December 2003 - cypherpunks-legacy

Re: Netscape & open NNTP servers
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:23 PM 1/24/96 -0800, you wrote: > I believe that it will use a SOCKS proxy if configured, but that >NNTP will not use the HTTP proxy. I am not certain about 2.x, but the 1.x would read mail through an NNTP proxy, but not post it. SOCKS would work, but not for the type of connection the poster was looking for... In 1.2 and 1.22, the NNTP proxy was hidden in the netscape.ini file. (It was considered "broken" becuase you could not post to news.) No good answers... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Secrecy of NSA Affiliation
by Douglas F. Elznic 17 Dec '03

17 Dec '03

At 12:35 PM 1/25/96 -0800, Timothy C. May wrote: >At 5:55 PM 1/25/96, Rich Salz wrote: > >>Up until recently (18-30 months ago) NSA employees were only allowed >>to identify themselves as employees of DoD. It was common knowledge, >>that unspecific references to Fort Meade meant NSA; and if you saw >>a P.O. from Procurement Office, Fort Meade, it meant the NSA was buying >>it. > >When I attended Crypto '88, nearly 8 years ago, at least several of the NSA >attendees had "National Security Agency" on their name badges. It may be >that run-of-the-mill employees still maintain the fiction for public >consumption that they are DOD employees, but such was not the case in 1988 >at "Crypto." > >(Recall the "NSA Employees Manual" which 2600 liberated, and which Grady >Ward then redistributed. It had some tips, as I recall, on what employees >should tell the curious.) > >When I visited the D.C. area in early '91 or '92 (I forget which year it >was), I stopped by Fort Meade to see the place. The sign out front >prominently said "National Security Agency," complete with the NSA seal (an >eagle lifting a hacker up in its talons). > >Also, much other evidence points to the NSA having "gone public" much >farther back in time than 18-30 months ago. Former DIRNSAs on the >MacNeil-Lehrer Newshour were always introduced as former directors of the >NSA. As early as the mid-80s, as I recollect. I think Bamford's book pretty >much outed the name, though it was widely known before that, of course. > >(I attended my freshman year of high school in Langley, VA. Through the >woods on one side of the school was CIA headquarters. At that time, 1967, >it was still only labelled as something like "Department of Transportation >Road Testing Facility." Everyone knew what it really was, of course. Rick >Smith, on this list, was a classmate of mine and can attest to this. The >CIA "went public" in the early 70s, the NSA in the early 80s, the NRO in >the early 90s...I sense a pattern. This means the ultra-secret ERO >(Extraterrestrial Research Organization) will be outed in the opening years >of the next decade.) > >--Tim May > > >Boycott espionage-enabled software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 - 1 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > > Phrack actualy published the manual. I have a local copy if anyone is interested. -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Guilt by Association?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:49 AM 1/25/96, Alan Olsen wrote: >This is a problem with the web of trust in general. It is known as "Guilt >by Association". > >Person X commits treasonable act A. All of the persons who are signed on to >his key could be considered to be co-conspirators. The same applies to >nyms. The difficulty with prosecuting nyms is finding the link to the real >world individual. Anyone associated with him/her/it will be considered to >be guilty by reason of key signage or a way of determining who the real >person is... .... >I guess we are stuck with the "Web of Guilt"... Although I disagree with many things the U.S. government has declared unlawful, and think we are on the wrong track in many ways, I don't see any evidence for a "web of guilt." I could have signed the keys of Timothy McVeigh, O.J. Simpson, and Hilary Clinton, and yet this would not cause any prosecutor to indict me, per se. (Brian Davis, do you disagree?) Obviously if one of these persons I was known to have associated with, to the point of signing their keys, were under investigation, then some detectives might follow up some leads to find out who I was. This is ordinary detective work, not guilt by association. Key-signing is overrated, in my view. It is just an affidavit from someone that they think a person is related to a key. I've signed a few keys (not many, and don't ask me to!), and I've never once asked for any form of state-sanctioned ID. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Crippled Notes export encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:56 AM 1/25/96, Derek Atkins wrote: >Yes, it is a huge can of worms. Worse, since it is done on a >case-by-case basis, there really is no clear definition of where the >exportable vs. non-exportable line actually is. You need to try it to >test if it will work or not. Several people have mentioned the "case by case" nature of the crypto export situation, and this is of course the key. I don't claim to have studied the ITARs as, say, Phil Karn or Dan Bernstein have. Or to to have reviewed relevant case law, precedents, etc. But I'm not sure it's important. That is, the Munitions Act and related laws/regulations were set up to meet certain end goals considered desirable. With considerable flexibility in interpreting these rules and regulations, State and NSA seek to meet the end goals they have established, not to scrupulously define the exact boundaries of the law. Thus, let me try to think like them and present some situations people have proposed (or actually filed cases about, a la Bernstein, Karn, etc.), and *guess* which way things will go. Others may disagree. Here they are: Situation/Test Case Likely End Result * Export of t-shirt * Foot-dragging, but eventual approval (foot-dragging because D.C. won't be sure how any decision they make will be taken) * Ian Goldberg returning to Canada * The issue won't even come up (Students routinely return to Israel, Netherlands, etc. Nobody cares. Especially with regard to students returing to Canada, which is of course treated as a backward child of the U.S. for the purposes of crypto policy.) * Goldberg's team sets up in Zurich * NSA issues warning to Foobar, Inc. (In this hypothetical, Ian Goldberg has a team in Berkeley writing the MongoBrowser Web browser. They decide U.S. laws on crypto export are too restrictive and decide to move their operation to Zurich. This is clearly designed to skirt the "spirit" of the Munitions Act/ITARs, and so the NSA/State will try to head it off. Assuming they even learn it is happening, which is a very real impediment to practical enforcement. Ex post facto, MongoBrowser and its programmers could be hassled upon entry to the U.S. later.) And so on. In other words, you need to "think like them" with regard to what's a potentially real threat and what's not. T-shirts are not real threats, but RSADSI deciding to move its core crypto development to Zurich is. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: PGP in Eudora and other mail programs
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 25, 1996 11:54:46, 'tcmay(a)got.net (Timothy C. May)' wrote: > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) > [REPOSTED FROM ALT.PRIVACY.ANON-SERVER] > >John Doe is a Windows program that makes creating and >operating a Nymserver account a *lot* easier > >A Nymserver allows you to: > >* Create an address of the form your-choice(a)alpha.c2.org >* Cannot easily be traced back to you >* Your Internet Service provider cannot snoop on you >* Can post to Usenet and Mailing Lists >* Your correspondents do not need to do anything special >* Can receive replies addressed to your pseudonym > >These facilities have been available for some time but >John Doe simplifies operation. > >This is a "try before you buy" version expiring 30 days >after installation. The registered version is only 15 >pounds (UK) that's about $25 (US) > >More information and a download are available on: > >http://www.compulink.co.uk/~net-services/jd.htm > >Steve Harris - Net Services > I then posted to alt.privacy.anon-server the following preliminary review: I downloaded a trial version of John-Doe and have been playing with it for a day. Herewith my initial impressions of it: Downloading it from the source: as described. easy. Performing basic installation on my hard disk: essentially automated. should not trouble or even hassle anyone with even a marginal knowledge of Windows. Performing installation as WinsockApp in my Pipeline e-mail software: moderately easy to impossible. Pipeline uses an odd e-mail system that automatically fills an empty SUBJECT field with the phrase "[NO SUBJECT]" that jams everything and caused every test message I sent to bounce back to me. However, I then downloaded a copy of Eudora Light to use with John-Doe. This seems to be working. I really hated the need to do this and the extra hassle but it is not a specific bug in John-Doe. (On the other hand Steve, since installation programs are constantly being improved even to deal with other company's brain-damaged software ... Hint, hint, hint...) Does it work as Steve says: as far as I can tell, yes. Overall impressions (very preliminary): John-Doe is a classical example of how elite technology pulls mass technology in its wake. PZ developed PGP and got it widely out, even if the command line structure kept most people from learning it. Then other people (penet not included here) developed Mixmaster etc. tech that worked well but was so complex that only an estimated 500 people worldwide could use it. Then other people developed front ends for PGP etc., like PGPSH and Private Idaho. Finally, people like Steve develop real front ends for the complex tech that puts the ability to use the previously elite tech in the hands of people who want the earlier complexity to disappear. I suspect that John-Doe will go through the normal new-product cycle -- discovery of bugs, slight improvements, and then better integration of user needs. Ultimately, as the product matures, I think that Steve's John Doe will be seen as a revolutionary development in privacy equal to (in a far less technical but more end-user way) PZ's original PGP. -- tallpaul "To understand the probable outcome of the Libertarian vision, see any cyberpunk B movie wherein thousands of diseased, desparate and starving families sit around on ratty old couches on the streets watching television while rich megalomaniacs appropriate their body parts for their personal physical immortality." R. U. Sirius _The Real Cyberpunk Fakebook_

