December 2003 - cypherpunks-legacy

Re: "Concryption" Prior Art
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

It occurs to me that such a combined form would be useful for the idea of having a message that can get multiple results depending on the passphrase used. One example might work as follows: A section of data is placed at the beginning of the encrypted material. When it is decrypted or encrypted (depending on how one wants to work things) with a given passphrase, it turns out a series of bits, reiterated as needed. Each x bits is used to say how far along in the encrypted material the next piece of information making up one encrypted message (using the same passphrase) is. If you put in a different passphrase, you get a different series of bits, and thus use a different set of information for the encrypted material. The The major problem that I can see with this scheme is overlap between messages. I would guess that one would need to keep coming up with different data sections until one originated that wasn't a problem. How long this would take would depend on the value of x and how long the data section was. However, this should only need to be done once for a given set of passphrases and the corresponding key (used for all of them). Any alternate suggestions? Not being a programmer, I have no real idea how to put this concept into practice. (And, moreover, someone else came up with the idea of multiple data sets from a given encrypted message; I am simply suggesting a potential mechanism). -Allen

2 1

Downsizing the NSA
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:33 PM 1/27/96, hallam(a)w3.org wrote: >They probably should do, the NSA was critical in ensuring the demise >of the USSR and in maintaining stability throughout the cold war period. > >The point is not that the NSA had no military function. The point is that >it is now an agency searching for a role. It is often a dangerous thing >for the military to involve itself in civil affairs. I agree with this strongly. From my readings about the NSA in particular and SIGINT in general, they played a valuable role in the 1950-1990 Cold War period. (I'm not so sure a world war would have resulted in some alternate history where the NSA did not exist, but I suspect things might have been more chaotic and that war might have been likelier. I am thus prepared to give credit to the NSA where credit is due.) However, as Phill notes, the NSA and other intelligence agencies are now in that most dangerous of positions: a powerful agency or department casting about for something to do. Spying on citizens and keeping the keys to their private communications and diaries is not an appropriate option. AT&T is downsizing, IBM downsized a while back, so why couldn't the NSA just do the right thing: admit that the Soviet threat is no more, congratulate the victors, and downsize by 20,000 employees? --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 4

Re: NRO Slush Fund
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>Spy Agency Said to Have Spare Billions Sad to think that the undersecretary for defense who used to have oversight of the NRO is now the Secretary of Defense. One would guess he is trying not to pick up any bricks right now

2 1

Re: [rant] A thought on filters and the V-Chip
by jim bell 17 Dec '03

17 Dec '03

At 06:38 PM 1/26/96 -0800, Rich Graves wrote: >On Fri, 26 Jan 1996, jim bell wrote: >> On the other hand, this would be an EXCELLENT "argument" to bring in front >> of a Congressional committee considering the adoption of any V-chip type >> proposal. Once they discover that a ratings system could be used for the >> diametrically opposite reasons of their reason for having it in the first >> place, they'll try to modify their proposal to prevent this. >> >> If we're lucky, this'll have the effect of killing the whole concept of >> government-sponsored (required?) V-chip-type technology. >> >> OTOH, I agree with other posters who think that truly voluntary content >> selection would be an excellent addition to television: In effect, an >> automatic, programmable TV-Guide search engine. > >While it's hard to find a general theme here, I think I disagree. What? You mean you LIKE to read TV guide every week, cover to cover, in advance, to scedule your TV viewing habits? >Anyway, >I don't think that even truly voluntary content selection is a good idea, >because it reduces art to numbers, which is wrong. Aw, admit it. You're just still pissed 'cause I called you a f------ statist. <G>> Me, I'd like to be able to tell my "TV-Guide search engine" to: 1. Look for this particular show or movie. 2. Look for this particular star, director, or other participant.. 3. Follow a subject thread, say on the news. 4. etc. Maybe even a more complex (artificially intelligent) agent that "knows" me well enough to anticipate my desires. > lead to a balkanization that diminishes the common >culture. I think it was good the way network TV was limited to the lowest >common denominator, but with variety. People who wanted something with a >little more flavor than WonderBread [tm] were able to find it, but they >did have to look, which often involved *meeting other people* with common >interests, and they still tuned in to Ed Sullivan to see what the Joneses >were watching. Give people 1024 bits' worth of channels to choose from, >classified by arbitrary criteria involving no human contact, and you get >something entirely different. I'm not sure what's happening now, but I >don't think I like it. You're entitled to NOT like it. But I'm equally entitled to use modern technology to sift through 60+ cable channels, or 300+ DSS-type channels.

