December 2003 - cypherpunks-legacy

Fwd: Re: Fwd: Re: FH radios [Dave Emery] [Vaughan Pratt]
by stig＠hackvan.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I forwarded a cypherpunks message to technomads, where it got a killer response, so I'll bounce it back to Cypherpunks... Stig - ------- start of forwarded message (RFC 934 encapsulation) ------- From: Vaughan Pratt <pratt(a)cs.stanford.edu> To: technomads(a)UCSD.EDU Subject: Re: Fwd: Re: FH radios [Dave Emery] Sender: pratt(a)cs.stanford.edu Date: Tue, 26 Dec 1995 12:00:43 -0800 Message-Id: <199512262000.MAA23334(a)Coraki.Stanford.EDU> In-reply-to: Your message of "Tue, 26 Dec 1995 07:07:00 PST." <m0tUayp-0006F0C(a)hackvan.com> >>> Thus in a frequency-hopping radio you can push the retuning (read RF >>> phase-locked loop) technology to its limit and build transmitters and >>> receivers around them. These typically hop in the order of 100 times a >>> second. The adversary has to find the uncorrelated signal very quickly >>> indeed *and* have PLL technology at least as good as yours to recover >>> anything from it. Finding the signal generally means listening to all >>> frequencies at once, requiring huge amounts of hardware parallelism and/or >>> realtime computing power. Once you throw ten or so radios onto the same >>> band, it's no longer any use looking for the strongest signal, making that >>> approach useless. >> >> This is nowhere near the limit of the technology. 15 years ago, I was >> working on PLLs that would stabilize within a couple degrees of final >> phase within 3.5 microseconds. That permits you to do useful work at >> 100,000 hops per second. >> > There is also a newer technology called direct digital synthesis >or DDS that works by accumulating phase (adding to the previous value) >each tick of a high frequency clock in a register at a rate determined >by the contents of another register (the value here sets the frequency) >with the upper bits of the accumulated phase being used to address a >sine/cosine lookup table rom which in turn feeds digital output values >into a D/A converter. The output of the D/A converter is a sampled >approximation of a sine or cosine wave at a frequency set by the >increment register. The sample rate is set by the high frequency clock >rate. This is all wishful thinking. A 26-MHz wide channel such as 902-928MHz has a channel capacity of 2*26 Mbs or 6.5 megabytes/sec. So if someone can tell *that* you are transmitting somewhere within that channel then they simply record *everything* at that data rate in the entire channel, your transmission and everyone else's, for the necessary time. A $600 3.5Gb Sequel drive can record a ten-minute transmission; then the eavesdropper can use one Pentium or two dozen, budget permitting, to extract your message from that data. If all you are doing is frequency hopping or spread spectrum, reconstruction is a very undemanding algorithmic task, and one Pentium should be able to reconstruct your signal the same day, two dozen the same hour. >But to get back to the original point of this thread - while >such techniques are possible (as is full hard encryption), it is my >understanding that actual conusmer 900 mhz digital cordless phones >that use frequency hopping use a very limited set of frequencies >and a small set of fixed hopping patterns and don't hop very fast. Hopping speed is almost completely irrelevant to the computational complexity of this problem. >When the brand of cordless phones that most emphasizes security >from eavesdropping in its point of sale advertising display is the one that >uses open FM with simple speech inversion you know there is something >wrong, particularly when the company that makes it is a pioneer in >really secure digital speech over handheld radios (and a big governmeent >contractor). To put it mildly. You can never overestimate the cost of decryption. What looks expensive enough today to decrypt can plummet by orders of magnitude on alarmingly short notice. We used to think TCP was mildly secure until easily installed sniffers became freely available on the internet that would reconstruct a telnet connection and print out the first 100 characters, making it child's play to extract passwords. If you think that you are secure because the effort of an attack seems on the high side, bear in mind that the tasks in a systematic attack can by definition of "systematic" be programmed, greatly easing the attacker's task. And once programmed, the program can be distributed to all and sundry on the internet. If a given level of cryptographic strength seems adequate for a message, add several orders of magnitude and maybe you'll be lucky. I know of only two really satisfactory places to hide information worth hiding: combinatorial search space (read: real encryption such as DES or RSA, with a hefty key), and the real world, which as a search space is approximately the size corresponding to a combinatorial space encrypted with a 256-bit key (i.e. the world seems bigger than 128 bits and smaller than 512). The latter is distributed in space-time and frequency (momentum-energy); if you consider only space-time or only frequency the universe looks like only a 128-bit hiding place in either case. Both together give you 256 bits (very approximately, that's a very round binary number). Vaughan Pratt - ------- end ------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMOCS5khaKuRiAqcVAQEJEAP/WNqKrjrGk5LpYt5fw70BtFYZEIMqkBzu TQscTmoK2sSOeI9yjxmOp8aQhArLpOdN0ZQgfwkuelfV+/n73ms3hMV+JIDOvuFx hirE1iBvZDMgEPX1BdyP94Me13a1f8mBKTTG1cPLIYKLSTZ1tmQ/MVI0EYN9H16U AETV7FJilvM= =l+fI -----END PGP SIGNATURE-----

