times. (Insomnia's value as a research aid, coming soon to a major scientific journal.) Each post went through the remailer, to a nym server, back through the remailer, and then to me. The trip time is the interval from the end of a posting session with Eudora and PPP connection to Teleport to the arrival of a message in my mailbox at Teleport. Times are given in hours and minutes. "Failure" means that I hadn't gotten a reply back within four days of posting it. I anticipate doing this on a monthly basis, and would be delighted to hear from anyone else doing the same. Joel McNamara has raised the possibility of a net resource that would feed back the data for whatever region is closet to the inquirer, which sounds seriously cool to me. REMAILER PERFORMANCE, MID-JANUARY FAILURES REMAILER AVG MIN MAX NOTES 0 hroller(a)c2.org 00:05 00:02 00:18 0 homer(a)rahul.net 00:06 00:03 00:14 0 hfinny(a)shell.portal.com 00:08 00:02 00:38 0 remailer(a)armadillo.com 00:09 00:06 00:12 0 hal(a)alumni.caltech.edu 00:09 00:02 00:24 0 remailer(a)utopia.hacktic.nl 00:19 00:03 01:20 0 mixmaster(a)vishnu.alias.net 00:56 00:23 02:38 0 remailer(a)valhalla.phoenix.net 01:35 00:20 05:49 0 mixmaster(a)remail.obscura.com 02:36 00:23 06:55 0 remailer(a)bi-node.zerberus.de 07:43 00:15 19:54 1 remailer(a)replay.com 00:31 00:13 01:14 2 remail(a)c2.org 00:52 00:14 03:00 8 remailer(a)extropia.wimsey.com 01:46 01:19 02:13 [1] 8 mix(a)remail.gondolin.org 11:17 03:58 18:36 10 amnesia(a)chardos.connix.com ? ? ? [1] On the 19th or 20th, extropia.wimsey.com suddenly cleared backlog, and all my messages did go through. So I'll see how it does in February; looks like they had a week-long weirdness of some kind. Comments welcome. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: Netscape & open NNTP servers
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:23 PM 1/24/96 -0800, you wrote: > I believe that it will use a SOCKS proxy if configured, but that >NNTP will not use the HTTP proxy. I am not certain about 2.x, but the 1.x would read mail through an NNTP proxy, but not post it. SOCKS would work, but not for the type of connection the poster was looking for... In 1.2 and 1.22, the NNTP proxy was hidden in the netscape.ini file. (It was considered "broken" becuase you could not post to news.) No good answers... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Secrecy of NSA Affiliation
by Douglas F. Elznic 17 Dec '03

