December 2003 - cypherpunks-legacy

Re: Duress
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:49 PM 3/3/96 -0500, Dr. Dimitri Vulis wrote: >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. The air-transport system has had a Hijack transponder code for years. The pilot dials it into the air traffic system radar transponder when the plane is hijacked. However there is a problem. One of the private pilot magazines reported that a small plane operator used the code (because his airplane was, in fact, being hijacked). When he landed the airplane, it was surrounded by LEA, and in the ensuing gun battle, everyone on the airplane died. The went on to say that the safety of the passengers and airplane are the pilot's primary responsibility and that pilots should consider this incident when deciding to use the code. Duress codes need to be designed to minimized the chance of such responses when they are used. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 4

Re: (Fwd) Gov't run anon servers
by Hal 17 Dec '03

17 Dec '03

I have run two remailers for about three years now, and I have never been contacted in any way by law enforcement or government people in relation to the operation of the remailers, or of any mail which has been sent through them. I get a fair number of complaints by private individuals, but I have never heard anything from the government. However, if I were a computer-savvy law enforcement agent, and I wanted to track messages through one of my remailers, I would try a technological approach. I would first break the key for my remailer. That is trivial. The passphrase is in PLAINTEXT in the script file which runs the remailer!. It has to be. That is true of all automated remailers. Anyone who can break into the remailer server and acquire root permission can find the remailer secret key. My keys have been unchanged for three years. Surely some enterprising hackers have stolen the keys by now. (That is why my keys are only < 512 bits.) Then the LEA has to insert mail-monitoring software somewhere either in the remailer system or on some connection to it. That is probably more difficult and may require cooperation from a system manager somewhere. I don't really know how hard it would be. But breaking the key is the easy part. Hal

2 1

FUD about Remailers--the Strassman/Marlow "Revelations"
by tcmay＠got.net 17 Dec '03

17 Dec '03

I didn't imagine that people would take the off-the-wall assertions here seriously, but "Anonymous" seems quite worried, so some comments can't hurt. At 4:40 AM 3/4/96, Anonymous wrote: > >>Both presenters explicitly acknowledged that a number of anonymous >>remnailers in the US are run by government agencies scanning traffic. >>Marlow said that the government runs at least a dozen remailers and that >>the most popular remailers in France and Germany are run by the >>respective government agencies in these countries. In addition they Oh really? And just which remailers are in France and Germany? (Raph's list doesn't show any ".de" or ".fr" sites, at least that I could see. It's possible that a site or two exists in France or Germany, but I'm skeptical. And certainly the "the most popular remailers in France and Germany" is an odd comment.) There are of course remailers in the Netherlands (Hacktic, for example), and Julf's site in Finland. Perhaps Marlow mistook these countries for France and Germany? In any case, the claim that the few sites in Europe are "at least a dozen remailers" and that they are run by the intelligence agencies of France and Germany is specious. I consider it unlikely that the remailer operators are working for the spooks. (Something to consider in the future, and even to be thoughtful about now. But unlikely at this time, with the current players, for various reasons.) Further, as with other recent comments we've seen, the authors seem to misunderstand the nature of chained remailers. These errors, plus the apparently slapdash way the article was cut-and-pasted together (from the Web pages of others, usually without acknowledgement), plus the scare tactic tone, makes me dismiss the entire "paper." >>mentioned that the NSA has successfully developed systems to break >>encrypted messages below 1000 bit of key length and strongly suggested >>to use at least 1024 bit keys. They said that they semselves use 1024 >>bit keys. As others have also noted, just FUD to confuse and scare. > I don't know about everyone else, but I consider this, if true, to be a >MAJOR worry. It never ceases to amaze me how lightly the government takes >lying to the people. Unfortunately I don't have the contacts or resources >to do any further investigation, I hope this thread is resolved one way or >another soon. > >nobody@unimportant "Investigation" can be done by doing what I just did: looking for these supposed "dozens" of the "most popular" remailer sites, looking for them in France or Germany, and not finding them. (Maybe they're secret, known only to CIA, SDECE, and BND operatives? The operative word being "paranoid.") --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Looking for code to run an encrypted mailing list
by John Pettitt 17 Dec '03

17 Dec '03

I'd like to run an encrypted mailing list - the model I'm linking of is this .. Poster cryptes mail with pgp using list exploder key. List exploder decrypts mail and recrypts with keys for all current list members and then sends the mail. [I don't want all the list members to need to know every other list members public key] Before I lanch into hacking majordomo - has anybody done this already or somthing like it ? John -- John Pettitt email: jpettitt(a)well.sf.ca.us (home) jpp(a)software.net (work)

