December 2003 - cypherpunks-legacy

SSN collection prank
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I haven't seen this here. somewhat amusing. ------- Forwarded Message Date: Sun, 7 Jan 1996 19:49:14 -0500 (EST) From: Brad Dolan <bdolan(a)use.usit.net> To: snet-l(a)world.std.com Subject: (fwd) Private SSN Collection Project <cool!> (fwd) - - ---------- Forwarded message ---------- - - ---------- Forwarded message ---------- Date: Sun, 31 Dec 1995 00:01:48 -0800 From: Clint Danbury <danbury(a)shell.wco.com> Thank you for your response. Please send Full names and Social Security Numbers of anyone you know, including government officers and/or employees, to: Clint Danbury, Box 750037, Petaluma, CA 94975-0037 email: danbury(a)ssnShirt.com Questions And Answers On The Nationwide SSN Collection Project. - - -1- Why are you collecting SSNs ? Answer: For fun and amusement. - - -2- What do you plan to do with them ? Answer: Put them on sweatshirts and sell them through specialty clothing retailers. It has been suggested also that I post them on large billboards along the Mexican border, but I don't have enough capital to pull of such a stunt at this time. - - -3- How long do you intend to continue this ? Answer: Until it becomes illegal. The moment any legitimate government authority informs me of the specific laws which (A) Forbid the collection, recording, and distribution of SSNs by private parties, and (B) Provide legal recourse for the individual citizen against private parties which do so, I will stop. - - -4- What if the government finds out what you're doing ? Answer: First off, the government knows very well what I'm doing. I've been "reported" multiple times to the SSA and the Secret Service. Secondly, the government can find me quite easily (I'm in the phone book). Third, I will cooperate completely with any legitimate government authority. - - -5- Here's my ex-spouse's SSN; will you make him/her miserable for me ? Answer: Hell No ! If you want me to engage in illegal activity for you, then go somewhere else ! - - -6- Isn't what you are doing illegal ? Answer: Not according to the SSA. They have declared the private use of the SSN unrestricted. (More on this in a few questions) - - -7- If My name/SSN were in your database, would you tell me ? Answer: In order for me to confirm this, you must first tell me what your full name and SSN is, then I will tell you if you were already in there. If this sounds like two-faced hypocrisy, great! I got the idea from CBI-Equifax; that's their very own policy. If you don't tell them what your SSN is, they won't tell you what they've got on you. Therefore, I have decided to do the exact same thing. (If you don't believe it, then why don't you call them and ask for yourself?) - - -8- What if someone did the same thing to you ? How would YOU feel ? Answer: This already has happened to me. I told the SSA office about it, repeatedly, and they would take no action. (The story appears in the next answer.) - - -9- How did this all start ? Answer: In 1985, a co-worker learned that I object to the "Uni-Number" concept of identifying a single person across multiple databases. I was (and still am) specifically concerned about the use of the SSN for Non-Tax identification. The company placed our SSNs on our name tags, which, thankfully, we did not have to wear constantly, although we would occasionally have to display it for a guard during certain times. This co-worker went poking through my briefcase while I was out of my office, copied down my SSN, and then, for his own fun and amusement (I'm guessing at his motives, I don't know his true reasons) displayed it for me, and would not tell me where he got it. Seeing that this angered me, he then went to other co-workers, who joined him in making my SSN even more public. They then went to the personnel files, (which the company made no attempt to keep locked) and double-checked the number with my job application. After that, they memorized it, and, (again, I'm guessing here) for their own amusement, they would recite it in unison around the lunch table. (I know this sounds impossible, but it really did happen.) After that job ended (not very happily, surprise) I let myself cool off for a few months, and then moved to another city. During my time in that other city, I contacted the SSA office there, seeking another SSN. I made dozens of phone calls and wrote letter after letter, all to no avail. My letters got shorter and to-the-point, not long drawn out things. It took only 30 seconds to read them. This continued for several months. The result was always the same: words without action, and no replacement SSN. The company in that city went down the tube, and I had to move again. I wrote and called off-and-on over the next few years, and got the same treatment; empty words, stall-him-off, and they would make no statement one way or the other. In September of 1993 (perhaps an earlier date, I'm not sure) the SSA finally came out and gave their official written approval for unrestricted use of the SSN by private individuals and private organizations for any purpose, including fun and amusement. The pamphlet is entitled "Your Social Security Number", is SSA Publication 05-10002, and dated September/1993. You can get a copy by calling them at 1-800-772-1213. On page 9 of that pamphlet, they have finally removed all restrictions on the private use of the SSN and they've put it in writing... "Because there is no law concerning the use of a person's Social Security number by a private individual or organization, Social Security has no control over such use." So, if those are the rules they've made, fine. Those are the rules by which I'll act. The collection and distribution of other people's SSNs is (as you've just read) a legally unrestricted activity and that's exactly what I'm doing. - - -10- Where do you get the SSNs ? Answer: "...there is no law..." so, just like CBI, TRW, TU, et.al., I don't have to tell you where I got yours. Ask CBI where they got your SSN; they won't tell you, and neither will I. - - -11- How do you check for accuracy ? This question bothered me a lot at first, however, it has become astoundingly simple to check whether a number is accurate or not. So, just exactly how do I do this ? CBI doesn't have to tell, and neither do I. "...there is no law..." - - -12- How can I get a copy of your list ? Answer: Unfortunately, I have found the drones to outnumber the worker-bees by a factor of about 10-to-1. This is not the soup-kitchen, it's a group project. If you want SSNs from me, then I want SSNs from you. In the past, I offered a 1-for-1 exchange. I will no longer make that public offer. What is offered is this: If you will send me full names and SSNs of prominently elected officials, media-babes, et.al., then I will (to the extent my database allows) send you back full names and SSNs of other prominent politicians and media babes, 1-for-1 if I can. Of course, full names and SSNs of any individual or group are still welcome, they just don't qualify for the 1-for-1 offer. Copyright, 1995 by Clint Danbury (Better Living Thru Better Living) ************************************************************************** X SNAIL ME + GABRIELLI'S (Mendocino,CA, USA) 0 X YER ROSEHIPS + 0 X IF YOU LIKED THIS POST! + *Pinot Noir* & *ASCENZA* (WHITE-BLEND)-YUMMY!0 ************************************************************************** [Ask Fer "Mendocino,Ca. -- *Gabrielli Wine*" at yer local wine shop if'n ya want to tend yer rugosa] Let your voice be heard in the campaign to save the life of Mumia Abu Jamal ++++ more info: http://www.calyx.com/ ++++ - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