17 Dec '03

At 12:35 PM 1/25/96 -0800, Timothy C. May wrote: >At 5:55 PM 1/25/96, Rich Salz wrote: > >>Up until recently (18-30 months ago) NSA employees were only allowed >>to identify themselves as employees of DoD. It was common knowledge, >>that unspecific references to Fort Meade meant NSA; and if you saw >>a P.O. from Procurement Office, Fort Meade, it meant the NSA was buying >>it. > >When I attended Crypto '88, nearly 8 years ago, at least several of the NSA >attendees had "National Security Agency" on their name badges. It may be >that run-of-the-mill employees still maintain the fiction for public >consumption that they are DOD employees, but such was not the case in 1988 >at "Crypto." > >(Recall the "NSA Employees Manual" which 2600 liberated, and which Grady >Ward then redistributed. It had some tips, as I recall, on what employees >should tell the curious.) > >When I visited the D.C. area in early '91 or '92 (I forget which year it >was), I stopped by Fort Meade to see the place. The sign out front >prominently said "National Security Agency," complete with the NSA seal (an >eagle lifting a hacker up in its talons). > >Also, much other evidence points to the NSA having "gone public" much >farther back in time than 18-30 months ago. Former DIRNSAs on the >MacNeil-Lehrer Newshour were always introduced as former directors of the >NSA. As early as the mid-80s, as I recollect. I think Bamford's book pretty >much outed the name, though it was widely known before that, of course. > >(I attended my freshman year of high school in Langley, VA. Through the >woods on one side of the school was CIA headquarters. At that time, 1967, >it was still only labelled as something like "Department of Transportation >Road Testing Facility." Everyone knew what it really was, of course. Rick >Smith, on this list, was a classmate of mine and can attest to this. The >CIA "went public" in the early 70s, the NSA in the early 80s, the NRO in >the early 90s...I sense a pattern. This means the ultra-secret ERO >(Extraterrestrial Research Organization) will be outed in the opening years >of the next decade.) > >--Tim May > > >Boycott espionage-enabled software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 - 1 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > > Phrack actualy published the manual. I have a local copy if anyone is interested. -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Guilt by Association?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:49 AM 1/25/96, Alan Olsen wrote: >This is a problem with the web of trust in general. It is known as "Guilt >by Association". > >Person X commits treasonable act A. All of the persons who are signed on to >his key could be considered to be co-conspirators. The same applies to >nyms. The difficulty with prosecuting nyms is finding the link to the real >world individual. Anyone associated with him/her/it will be considered to >be guilty by reason of key signage or a way of determining who the real >person is... .... >I guess we are stuck with the "Web of Guilt"... Although I disagree with many things the U.S. government has declared unlawful, and think we are on the wrong track in many ways, I don't see any evidence for a "web of guilt." I could have signed the keys of Timothy McVeigh, O.J. Simpson, and Hilary Clinton, and yet this would not cause any prosecutor to indict me, per se. (Brian Davis, do you disagree?) Obviously if one of these persons I was known to have associated with, to the point of signing their keys, were under investigation, then some detectives might follow up some leads to find out who I was. This is ordinary detective work, not guilt by association. Key-signing is overrated, in my view. It is just an affidavit from someone that they think a person is related to a key. I've signed a few keys (not many, and don't ask me to!), and I've never once asked for any form of state-sanctioned ID. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Crippled Notes export encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:56 AM 1/25/96, Derek Atkins wrote: >Yes, it is a huge can of worms. Worse, since it is done on a >case-by-case basis, there really is no clear definition of where the >exportable vs. non-exportable line actually is. You need to try it to >test if it will work or not. Several people have mentioned the "case by case" nature of the crypto export situation, and this is of course the key. I don't claim to have studied the ITARs as, say, Phil Karn or Dan Bernstein have. Or to to have reviewed relevant case law, precedents, etc. But I'm not sure it's important. That is, the Munitions Act and related laws/regulations were set up to meet certain end goals considered desirable. With considerable flexibility in interpreting these rules and regulations, State and NSA seek to meet the end goals they have established, not to scrupulously define the exact boundaries of the law. Thus, let me try to think like them and present some situations people have proposed (or actually filed cases about, a la Bernstein, Karn, etc.), and *guess* which way things will go. Others may disagree. Here they are: Situation/Test Case Likely End Result * Export of t-shirt * Foot-dragging, but eventual approval (foot-dragging because D.C. won't be sure how any decision they make will be taken) * Ian Goldberg returning to Canada * The issue won't even come up (Students routinely return to Israel, Netherlands, etc. Nobody cares. Especially with regard to students returing to Canada, which is of course treated as a backward child of the U.S. for the purposes of crypto policy.) * Goldberg's team sets up in Zurich * NSA issues warning to Foobar, Inc. (In this hypothetical, Ian Goldberg has a team in Berkeley writing the MongoBrowser Web browser. They decide U.S. laws on crypto export are too restrictive and decide to move their operation to Zurich. This is clearly designed to skirt the "spirit" of the Munitions Act/ITARs, and so the NSA/State will try to head it off. Assuming they even learn it is happening, which is a very real impediment to practical enforcement. Ex post facto, MongoBrowser and its programmers could be hassled upon entry to the U.S. later.) And so on. In other words, you need to "think like them" with regard to what's a potentially real threat and what's not. T-shirts are not real threats, but RSADSI deciding to move its core crypto development to Zurich is. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: PGP in Eudora and other mail programs
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 25, 1996 11:54:46, 'tcmay(a)got.net (Timothy C. May)' wrote: > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) > [REPOSTED FROM ALT.PRIVACY.ANON-SERVER] > >John Doe is a Windows program that makes creating and >operating a Nymserver account a *lot* easier > >A Nymserver allows you to: > >* Create an address of the form your-choice(a)alpha.c2.org >* Cannot easily be traced back to you >* Your Internet Service provider cannot snoop on you >* Can post to Usenet and Mailing Lists >* Your correspondents do not need to do anything special >* Can receive replies addressed to your pseudonym > >These facilities have been available for some time but >John Doe simplifies operation. > >This is a "try before you buy" version expiring 30 days >after installation. The registered version is only 15 >pounds (UK) that's about $25 (US) > >More information and a download are available on: > >http://www.compulink.co.uk/~net-services/jd.htm > >Steve Harris - Net Services > I then posted to alt.privacy.anon-server the following preliminary review: I downloaded a trial version of John-Doe and have been playing with it for a day. Herewith my initial impressions of it: Downloading it from the source: as described. easy. Performing basic installation on my hard disk: essentially automated. should not trouble or even hassle anyone with even a marginal knowledge of Windows. Performing installation as WinsockApp in my Pipeline e-mail software: moderately easy to impossible. Pipeline uses an odd e-mail system that automatically fills an empty SUBJECT field with the phrase "[NO SUBJECT]" that jams everything and caused every test message I sent to bounce back to me. However, I then downloaded a copy of Eudora Light to use with John-Doe. This seems to be working. I really hated the need to do this and the extra hassle but it is not a specific bug in John-Doe. (On the other hand Steve, since installation programs are constantly being improved even to deal with other company's brain-damaged software ... Hint, hint, hint...) Does it work as Steve says: as far as I can tell, yes. Overall impressions (very preliminary): John-Doe is a classical example of how elite technology pulls mass technology in its wake. PZ developed PGP and got it widely out, even if the command line structure kept most people from learning it. Then other people (penet not included here) developed Mixmaster etc. tech that worked well but was so complex that only an estimated 500 people worldwide could use it. Then other people developed front ends for PGP etc., like PGPSH and Private Idaho. Finally, people like Steve develop real front ends for the complex tech that puts the ability to use the previously elite tech in the hands of people who want the earlier complexity to disappear. I suspect that John-Doe will go through the normal new-product cycle -- discovery of bugs, slight improvements, and then better integration of user needs. Ultimately, as the product matures, I think that Steve's John Doe will be seen as a revolutionary development in privacy equal to (in a far less technical but more end-user way) PZ's original PGP. -- tallpaul "To understand the probable outcome of the Libertarian vision, see any cyberpunk B movie wherein thousands of diseased, desparate and starving families sit around on ratty old couches on the streets watching television while rich megalomaniacs appropriate their body parts for their personal physical immortality." R. U. Sirius _The Real Cyberpunk Fakebook_

