December 2003 - cypherpunks-legacy

Re: Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com
by Rich Graves 17 Dec '03

17 Dec '03

This seems to have been confirmed in private email. So, what's the real target? ---------- Forwarded message ---------- Date: Fri, 12 Jan 1996 13:15:37 -0800 (PST) From: Rich Graves <llurch(a)Networking.Stanford.EDU> To: Eric Murray <ericm(a)lne.com> Subject: Re: Novel use of Usenet and remailers to mailbomb from luzskru(a)cpcnet.com On Fri, 12 Jan 1996, Eric Murray wrote: > > Unless someone comes forward to say that they were the target of this > > attack, I'd guess that the target is the remailer network itself. > > The target, Homer Wilson Smith, is one of the people embroiled in > the Scientology wars. I don't want to get into the recent history > of repression and abuse by Scientology agents & sympathizers, but > my guess is that this is an attempt to harass someone that > Scientology doesn't like. Yes, I've heard of him. But doesn't the given address just forward to a remailer? Have you seen anything to indicate that the flood really goes to him? Actually, last time I saw, he was no longer really embroiled. He was backing off to become a neutral ISP. He still runs lazarus, of course. -rich

1 0

Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself ABostick allegedly wrote: > > Somebody, too clever for their own good by half, has come up with a > novel way of using Usenet and anonymous remailers to perpetrate > mailbombs. The M.O. is to post a message to the naked-lady newsgroups > saying "get pics in your mailbox! send this message to this address!), > giving the email address of a cypherpunk-style anonymous remailer and > including a pgp-encrypted message block. <snip> > Cypherpunks: is there any way to respond to, or prevent, this sort of > attack short of actually shutting down the remailer? > > What comes to my mind is the remailer operator grepping for a character > string of ASCII-armored cyphertext from the known attack message and > throwing messages containing it into the bit-bucket. It is highly > unlikely that this would appear in any message except the attack > message. The problem with this is that it works only for a known attack > message -- it can shut down an ongoing attack, but it can't prevent new > ones. You could have remailers clamp down on multiple copies of the same message, but that is easily countered by convincing the UseNet stupes to insert their e-mail address or something. In general there is no way to prevent this kind of mail-bombing without compromising anonymity. By the way Alan--your message failed PGP verification. I received it by way of Bob Hettinga's "e$pam" list. While Hettinga gets double-plus good points for content, his technical performance as a list operator is lacking. Which is to say: the message might have gotten munged by the "e$pam" list processor. Regards, Bryce PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMPb5w/WZSllhfG25AQGtPwQAgoxim084bbBkXIQyhePSY63HttrqFZg9 JGJjbKBMc6fHgI+gylEEAhl75wVUgq5jKPJcHVfY23XVS4wfPRu+CIx8uHhVm9xB limA3BUscRutWsSXXe+tkKtyA97xUjpAMHpaE729pGeRForHEdpkRFb5jC3DjofX lNpRuRQ9+VE= =CyXg -----END PGP SIGNATURE-----

1 0

PGP filter?
by Brad Dolan 17 Dec '03

17 Dec '03

InfoWorld, 1/8/96 Network Security: Software scans E-mail gateways for virus threats -- by Jessica Davis The increasing number of links between LANs and the internet has raised security concerns on private networks. To address this issue, Central House Technologies Inc. has acquired the North American rights to MimeSweeper Internet mail virus-protection sofware from Integralis Ltd., in Berkshire, England. [...] The Windows NT server application works by unbundling and unzipping messages at the gateway and returning the attached documents to their original file format. Then MimeSweeper uses a virus-checking utility installed by the customer to examine the attachments. Upon receipt of a suspect attachment, MimeSweeper notifies the postmaster and quarantines the message until the administrator can take action. [...] Integralis also plans to add the capability to scan outgoing documents for confidential information and add corporate disclaimers to outgoing mail. Integralis is also working on support for public key encryption to allow encrypted messages to enter private networks without delays from quarantines. [...]

