December 2003 - cypherpunks-legacy

A Modest Proposal: Fattening up the Proles
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:57 AM 1/17/96, tallpaul wrote: >-- >tallpaul > >"To understand the probable outcome of the Libertarian vision, see any >cyberpunk B movie wherein thousands of diseased, desparate and starving >families sit around on ratty old couches on the streets watching television >while rich megalomaniacs appropriate their body parts for their personal >physical immortality." > R. U. Sirius > _The Real Cyberpunk Fakebook_ The absurdity of this point is obvious to anyone with a brain. Why would we want the donors to be "diseased" and "starving"? It is imperative that donors be healthy and non-anorexic (we used to use the phrase "fattened up," but this is no longer au courant). To keep the proles reasonably healthy, the plutocrats are encouraging the current wave of exercise videos, ThighMasters, Buns of Steel, etc. And lots of beer, as the Kobe beef quakers have shown. Other than this, R. U. has it about right, I think. (Ironically, I brought up the new book, "The Winner Take All Society," at the last Cypherpunks meeting. No time to discuss it here, but it confirms my strong belief that we are heading for a economy in which a shrinking fraction of workers have really valuable things to contribute, and a growing fraction of the population does not. I had not recalled the authors, but Strick had a battery-powered laptop and Metricom wireless modem, and ran an Alta Vista search from where he was sitting: ROBERT FRANK & PHILIP COOK, The Winner-Take-All Society, New York: The Free Press.) This may shock some of the newcomers here, who haven't heard this, or who haven't deduced it from our posts, but many of us are elitists. Or, more precisely, we are for people looking out for Number One, with the expectation that many other people simply won't make it. Think of it as evolution in action. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A weakness in PGP signatures, and a suggested solution (long)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: ckey2(a)eng.ua.edu (Christopher R. Key) >First of all, if the recipient is a newsgroup, why would that particular information need to be part of the signed information? If you post to a newsgroup a message that is only signed (as opposed to encrypted also), then you are obviously not worried about who reads it. The signature is only a method of proving that the important text (message) is unchanged and intact, and that the person who it is supposed to be from is the same who signed it. -------------- How about proving that you _weren't_ spamming? I.e., an enemy spots a message on a newsgroup from you with a signature, then duplicates it with header modifications on 500 newsgroups including news.admin.net-abuse.misc (to add insult to injury). Sorry if a bunch of other people have pointed this out by the time my message gets to toad.com, but... -Allen

1 0

remarkable recent stories
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I haven't seen much dialogue on some key things that have popped up recently of high relevance to this list; forgive me if these are covered in threads (inappropriately named?): 1. GNN had an article in which Madsen (puzzle palace coauthor I believe) stated that the NSA was trying to restrict anonymity by working behind the scenes with Lotus, Microsoft, etc. major meat for TCM's "NSA visits" compendium assuming he's still working on it. also, it sounds like the most direct evidence that the NSA is working against anonymity in cyberspace, something that really surprises me. 2. the same article had Madsen stating that the NSA is vacuuming down Internet traffic. he gave the likely entry points that they are doing this. this is one of the first major credible insistences I've seen that the NSA is doing this. (there are of course a bazillion urban legends that the NSA does this). Madsen claimed that some private companies were getting contracts for the work. hmmmmmmm, possibility of some cyphersabotage here, like what went on with mycotronix? (sp?) 3. the absolute biggest blockbuster of them all: the NSA supposedly did a study about how crypto regulations affect US competitiveness in the international marketplace and *concluded* they were damaging it. (surprise!!) the Commerce Dept. has recommended *easing* export regulations. this is very notable for several reasons: - The NSA would probably not release the study unless they were hinting at a new policy decision. they do a bazillion studies surely but none of them see the light of the public day. why would they release *this* one? - the commerce dept is probably heavily influenced by the NSA-- i.e. I doubt that they would come out with a favorable recommendation for crypto unless the NSA approved. however, on the other hand, in the articles there was a caveat that "if the military and spy agencies allow it". not sure what was meant by that. - what I wonder is if the same NSA study was more comprehensive and tried to look at the overall implications of current or altered crypto export policy. i.e., did they try to address the question, "what would really happen to overall US situation if crypto were unregulated? would it mean better business? more or less crime?" etc. I have said this before, but everyone seems to *assume* that unrestricted crypto necessarily releases the 4 horsemen of the infocalypse, but what if an actual *study* was done, that potentially *contradicts* this idea? there are many examples of new technology being introduced that has an effect far different than that anticipated by the masses or the conventional wisdom, and often much more benign than expected. - what this all suggests to me is a possible major policy/political switch inside the NSA in which possibly someone who is more in favor of code making than code breaking is gaining the reigns. its tough to guess based on the NSA's entrails, but recent events are some pretty odiferous entrails, I'd be interested to here what others think.

