December 2003 - cypherpunks-legacy

SSH for Windows
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

...can be found at URL http://public.srce.hr/~cigaly/ssh/. FYI. -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes

1 0

Re: PRIVACY: Private traces in public places
by tcmay＠got.net 17 Dec '03

17 Dec '03

(Sasha, good to have you on our list!) At 3:26 AM 1/10/96, Alexander 'Sasha' Chislenko wrote: > Sometimes, it comes as an unpleasant surprise to a person who >looks for web pages referencing his own name, and finds, among >other things, many of his explicit or controversial usenet or mailing >list messages, old resumes that may contradict the current one, >critical remarks of his high school girlfriend and former colleagues, etc. >Knowing that this information is easily accessible to his new girlfriend >and prospective employer may make him more than uncomfortable. Remember a couple of years ago on the Extropians list when I claimed to have compiled dossiers on people, from their admissions in posts about drug use, infidelities, and other such things? Several of them got quite irate. >All advice to such a person you may see on the Net mentions Net laws >that should have been passed and personal actions that should or >should not have been taken. Not all such advice, because my advice has been different from this. >How can people protect themselves from all this? > >Will people of the future all wear identical privacy suits, gloves and >helmets and burn >everything they have touched? > >Or they will just try not to do things they may later be ashamed of? >(How do you know what you may be ashamed of 30 years from now?) Or, the option I prefer: do what you gotta do, and screw those who claim you should be ashamed of yourself. Think of this as a screening process: anyone who is so offended or ashamed for you (what a concept: "I'm ashamed for you") probably is not someone you would want to deal with. Works for me. I'm not trivializing the issue of search engines and archiving systems turning up articles written, old posts, etc. Every couple of weeks, sometimes more often, someone sends me a copy of one of my postings and claims that someone else must be forging my name (recent posts on racial issues, for example--while I'm not a racist, I despise quotas, setasides, and preferential treatment for lazy people, of any race...this obviously makes some people "ashamed for me" :-}). These people, obsessed with political correctness, or having some notion that consistency must be enforced, are the populist form of Thought Police. Mostly I ignore these people pestering me to "explain" a post I made in a group, and, if they persist, I add them to my filter file. I prefer this liberated outlook to either of the two options you presented. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:15 PM 1/6/96 -0500, Michael Handler <grendel(a)netaxs.com> wrote: >ObGPS/cpunk/physical-location-of-machines: A recent IETF proposal would >create a new DNS record that encoded the physical location of a >machine, encoded in latitude and longitude. This would solve the >problem MIT has had in distributing PGP, i.e. where exactly is >unix5.netaxs.com? However, there's nothing to stop you from adding >records that say your machines are at the latitude and longitude of, >say, Fort Meade... ;-) My laptop's latitude and longitude aren't constants.... And a DNS record identifying the precise location of compuserve.com or netcom.com might not be very meaningful; a more detailed record identifying the location of port5.paloalto-annex-3.netcom.com might tell you which terminal server to aim an ICBM at, but won't tell you where I dialed in to it from. But it still won't tell you if the user is in Washington DC or Germany, though perhaps a DNS record for Snow-Depth might be a bit more informative. > ftp://ds.internic.net/rfc/rfc1876.txt >Again, I'm not too sure of the viability of this proposal. Not on >effectiveness of proving true location -- it is more geared toward >"visual 3-D packet tracing" -- but simply because I have _no_ fricking >idea where our machines are (in terms of lat and long) to any degree >of accuracy. There are several geography servers on the net, which can tell you the lat/long for a city (more useful if your city is, say, Holmdel NJ than if it's Los Angeles.) Or you can buy one of those $12.95 CD-ROMs with all the street addresses in the US on them (perhaps at the cost of adding a PC or Mac and CDROM drive to run the software...) Feed it a street address, and you can get pretty close (mine actually targets the other end of my block, but it's not doing interpolations...) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Groups of prime order
by Joanna Orzechowska 17 Dec '03