4 3

FW: your financial transactions posting (fwd)
by Light Ray 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 29 Dec 1995 00:02:50 -0800 From: Bud Aaron <bud(a)checkmaster.com> To: "'privacy(a)ftc.gov'" <privacy(a)ftc.gov> Cc: "'hwg-business(a)daft.com'" <hwg-business(a)daft.com> Subject: FW: your financial transactions posting ---------- From: Greg Metcalfe[SMTP:biosphere@proaxis.com] Sent: Thursday, December 28, 1995 9:35 PM To: bud(a)checkmaster.com Subject: your financial transactions posting Bud, I've seen some well thought out messages in the commercial transactions listserver, but you are the first that I've seen with real numbers. Would you do us all a favor and make sure that you get some of this information to the privacy(a)ftc.gov discussion? I hope I'm not impertinent for asking. But numbers are probably our only hope. The gov has never really been into quantitative thinking... TIA --- Greg Metcalfe | The secret is getting E-mail biosphere(a)proaxis.com | enough sleep. URL http://www.proaxis.com/~biosphere | Usually. The following is a copy of the information mentioned above: The following article is quoted directly from Bank Technology News "Are Internet Security Fears Unfounded? Just how safe is the Internet? Pretty darn safe, according to Forrester Research, Inc., Cambridge, MA. Forrester predicts Internet fraud will occur far less frequently than current rates of fraud with cellular telephones, toll calls and credit cards (see chart). Cellular telephone fraud costs the phone industry almost $20 per $1000 in revenue, Forrester says, and toll-call fraud eats up $16 per $1000 in revenue. Meanwhile, credit-card fraud cost MasterCard almost $1.50 per $1000 in revenue in 1993. In contrast, Forrester says companies can expect to lose only $1 per $1000 of transactions on the Internet. Forrester's contentions on the safety of the Internet are backed up by some of the judges in this year's Best of the Newest bank technology survey. While many of the judges expressed concern over security issues, quite a few were also confident that the Internet will become a stalwart transaction system. See page one for further analysis of all the newest banking technologies." The chart accompanying this article shows the fraud levels in graphic form. You folks keep making drafts as a collection system seem more and more attractive. The fact that drafts MUST be deposited (not just cashed) and that the bank is going to want to know the depositor quite well means that tracking is excellent. The requirement added by the FTC that those whose accounts are being drafted must be notified by mail makes the system even safer. Let me add this - some level of security is obviously needed but regardless of the level of security, fraud will occur. All of these arguments for high levels of security remind me of the need for virus protection. Yes, virus attacks are real but virus protection vendors certainly make money by raising greater fear than may be realistic. Bud Aaron bud(a)checkmaster.com http://www.checkmaster.com/internetchecks/ The privacy list is run automatically by the Majordomo list manager. Please mail questions/problems to owner-privacy(a)ftc.gov