1 0

CDT Policy Post No.34 - Victory for Zimmermann, Fundamental Privacy Issues Remain
by editor＠cdt.org 17 Dec '03

17 Dec '03

Apologies to those of you who are also on the CDT Policy Post distribution list, but I felt that this issue was sufficiently important to cc to the cypherpunks list. Hope you find this relevant, Jonah Seiger CDT editor ------------------------------------------------------------------------ ****** ******** ************** ******** ********* ************** ** ** ** *** POLICY POST ** ** ** *** ** ** ** *** January 12, 1996 ** ** ** *** Number 34 ******** ********* *** ****** ******** *** ------------------------------------------------------------------------ A briefing on public policy issues affecting civil liberties online ------------------------------------------------------------------------ CDT POLICY POST Number 34 January 12, 1996 CONTENTS: (1) A Victory for Phil Zimmermann, Fundamental Privacy Issues Remain (2) Press Release Announcing DOJ's Decision to Drop Case (3) Subscription Information (4) About CDT, Contacting Us This document may be re-distributed freely provided it remains in its entirety. Excerpts may be re-posted by permission (editor(a)cdt.org) ------------------------------------------------------------------------ (1) VICTORY FOR ZIMMERMANN, FUNDAMENTAL PRIVACY ISSUES REMAIN After 3 years of investigation, the United States Department of Justice Thursday (1/11) announced that it would not seek an indictment of Phil Zimmermann, the author of the widely popular encryption program known as Pretty Good Privacy (PGP). While this development is obviously good news for Zimmermann, who was the undeserved target of a long and arduous investigation, criminal threates against those who seek to protect their privacy remain in place. The Justice Department had been investigating Zimmermann for possible violations of Arms Control Regulations of after PGP was posted to Usenet newsgroups and subsequently distributed through the worldwide Internet in the spring of 1991. CDT wishes to extend heartfelt congratulations to Phil, who has demonstrated remarkable patience and perseverance in the face of harassment and intimidation by the Federal Government. Instead of laying low and waiting for the outcome of the investigation, Phil took the offensive and became the leading figure in the effort to provide easy to use, strong cryptographic applications to the masses. CDT hopes that Phil will remain active in the fight to encourage the relaxation of export restrictions and access to strong cryptography. FUNDAMENTAL ISSUES REMAIN -- EXPORT OF STRONG CRYPTOGRAPHY STILL PROHIBITED, FUTURE PROSECUTIONS OF CRYPTOGRAPHERS BY THE FEDERAL GOVERNMENT STILL POSSIBLE Although the announcement by the Justice Department is a tremendous personal victory for Phil Zimmermann, government restrictions on encryption exports remain firmly in place. As such, the current Administration policy is a major roadblock to privacy and security, as well as the future of commerce, on the Internet. The Clinton Administration continues to push for a national cryptography policy based on key-escrow and limited key lengths. In addition, the Administration's current policy proposal seeks to use export controls as a means to influence the domestic marketplace for cryptographic applications. The decision to drop the case against Zimmermann also leaves unresolved the question of whether posting materials on the Internet could result in the violation of export control regulations. Although Zimmermann's defense was based in part on the argument that the First Amendment protects such postings, that question remains undressed. As a result, developers of strong cryptographic applications who make their programs available on the Internet may in the future face harassment and indictments from the Federal Government. This issue is currently pending before Federal Judges in the Karn and Bernstein cases. BACKGROUND ON THE DISPUTE The export of cryptographic applications with key lengths above 40 bits is currently illegal under the International Trafficking in Arms Regulations (ITAR). The Government maintains that these restrictions are necessary in order to protect national security, and has successfully fought efforts to repeal or relax the export controls (including efforts by fmr. Rep. Maria Cantwell (D-WA) in 1994). Privacy advocates and the computer hardware and software industry argue that the export controls stifle the development of strong cryptography both domestically and internationally, undermining privacy and security on the global information infrastructure. When Zimmermann published PGP in 1990, it was among the first widely available and relatively easy to use cryptographic applications, and for the first time provided the average citizen with the ability to protect sensitive information on the relatively insecure Internet. In the eyes of the Government however, PGP represented a threat to national security and law enforcement. Although the government has announced that it will not prosecute Zimmerman, government efforts to restrict the distribution of strong cryptography will no dobut continue. As privacy advocates, we must not allow Zimmermann's victory to conceal the larger issues. Privacy, security, and commerce on the Internet remain hostage to export restrictions, the National Security Agency, and Clinton Administration efforts to impose an unworkable key-escrow regime. For more information on the Administration's current cryptography policy initiative and what CDT is doing to fight it, visit CDT's cryptography issues web page. URL:http://www.cdt.org/crypto.html For More Information Contact: Daniel J Weitzner, Deputy Director <djw(a)cdt.org> Center For Democracy and Technology +1.202.637.9800 ----------------------------------------------------------------------- (2) DOJ PRESS RELEASE ANNOUNCING THE DECISION TO DROP THE ZIMMERMANN CASE United States Attorney Northern District of California ______________________________________________________________________ San Jose Office (408) 535-5061 280 South First Street, Suite 371 San Jose, California 95113 FAX: (408) 535-5066 PRESS RELEASE FOR IMMEDIATE RELEASE January 11, 1995 Michael J. Yamaguchi, United States Attorney for the Northern District of California, announced today that his office has declined prosecution of any individuals in connection with the posting to USENET in June 1991 of the encryption program known as "Pretty Good Privacy." The investigation has been closed. No further comment will be made by the U.S. Attorney's office on the reasons for declination. Assistant U.S. Attorney William P. Keane of the U.S. Attorney's Office in San Jose at (408) 535-5053 oversaw the government's investigation of the case. ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION CDT Policy Posts, which is what you have just finished reading, are the regular news publication of the Center For Democracy and Technology. CDT Policy Posts are designed to keep you informed on developments in public policy issues affecting civil liberties online. In order to subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance constitutional civil liberties and democratic values in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1001 G Street NW * Suite 500 East * Washington, DC 20001 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post No. 34 1/12/96 -----------------------------------------------------------------------