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:53 AM 1/28/96 +0100, Alex de Joode wrote: > >Belgian TV (the dutch language channel) has a page on teletext (Ceefax) >[I don't think US tv has that feature] stating that the French backbone >is thinking about blocking sites that provide information that they deem >ethicly unacceptable, like sites that promote the denial of Konzentrations >Lagers, the extreme right, pornografic and pedophile sites. > >[page 128 BRTN, for those who can receive BRT] > > What about "the extreme left." Don't those people deserve to be blocked too? And how about US radio stations on RealAudio 2.0. Cultural Imperialism. So how do we overcome these "backbone blocking" maneuvers? DCF

2 1

Re: Over-reacting?
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:38 PM 1/28/96 -0800, jim bell wrote: >At 05:42 PM 1/28/96 -0800, Timothy C. May wrote: >>We already have enough traffic here, and don't need replies from a bunch of >>other lists, be they libertarian lists, digital commerce lists, human >>rights lists, or java lists. >> >>The latest example of this is the rantfest invvolving these players: > >I really don't know why I'm being "killed" by May in this way. He cites a >rant by a local (Portland, Oregon) crackpot named "Jack Hammer." I even >took the time to apologize for his existence, while I do claim a certain >lack of responsibility: Basically, I'm being targeted because Hammer can't >stand my essay. (Whether May will even see my apology is in doubt, I >suppose...) While May certainly has the right to "killfile" whomever he >wishes, it might be a bit more logical to do this in a graduated fashion, >"killing" Hammer and then waiting to see if the rest of us follow in his >habits. The reason for the killfiling is your habit of adding multiple additional mailing list into the To: and cc: list. I have seen more than one post where you have added a Libritarian list and the "Democracy Now Channel 2' list into the fray, not to mention other individuals. THAT is why you are getting the golden killfile, not your association with Jack "Acid" Hammer. (Though that may help...) The only individual I have killfiled (so far) is Dr. Fred. (At least on mailing lists. Usenet is another matter...) Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:42 PM 1/30/96, Jonathan Rochkind wrote: >I'd say _all_ news, not just software news, is P.R. controlled, these days. >You can largely hold Edward L. Bernays, the "father of public relations" >(who just died last year) responsible for that--or the societal conditions >that allowed Bernays to do his thing. Bernays developed expertise in >"engineering of consent" turned the news into a commercialized and Interesting term, similar to Chomsky's "Manufacturing Consent" (which obviously must've come later...). >Now, the news you read is manufactured in press releases to sell a product, >and is there because a well written press release convinced a reporter or >editor that a marketting ploy was actually a newsworthy event (or, perhaps, >because the advertising dollars that went along with the press release >convinced him). Witness FVs demonstration of key capture becoming a >newsworthy event. Maybe I've from the old school, the school that says one should be more modest, objective, and circumspect. Then, if it's really news, and not just a PR scam, the journalists will come. (Understand that I'm not saying I'm sort sort of paragon of modesty. Far from it. But I try to control myself.) I think that the view that "all news is hype" is overly harsh. In fact, corrective forces tend to slow this headlong rush into P.R. For example, the reaction here to the Nathaniel Borenstein/First Virtual hyperbole, and the fatuous, credulous article by Simson Garfinkel (sorry, Simson, but I call 'em as I see 'em), will undermine their credibility for a long time. Crying wolf, and all that. The FV "discovery" that insecure machines can cause all sorts of problems rated at most a brief paragraph in the papers, not the full-page treatment Garfinkel and his editors gave it in the "San Jose Mercury News" (and maybe other papers that picked it up, or will in the next few weeks). Newspapers and magazines that run "fluff" pieces, taken almost directly from press releases, lose credibility. (Nathaniel B. claims that the Simson G. piece ran _first_, before his Press Release. Well, how did Simson first learn of the FV "discovery"? How did the FV President arrange to be photographed? It seems pretty clear to me that FV was involved in the development of the story, perhaps even planting the seed for it. Not necessarily a dishonest thing to do, of course, just a bit tacky given that the "discovery" is not news. >If you want to effect what's in the media, maybe you should learn how to >issue press releases. Nope. I think it a very poor model for getting information out. With all due respect to Sameer, who has done many fine things, I gag every time I see a press release from Community Connection in which Sameer interviews himself. Or, put another way: [Embargoed for release until Jan. 30, noon PST] Crypto Anarchy Foundation Releases Views on Self-Interview Press Releases Corralitos, CA. The Crypto Anarchy Foundation, the world's leading think tank on crypto anarchy, today is announcing its views on press releases. According to Crypto Anarchy Foundation founder and President, Timothy C. May," "We think these press releases are a phony means of pumping up a story." When asked for more details, he added: "The self-interviews are really tacky. Can't you ask me some better questions?" The Crypto Anarchy Foundation, the world's foremost provider of information about crypto-mediated anarcho-capitalism, may be reached at 408-728-0152. CAF spokesperson Tim May can arrange interviews with CAF founder Tim May. --Tim May, CAF founder, chief technical officer, and media relations specialist Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by Weld Pond 17 Dec '03