1 0

Revocation of Zimmermann's fossil key
by Philip Zimmermann 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To whom it may concern: I have revoked my oldest PGP key, keyID FF67F70B, user ID "Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu>" which should no longer be used. Instead, use my newer key, keyID C7A966DD, with user ID "Philip R. Zimmermann <prz(a)acm.org>" The new key has been distributed with all PGP versions since version 2.3a in 1994. My old email address at the sage site will soon disappear, so I'm revoking my old key. I keep getting mail at my old address at sage because people get that old address from my old key. I can't just revoke my old userID, so I have to revoke the whole key to get people to stop using it. Below is my revocation certificate, which I created shortly after I generated my new key in 1994. Please discontinue the use of my old key and my old email address. Note that this revocation does not imply that my old key has been compromised. -Philip Zimmermann prz(a)acm.org Here's my old public key with the revocation certificate... - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAipt8iwAAAEEALGKgLblEQCfcZEiQ+jBFnw5g0B+o16GMPssYBKI7bWgjGbB DqnkQoMGagNJpcG5tX2bKpJdegi01Sp22QOMpZbdrv/KXRWHp/JjrNLAZHp9B+nl osbRrPLhGZZA/OgyU6D2GsGnMDcTacPD43wo1g+RUpDv+UjMr+J13g7/Z/cLAAUR iQCVAgUgLIUrAOJ13g7/Z/cLAQHThQP+NtEJ2yPCXPA+Em45HDWQLwb3X0AM61K0 Mt0Woq54eaC1U5A03oVqV5wEPM6mfrhH18FB6NwO5eROKOdXY1xz7nCggJ9eYfoX ZH6wfXCqGFSB4oLJU97nFHrqvh69IYSrrlKM/dJ29F5CKVxJApstpnRmfHddrZLP yfR2y6dxGeW0LFBoaWxpcCBSLiBaaW1tZXJtYW5uIDxwcnpAc2FnZS5jZ2QudWNh ci5lZHU+ =9UCt - -----END PGP PUBLIC KEY BLOCK----- Here's my new public key, generated in May 1994... - -----BEGIN PGP PUBLIC KEY BLOCK----- mQCNAiv8ZoAAAAEEAKc4d45hN5qFM79nWGLkrGWputWmtdxJk0BZEbi0kNRbJBC2 p10ASImd//cCDwLR2alBUSt8O2WGik9PBZgthjMOenoDmzKiG8BkE9AFKonyxvD2 lDnqbydXi+YQmOTsWSw4jTTSb3cflhVkf8hVUVpMFQThafV0CmV5hLjHqWbdAAUR tCJQaGlsaXAgUi4gWmltbWVybWFubiA8cHJ6QGFjbS5vcmc+iQCVAgUQLB48XPTK AIGN5yLZAQHWtwP/RBiLPN4dnt8sm9qZtK0HPYV0hfdZ4IiSfR0V52uKKMQsIrBJ x2c5Z2vurBLeKkh8Oecf/X+Zh2mEenrymR/urBCf8xGQnyTPew4t/3IQ5KXsqi2b uOTysk9Pkk+cqxZTEXJQWixB3fVKrCkR02xbWcRXQ/pPs0ObOE4VLtQT1G2JAGAC BRAsHUvayj2h/YZap/MBAcRRAliFU3EgFQdOGkC2nCupBAitm/R6CkKtayTZHQrd e5I/pCY0bGUc6alEnSuqZUyA9HC1fMg0iqsqM4vrQ6PZr2qV0IXDY4miyYNRJyKJ AJUCBRAr/GdG4nXeDv9n9wsBAYr/BACh4r3DZsq9IOy2mcd+0D0qKV0Ymb887Lw0 KjIBKLmUIqXUw2Rbn8bAnr+GF0qGE61oAHdSSN7pLROmfjl7nMVaODXHOxYuLHAn HZ0Z/AQsLc5U055Pm6rQ5lKrSaL4z9mEKJTWM9hQDYMZpH4oAC8hIz+apYH+/hBj ZR9w7AKluw== =1jM9 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOOo+WV5hLjHqWbdAQHhaQP/SW02cLbkAtHq6cdNHtcJ4YqSlKqxumyR BYpjKrNatLiVAFQP8njiLRFqPi8rgf6809nnQETIVcyt3BzURakyJLd4UuL3vvqD lluyGdj9MoaQiQkWIbBMADFdNGFDvRCQkcxhS78hHwXSY7viCSWNnfCdJcpaFNCk QPfqPsMErMo= =uH7K -----END PGP SIGNATURE-----