1 0

(fwd) e$: Starting an Avalanche
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: e$(a)thumper.vmeng.com Mime-Version: 1.0 From: rah(a)shipwright.com (Robert Hettinga) Date: Fri, 12 Jan 1996 13:02:27 -0500 Precedence: Bulk To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: Starting an Avalanche -----BEGIN PGP SIGNED MESSAGE----- e$: Starting an Avalanche 1/12/96 Boston, Massachusetts The most interesting thing I've read in quite a while is a reprint of the March 31,1995 issue of Esther Dyson's Release 1.0, which, I understand, was the first time someone other than Esther herself edited an issue. The editor was none other than Eric Hughes, of cypherpunks fame, and the topic was, of course, e$. Well, he didn't up and say "e$" anywhere, exactly, the title of the whole issue was "A Long-Term Perspective on Electronic Commerce", but he was talking about e$ just the same. Eric told me about this magnum opus when he came to help me talk about e$ at Apple in December. It was the first time I had heard of it, and when I talk to people who are interested in these things, it's the first they've heard of it, too. Blink once, and you miss the good stuff, I guess.. I won't go too much into what he said there, as I'm still digesting it, and it's frightfully copyrighted, but I'm sure you can get reprints from EDventure Holdings, Esther's company, by sending e-mail to their circulation and fulfillment manager, Robyn Sturm, robyn(a)edventure.com . You can definitely tell Eric wrote it, though. When Eric's really cooking, it's like he invents this whole language to describe what he's talking about. In this case, that's a good thing, because most of what he talks about he has to invent as he goes along. Anyway, it's 28 single-spaced elite-pitched pages of pure Eric, and it's manditory reading for anyone who wants to sit in on an advanced e$ colloquium from the comfort of their own living room... I'm taking, as my text for today's sermon (say "amen!", somebody), the following, from Eric's Release 1.0 issue, page 19: "Multiparty compatibility. "A software product launch is a two-party negotiation. Software vendors write products for a given operating system and persuade consumers to buy it. This is a standard retail transaction. Prospective sellers of a money system, however, have a four-party negotiation: the money system vendor, consumers, merchants and financial intermediaries. That is, there is one seller and three buyers, each of which has different system requirements. "Consumers have microcomputers or PDAs or smart cards. Merchants vary widely by size; each will hve different requirements for operations size. Banks and other intermediaries require extremely reliable transaction processing systems. No single vendor will be able to meet all these requirements. Anybody who expects to provide the entire technology infrastructure for a new money system will fail outrightly and completely. Success will require partnerships at the very least. Open standards will be even more likely to succeed. "This criterion against isolation cuts out several would-be contenders from my book right away: Netbank, Digicash and the academic projects NetBill and NetCheque. This is not to say that these companies won't have businesses, but rather that their ventures will always remain small." Now, this was written in, say, February of last year. A year ago. What amazed me was that it was exactly what I was talking to someone about last week. I love this stuff... Now I'm not bashing any of the above payment schemes, here, but there is a lot of the old industrohierarchical (see, Eric, I do neologism too!) mindset in what a lot of e$ protocol developers are doing out there. With that in mind, I'm going to step into *my* version of e$-Life, - -the-Universe and -Everything, and I'm going to do it with a model for distributing digital bearer certificates of various kinds, starting with digital cash, but easily extensible to any kind of digital bearer certificate. Definitions As Eric said, there are at least 4 players in any money system. I hope I may be excused if I tweak this a bit... Consumer The first player is the consumer. This is the person who purchases a digital bearer certificate for some reason. In the case of a digital cash certificate, this person is buying a piece of digital cash from someone else, for some other kind of money, in order to effect a transaction on the net later. Merchant It gets more complicated a little later, but, for the time being, this is a person who accepts a digital bearer certificate in exchange for something else. Usually this person is a commercial entity, and