1 0

Re: another thought about random numbers
by David Neal 17 Dec '03

17 Dec '03

> Date: Wed, 24 Jan 1996 18:58:27 -0800 > To: cypherpunks(a)toad.com > From: "Erik E. Fair" (Time Keeper) <fair(a)clock.org> > Subject: another thought about random numbers > While musing over a roulette table, and noticing the preponderence of > electronic games in the various Casinos in Stateline, NV, a thought > occurred: does anyone know what sorts of random number generators those > electronic games use, and how (if at all) they are measured and regulated by > the Nevada Gaming Commission? They might have something to teach us. > > Erik Fair I cannot speak for what algorithms are used in the devices, but someone made a low-tech analysis and hack for these machines a while back. He noticed that a certain brand of keno machine reseeded its random number generated with a constant each time power to the machine was lost. Unfortunately he hit the same casino three times (the stainless steel rat says always be prepared to walk away no matter how much is at stake to steal again another day) and he was forced to divulge his method. The machine were consequently fixed. I doubt those machines use crypto strength RNGs because who is going to spend the time, energy and money to hack a .25c slot machine? The payout is too small. For an excellent real-world example of this try 'The Eudaemonicus Pie.' Briefly, its a book about people who successfully hacked roulette machines but at a net loss because of all the time and energy spent developing their technique. > >

1 0