17 Dec '03

Hi CP's! Hope someone would be so kind to help me wiht this: Is it weaker to use arithmetic mod (p-1), and hence all Zp, when suggested to work in a group of prime order q? This question is connected with discrete log signature protocols such as that in Pedersen's "Improved privacy in Wallets with Observers" or Schnorr's. I would appreciate any help ASAP, since I'm in a hurry. Please, answer me by personal mail since I'm not subscribed to the CPs list now. Thanks and best wishes from Poland. Joanna

1 0

Re: PRIVACY: Private traces in public places
by John Young 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)REPLAY.COM (Anonymous) on Wed, 10 Jan 1:43 PM > Last summer the first case in Britain of a libel on the Internet was > settled out of court when Laurence Godfrey accepted undisclosed > damages from another nuclear physicist, Philip Hallam-Baker, over > remarks made in 1993 on Usenet, an electronic conference with 16 > million users. And Peter Lilley, the Social Security Secretary, sent a > stiff letter to the vice-chancellor of Leeds University after one of > its students used a faculty computer to make defamatory allegations > about him. ---------- The NYT reports that by 2000 there will be over 1 million lawyers in the US. These fine-minders, supported by the burgeoning private investigative and security fields, will surely mine electronic archives as thoroughly as they research paper -- and thanks to wondrous Altavistas maybe more thoroughly. And backed by these highly skilled lobbyists, laws will change to make remunerative rain of -- and by -- archiving and search technology as they have to capitalize on the technology of doing the same in the worlds of printing, telegraph, telephone and television. Promotion of these privacy-invasive services on the Net parallels the defensive measures explored on cypherpunks. Perhaps all c'punks should subscribe to cyberia-l and vice versa; they are hand in hand, or fist to fist, on this.

2 1

Re: Mixmaster On A $20 Floppy?
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 10, 1996 03:00:00, 'Bill Stewart <stewarts(a)ix.netcom.com>' wrote: >At 08:55 PM 1/5/96 -0500, tallpaul(a)pipeline.com (tallpaul) wrote: >>I've reports that the latest version of SyQuest's external parallel port >>EZ135 "floppy" drive is due on the shelves this month. > >Iomega's ZIP drives are similarly priced, hold 100 MB, and >come in parallel and SCSI flavors. > Quite right. In many ways the SyQuest and Iomega products are identical. However, I'm shooting for the SyQuest because of the advertised 12.5 msec access time. In any case, the tech is there and it is portable so we can expect to see a variety of similar products in the future. >>Question 1: Can you fit linux, pgp, mixmaster, etc. on the 135 Mb disk and >>have enough useful space left over for a useful amount of data? > >As various people have said, you can do it on a couple of floppies. >Is Mixmaster designed in a way that could easily accommodate having >Mixmasters pop in and out of existence, either well-known ones that travel, >or (with some enhancement) temporaries that pop up and squawk their >existence to some sort of web site or mailing list? What would it >take to add this capability? > I can't answer these questions which is why I started this thread to get answers from those who have the knowledge required to make meaningful answers. The major problem today stopping the proliferation of "temporary" sites seems to be the user interface. Ultimately, we would want something that was very easy to use and had incredibly simple user manuals (like the Army's Training Manuals for really dumb soldiers). You know, the ones that start: "This is a bullet. It has a pointy end and a flat end. The pointy end is the end you want to face the enemy. The flat end is the end you want to face you." >>Question 3: Anyone want to speculate on what data recovery is like when >>encrypted data and the horse it rode in (and out) on has all been >>physically destroyed at a replacement cost of only $US20? > >Old 5 1/4" floppies make a very secure satisfying sound when you >take the magnetic material out and drop it into a shredder :-) >The 20 MB Bernoulli Box floppies were also shreddable. > Yeah, and imagine the noise an anti-privacy technician makes when he/she/it is told to try to extract plaintext from the shredded results. >#-- ># Thanks; Bill ># Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 ># ># "The price of liberty is eternal vigilance" used to mean us watching ># the government, not the other way around.... > > -- -- tallpaul -- Any political analysis that fits on a bumper sticker is wrong.