3 2

Ooops
by Johnathan Corgan 17 Dec '03

17 Dec '03

Some rather, uh... uncreative bash scripting resulted in my trashing beyond reasonable repair all my inbox mail for the last half a day or so. Looks like there were a few posts from some list members--please resend any important mail. Thanks. -- Johnathan M. Corgan jcorgan(a)aeinet.com http://www.aeinet.com/jcorgan.htm

1 0

RE: FW: Net Control is Thought Control
by blanc 17 Dec '03

17 Dec '03

From: Vladimir Z. Nuri "how can you be so sure that the cypherpunks lists is really what you think it is?" 'Cause I'm real, real smart. "a bunch of people from around the country independently interested in crypto?" "An effete corp of impudent snobs who fancy themselves intellectuals." (Spiro Agnew) "an agent provacteur, or agent saboteur, could create a vastly different perception regardless of the input of other people." It's true there are juveniles who occasionally disturb the list, but I expect that most members have a real interest in the subjects discussed and wish to bring out pithy points of truth & wisdom for all to behold, taking full credit for their contribution to the general atmosphere of learned intelligence. People have to grow up from childhood, Nuri-logical, and even then it's possible to be mistaken & to be misled. But there is no substitute for work, for the work of thought, which is the only means any human being has to solve the problems of living as a conscious, sensitive being. The only way to deal with all of the problems you mentioned is to continue to work to solve them in the way which will be most satisfactory to moral creatures. .. Blanc

1 0

RE: Spiderspace
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

I think Tim was referring to someone gleaning your private key, which would be a Disastrous Thing (tm). If that's not what he was referring to, I still think it's a possiblity. Kurt ---------- From: Martin Diehl[SMTP:mdiehl@dttus.com] Sent: Tuesday, January 16, 1996 13:59 To: cypherpunks(a)toad.com Subject: Re: Spiderspace On 1/16/96 12:35 PM, tcmay(a)got.net (Timothy C. May) at Internet-USA wrote: > I've been thinking a lot about the problems and opportunities that are > coming up as more and more "spiders" (Web searchers, crawlers) are > indexing directories and files on systems they can find. [snip] > Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of > hits, including what appeared to be several _private archives_ of parts > of the traffic. (By "private" I mean in the sense that they were > someone's personal archives, and not necessarily complete or even > semi-officially sanctioned.) [snip] > I've started to look for things like PGP files laying around buried in > subdirectories. I can imagine attacks based on this. [snip] > Fourth...left to your imagination. > --Tim May > We got computers, we're tapping phone lines, we know that that ain't > allowed. > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^756839 - 1 | black markets, collapse of governments. > "National borders aren't even speed bumps on the information superhighway." I gather that it would be a Bad Thing (TM) to have someone get both the encrypted and clear text forms of your message (from either you or from the recipient) Maybe regularly changing your encryption keys is a Good Thing (TM) Martin G. Diehl

1 0

Re: [NOISE] Re: Eggs at Customs (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 16-JAN-1996 00:12:29.92 >Morality has nothing to do with it. It's the speed of the evolution. If you walk across the straits, the system has the time to react and restore a dynamic equilibrium. If you immediately release a new species with no natural predators, the system is shattered, and it might not survive. This is not to say that ecosystems and societies are static -- they evolve constantly, displaying unpredictable punctuated equilibrium (Steven J. Gould was right, Edmund Burke and Karl Marx were wrong). ------------- A few things from the biological point of view (and I _will_ try to bring in a bit of cypherpunks relevance). First, if the ecosystem were as unstable as the Greens in the 1960's and later kept predicting (Silent Spring and all that), it would have collapsed already. Look at how many species we've taken out already. Second, almost all ecosystems that are that vulnerable (to extinction of a keystone species or to import of something that starts eating) are small ones that don't really matter in the long run. For one thing, the more biodiversity _within_ an ecosystem exists, the more likely it is that something from outside (or something removed from within) will have a control (or a replacement). In other words, there are fewer and fewer true keystone species as the internal biodiversity of an ecosystem goes up. ------------- [...] >Cute cuddly seals and frieldly dolphins and teddy bears get "sympathy" among mainstrean "environmentalists," and the Sierra Club and World Wildlife Federation calendars raise a lot of money, but it's the plants and bugs and bacteria that are really important. Elephants and blue whales look big and important to us, but they're really inconsequential in the larger scheme of biodiversity. They could go extinct and the planet doesn't really care. But kill the blue-green algae and the trees, and we're all dead. ------------- The algae? Sure, they're important... they're also thoroughly likely to not be affected significantly. One, they've got so many things acting on them in the first place. Two, there is quite a bit of diversity within the algal group. What takes out one strain (I have always had my doubts about "species" with mitotically reproducing organisms) is unlikely to take out the rest... and they mutate quickly enough to give rise to more strains pretty rapidly when one "niche" is freed up. The trees, on the other hand, are in the classification of "nice to look at but not really neccessary," like the elephants. They're a great carbon _sink_, but they don't really do that much CO2 recycling. And even if they were... we can replant trees very quickly. It's the rain forests and the old growth forests that are hard to replace as such. Cypherpunks relevance? Well, digital cash and encrypted messaging make it a lot easier to do the type of deals you're talking about... they also make it harder for people to place irrelevant prerequisites (like "not from rain forest land") on their purchases. So far, most of the anti-cypherpunks arguments have come from the conservative side. Be prepared for some from the liberal environmentalists (as well as the liberal socialists who want to keep lots of tax dollars flowing). -Allen