3 2

Re: (Fwd) Gov't run anon servers
by jim bell 17 Dec '03

17 Dec '03

At 10:52 AM 3/4/96 -0800, Hal wrote: >However, if I were a computer-savvy law enforcement agent, and I wanted >to track messages through one of my remailers, I would try a >technological approach. I would first break the key for my remailer. >That is trivial. The passphrase is in PLAINTEXT in the script file >which runs the remailer!. It has to be. That is true of all automated >remailers. Maybe I just don't know much about automated remailers, but I don't understand why you said that the passphrase "has to be" in plaintext in the script file. I find this hard to believe. While I am far from an expert on cryptographic matters, I would assume that any received attempt at a password could be securely hashed (128 bits?) and compared with a pre-stored hash value. If it's the same, it's assumed that the password was correct. What's wrong with this?

2 1

Not a good idea...
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:35 PM 3/7/96, owner-cypherpunks(a)toad.com wrote: >I wonder whether they've actually considered the liability situation >in re: blocking sites that shouldn't be blocked? I mean, sure, they >seem nice enough about setting things right (like with the Nynex sites >whose url's had "xxx" in the paths), but it seems to this non-lawyer >that a case could be made for damages inflicted by being known as a >purveyor of filthy indecency for even a short while. We need to be very careful here. A service like "SurfWatch," voluntarily used by others, has entered into no contracts with sites to meet defined standards of what should and shouldn't be blocked. It is essentially a "review" service, like a reviewer of books, movies, restaurants, etc. Sure, some books, movies, and restaurants are "hurt" by negative reviews, but this is life in a free society. It has not yet reached the point in these Beknighted States that a bad review can be the basis of a tort (though I could be wrong...nothing would surprise me these days). Let me use myself as an example. "TimWatch" offers to inform people of sites he thinks are not desirable for them to visit. I freely admit that my criteria are imperfect, and people can choose to follow my advice or not follow my advice. I may even sell a software package ("TimWatch") to let users screen sites at their own machines. Now, do we as Cypherpunks really think TimWatch or SurfWatch should be liable for "damages" because someone got their feelings hurt? Absent a contract, spelling out the performance expected, of course not. If SurfWatch can be sued for a "bad review," then Siskel and Ebert had better find a new line of work. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 4

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- someone wrote: >[homepage on IO] > >BTW, did you hear that IO got on the SurfWatch "bad list" because there >were more than 25 complaints about objectionable material in the io.com >domain. (Apparently, when SurfWatch hears more than 25 complaints >against a particular domain, the just deny access to the whole domain >rather than particular URLs.) A quick phone call to the Surf Watch people revealed that they rarely block whole domains, and that they are not currently blocking all of io.com. - -- mutant(a)compuville.com "They that can give up essential liberty to mutant(a)cypher.net obtain a little temporary safety deserve (send mail with Subject: neither liberty nor safety." send-pgp-key for PGP key) -Ben Franklin ~1784 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMT9NaH0ndmRPxibdAQFSJwQAtq/s1c+GZlHvgVOhNgM8Dseq0SQ+6L8U bx8FV0l85anNk+fjRnY5hD8RflHFeVzLis2yDmn8BLjYzVnHBEWBXXncpwg3okoQ FOMJJTZZbOec10ESy3pvRPwgie60IaR3qIcHUmUHRqbv5dOjgDg5GhYWeZ8rhCCN 0pisfaQBsVc= =qgSw -----END PGP SIGNATURE-----