1 0

TAL_kup
by John Young 17 Dec '03

17 Dec '03

1-10-96. NYPaper: "Group Urges an Internet Ban On Hate Groups' Messages. Joins in Move to Censor Offensive Material." Citing the "rapidly expanding presence of organized hate groups on the Internet," a leading Jewish human rights group yesterday began sending letters to hundreds of Internet access providers and universities asking them to refuse to carry messages that "promote racism, anti- Semitism, mayhem and violence." A sage says, "It is not possible to end idiocy by censoring it. The best response is cellular." TAL_kup

2 1

E-cash and Interest
by Tim Philp 17 Dec '03

17 Dec '03

I had been doing some thinking about E-cash and some of the implications. It seems to me that there is another element in the discussion that has not gotten very much consideration. When you have your money in the bank, you are earning interest on the money (albeit not very much! <g>) and that money continues to earn interest until it is withdrawn. If you write a check to pay for something, that ends your interest accumulation for that money. With the E-cash systems that I have seen, you generate your own E-cash and have it signed by a 'bank' At that moment, it becomes like cash in your wallet and you loose interest that this money could be earning. Has this issue been addressed, or am I missing something? Regards, Tim Philp =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

3 2

Reports available via CTRS
by David J. Bianco 17 Dec '03

17 Dec '03

[Abstracts for, and (in most cases) links to these report titles can be found at the CTRS site, http://www.itribe.net/CTRS/ ] 1.Tuomas Aura, Modelling the Needham-Schroeder authentication protocol with high level Petri nets, Technical Report B14, Espoo, Finland, September 1995. 2.Arnold G. Reinhold, Diceware for Passphrase Generation and Other Cryptographic Applications, Cambridge, MA, July 28, 1995. 3.Arnold G. Reinhold, A Diceware Word List, Cambridge, MA, July 28, 1995. 4.Arnold G. Reinhold, Results of a Survey on PGP Pass Phrase Usage, Cambridge, MA, July 28, 1995. 5.Arnold G. Reinhold, "Common Sense and Cryptography" , Internet Secrets, John Levine and Carol Baroudi (Ed.), Foster City, CA, 1995, pp. 115-150. 6.Arnold G. Reinhold, On the Function of MHC-Antigen Specificity, Cambridge, MA, March 3, 1989. 7.VeriSign, Inc., FAQ: Answers About Today's Digital IDs, July 15, 1995. 8.Roos, Andrew, A Class of Weak Keys in the RC4 Stream Cipher (Preliminary Draft), Westville, South Africa, September 1995. 9.Terry Ritter, Substitution Cipher with Pseudo-Random Shuffling: The Dynamic Substitution Combiner., Cryptologia, vol. 14, no. 4, 1990, pp. 289-303. 10.Terry Ritter, Transposition Cipher with Pseudo-Random Shuffling: The Dynamic Transposition Combiner., Cryptologia, vol. 15, no. 1, 1991, pp. 1-17. 11.Terry Ritter, The Efficient Generation of Cryptographic Confusion Sequences., Cryptologia, vol. 15, no. 2, 1991, pp. 81-139. 12.Terry Ritter, Voice and Video Cryptography in a DSP Environment., Proceedings of the Second Annual Texas Instruments TMS320 Educators Conference, Houston, Texas, August 5-7, 1992. 13.Terry Ritter, Estimating Population from Repetitions in Accumulated Random Samples., Cryptologia, vol. 18, no. 2, 1994, pp. 155-190. 14.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, An Efficient Fair Payment System, India, Mai 1996. 15.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, An Efficient Electronic Payment System Protecting Privacy, Lecture Notes in Computer Science, vol. 875, pp. 207-215, Berlin, November 1994. 16.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, Blind Signatures Based on the Discrete Logarithm Problem, Proceedings of EUROCRYPT 94,Lecture Notes in Computer Science, vol. 9505, pp. 428-432, Berlin, May 1994. 17.Stadler, Markus; Piveteau, Jean-Marc; Camenisch, Jan, Fair Blind Signatures , Proceedings of EUROCRYPT 95,Lecture Notes in Computer Science, vol. 921, pp. 209-219, Berlin, May 1995. 18.Kocher, Paul C., Cryptanalysis of Diffie-Hellman, RSA, DSS, and Other Systems Using Timing Attacks, Stanford, California, December 1995. 19.Schoenmakers, Berry, An Efficient Electronic Payment System Withstanding Parallel Attacks, CS-R9522, Amsterdam, Netherlands, March, 1995. =========================================================================== David J. Bianco | Web Wonders, Online Oddities, Cool Stuff iTribe, Inc. | Phone: (804) 446-9060 Fax: (804) 446-9061 Suite 1700, World Trade Center | email: <bianco(a)itribe.net> Norfolk, VA 23510 | URL : http://www.itribe.net/~bianco/

