December 2003 - cypherpunks-legacy

Re: [rant] A thought on filters and the V-Chip
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 29-JAN-1996 11:02:03.09 >What parents are attempting to do when they restrain their children's access to "sex and drugs and rock and roll" (or Republicanism for that matter) is to mediate their "spiritual" environment to keep them from becoming hardened. They know the kids will grow up, they just want them to grow up in a nice way. ------------------- From what I've seen, kids are better off when they don't see the world through blinders/rose-colored-glasses. For instance, benign neglect is a lot better for children than overprotectiveness... I wish my parents (as much as I love them) had applied it to me, I'd have turned out a lot better. (I am also getting information from multiple psychiatrists and psychologists, including ones who (unlike me) have raised children). ------------------- >Children who listen to Vera Lynn's singing and Cole Porter's songs will end up quite different from those who favor louder, less vocal music. Note that in spite of what liberals might think, fundamentalist christians are less likely to divorce, less likely to report spousal beatings, less likely to kill themselves, and more likely to measure high personal satisfaction ^^^^^^^^^^^^^^^^^^^^^^^^^^ levels on standard psychological tests than are, say, readers of The Nation. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ------------------- Well, yes, someone with a blind conviction that they're going to someplace nice when they die, confidence that their intolerance is right, and other such ideas tends to have higher personal satisfaction levels. Also, this "personal satisfaction" is overrated... as Jack L. Chalker pointed out, a blade of grass is perfectly happy... even after it's picked. ------------------- >The cypherpunks relevance of all this is that it should soon be possible to create completely mediated environments for ourselves and our children. Through the use of implants and real-time VR processing, it will be possible to edit our "interface" with the Real World such that unpleasant aspects are edited out. We will be able to change the attire, hair, facial expressions, voice, and even smell of those around us to conform to our own esthetic desires. Likewise with our physical surroundings. Safety may discourage making a complete transformation in one's surroundings, but one can certainly soften the edges. --------------------- Sasha's enhanced reality or whatever it was called, yes. The cypherpunk relevance would appear to be more that there should be methods to get true information to kids (and those under repressive governments, which is about the same thing in most families) despite attempts to stop it. Anyone for posting (anonymously) some image viewers and pornographic site locations to one of the k12 groups? -Allen

1 0

Re: Escrowing Viewing and Reading Habits with the Governmen
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"trei(a)process.com" 29-JAN-1996 14:32:19.64 >The general reaction of the library community was, I am glad to say, entirely pro-privacy. -------------------- To their credit, yes. One application of this that others may be interested in is that ILL requests (I have been told) come from a library, not from a library's user. Thus, when I made one and got it back from the CIA's lending library (yes, they have one), they didn't know who I was... fortunately, given the book in question. Sort of a lesson for things like sites, et al. If all that someone can tell is that a IP or whatever request came from a particular site, then traffic analysis and other such things are disrupted. One way to do this would be to set up fictional accounts automatically to serve as proxies (relayed to the real account), which would make it impossible for a normal proxy-detector (lack of information or a particular set of information) to filter them out. -Allen

2 1

Nautilus?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I was wondering if some of you ever used Nautilus, if it was good, if it has a backdoor, etc. I am not knowledgeable enough to inspect source by myself. Any comments? Since the topic was probably discussed extensively, feel free to reply to me directly. Regards to all cyphering punks! JFA Why, you might wonder, is it that civil servants never look out through the window in the morning? What would they otherwise occupy themselves with in the afternoon?