thus needs to be able to test the certificate, on-line with the underwriter, before accepting it, in order to prevent double-spending and reduce the risk of the transaction. Underwriter This is the entity which issues the certificates, and is responsible for exchanging them into other forms of money or certificates of other kinds. The second most important thing an underwriter does is to verify that certificates haven't been double-spent. The most important thing an underwriter does is to market its certificates. Trustee A trustee holds the money for the underwriter while it's on the net. Like bond trustees, the trustee works for "shareholders", the holders of the digital certificates, according to an agreement between the underwriter and the certificate holders. Typically, the trustee is a bank, since certificates are usually settled for money. Software Developer Off of the net, there are consumers, underwriters and trustees of physical certificates. We haven't really introduced any really net-specific features. Here's where we do. Since digital certificates are digital objects, they're created and handled by software and moved around on networks. The second most important thing that developers of digital bearer certificate software do is to write software which issues, verifies, and handles digital bearer certificates. The most important thing that developers of digital bearer certificate software do is to market their software to consumers, to trustees, and to underwriters. A software developer can develop all kinds of different software and market that code to any market that's out there: vertical, functional, or any niche that makes money. A developer can make wallets, which can do peer-to-peer or client-server transactions, or cash registers, which do on-line transactions involving the underwriter to validate certificates against double spending, or mints, which produce and validate the digital certificates themselves. A developer can even subdivide those major software objects into smaller peices, if there's a market for it. Protocol Inventor Protocol inventors are the people who had the idea to begin with. They figured out how to generate, handle, verify, and transmit this particular type of digital bearer certificate, and typically have patents on the process. The second most important thing a protocol inventor does is design cryptographic protocols, licence them, and validate their implementation. The most important thing a protocol inventor does is market their protocols to software developers, to underwriters, and, in the early stages, to trustees. A prima facie retread Yes, it's time for Hettinga to trot out his now-threadbare (I'll say "time-tested") business model for digital cash, and show how this all works. Of course, you can use digital bearer certificates for all kinds of things besides cash, and I contend in my more unrestrained moments, that *any* security can be issued as a digital bearer certificate, but's let's stick with digital cash here, for the time being. The protocol inventor is a cryptographer who has a brainwave one day and invents a digital bearer certificate protocol. He announces it, patents it if possible, lots of other cryptographers vet it, and it works. Potential underwriters, software developers, and even trustees blow apart his e-mail server asking him when he's going to let them build code, businesses, or whatever it is they want him to let them build. The inventor convenes a group of interested developers, and they start working out how to implement the protocol into code. The inventor makes deals with all of them. When they've finished their code, he'll certify that their code adheres to the protocol, and they'll pay him a licence, or a certification fee, or whatever. The inventor also starts to chum the water for underwriters, even though the developers are the people who're going to be actually closing deals with them, and trustees, even though the underwriters are going to be actually closing deals with *them*. So, the day comes, and people are actually buying these certificates. The consumer buys, from one of many software developers, or is given, by one of many underwriters, a wallet, which allows the storage and disbursement of digital bearer certificates, either on-line or off-line. I personally believe that there will be off-line transactions between people who trust each other enough, caveat vendor ;-). The consumer goes to a web page. Think of this web page as the equivalent of an automatic teller machine. As such, it has at least link-, and hopefully internet-level encryption to the user's machine. Not only that, but