More on Belgian 'key escrow law'
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

I looked up the law mentioned in the newspaper article and it goes like this (non french speaking cypherpunks, please see comments below <grin>): ---- "Loi du 21 décembre 1994 portant des dispositions sociales et diverses" - published in the 'Moniteur Belge' (= the official journal in which all laws are published), Vol. 164, Nr. 250, Friday 23 December 1994, p. 31878-31963. (p. 31960-31961): " Art. 202 Il est inséré dans la loi du 21 mars 1991 portant réforme de certaines entreprises publiques économiques, un article 70bis, rédigé comme suit: <<Art. 70bis - Le Roi fixe, par arrêté délibéré en Conseil des Ministres, les moyens techniques par lesquels Belgacom et les exploitants des services non réservés qu'Il désigne doivent permettre, le cas échéant éventuellement conjointement, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications privées dans les conditions prévues par la loi du 30 juin 1994 relative à la protection de la vie privée contre les écoutes, la prise de connaissance et l'enregistrement de communications et de télécommunications privées.>>" (p. 31961): " Art. 203 L'article 95, alinéa 1er, de la même loi est complété comme suit: <<5° l'appareil terminal rends inefficaces les moyens permettant, dans les conditions prévues aux articles 88bis et 90ter à 90decies du Code d'instruction criminelle, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications.>>" ---- Simplifying it all seems to boil down to this: The 1994 Law ammends a 1991 Law; that is, it adds a couple of articles/paragraphs. Art. 202 stipulates that Belgacom (= Belgium's leading telephone company) and other telecom companies have to cooperate with law enforcement when it wants to tap telephone lines - no, sorry, make that telecom lines (!). Note that tapping is only allowed under certain circumstances stipulated in the so-called Privacy Law (see also my previous posting to this list). Art. 203 is the most important as far as key escrow is concerned. It completes Art. 95 of the 1991 Law which stipulated 4 conditions in which telecom equipment may be seized. These initial conditions are rather harmless (equipment does no longer conform to the initial specifications, it hinders public broadcasts, presents health risks for the users,...). Art. 203 adds a 5th and stingy one: equipment that makes tapping impossible may be disconnected from the network and seized ... On the face of it - I'm not a lawyer, so don't pin me down on this - this means no crypto (or only with key escrow) ... Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