1 0

Re: Employer Probing Precedents?
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:12 PM 12/28/95 -0800, Tim May wrote: >However, corporations aren't given the luxury of disassociating themselves >from the actions of their employees. (Contract workers are a further issue, >and the issue of whether they supply their own tools/computers, workspace, >etc., enters in.) I think this point about "contract workers" is going to become a lot more interesting as people move away from the traditional "employee for life" model and towards working at home/telecommunity, or working as subcontractors/consultants, etc. Further, it's becoming more common for employees to own their own communcations tools, and bring them to work. Arguments about a right to eavesdrop as being derived from workplace property ownership don't seem to work where an employee is talking on their personal cell phone, getting/sending messages on the SkyTel two-way pager that they pay for, using their laptop/Newton/PDA to get/send E-mail (using their private ISP/POPmail provider mailbox), and so forth. The concerns (about disclosure of secrets or wasting of time) raised to justify the invasions of employee privacy are still present, of course, but not the convenient "it's not your phone so you have no privacy" excuse. Employee/contractor ownership of work tools (or non-work related communication tools in the workplace) is probably going to get even more interesting; recent Ninth Circuit decisions re copyright law and licensing agreements have been sharply restricting the right of software licensees to allow third parties to use the licensed software. (e.g., _MAI v. Peak_ and _Triad Systems_, see http://darkwing.uoregon.edu/~gbroiles/triad for more on this and pointers to other analysis and the opinions themselves) I think this may lead to software licenses (or hardware ownership) which follows employees from home to work, and from job to job. Employees may get a credential from Microsoft, or Borland, or Mathematica or Word Perfect saying that they're allowed to be using a set of software tools; professionals will probably pay for those credentials themselves, or have them paid for as a fringe benefit of employment. An easy connection is to training related to the "software-right" - the licensor would also certify that the employee has been subjected to X hours of training and knows at least Y buzzwords and Z fancy tricks relating to the software. Retired or unemployed workers may work in a "black market", using software they're trained on but not licensed/certified for, logging on with the credentials of licensed users who have died recently or are sleeping. (Similar to the network of unlicensed uninsured under-the-table contractors, framers, electricians, drywall installers, etc., who exist at the fringes of construction activity.) And so on. >I maintain that my employees are beholden to me as to what they run on >their computers. They can always choose not to work for me. (And the same >applies to hotels, actually. Were a hotel to have stringent rules on >in-room behavior, such as the YMCAs and religious retreat hotels have, then >customers have little right to complain about bed checks, mixed sex bans, >etc. That most hotels have no such rules says more about where the >Schelling points are than it does about the efficacy of rules and laws. Subscribers to the Coase theorem would suggest that (modulo transaction costs) it doesn't matter who is initially assigned the right to determine whether or not surveillance will occur - the party who most values that right will bargain for it in the end. Then again, that party may lose something in exchange - and that's what makes this interesting. (And, I think, much too complex to simply be dismissed as a matter of "property rights". Then again, property looks to me like something that law creates, not something which exists pre-law which law is created to protect. YMMV.) I'd rather see the right to control surveillance assigned to employees, and let employers pay extra for it if they think it's necessary to their business situation. (Some might argue that this is the current situation, or at least that surveillance is something that market participants bargain over. My impression is that the current situation is legally murky absent a clear statement re "we're going to monitor you on the phone and search your briefcase when you enter and leave" and that a clear resolution re the legal baseline of surveillance would be useful to bargainers. And if we were to set a baseline for further bargaining, I'd rather see it set to favor employees.) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Re: FH radios
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

Dave Emery writes: > There is also a newer technology called direct digital synthesis >or DDS that works by accumulating phase (adding to the previous value) We use DDS in some of our Microwave equipment between sites. > > There is certainly little additional cost to building a >trully secure digital cordless phone given the dense ASIC technology >that is standard in this kind of product - but someone has to >persuade the manufacturers that there is a real need and find a way >to allow them to export the product. > I agree; but, if the information you are passing is truly that important just use a landline phone. Eliminate the possable "leak". I'm not claiming that a landline phone is secure, but your cordless is connected to it, so no matter how good your security is on the phone its no longer secure once it leaves the base station and enters the landline. Further encryption can be implemented but this requires equipment on both ends. Really aren't we trying to create the most secure methods of information exchange with the least amount of cost? I'm budget restricted so PGP and the internet are more secure and cheaper for me than most other means of comunication, so far. :) Dr0id (andr0id(a)midwest.net callsign: N9XLM) ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