17 Dec '03

Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >> Programs needing secure entry create a "secure entry field" which is >> really just an imagemap with the digits (and alphas if required) placed >> randomly about. The user then uses the mouse to click on these numerals. >> Ideally the graphics that represent the numerals would be drawn from a >> random pool and are misformed to thwart any OCR attempts. The graphics could >> be made even more difficult to OCR by mixing in words and pictures to >> represent the numbers. >If any particular program for doing this came into widespread use, we >could engineer an attack, similar to our keystroke attack, based on the > specific properties of the approach used. You could try but I don't think you would succeed. I have problems doing OCR on faxes with a top of the line OCR program. Don't tell me your trojan horse is going to be able to OCR images that are designed to be hard to OCR. Here is an example of an imagemap for secure number entry. http://www.l0pht.com/~weld/numbers.html Since this is inherently a visual thing, I thought I would cook up a graphic on the web siince you cannot do this via email easily. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio L0pht Open House 2/3/96 at 8:00pm - Live on irc #l0pht - write root(a)l0pht.com for details.

4 3

Apology and clarification
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

First of all, I believe that I owe the cypherpunk community an apology for an error in judgement on my part. The message that I sent out yesterday regarding our demonstrations of a newly-discovered security threat was the exact same text that I sent to a far less technical audience. As such, I understand that many people on this list found the tone of my message to be insulting and offensive. I apologize, and I certainly didn't mean to insult anyone's intelligence. Having said that, please cut me a break. If you read my message as saying "FV has just invented keystroke sniffing" you've completely missed the real attack here. If you really think I'd throw away my reputation on a bogus claim like that, you're insulting *my* intelligence. My (charitable?) take on it is that a lot of people were so put off by the tone of my mass-market message that they leapt to the quick but erroneous conclusion that there was no underlying content. There is. The threat is NOT from keystroke sniffing per se, and we're certainly not claiming to have invented keystroke sniffing. However, we do have to *explain* keystroke sniffing in the public announcement, because it is a *part* of our attack, and most of the public does NOT already know that it's possible. What we at FV have done is to demonstrate how easy it is to develop an FULLY AUTOMATED attack that undermines the security of all software-based credit card commerce schemes. It is the automated aspect that separates it from all of the "dumpster-diving" attacks on credit card numbers which have previously been widely discussed, because it provides a path to large-scale fraud that has never been publicly discussed before, to my knowledge. The key "invention" in our approach is to integrate several techniques that are already well-known (in this community) into an automated attack that we consider to be devastating to commerce systems based on software-encrypted credit cards. Our approach combines the following four known problems into a fatal attack: 1) Consumer machines are insecure and easily compromised. 2) Keyboard sniffers are easy to write. 3) Credit card numbers are self-identifying (they have check digits) and can easily be extracted from a huge stream of input data. 4) Once intercepted, small amounts of information (e.g. a cc #) may be distributed completely tracelessly over the Internet. When you put all four of these together, you have an attack that IS new, in the sense that nobody we know of has ever mentioned it before, and which could in fact be used by a single criminal, with only a few weeks of programming, to tracelessly steal MILLIONS of credit cards, if software-encrypted credit-card schemes ever caught on. This is a very real threat. If you think we're just re-hashing keyboard sniffers, you haven't yet understood what we're demonstrating. The real threat is the traceless theft of millions of credit card numbers by a single easily mounted automated attack. So here's the factual claim, to be proven or disproven: One good programmer, in less than a month, can write a program that will spread itself around the net, collect an unlimited number of credit card numbers, and get them back to the program's author by non-traceable mechanisms. Does anyone on this list doubt that this is true? If so, I'd like to know the flaw in my thinking, -- I am *not* too proud to withdraw any claims that aren't true. If not, I think it's worth noting that this fact was previously completely unknown to the bankers and businessmen who are putting large sums of money at risk on the net. The only way to get the message to those communities is with a very visible public announcement of the kind you saw yesterday. -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

3 5

AOL privacy (not)
by Edgar Swank 17 Dec '03

17 Dec '03

AOL RECORDS USED TO SOLVE MURDER CASE Fairfax County, Va. police recently obtained a search warrant for electronic files relating to participants in an American Online chat room in an effort to solve a murder in New Jersey. The victim had met his alleged assailant through a "men for men" chat room, and investigators say several other chat room participants helped in disposing of the body. One of them, a 24-year-old woman, is now charged with tampering with the evidence. An AOL spokeswoman said that it is the company's policy to comply with subpoenas, and that although it does not keep records from chat rooms, it does keep records of e-mail for five days before they are purged. "We certainly respect and abide by our customers' right to privacy, but we are also going to follow the law. We have 4.5 million customers -- that's the size of a city. When we have some problems, we have to deal with it responsibly." (St. Petersburg Times 28 Jan 96) *************************************************************** EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Emmitt Smith (assuming that your name is Emmitt Smith; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.) -- edgar(a)Garg.Campbell.CA.US (Edgar Swank) The Land of Garg BBS -- +1 408 378-5108

1 0