1 0

CRAX Mix Rax
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

European Commission Moves To Stamp Out Racism On Internet Burssels, 31 Jan 1996 -- The European Commission (EC) has formed a pan-European group to "encourage the mixing of people of different cultures" from both inside and outside Europe. According to EC officials, the first task of the Consultative Commission on Racism and Xenophobia (CRAX), as it is called, will be to investigate and, using legal means, stamp out the current wave of racism on the Internet. In a prepared statement, CRAX said that it hopes that the EC "will take all needed measures to prevent the Internet from becoming a vehicle for the incitement of racist hatred." EC officials are soft-peddling on what legislation they plan to enact to back up the investigations of CRAX. Currently, apart from France and Germany, there is no specific anti-racist legislation. The laws of France and Germany were created in the aftermath of the Second World War in order to prevent the rising of the so-called "Fourth Reich," an extremist group which posts messages on the Internet, as well as running Thule bulletin board systems (BBSs) in Germany. According to EC officials, the Thule BBSs, which first appeared in 1991, started spreading the Neo-Nazi word on the Internet in late 1994, having established themselves as a means of information exchange in Germany and, to a limited extent, in France. As reported previously, the "Thule Network" first came to the public's attention when the January, 1994, issue of Chip magazine (a popular computer monthly in Germany) claimed to have unearthed eight Thule BBSs. According to Chip magazine at the time, "The (Thule) network distributes information on demonstrations and invitations to meetings, addresses for contacting parties and groups, and it reviews and offers books and magazines. One of the mail-boxes contained instructions for producing military explosives and letter bombs. A great deal of space is taken up by 'political discussions' among the users." Thule is Norse or Viking terminology for "top of the world." The Thule Network's name actually derives from the small, elitist 1920s movement which was considered to be the Nazi vanguard. Thule movement leaders included Rudolf Hess. Some BBSs on the Thule network have names such as "Wolf Box" and "Resistance," while many Internet messages are signed by people calling themselves "The Wolf," among other names. --

2 1

Re: Crypto-smart-card startup Inside Technologies
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 1/31/96 -0800, Peter Monta wrote: >There's an article in the January 29 _EE Times_ about a French >cryptographic-smart-card startup called Inside Technologies. >Tidbits: > > ..."In public-key cryptography, 512-bit keys are typical and > already vulnerable. So we are looking at 640-bit-long keys > supported by a scalable design." This kind of thing disgusts me. We already know 512-bit keys are weak. As I recall, I was told that 512 bit keys could be cracked in 20,000 MIPS-years. If the ballpark formula holds that adding 10 bits doubles the security, that merely means that 640 bits is 2**(128/10) or 8000 times strong. While obviously better than 512, it is not ENOUGH better to make me confident that this is a long-term secure length. 768 or 1024 bits should be considered the minimum. A deliberate design of 640 bits makes it look like it's intended to be crackable in 5-10 years, much as DES was suspected of a similar design decision in limiting its keylength to 56 bits.

2 1

Online Libel Rules
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

UK - New Rules For Online Libel Called For Wokingham, Bershire, England, 31 January 1996 -- CompuServe, Europe Online, and Microsoft Network (MSN), have banded together to lobby the British Government for a clear definition of the legal rules for online libel. In British law, libel is defined as a defamatory statement. Because of the "new" nature of online services, however, online libel is treated as something of a gray area as regard legal issues. In a joint submission to the Lord Chancellor's department, the three online companies claim that online service providers typically cannot control the content of messages that users of their services or the Internet, send. The companies are recommending that the online service provider not be held responsible for libels statements made online, unless the service provider has "reasonable notice" that a libels statement has been transmitted on to its system, and "has the ability and the authority to prevent" its publication, but "fails to do so" within a reasonable time. According to Andrew Gray, European business manager with CompuServe, the Chancellor's Department is currently conducting an extensive review of UK libel law to deal with a number of current problems. Based upon this review, the Government is expected to introduce new libel legislation this spring. "We applaud the Lord Chancellor's Department's efforts to bring the defamation law up to date. We hope that the upcoming legislation will deal effectively with the problem of libel that takes place over an online service or the Internet," Gray explained. Andreas Breijs, manager of Europe Online, meanwhile, said that online services are not like traditional newspapers or magazines. "These services are more like a railway train, where the operator may own the passenger cars, but has no idea what the passengers may be saying to each other, and no way of controlling their conversations," he said. Judy Gibbons, manager of Microsoft's MSN operating in the UK, said that the major online providers work hard to run responsible services. "They should not be penalized for the actions of unrelated individuals who might happen to make libelous statements using their services without the knowledge or consent of the service provider," she said. Alistair Kelman, a lawyer specializing in information technology (IT) affairs, said that he was not surprised by the online services' request to the Lord Chancellor's Department, especially given the current situation. "There is no case law on this subject and it is likely that a test case will come sooner, rather than later. The Government is keen on a clarification on the issue, as it is itself publishing a lot of its information on the Internet, in the move towards a more open and IT-relevant Government," he explained. Peter Sommer, an IT security specialist and Fellow of the London School of Economics, said that, far from being just another publishing medium, it was important that people understand that the Internet is very similar to a telephone line. "If I libel someone over the phone, you're not going to involve the telephone company, are you? It's the same with the Internet and some online services. Of course, if the online service has the ability to remove someone's comments and does not do it, then it's a different matter and that is what the definition by the Lord Chancellor's office is all about," he said. --