2 1

ideath remailer permanently down / PGP key changes for Greg Broiles
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't think that the local freenet folks are ever going to get my domain name again, so I'm officially announcing the closing of the remailer formerly located "remailer(a)ideath.goldenbear.com". Mail to the goldenbear.com domain has been bou for almost three weeks now, and I expect that to continue. Sorry for any inconve I predict about a year of erratic net access and moving around while I finish la school, take the bar exam(s), and find a job or get a business started. When eve settles down I plan to find a reliable net connection and run a remailer again. Due to the loss of my domain name and UUCP connectivity, other changes are happe I'm now using a Windows box, not a Unix box, for my net access; have switched to for DOS and Private Idaho (nice job, Joel!). Am also using a new PGP key, since my old one (0x58ddf30d) was almost 3 years ol updated the MIT PGP keyserver with an "obsolete" marker for the old key, as well new key (signed by my old key). The new key is appended to this message. Am using a new long-term E-mail address, "gbroiles(a)netbox.com". Re my discussion weeks ago of alternatives for mail storage/forwarding, I have settled on netbox. can receive mail as "gbroiles(a)darkwing.uoregon.edu" but I expect that address to working sometime this coming May. The netbox.com address will ideally keep worki years to come. - -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud | -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMOPafv37pMWUJFlhAQGnhAf/XrHe38eww+sMf0/mmqKFzT9xX9USCCBO 5yMteRAmAsEiiTo8TPcRPlB6eKqCrCiJJqDMfxm3UaWhhqBilRhQoB8BqdCvjTLY 87/HsHKV3Iv4IPvud+ojk9GEXwUf204U9m/CgVF17HKO+XTCK5GVN7gmsqWWxsLr a5gNccpentcFiy0KJVUWfLguOXA20I+nGnkZjMBK/RAPotBg4gezE2jqjbYyQ1rC y0SLX843ufEfRaePC1X8IyWH32gqiyrW5rZuTo8B2usbR96Y2VXXX6Oprrd5CD38 AuUhjkOXVEsCFVP5bt6uQbM81Uhvxc1mFYHYKKJyuWPWo5E6tBwXZA== =Heo3 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAy8+sdEAAAEH/2YvMvdRxoxAIpNp1W88EGq4EMOVhpucjGjZByoJATpDoU+x sqZl6lwzWh7yhHbLfuUZhWZVhLlLGxOAcHkZ3o6Tao+T/qCLKUnyFtw3Q/Wpzfiw YIGbXkbKvSaI7U3PTMHraimiZNAW/QAhIuLanVEkl/rko/aIdvyIfOJSFHW9Bjml ArZmyrsT8PiA+Eiqa+JyRv/JnWiJJ00FYHhG1GkcAvBovQJxxLzqq9PcB8nVlVfS t4aV2z1OfmjXHq4pgUye6CwdjzXnMz3e70FT1erkoP+/iC56iSkb/4J67y8NnKgq RNQ8lt+X2+vnq3Fa8r8EhhqZFZcV/fukxZQkWWEABRG0IkdyZWcgQnJvaWxlcyA8 Z2Jyb2lsZXNAbmV0Ym94LmNvbT60KUdyZWcgQnJvaWxlcyA8Z3JlZ0BpZGVhdGgu Z29sZGVuYmVhci5jb20+iQCVAwUQLz8tYn3YhjZY3fMNAQGOkwP/cYeYdbTj9H0C BVI9nw70avUIGYUWT1HdQaK6YqdOvV4Eg56rpKdFEFlwUdOBg8MbuFaLMbbAnKxH EvGsQBtu0N1kyIebMAuEniT/22yVlVGHHS+uGxyBKq1i7Nv5uRXl2WSdQDUCHN0W 9YAzReRI1F6ExnVXJHuHo4EY7lQ3P94= =yJO8 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Proxy/Representation?
by David E. Smith 17 Dec '03

17 Dec '03

At 10:46 AM 12/28/95 -0500, perry(a)piermont.com wrote: >"David E. Smith" writes: >> The question is: how do the current software packages handle representatives >> and proxies for a given is-a-person? Using PGP as an example, I can't sign >> a message with Helen's key. >Nor should you be able to, actually. And I can't :) >The right way to do this in the digital world, IMHO, is to have a >standard for "Power of Attorney" documents, and for the entity >receiving something signed in your key that should be signed in >another person's key to also see the digitally signed power of >attorney document. Then the entity can check the signature on the >power of attorney was in Helen's key, and that the signed key in that >document was the key that signed the document signed by the "attorney". That's more of what I was looking for. I suppose that (I'm still using PGP as my example) there could be a shared PGP key, signed by Helen and myself, where only the two of us know the passphrase, with a keyid of "David Smith <dsmith(a)midwest.net> on behalf of Helen Jones <helen(a)devnull.org>" or something similar. The obvious problem is that in sharing the pass phrase the security is weakened. (Paranoid threat model: at some point we have to decide on the pass phrase, and we are videotaped/bugged/spied upon while this takes place.) dave ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745, +1(573)339-3814 PGP ID 0x92732139, homepage http://www.midwest.net/scribers/dsmith/ Dec15-Jan15: (618)244-3340/2209 Perkins, Mt Vernon IL 62864