[local] Minneapolis CP get-together
by Kevin L Prigge 17 Dec '03

17 Dec '03

Who: Minneapolis Cypherpunks What: Local get-together & key signing party When: Saturday, Feb 10th @ approx 5pm -> ??? Where: Applebees (3200 W Lake St) I'll be facilitating a key signing, send your public key to me before hand to get on the list. If you have any questions or need directions, let me know. -- Kevin L. Prigge |"Have you ever gotten tired of hearing those UofM Central Computing | ridiculous AT&T commercials claiming credit email: klp(a)tc.umn.edu | for things that don't even exist yet? 010010011101011001100010| You will." -Emmanuel Goldstein

1 0

Re: [rant] A thought on filters and the V-Chip
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:56 AM 1/26/96 -0800, Alan Olsen wrote: >I have known too many adults that believe that by restricting their kids >access to information, they can prevent them from growing up. In these >parent's minds, such information is what makes them want to hump their >little brains out. Biology has nothing to do with it in their limited way >of thinking. Cluelessness does not just cover computers with these people. >It also covers any other topic that required more than two brain cells to >understand. Actually, if you place a child in one sort of environment or another you do get a different "product." The behavior of Amish children raised on farms in rural Pennsylvania differs significantly from the behavior of children raised crack-addicted parents in Bed-Stuy. In fact, you get almost non-overlapping bell curves for every characteristic. I would guess too that if you switched kids at birth between these two populations, the final results wouldn't differ by much. What parents are attempting to do when they restrain their children's access to "sex and drugs and rock and roll" (or Republicanism for that matter) is to mediate their "spiritual" environment to keep them from becoming hardened. They know the kids will grow up, they just want them to grow up in a nice way. Children who listen to Vera Lynn's singing and Cole Porter's songs will end up quite different from those who favor louder, less vocal music. Note that in spite of what liberals might think, fundamentalist christians are less likely to divorce, less likely to report spousal beatings, less likely to kill themselves, and more likely to measure high personal satisfaction levels on standard psychological tests than are, say, readers of The Nation. The cypherpunks relevance of all this is that it should soon be possible to create completely mediated environments for ourselves and our children. Through the use of implants and real-time VR processing, it will be possible to edit our "interface" with the Real World such that unpleasant aspects are edited out. We will be able to change the attire, hair, facial expressions, voice, and even smell of those around us to conform to our own esthetic desires. Likewise with our physical surroundings. Safety may discourage making a complete transformation in one's surroundings, but one can certainly soften the edges. Note that this is just an easier-to-implement version of what we can do already with our own minds. It will be interesting to see the effects on people who live in these mediated worlds. DCF "My grandmother didn't like to use the word 'Democrats' in the presence of the children. She called them 'bastards' instead." -- PJ O'Rourke

1 0

KOH "Helpful" Crypto Virus
by Laszlo Vecsey 17 Dec '03

17 Dec '03

I'm looking for more information on the KOH Virus, a 'helpful' virus which kindly asks to infect your system and encrypt all of your data. It spreads to floppies (upon request) and to other systems, encrypting all files. I read about it in Boardwatch magazine, which surprisingly states that the U.S. government forbids the distribution of all cryptographic programs in binary form; source code can be freely distributed. Please point me towards the source/binary, or further information. (define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) "SGI and Linux both run Motif and X11. They both compile c++ cleanly (using gnu g++). They're the same!"