1 0

Active processes monitoring?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I'm running on a first generation 486 ISA 4meg ram Win 3.11 I use realdeal /commercial and wipeswap.exe in an *.bat that launch Win3.11 How can I detect if another process is running on my system? I use MEM /c in a dos window. But is that sufficient? Can a hidden process detect MEM loading and hide itself somehow? Are there others applications like MEM that are not as universal? (here, I guess that such stealth behaviour have to rely on identifying the program being loaded, thus, a less common program has less chance of being fooled) Thanks JFA

2 1

parallel encryption
by Simon Spero 17 Dec '03

17 Dec '03

Ok, so I've got my BeBox and so finally have an SMP of my own again; anyone want to suggest any cool crypto stuff that parallelises well? Rogaways hashs look interesting, and nDES offers an obvious process network for pipelining, but what about things like running multiple interleaved CBC streams in parallel, with each stream starting off from a different IV? I can't think of any practical ways of speeding up a single RSA operation, although twice as many processors obviously gives twice the thruput. Simon ------ "GM spent $3.6 billion giving birth to the Saturn, and it doesn't even go supersonic." - Ben Rich, Skunk Works head (75-91)

2 1

Re: The FV Problem = A Press Problem
by vin＠shore.net 17 Dec '03

17 Dec '03

Mr. Bornenstein's press release ("FV's position on Merc article") was egregiously self-serving and embarrassingly over-inflated. Yet, First Virtual's CC-focused keyboard sniffer ("...a program which completely undermines the security of every known credit card encryption mechanism for Internet commerce") and his postulated widespread stealth attack on unprotected consumer PCs highlighted an obvious -- but oft forgotten, at least in non-CompSec circles -- vulnerability. An encrypted link is only as secure as the CPUs at either end. Not an unimportant consideration as we plunge into Internet commerce; and surely a valid point for one vendor to make, if it suggests unrecognized risks in a competitor's scheme for consumer purchases and payments. Borenstein is handling his inevitable mugging in C'punks with zest and considerable aplomb; even including an apology for submitting his sensationalistic attack on crypto-based competitors to this List. Before folks leap from FV's text to damning the San Jose Mercury New's articles by Simson Garfinkel, however, they should pause and read or maybe re-read Garfinkel's three articles. <http://www.sjmercury.com/clips/> Mr. Garfinkel is probably the single most technically-literate journalist writing about computer security for mainstream (or trade press) media. His Mercury News article is precisely focused on FV's initiative in developing this demo program (a trojan screen saver) and the campaign by the Southern California company to use the demo to illustrate a relatively unguarded aspect of Netscape's SSL-protected credit card transactions, which have been widely touted as the be-all of Network Commerce. It was, as Garfinkel bluntly put it: "a direct attack against the security promised by Netscape Communication Corp.'s popular Netscape Navigator..." Mr. Borenstein later expressed his regret that Garfinkel had cast the story as a competitive attack, but IMNSHO Garfinkle was right on target: the FV campaign was a targeted bombardment of their most prominent competitor. And a campaign it was -- well deserving media attention. FV apparently carted their demo code and attack model back and forth across the country. FV gave presentations to NIST, NSA, the US Treasury, and the White House, according to Garfinkel. The only silly comment in Garfinkel's article was a direct quote from FV's Bornenstein: "One of the things we've heard from people inside government were comments along the line, 'We thought only NSA knew how to do this....'" (And if a world-class CompSec/UNIX expert like Garkinkel wasn't chuckling when he wrote that -- and expecting knowledgeable readers to giggle and grin when they read it -- I'll stew and eat my beaver hat!) The Merc's quotes from independent security experts -- commenting on FV's attack model -- were notably dry and balanced. Yes, the attack and threat vectors were real -- but, noted the American Banker's Association's Kawika Daguio: "It is a classic attack." "I've seen it, and I've seen things like it before," said Mr. Daguio. Nothing new. Matt Bishop, the UC prof, also sounded less than awed by FV's creativity: "There is no reason why one could not write a program to monitor keystrokes, look for numbers which look like credit card numbers, and sent them out over the Internet," in an unobtrusive way, to a thief elsewhere. (Prof. Bishop might have had more to say, had he been told it took a FV programmer a _month_ to write a keyboard sniffer optimized for credit card data;-) As a newcomer to this List, I have the impression that C'punks are a little jaded when it comes to mass-market CompSec and ComSec threats -- and perhaps a little rabid when it comes to anyone rash enough to suggest that the first mass-market crypto product (in the hands of naive consumers, with unprotected PCs and poor CompSec habits) may have dangerous procedural vulnerabilities. A little perspective, guys! Crypto from an insecure base has risks that deserve to be highlighted; and credit cards numbers are uniquely negotiable passwords. FV is scare-mongering, sure -- but that's combat marketing. Mr. Borenstein's press release posted in C'punks was chumming with raw bloody beef -- and that was just dumb -- but it was striking how blithely many folks here acknowledged (and immediately dismissed) the threat he described. Nothing wrong with FV trying to slow the bandwagon of a major competitor by drawing attention to vulnerabilities or potential vulnerabilities of their technology in a mass market. This happens a lot -- although most corporate perpetrators try to hide their hand a lot more than FV did, and they generally sound a lot less self-righteous -- but a little brawling is not a bad thing, particularly in IS security. (Some markets, like firewalls, desperately need a little more competitive clarity.) On the other hand, Mr. Borenstein's hyper-inflated presentation of First Virtual's case all but begged for the C'punk lynch mob that has followed him down through several threads on this List. If he didn't expect the reception he got, he should fire his PR advisor and get someone who knows how to write without the purple prose and napham. Simson Garfinkel and the Mercury News are getting a bad rap from folks caught up in the mob chasing Mr. Borenstein. Read the three articles. The on-line version has a headline that is a bit overwrought ("Program shows ease of stealing credit information") but overall, it's a credible, savvy, and amusing piece of journalism about FV. Quite professional, I'd say. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