the consumer's account information is probably encrypted so that not even the underwriter sees it, in the same way that the Cybercash protocol works now. If the consumer's machine has a card swiper, then he swipes a card and enters a pin number. He could also store this information encrypted on his hard drive, and just type a passphrase to release it. He could also have all this on a smart card. Software and hardware vendors will build what consumers, underwriters, and trustees want to use. The request and authorization for cash goes over the net, through the underwriter and the ATM network to the consumer's bank, who sends an authorization message back to the underwriter to disburse digital cash certificates in the amount of the consumer's request. At least that's the way it would work for the time being. It's easy to see that, if the consumer's bank was on the net, the transmission authorizing disbursement to the underwriter could just go over the net itself. The bank and the underwriter settle with a fed funds wire. For the time being, anyway. ;-). The underwriter then issues the certificates to the consumer in the desired denominations, in addition to whatever fee the underwriter charges, in the same way traveller's checks are sold at a premium at the time of sale. The money from the consumer's bank goes to the underwriter's account at his trustee bank, collecting interest, payable to the underwriter, until the money comes back off of the net someday, payable to the redeemer at par (the value of the denomination of the certificate). The consumer then buys something on-line from a merchant, or off-line from another consumer (or a merchant who can't afford the security of an on-line transaction, and believes the risks are worth it), who then either spends the cash certificate somewhere else or redeems the certificate through the underwriter, who in turn has his trustee wire the money to the merchant's bank. Wearing too many hats When you break the world up the way I have above, you see the world of digital certificates in very interesting terms. First of all, you can see what Eric was talking about. Lots of people in the digital cash business are trying to wear too many hats. Underwriters who are also trustees, protocol inventors developing software, merchants who are software developers. Remember my contention elsewhere that the worst thing you can do in a geodesic market is to create industrial scale-economy hierarchies. The more independent entities you have, doing different things in as market-driven a fashion, the better. The instantaneity of communication and the multiplicity of information processors continually lowers the cost to entry and makes markets very competitive, forcing lots of innovation and product evolution. Concentrations of information, or any other resource, get "surfacted" into the lowest possible reaches of the network as processor prices fall. In InfoWorld a couple of months ago, I compared Microsoft to a dog in the manger in this regard, and you can see what they're trying to do now that they figured out that their monopolistic desktop strategy won't hunt on the internet. Now What? So. You've developed the be-all, end-all digital bearer certificate protocol. What do you do? The most important thing you can do is to develop, validate, and above all, promote your protocol. Anything else is not only inefficient, but, in the worst scenario, it can be considered a threat to one or more of the other players in the system, and no one will adopt it. Your protocol is stillborn. The thing you want to do is to create as many software developers, as many underwriters, and as many trustees as possible. Why? The more underwriters you have, the more people are using your protocol. Remember, the underwriters are charged with actually marketing the certificates themselves. Also, the more underwriters there are, the more robust your certificate system is, because there is no single point of failure -- economic, operational, or otherwise -- in the system. The more trustees you have, the more faith everyone has in the system. The social and legal parts of your protocol are enforced by the trustees. They're there to hold the stakes and keep everyone honest. To prevent repudiation of the certificates by the underwriters themselves by making them hold a respectable reserve against the certificates outstanding, for instance. In addition, the trustees could be used to settle certificates from one underwriter against those of others. That's already built into the banking system, with various central bank wires and clearing associations. In the model above, the