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:42 PM 1/30/96, Jonathan Rochkind wrote: >I'd say _all_ news, not just software news, is P.R. controlled, these days. >You can largely hold Edward L. Bernays, the "father of public relations" >(who just died last year) responsible for that--or the societal conditions >that allowed Bernays to do his thing. Bernays developed expertise in >"engineering of consent" turned the news into a commercialized and Interesting term, similar to Chomsky's "Manufacturing Consent" (which obviously must've come later...). >Now, the news you read is manufactured in press releases to sell a product, >and is there because a well written press release convinced a reporter or >editor that a marketting ploy was actually a newsworthy event (or, perhaps, >because the advertising dollars that went along with the press release >convinced him). Witness FVs demonstration of key capture becoming a >newsworthy event. Maybe I've from the old school, the school that says one should be more modest, objective, and circumspect. Then, if it's really news, and not just a PR scam, the journalists will come. (Understand that I'm not saying I'm sort sort of paragon of modesty. Far from it. But I try to control myself.) I think that the view that "all news is hype" is overly harsh. In fact, corrective forces tend to slow this headlong rush into P.R. For example, the reaction here to the Nathaniel Borenstein/First Virtual hyperbole, and the fatuous, credulous article by Simson Garfinkel (sorry, Simson, but I call 'em as I see 'em), will undermine their credibility for a long time. Crying wolf, and all that. The FV "discovery" that insecure machines can cause all sorts of problems rated at most a brief paragraph in the papers, not the full-page treatment Garfinkel and his editors gave it in the "San Jose Mercury News" (and maybe other papers that picked it up, or will in the next few weeks). Newspapers and magazines that run "fluff" pieces, taken almost directly from press releases, lose credibility. (Nathaniel B. claims that the Simson G. piece ran _first_, before his Press Release. Well, how did Simson first learn of the FV "discovery"? How did the FV President arrange to be photographed? It seems pretty clear to me that FV was involved in the development of the story, perhaps even planting the seed for it. Not necessarily a dishonest thing to do, of course, just a bit tacky given that the "discovery" is not news. >If you want to effect what's in the media, maybe you should learn how to >issue press releases. Nope. I think it a very poor model for getting information out. With all due respect to Sameer, who has done many fine things, I gag every time I see a press release from Community Connection in which Sameer interviews himself. Or, put another way: [Embargoed for release until Jan. 30, noon PST] Crypto Anarchy Foundation Releases Views on Self-Interview Press Releases Corralitos, CA. The Crypto Anarchy Foundation, the world's leading think tank on crypto anarchy, today is announcing its views on press releases. According to Crypto Anarchy Foundation founder and President, Timothy C. May," "We think these press releases are a phony means of pumping up a story." When asked for more details, he added: "The self-interviews are really tacky. Can't you ask me some better questions?" The Crypto Anarchy Foundation, the world's foremost provider of information about crypto-mediated anarcho-capitalism, may be reached at 408-728-0152. CAF spokesperson Tim May can arrange interviews with CAF founder Tim May. --Tim May, CAF founder, chief technical officer, and media relations specialist Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: [NOISE] Borenstein's Fatal Spam
by daw＠boston.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <pgpmoose.199602010813.60849(a)paganini.sydney.sterling.com>, Greg Rose <Greg_Rose(a)sydney.sterling.com> wrote: > A number of people have written words to the > effect of: > First Virtual, you lost a lot of ground with me. > (sounds like others feel the same way, too). > > I disagree. I think there is a big difference > between "knowing theoretically that X, Y and Z > are possible" and "look, I have a program that > does X, Y and Z in a certain order, and very > fast, and surprisingly successfully, and this has > major implications for the banking community". [...] > I think most of the problem here is that we heard > about it in media words first, and in a reasoned > argument second. That's life. Ok. Fair enough. Good points. Personally, what I found most distasteful about FV's post was their conclusions, not their experimental procedure. I agree that their keyboard-sniffer lends more evidence to the well-known argument that, to make good use of crypto, you need secure endpoint machines. I disagree when FV concludes that this makes crypto useless. Instead, I'd contend we just need to work to secure our endpoints better; then we can do all sorts of neat stuff with crypto. I found their conclusions to be academically displeasing. But I guess that's what happens when you're trying to sell a product... - -- Dave Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ/lHSoZzwIn1bdtAQG3bQF6AnSQY/3Hy6ha35vI5YrbyF8w7Xq/IcN9 IIwNqUKmrqlugKuduk0A9VqDG9Zi0Ksm =7awQ -----END PGP SIGNATURE-----