1 0

NYT on Crypto Bills
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, March 4, 1996, p. D4. Compromise Bills Due on Data Encryption Industry Opponents and Civil Libertarians Are Lukewarm, at Best By John Markoff Legislation will be introduced in the House and the Senate tomorrow in an effort to break the deadlock between the computer industry and the Clinton Administration over the control and export of software and hardware used to scramble electronic data. So far, though, the proposed measures have received only cautious endorsement from industry executives, while civil-liberties and privacy groups say they are worried that the bills would enable the Government to decode scrambled transmissions. Senator Patrick J. Leahy, Democrat of Vermont, and Representative Bob Goodlatte, Republican of Virginia, plan to introduce similar bills that affirm the right of Americans to use any type of data-coding equipment without restriction and prohibit the mandatory use of special keys that would allow law-enforcement agencies to read scrambled data. Their bills would also make it a crime to use encryption technology in committing a crime and would permit the export of data-coding software and hardware if similar technology was available from a foreign supplier. Data-coding, or encryption, technology is based on mathematical formulas that rely on the immense computing challenge inherent in factoring large numbers. Until recently, such technology was largely used by military and intelligence organizations and by some corporations like banks. As electronic mail and commerce have become increasingly accessible, however, the technology has become more controversial. In April 1993, the Clinton Administration proposed a national data-encryption standard known as Clipper, based on a system that would have made it possible for law-enforcement agencies, if authorized by a court, to decode private voice and data communications. The Clipper initiative has been strongly opposed by industry executives and privacy advocates. They argue that reliable coding technology is essential for commerce and privacy protection on the Internet. They also say that strict export rules are increasingly hindering the ability of United States corporations to compete with foreign suppliers. The proposed legislation would ease some current restrictions on the exporting of data-coding systems, but civil libertarians still see areas of concern. "The bills relax export controls, which is clearly a step in the right direction," conceded Marc Rotenberg, director of the Electronic Privacy Information Center, a Washington research and policy organization. But the negatives, he said, were that the bills opened the door to Government access to private transactions "and criminalize the use of cryptography when it is used to perpetrate a crime." Industry officials said they expected the legislation to stir little enthusiasm from corporate users. "Corporate America is absolutely unwilling to give a third party control of their data," said Jim Bidzos, chief executive of RSA Data Security, a maker of encryption software based in Redwood City, Calif. [End]

3 4

WARES - random generator
by Alan Olsen 17 Dec '03

17 Dec '03

This may be of interest to people on the list... >Keywords: madison hawai obsceni prising ridblood ribiliss >Subject: WARES - random generator >Reply-To: email(a)fringeware.com (FringeWare Inc) >Date: Tue, 5 Mar 1996 11:06:20 -0600 >Apparently-To: fwlist-daily(a)fringeware.com >X-UIDL: 4751f2738fffe6a83cf40be20fcd79a5 > >Sent from: email(a)fringeware.com (FringeWare Inc) > >A certain vendor of ours has approached FringeWare with an offer for >exclusive distribution a new product, which may be of general interest >to people reading this list. > >The product line is called Perfect Crypt Products and the new item >being considered is a random number generator which plugs into the >serial port of your PC/Mac/Sparcbook/Cray/etc., and pours out a stream >of random numbers. The process is based on thermal radiation, the >randomness looks quite good, and the product would retail for about us$50. > >If you have an interest in such a product, please let us know here >at: email(a)fringeware.com and we'll add it to our catalog. > >One-time pad enthusiasts and PGP officionados might consider this >offer especially. > > >----------------------------------------------------- >pxn * FringeWare Inc. * http://www.fringeware.com > > > > > --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> In a statement from Washington, the America's Carriers Telecommunication >Association says it "submits that it is incumbent upon the FCC to exercise >jurisdiction over the use of the Internet for unregulated interstate and >international telecommunications services." > "For example," adds the ACTA statement, "online service providers generally >charge users around $10 for five hours of access and then around $3 for each >additional hour. Five hours equals 300 minutes, divided by $10 is 3.3 >cents per >minute. The average residential long distance telephone call costs about 22 >cents per minute or seven times as much." It seems that once again, big business is trying to get in the way of progress and competition because they are afriad they are going to lose some money. It seems to me that the ACTA is upset because someone found a way to "do it cheaper" and the telco's stand to lose a lot of long distance dollars. So rather then using this technology and perhaps lowering LD rates, instead they seek to block out the technology from the public. I wonder what would happen if someone discovered an drastically cheaper alternative to gasoline, but it never made it main stream because the oil companies would go out of business. Seems like the same type of situation with the telco's. > Says ACTA, "Technology may once again be surpassing government's ability to >control its proper use. However, the misuse of the Internet as a way to >'by-pass' the traditional means of obtaining long distance service could >result in a significant reduction of the Internet's ability to transport >its ever >enlarging amount of data traffic." No, the technology is surpassing the telco's ability to provide low-cost communications. > Specifically, ACTA petitions the FCC to define the type of permissible >communications that may be effected over the Internet. Permissible communications? This sounds like something out of the CDA ... I say, just try and regulate it. I want to see the FCC try and monitor several million computer transmissions every day and see how well regulation works. Thomas J. Sawyer sawyer(a)nextek.com

1 0