trustee is the link to the non-net economy. It is the ultimate settlement mechanism because, for the time being, digital cash has to be denominated in other currencies. Certainly, like any method of abstracting value, digital cash cannot exist if it is not immediately convertable into other things of value, so there will always be those who are responsible for guaranteeing those conversions. In my model, and in non-net securities markets, those people are the trustees. The more developers you have, the more competition there is to build software which creates, handles, and verifies the certificates as efficiently and reliably as possible. Like underwriters, software developers are responsible for marketing *their* products -- the wallets, the cash registers, the mints, that your protocol requires in order to function -- to the various participants in the digital certificate market. That means that you have to be as open with your protocol as possible. You have to create a set of reference documents which everyone can read and understand. You have to promote the hell out of the protocol by hosting conferences of current and potential underwriters. Then, when you have lots of developers, underwriters, trustees, and, by extension, users, of your certificate protocol, you have to keep the protocol honest by cryptographically validating the various software parts so that the market's participants can trust that the protocol is being adhered to. That means *not* writing software, paradoxically. The reason you have this great protocol is because you're a great cryptographer: not a great underwriter/marketer, not a great developer, not a great trustee/banker. The entire market can't function without you, and, in a geodesic market, you can add significant value and get paid for that value without owning all the other components of the system to get it. The great unwashed avalanche There's great benefit to having this great unwashed horde of people helping you put all this together. Most of that benefit comes from creating a large chaotic emergent system, a market. People can specialize in some small piece of the system and optimize it without you having to tell them what to do, for instance. In addition, very small investments yield rewards way out of proportion to the money invested. My favorite example for this is the prize that was offered for flying non-stop from New York to Paris. Many times the prize money was spent in achieving the feat by all the contenders, and some single teams probably spent more than the prize money all by themselves. The rewards to the person who finally completed the trip greatly exceeded the prize money he won. Finally, the rewards to aviation the aviation as a whole were much greater than all the money spent by all the teams trying to be first. That's the great thing about creating an emergent process like a digital certificate market. It's like kicking some snow down on top of an avalanche zone. You release all that stored energy, ambition, and talent. All at once. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPagTfgyLN8bw6ZVAQHmqQP/RaD/2XPxO2Gx2otHjAPI8+H+xkT85JSX BqVyYEYo/8ilbf/bmZC9YDIhmi0vDpEODkj+7LJ0zsm8AX0LAOLj8N23f3R5LXX0 2QNvPczNN8v+9T1M2r4bhgtRUfy7OPFkOpvfbrJkkWT4XNL8PwojAA3UMVQ8UgYJ A0nLC/z+78s= =5TRr -----END PGP SIGNATURE----- -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here. Be a charter sponsor for e$pam, e$, and Ne$ws! See http://thumper.vmeng.com/pub/rah/ or e-mail rah(a)shipwright.com for details... ------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: bad PGP signatures
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself Bob Hettinga is alleged to have written: > > How 'bout this one, Bryce? > > ;-) Yep. That one (mine, for those watching at home) verifies. My first guess is that it is because my messages are formatted for 64 columns and all the other messages that are failing to verify (like: To: mix-l(a)vishnu.alias.net, remailer-operators(a)c2.org, \ cypherpunks(a)toad.com Subject: New Mailing List (encrypted) Date: Sat, 13 Jan 1996 13:42:49 -0600 From: John Perry <perry(a)vishnu.alias.net> which just came through) are formatted for 80 or 79 or 78. Perhaps thumper is chewing on lines longer than 78 or 76 or something. Just a guess. Bryce PGP sig (New! With cleartext timestamp!) follows Sat Jan 13 15:26:48 MST 1996 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMPgxzfWZSllhfG25AQFu8QQAj/kc4jgYaKV4QAtvQDiZFIVSBPcgY1qR 4yJWNhlAioQ1I9g0WYiZjxUfa0hl+B77slSM362uaZxvotU1E440bpiZGMcaItBb ebUDW0UxyhLnUEgcMqo5S8B9mY8eVKiV8j/VASt4bu7RexTyCuRU7VM8FDxj8Vpv If1nqAsWTNg= =Hilf -----END PGP SIGNATURE-----