1 0

Re: another thought about random numbers
by David Neal 17 Dec '03

17 Dec '03

> Date: Wed, 24 Jan 1996 18:58:27 -0800 > To: cypherpunks(a)toad.com > From: "Erik E. Fair" (Time Keeper) <fair(a)clock.org> > Subject: another thought about random numbers > While musing over a roulette table, and noticing the preponderence of > electronic games in the various Casinos in Stateline, NV, a thought > occurred: does anyone know what sorts of random number generators those > electronic games use, and how (if at all) they are measured and regulated by > the Nevada Gaming Commission? They might have something to teach us. > > Erik Fair I cannot speak for what algorithms are used in the devices, but someone made a low-tech analysis and hack for these machines a while back. He noticed that a certain brand of keno machine reseeded its random number generated with a constant each time power to the machine was lost. Unfortunately he hit the same casino three times (the stainless steel rat says always be prepared to walk away no matter how much is at stake to steal again another day) and he was forced to divulge his method. The machine were consequently fixed. I doubt those machines use crypto strength RNGs because who is going to spend the time, energy and money to hack a .25c slot machine? The payout is too small. For an excellent real-world example of this try 'The Eudaemonicus Pie.' Briefly, its a book about people who successfully hacked roulette machines but at a net loss because of all the time and energy spent developing their technique. > >

1 0

Re: "This post is G-Rated"
by frantz＠netcom.com 17 Dec '03

17 Dec '03

... Discussion of rating systems elided. Does anyone have suggestions for achieving the goals of the V-Chip with many non-govermental rating agencies? It seems to me that empowering parents would head off the TV/Internet censors. Any parent who was interested in acting as a censor for their children's TV/Internet would be happy to pay an extra $20 or so for the technical means to achieve that goal. The big problem is how are the labels attached to the programs. I agree with Tim that it is probably imposible for individual Usenet postings. However is should be possible for TV programs, and whole newsgroups. BTW - I think that such hardware/software is a wonderful way train hackers. Most of the teenagers I know, know more about their home electronics than their parents do. And the teenagers RTFM. Bill

4 3

Re: PGP in Eudora and other mail programs
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:54 1/25/96, Timothy C. May wrote: >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) There exist two Eudora/PGP packets. The MacPGP Kit and MacPGP Control. I'd use MacPGP Control. Just do a search for it. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: another thought about random numbers
by Frank Stuart 17 Dec '03

17 Dec '03

>While musing over a roulette table, and noticing the preponderence of >electronic games in the various Casinos in Stateline, NV, a thought >occurred: does anyone know what sorts of random number generators those >electronic games use, and how (if at all) they are measured and regulated >by the Nevada Gaming Commission? They might have something to teach us. I don't have a reference, I'm afraid, but I think I remember hearing about someone using past keno numbers to predict future ones. When they correctly guessed all the numbers twice in a row, casino officials stopped the game and were reluctant to pay (though, I think they eventually did). Assuming I didn't dream the whole thing, it seems like it wasn't in Nevada... possibly on an Indian reservation? I think it happened 6 months to a year ago. I'm sorry I can't be more specific. | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

2 1

Re: TOP_tap
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:55 PM 1/25/96 -0500, Rich Salz wrote: >Up until recently (18-30 months ago) NSA employees were only allowed >to identify themselves as employees of DoD. It was common knowledge, >that unspecific references to Fort Meade meant NSA; and if you saw >a P.O. from Procurement Office, Fort Meade, it meant the NSA was buying >it. Back in the dark ages (I think early 1980s), I attended a Symposium on Operating System Princples at Asilomar, California. My luck-of-the-draw room mate was wearing a badge which proclaimed that he was from NSA, Fort Mead, MD. A story of California hippy meets US-DOD. Bill

4 4