FV has 91 day lag between sales and payment
by Vincent Cate 17 Dec '03

17 Dec '03

FV seems to be the only Internet payment mechanism that lets buyers quickly open an account and use their credit card to cover purchases. Anyone know of any others? The FV 90 day lag is their main downside in my opinion (though defaulting to not paying if the customer does not answer email is another problem). So FV does not take any risk at all - and a merchant has to have enough extra capital to let 3 months worth of sales sit at FV. Some ideas for ways that they or someone else could improve on this: 1) reduce the 91 days after a merchant had been a merchant for awhile 2) reduce the 91 days when sales were to long time customers 3) verify customers with letters/phone calls when opening the account and then with digital signature on sales - and give very short clearing time -- Vince ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 15:11:02 -0800 From: morehelp(a)fv.com To: vince(a)offshore.com.ai Subject: <960130/vinc0328078> (Lag between sales and payment?) Your question has been answered by a help operator for FIRST VIRTUAL (TM). The operator assigned to your question is op106 (Christopher Arndt), That operator, or someone consulted by that operator, has provided the following answer to your question: ---------------- Hello, We put an escrow hold on a seller's money for 91 days to protect ourselves from buyer credit card charge backs. We realize this can be inconvenient for some of our sellers, but at this time, that is how the system works. Federal Regulation Z of the Credit Card Regulations entitles credit card holders to a 90 period during which they can charge back any purchase. Though buyers are obligated to return the goods, this does not always happen. The credit card company is obligated by federal law to pay the buyer back, and it is the merchant who is left without payment. In our system, because it is First Virtual that has the merchant credit card account, not you, First Virtual is at risk of losing money when your buyers issue charge backs on your sale items. Because we do not conduct any credit checks on a seller, and because any buyer can charge back any charge, if we didn't protect ourselves with this 91 day hold, we could easily fall victim to charge back fraud. But once 90 days have passed, it becomes significantly harder for a buyer to make a charge back. And it is at this point that we feel that the risk of a charge back is sufficiently low that we can deliver your funds to you. We hold your money for 91 days for our protection, but the flip side is that we allow our sellers the freedom of being allowed to sell without having to go through a credit check. Virtually anyone can sell using First Virtual, and this opens up many possibilities for people who otherwise would not be able to sell products through major credit cards over the Internet. Thank you for your interest in First Virtual -- ************************************************************* ...one flew east, one flew west, one flew over the cuckoo's nest... Christopher Arndt First Virtual Holdings carndt(a)fv.com http://www.fv.com ************************************************************* ---------------- You may communicate further with our operator by replying to this message. If you are unhappy with the service you get from operator op106, you may send mail to "helpescalator(a)fv.com". Your original question is included at the end of this message. Thank you for using FIRST VIRTUAL!

2 1