1 0

SSN collection prank
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I haven't seen this here. somewhat amusing. ------- Forwarded Message Date: Sun, 7 Jan 1996 19:49:14 -0500 (EST) From: Brad Dolan <bdolan(a)use.usit.net> To: snet-l(a)world.std.com Subject: (fwd) Private SSN Collection Project <cool!> (fwd) - - ---------- Forwarded message ---------- - - ---------- Forwarded message ---------- Date: Sun, 31 Dec 1995 00:01:48 -0800 From: Clint Danbury <danbury(a)shell.wco.com> Thank you for your response. Please send Full names and Social Security Numbers of anyone you know, including government officers and/or employees, to: Clint Danbury, Box 750037, Petaluma, CA 94975-0037 email: danbury(a)ssnShirt.com Questions And Answers On The Nationwide SSN Collection Project. - - -1- Why are you collecting SSNs ? Answer: For fun and amusement. - - -2- What do you plan to do with them ? Answer: Put them on sweatshirts and sell them through specialty clothing retailers. It has been suggested also that I post them on large billboards along the Mexican border, but I don't have enough capital to pull of such a stunt at this time. - - -3- How long do you intend to continue this ? Answer: Until it becomes illegal. The moment any legitimate government authority informs me of the specific laws which (A) Forbid the collection, recording, and distribution of SSNs by private parties, and (B) Provide legal recourse for the individual citizen against private parties which do so, I will stop. - - -4- What if the government finds out what you're doing ? Answer: First off, the government knows very well what I'm doing. I've been "reported" multiple times to the SSA and the Secret Service. Secondly, the government can find me quite easily (I'm in the phone book). Third, I will cooperate completely with any legitimate government authority. - - -5- Here's my ex-spouse's SSN; will you make him/her miserable for me ? Answer: Hell No ! If you want me to engage in illegal activity for you, then go somewhere else ! - - -6- Isn't what you are doing illegal ? Answer: Not according to the SSA. They have declared the private use of the SSN unrestricted. (More on this in a few questions) - - -7- If My name/SSN were in your database, would you tell me ? Answer: In order for me to confirm this, you must first tell me what your full name and SSN is, then I will tell you if you were already in there. If this sounds like two-faced hypocrisy, great! I got the idea from CBI-Equifax; that's their very own policy. If you don't tell them what your SSN is, they won't tell you what they've got on you. Therefore, I have decided to do the exact same thing. (If you don't believe it, then why don't you call them and ask for yourself?) - - -8- What if someone did the same thing to you ? How would YOU feel ? Answer: This already has happened to me. I told the SSA office about it, repeatedly, and they would take no action. (The story appears in the next answer.) - - -9- How did this all start ? Answer: In 1985, a co-worker learned that I object to the "Uni-Number" concept of identifying a single person across multiple databases. I was (and still am) specifically concerned about the use of the SSN for Non-Tax identification. The company placed our SSNs on our name tags, which, thankfully, we did not have to wear constantly, although we would occasionally have to display it for a guard during certain times. This co-worker went poking through my briefcase while I was out of my office, copied down my SSN, and then, for his own fun and amusement (I'm guessing at his motives, I don't know his true reasons) displayed it for me, and would not tell me where he got it. Seeing that this angered me, he then went to other co-workers, who joined him in making my SSN even more public. They then went to the personnel files, (which the company made no