1 0

c4 cellphones
by Brad Dolan 17 Dec '03

17 Dec '03

Israeli news sources report: PLO security authorities have prohibited the use of cellular telephones in public buildings. In addition, no person is permitted within 200 meters of Arafat's office with a cellular phone. Paranoia abounds. How safe is *your* cellphone?

1 0

AP Article on Zimmerman Case
by Weld Pond 17 Dec '03

17 Dec '03

http://www.boston.com/globe/ap/cgi-bin/retrieve?%2Fglobe%2Fapwir%2F011%2Fna… Excerpt for the web impaired: ``Zimmermann never exported Pretty Good Privacy, so the U.S. Attorney seemed to be missing the point. Unfortunately there still is no clear ruling from our government as to whether or not making software available on the Internet counts as exporting it,'' said Simson Garfinkel, who wrote a book about the program. Zimmermann's supporters argued that without encryption, government could do widespread eavesdropping, perhaps for political reasons, scanning for words and phrases it considers subversive. They acknowledge that a few criminals may use programs like PGP to hide out in cyberspace, but believe that concern is outweighed by free speech and privacy rights. ``The case was part of the government effort to crack down on good technologies for privacy. We hope the government's decision signals a rethinking of federal policy in this very important area,'' said Marc Rotenberg of the Electronic Privacy Information Center in Washington, an on-line civil rights watchdog group. Others see the 2-year investigation of Zimmermann as intimidation. ``It seems to me is that all the U.S. Attorney is saying is that they don't want the public relations nightmare of prosecuting Philip Zimmermann, but they still want everyone scared so that they won't exercise their Constitutional rights,'' Garfinkel said. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Re: PRZ "battle lost"
by Gordon Campbell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:00 PM 1/12/96 -0800, "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: > >is there an alternative? yes, but it involves fewer lawyers than are >in the US today. > >however I don't see lawyers as the problem, but a symptom of something >deeper: the tendency of people to resort to legal action to settle >even trivial disputes. Very true. Up here (Canada), we have _much_ less of the "use the courts as a weapon of harrassment" phenomenon. But, I don't believe we have a (much) lower percentage of lawyers than you do. It's part of the mindset. Somehow, over the course of several generations, you folks have become an entirely too litigious lot for your own good. The result is was PRZ just came through and the multitude of cases that the Church of Sceintology is involved in. How to fix it? Beats me. However, I think it will probably have to start with the judiciary. Justices from all levels of your court system will have to put their collective feet down and stop allowing this kind of nonsense. I don't know enough about the inner workings of the legal systems to know if this would be all that's needed. Perhaps some new legislation would also be required. Whatever happens, it can only be for the better. In the meantime, could you get your damn lawyers off my tv? ;-) We don't let our lawyers do that. They've only been able to advertise at all in the last 10 years or so. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Help! Help! The paranoids are after me! iQEVAwUBMPcDkXNDC2/K0TjxAQHLaAf/Q4d3CUrcANLozJGR/uv5JsVyq8c+uhxy cKvsA/oxHPVTUynvUkqG8av0zhXl0t9hdOoi5RC7Q6jmNrYGvj3cSEXY/VN2EDR8 +4wVPxHQ7Mt3G4ffeR6Qe3hPU3Q/fHXGL7rLoJOD3IDI3LgC+K57Com5KJfXQVGe 7lpbnKSoCiny3pEbanCMMhrp8sZVM00B6oH2Hh6hIMaVEFpBao/ncyGUBiZLkmSr PLqlU7bTk81BicrMka0ep28KQwOF8lyGYCN1dxq64UCuBe02VATIZ/GnStQFa/YZ dwTpZtqM7SgDibkEnRwuKeonXd06oyWba0/f1QQm/Y1Cjglw8YAwXA== =VB/L -----END PGP SIGNATURE----- ----- Gordon R. Campbell, Owner - Mowat Woods Graphics P.O. Box 1902, Kingston, Ontario, Canada K7L 5J7 Ph: (613) 542-4087 Fax: (613) 542-1139 2048-bit PGP key available on request.