1 0

Re: new web security product
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 16 Jan 96 at 14:48, Perry E. Metzger wrote: : : "Ed Carp, KHIJOL SysAdmin" writes: : > I wouldn't pass this along normally, but it seems to allow folks to use : > their credit cards at home securely. Bye-bye, First Virtual... ;) : > : > http://www.cnn.com/TECH/9601/encryption/index.html : : I don't think its going to fly. No one wants to pay for an unneeded : $100 piece of hardware to encrypt the same credit card over and over : again, when a nearly zero marginal cost piece of software can do the : same thing. : I am not even sure it IS an encryption device. They say "Potentially vulnerable personal account information is scrambled or encrypted on the magnetic stripe on the card. It is electronically transferred through the hardware. That eliminates the need to say or "key in" the account number or expiration date. " It may just be a low cost? mag stripe reader... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPw78DUjeCeeebC9AQFmnAf/Sa/2jeRj/Oe7Vd5JEcIZZOIAhQK9XJI5 LQQGmKI9T2ZrzAeBI5eL+SdVvEs7PFqaW3tRVWaZDmW90uuL7qWcR732pRPOJ39k CL3SuHx0sUrPakjw2S+1JNZjLxQfgJNgMDGWLYVKIFvKPKjgUh2xAl6BagwaLJCa P5U4HwHWdmF8zQgBkFPzBKYYBZBJU7oqz2G9NV2H0cYtkQ2rZJS1sVk5ng8/RsYx b3Sw99WCBk9zVAy37NWKOJGlemk114ktgO4iL4iii23/lZR1zYhZDGJ+47ZPsSy7 Gt6JtQUWHzcnuQBoqwLYOog15GnWF9jIli/RK1K25wsDyCk5mMQsvA== =nW8l -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Certainly the game is rigged. Don't let that stop you; If you don't bet, you can't win.

1 0

Ozzie on Notes Crater
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Ozzie Outlines New Feature At RSA Data Security Conference San Francisco, Jan. 17 -- Ray Ozzie, president of Iris Associates, the developer of Lotus Notes, informed an audience at the RSA Data Security Conference here today that Notes Release 4, which began shipping this month, utilizes a new method of security called "differential workfactor cryptography." This new method allows the International Edition of Notes to use an encryption key equal in strength to the 64-bit key in the North American Edition, without the use of "key escrow" technologies. Ozzie explained that in the International Edition of Lotus Notes Release 4, whenever an encrypted 64-bit bulk data key is generated by the product, it is bound to a "workfactor reduction field," giving the U.S. government exclusive access to 24 of the 64 bits. When using the North American Edition of Lotus Notes within the U.S. and Canada, however, full 64-bit encryption is employed without the "workfactor reduction field." The two editions of Notes are fully interoperable. "We are very pleased to have arrived at a pragmatic short-term solution that addresses our international customers' requests for greater security within Notes," Ozzie said. "However, we continue to argue vigorously that, due to clear and present threats to our global information systems, all interests would be well served by widespread use of strong, high-grade cryptography. Without substantial rethinking of U.S. cryptography policy, particularly as it pertains to export controls, our global and national economic security is at risk."

1 0

A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

When WfW is installed, it creates a file in the Windows directory called WFWSYS.CFG. This is a standard Windows password file and may be decrypted with the password "23skidoo" (note that this is lowercase, since it's passed to the .PWL-handling code at a level which bypasses the usual password case smashing. The mangled 32-bit form which is passed to the RC4 key setup routine is { 0x67, 0x6F, 0xE3, 0x81 }). WFWSYS.CFG seems to be mostly identical for the few copies I could get to, and WfW networking won't work without it. Decrypting the file doesn't seem to give anything useful, the string "SYSTEM" and what looks like a few 8 or 16-numbers. I don't know enough about how WfW networking works, but my (very vague) guess is that it contains some sort of cookie to uniquely ID each machine for resource sharing over a network. If it does then it it's (yet another) pretty serious security hole, since it's encrypted with a fixed password and seems to be mostly identical over multiple machines. OTOH it may be something to do with serial numbers so you can't install the same copy of WfW on multiple machines on a LAN. Can anyone shed more light on it? Peter.

2 1