1 0

Re: Two Bits Four Bits ETC
by Brian D Williams 17 Dec '03

17 Dec '03

>>Brian D Williams writes: >>Excellent point Bill! Lets not forget that IBM owns Lotus Notes, >>be sure to include that in your bashing. They caved in on Lucifer >>after all. ;) >"Perry E Metzger" <perry(a)piermont.com> adds: >Lucifer isn't stronger than DES, so it wasn't a cave in. An >understanding of differential cryptanalysis makes all the >difference... True, I was refering to them halving the original key length. Brian

1 0

Crypto Cards
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From 29 Jan edition of EE Times, P 24: "Aix-en-Provence, France - A startup formed here to capitalize on the interest in cryptographic smart cards has won an assignment that could help put its name on the data-security map. The company, Inside Technologies, has been selectedby the Open Microprocessor Systems Initiative (OMI) to do the combo-chip layout for OMI's Cryptographic Reduced Instruction Set Processor (Crisp) project." ... "'In public-key cryptography, 512-bit keys are typical and already vulnerable. So we are looking at 640-bit-long keys supported by a scalable design' said [IT partnet William Orme]. He said that conventional smart-card ICs tend to be based on available 8-bit microcontrollers and, sometimes, cryptographic processors. Because it iss designed specifically for smart-card applications, the 8-bit RISC processor will require only 2,500 gates. Conventional crypto coprocessors tend to support only one type of algroithm, such as Rivest, Shamir, Adleman (RSA) or the Data Encryption Standard (DES). Orme said that by designing the CLU at a lower level of granularity, multiplies and squaring operations, calculations can be built up in the form of building blocks and can support a variety of algroithms adn key lengths. 'Users want their own, custom algrotihms, which can be downloaded at the time of use', he said. The CLU should support RSA, DES, and the Digital Signature Standard (DSS). RSA optimization will cover 320-, 512-, and 640-bit key lengths. 'The CLU will operate at a higher clock frequency than the RISC - 60 MHz, in our design - yielding 640-bit RSA decrypt in less than 50mS', Orme said." Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ8mc8VrTvyYOzAZAQHa4wP+Ml3UAaywNzw+0OrN3iRfQ6y2DbjcDOs9 12Th32OGNJc5Ri0BPkI3n1+mlpZfIp9jQQI8B5gLI39nwkC9u0xnfmLFxHcSGsLB /dynNagjOQ6/GhcZFs7XVMp0RJPYrmZ2QcmCZC5MF+V69+bTrGCMhN0+O1dPPneC VB9x/klwdLk= =yp0C -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

Re: Crypto-smart-card startup Inside Technologies
by Cedric Ingrand 17 Dec '03

17 Dec '03

> >There's an article in the January 29 _EE Times_ about a French > >cryptographic-smart-card startup called Inside Technologies. > >Tidbits: > > I find it in a way amusing that a country which > have very weird attitude towards use of crypto > (it is not allowed to be used) tries to set > standards and provide new technology. If they > are that opposing to use of strong encryption > how on earth they can be providing it to others > and get those others to believe there is no > catch in it? The use of encryption is in no way forbidden in France. It just has to be approved beforehand, which up to recently amounted to pretty much the same (-:. But, due to industry pressure, things are changing. Netscape can now market its secure server in France, as well as the export-version browser. I haven't heard of anyone having their PGP approved yet though.. Best, Cedric.

1 0