1 0

Microsoft's papers on NT C2 thang
by Rich Graves 17 Dec '03

17 Dec '03

[Oops, signature is only valid if the > 80 column line is preserved] -----BEGIN PGP SIGNED MESSAGE----- I'd appreciate it if someone could critique these papers for me, probably off the list. [Note that 198.105.232.5 is just one of the IP addresses being load-balanced by www.microsoft.com. The servers seem to crash a lot with the current Gibraltar beta, so if one IP address doesn't work (like .5 isn't responding to pings right now), try another and it will work.] - -rich - ---------- Forwarded message ---------- Date: 12 Jan 1996 11:22:38 -0600 From: Richard P. Bainter <pug(a)arlut.utexas.edu> Newgroups: comp.security.misc, alt.security, comp.os.ms-windows.networking.misc, comp.os.ms-windows.networking.windows, comp.os.ms-windows.nt.admin.networking Subject: Re: Microsoft continues to mislead public about Windows security bugs (a bit long, with references) In article <t6d9w0JfFigb089yn(a)oslonett.no>, Rune Moberg <mobergru(a)oslonett.no> wrote: >>This is true. In fact NT was never C2-certified as any kind of network >>server at all, but only as a standalone workstation. >I read a statement made by MS, that it doesn't matter, because if NT is >proved to be C2 secure in a standalone configuration, then it's secure >on the network as well. You believe everything MS tells you?! How naive. >C2 security, AFAIK, also requires that the server is protected (controlled >access). Once you have physical access to a machine, you could open it, >put in a floppy or hard drive, and access anything you'd like to on the >machine in question (with a disk editor, or with a fresh installation of >the OS in question). Atleast that's the only way I can think of to break in >on a NT Server. Otay, let me see. The server is protected if you aren't hooked up to a network. That implies *nothing* about the fact when a network is plugged into it. If I'm sitting at the console and have to enter a password to do things, doesn't mean I have to enter one from the network when I mount the entire disk. (Even if that is not the true case.) There are orange, red and blue books. This is all well pointed out on: http://www.windows.microsoft.com/TechNet/boes/bo/winntas/technote/security.… What has Microsoft actually passed? I had heard it was only Orange book C2 and not Red book C2. Micrsoft also points it out on: http://198.105.232.5/NTServer/c2bltn.htm Ciao, - -- Richard Bainter Mundanely | OS Specialist - OMG/CSD Pug Generally | Applied Research Labs - U.Texas pug(a)arlut.utexas.edu | pug(a)eden.com | {any user}(a)pug.net Note: The views may not reflect my employers, or even my own for that matter. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPcRpI3DXUbM57SdAQFbWgP9HrpdsuC/p3iURubYobgXRXlvlmrRgJot 5kDBCOrDHRtyjXQj7n0CLU6TsEpTLR2ZfTGNUrKoc2lE1q0+PSzF4WpOyywNKULw StB8d+0n0NPuN2Bcbb7mO0M0VbE9khL5CYrcfWB5FR6JPfXU18cfSTXCROgGu4U9 ASvbxOkVLeM= =L7so -----END PGP SIGNATURE-----

1 0