5 4

Another Internet Provider Censors Access (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Another shoe drops? ---------- Forwarded message ---------- Date: Mon, 1 Jan 1996 19:44:30 -0600 From: x To: y Y - Coming off CompuServe's announcement last week that it was cutting off all access to "alt.binaries" newsgroups under pressure from the German government, I'm passing along another apparent development from another Internet access provider, Netcom. Under the guise of a minor software upgrade, Netcom has changed its newsgroups access list to totally exclude "alt" groups altogether. Since there is no way to sign up for a newsgroup other than via the selection menu that Netcom provides, it appears that Netcom has managed to censor access to all those discussion groups. We are witnessing the not-so-gradual erosion of freedom of the Net. I not often find myself allied with John Perry Barlow, but on this one we are four-square: what with stupid attempts of government to pass unconstitutional restrictions, and acquiescence of the private sector to intimidation and pressure, freedoms of the many are being dictated by reactionary elements in places like Memphis, Tennessee. The next opportunity, I expect, will be to help underwrite the defense of the first criminal action brought under the new law. In the meantime, we can unsubscribe to services that curtail our liberties. "X" Speaking solely for myself, this time.

7 7

Re: Australian "calculatorcard"
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- From: Vin McLellan \ Internet: (vin(a)shore.net) > it's Pretty Good >(tm) security, but like anything not biometric, it is vulnerable to >black-bag attacks. physical possession being all that is required. VM> Actually, all ACE/Server or ACE software modules _require_ a VM> user-memorized PIN. Physical possession of a stolen token is not VM> enough to gain illicit access. >if >you know the algorithm and the serial number of the card and the >time, even that isn't necessary. VM> Bleep! Earth to amp! Check your voltage, lately? The token's VM> serial number has nothing whatsoever to do with the generation of a VM> SecurID's PRN token-code. hmmmm, let me see... yup. you are right. voltage low. give me a second to plug back in... VM> and distribution. The serial number stuck to the back of a SecurID VM> after it is programmed with its secret key -- a unique PRN VM> "significantly longer" than 56 bits -- but they are not the same VM> thing. The cpu in a SecurID doesn't even "know" the serial number VM> stuck on the back of the token. VM> (It would be Pretty Stupid <TM> to glue or emboss a secret on VM> the back of the damn token, wouldn't it?) I should note that Alan is VM> just regergitating one of the most widely circulated rumors about VM> SecurIDs -- which like any popular crypto device attracts a lot of VM> wiLd & w00ly speculation. actually, i was speaking pretty much off the top of my head. it's been a while since i registered it, but all i basically had to tell the server the first time i used it was the s/n. and yes, i think it would be Pretty Damn Stupid to have the s/n have anything to do with the actual seed or pin. VM> Getting the algorithm for SDI's one-way hash is no big deal, VM> given that it sits in software in thousands of SDI customer VM> installations, protected only by contract and trade secret status. VM> (The integrity of the product -- the unpredictability of the VM> token-code PRN series, and the secrecy of a specific token's seed or VM> key -- rightly depends cryptographic strength of the hash, not the VM> secrecy of the algorithm.) Getting a token-specific secret key would VM> hopefully be a much greater challenge. one would certainly hope so. <g> personally, i like the card. it offers pretty good security and thus gives me remote access to systems my employer would otherwise laugh in my face for access to (and did, more than once before we got these things). its main weakness would be a black bag job where someone gains physical posession. at that point, all bets on its securty are off for obvious reasons. luckily, because of the nature of the device, i can simply report it as stolen and it quickly becomes a rather worthless piece of silicon. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 December 31, 1995 22:15

1 0

Re: Guerilla Internet Service Providers (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 08:27 PM 1/1/96 -0800, you wrote: >Jim Choate: >> If you live in the Austin, TX area I will setup a dedicated slip for you at >> only $100/mo. > >in the Portland Oregon area, the price ranges from $234/year to >$1750/year for unlimited ppp access. (I have no idea how long the >$234/year is going to stay in business. that won't even cover the >cost of a phone line.) It seems to me that phone line costs are turning into a floor price for Internet access, when they shouldn't really be. The main asset telephone companies have, right now, is in RIGHTS OF WAY. Put an ISP in a business park that allows you to run your own dedicated copper pairs, and you've bypassed $25/month/line business phone line charges. At some point, individual urban and suburban blocks could easily be "guerilla re-wired" for ISP access without serious trenching, etc. The phoneco would still be involved, but in a far lower-profit mode, as the supplier of a single T1 to a multi-block area.

3 2