attempt to keep locked) and double-checked the number with my job application. After that, they memorized it, and, (again, I'm guessing here) for their own amusement, they would recite it in unison around the lunch table. (I know this sounds impossible, but it really did happen.) After that job ended (not very happily, surprise) I let myself cool off for a few months, and then moved to another city. During my time in that other city, I contacted the SSA office there, seeking another SSN. I made dozens of phone calls and wrote letter after letter, all to no avail. My letters got shorter and to-the-point, not long drawn out things. It took only 30 seconds to read them. This continued for several months. The result was always the same: words without action, and no replacement SSN. The company in that city went down the tube, and I had to move again. I wrote and called off-and-on over the next few years, and got the same treatment; empty words, stall-him-off, and they would make no statement one way or the other. In September of 1993 (perhaps an earlier date, I'm not sure) the SSA finally came out and gave their official written approval for unrestricted use of the SSN by private individuals and private organizations for any purpose, including fun and amusement. The pamphlet is entitled "Your Social Security Number", is SSA Publication 05-10002, and dated September/1993. You can get a copy by calling them at 1-800-772-1213. On page 9 of that pamphlet, they have finally removed all restrictions on the private use of the SSN and they've put it in writing... "Because there is no law concerning the use of a person's Social Security number by a private individual or organization, Social Security has no control over such use." So, if those are the rules they've made, fine. Those are the rules by which I'll act. The collection and distribution of other people's SSNs is (as you've just read) a legally unrestricted activity and that's exactly what I'm doing. - - -10- Where do you get the SSNs ? Answer: "...there is no law..." so, just like CBI, TRW, TU, et.al., I don't have to tell you where I got yours. Ask CBI where they got your SSN; they won't tell you, and neither will I. - - -11- How do you check for accuracy ? This question bothered me a lot at first, however, it has become astoundingly simple to check whether a number is accurate or not. So, just exactly how do I do this ? CBI doesn't have to tell, and neither do I. "...there is no law..." - - -12- How can I get a copy of your list ? Answer: Unfortunately, I have found the drones to outnumber the worker-bees by a factor of about 10-to-1. This is not the soup-kitchen, it's a group project. If you want SSNs from me, then I want SSNs from you. In the past, I offered a 1-for-1 exchange. I will no longer make that public offer. What is offered is this: If you will send me full names and SSNs of prominently elected officials, media-babes, et.al., then I will (to the extent my database allows) send you back full names and SSNs of other prominent politicians and media babes, 1-for-1 if I can. Of course, full names and SSNs of any individual or group are still welcome, they just don't qualify for the 1-for-1 offer. Copyright, 1995 by Clint Danbury (Better Living Thru Better Living) ************************************************************************** X SNAIL ME + GABRIELLI'S (Mendocino,CA, USA) 0 X YER ROSEHIPS + 0 X IF YOU LIKED THIS POST! + *Pinot Noir* & *ASCENZA* (WHITE-BLEND)-YUMMY!0 ************************************************************************** [Ask Fer "Mendocino,Ca. -- *Gabrielli Wine*" at yer local wine shop if'n ya want to tend yer rugosa] Let your voice be heard in the campaign to save the life of Mumia Abu Jamal ++++ more info: http://www.calyx.com/ ++++ - ------- End of Forwarded Message ------- End of Forwarded Message

1 0