December 2003 - cypherpunks-legacy

Re: TCP/IP Stego (was CU-SeeMe)
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-08 03:39:00 EST, you write: > -It can be applied by two routers which are in the middle > of the connection. The two endpoints of the TCP/IP > connection would not even notice. For example, if I control > a router "upstream" of a major connection point and the > site I wish to communicate with is in a similar position > then I can run the subliminal channel in a "spread spectrum" > mode across many connections and the packets can get reset > to their original settings by the other site. The user > whose stream we fiddled with does not even know that they > were used as carrier wave... You seem to be oblivious to the fact that this technique is only useful for ISP's, corporate networks, etc. that the average home computer user will never have access to. If I want to send a WAV file of my 2 year old son saying "Hi, gramma" (or a 24-bit color TIFF of him practicing nose-picking techniques) to my relatives, that is not overtly suspicious behavior, even if it has a slight amount of background noise (or graininess). As long as I don't stego too many bits in the file, and I strip out any overt "I'm crypto" headers, it will be impossible to prove that stego techniques were used on a file. Finding random bits where random bits normally live cannot be used to prove anything.

1 0

Re: Looking for code to run an encrypted mailing list
by Powers Glenn 17 Dec '03

17 Dec '03

- > I'd like to run an encrypted mailing list contact colossus(a)colossus.net they've already hacked majordomo to do this. please mention gpowers(a)meaning.com sent you. yes, this is an ad. but, two people have already asked and i figured there might be more. glenn

1 0

Artist self censorship (Was Chinese net-censorship) Noise
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Excerpts from internet.cypherpunks: 8-Mar-96 Re: U.S. State Dept critici.. by JFA T. QC, Canada@citene & later Declan B. McCullagh. >> There is no such thing as "self-censorship". Either you stick to >> your values, and then it is *not* censorship, or then you do not, >> and then, it is neither. >Self-censorship does happen, and it's a growing problem in the arts >community. (I'm not a commercial artist, so this is my understanding >from other panelists and speakers at a conference I spoke at last month.) >Making art more palatable or less "extreme" to curry favor with >corporate patrons, or to get that NEA grant, or to get that faculty >position is self-censorship, and it does happen. There is a photographer by the name of Jock Sturgis who is famous for his photographs of naturalists and their children on the beaches of California and France. Sturgis' home was raided by the FBI and all of his photographs, equipment, & records were seized under suspicion of producing child pornography The photo equipment, records, and photographs were returned but not after making Sturgis' life a living hell... Sturgis' work which has critical acclaim throughout art circles and has published two books profiling naturalists, has been quoted to saying that before taking a picture he usually asks himself about how this picture is percived, something the he never thought twice before the FBI raid. Mr. Avon should think twice before commenting on self censorship does not exist, for that could be the difference from having the door kicked in by the black ninja turtles with the FBI or toning down your work. --

2 1

Re: Signature 2
by mccoy＠communities.com 17 Dec '03

17 Dec '03

>Hi, > >> Assumption 1 : a privacy key can become uncrackable. >> Assumption 2 : an individual signature can become immune to fraud. >> Posit : fuse the two together so that pseudonyms/aliases/online names ensure >> complete privacy, but ensure that you talk to the same person >> everytime. >> Probably proposed already. > >Unforutnately both of your assumptions are wrong. A key cannot be >100% uncrackable, and a signature cannot be 100% immune to fraud. >With electronic security, there is always a chance that a key can be >cracked or a signature forged. The question is how hard is it to >crack the key or forge the signature? You need to balance the >security with the price. Derek is correct in that your use of the words "uncrackable" and "immune to fraud" were a bit over the top (in recent years everyone in the security and crypto community has become very nervous whenever anyone says things like this; they are usually trying to sell you something which is neither.) OTOH, he might want to temper his statement with a reference to fail-stop signatures... Just because someone with a lot of computational resources can produce a private key which matches your public key does not necessarily mean that they are the same ones that you generated, only that they found a set which work for the particular modulus which was chosen... In the "real world" there is nothing to prevent someone from forging your real signature on a check or document or from disguising themselves as you and taking your place at an important business meeting. The digital equivalents can be slightly more secure, but nothing is ever perfect. jim

2 1

This is my support letter to Sen Leahy
by B. Schneier 17 Dec '03

17 Dec '03

************************************************************************* This is a temporary e-mail address; I am in Cambridge until 12 March. Continue to send mail to schneier(a)counterpane.com; it forwards by itself. ************************************************************************* March 1, 1996 Hon. Patrick Leahy United States Senate Dear Senator Leahy, I would like to thank you for introducing the Encrypted Communications Privacy Act. As a member of the computer and information security research community, I am keenly aware of the vital role of cryptography in fostering the development of our information infrastructure. As the author of the book, "Applied Cryptography", I have unusual insights into the absurdity of cryptography export restrictions. It is not without irony that one may export my book in paper format, but not electronically. Presumably no rational person believes that the current restrictions actually prevent the spread of cryptography. I believe you recognize this, as evidenced from the strong stance taken in your bill. As the bill recognizes, we can no longer afford to hold on to the obsolete notion that cryptography is the sole province of government communications; the growth of modern networks has irrevocably pushed it into the mainstream. I applaud you leadership towards codifying these principles in a balanced and responsible way. In particular, the bill: o Removes the regulatory strangle-hold that has encumbered the development of mass-market security solutions; o Recognizes the futility of applying regulations intended to control the international arms trade to even the most mundane and commonly available software; o Encourages public confidence in encryption by allowing the marketplace to provide a full range of choices for privacy and security needs; o Recognizes the special obligations of keyholders to be vigilant in safeguarding the information entrusted to them, without imposing hurtles on the use of cryptography; o Allows the United States to continue its leadership role as a technological innovator; o Acknowledges the pivotal role of cryptography in electronic commerce. I continue to have concerns that the new criminal obstruction provision will discourage law abiding citizens from using cryptography. I hope that legislative history and further discussion will demonstrate the narrow intent of this crime. Overall, your bill takes very necessary strides towards ensuring that the protections we take for granted in traditional media keep pace with technology, and I commend your efforts. Sincerely, /s/ Bruce Schneier

1 0

Re: Jump Start ecash With IPhone
by eggplant＠inlink.com 17 Dec '03

17 Dec '03

How about...only paying for the initial investment of the phone program and hardware. No more costs to pay, get rid of long distance charges all-togther. Except for the ISP charge of course. And how about the ISP's setting up a special account for people only needing the Iphone. That way all the revnue that generates (well most of it) can go to increasing the bandwith. Increased bandwith (fibre?) is the key factor here, both your scenario and mine. Also, what companies want to invest in a dedicated internet phone? How about a combination...all-in-one web browsing (that's what many people will wnt in the future for sure), internet phone and CD-ROM playing system. That way people who don't want a full-scale computer can get something cheaper than a computer that will do all they need it to do. Of course the system should allow for email (including PGP, etc) and some text editing. Just a thought.... -- "... In Germany they first came for the Communists and I didn't speak up because I wasn't a Communist. Then they came for the Jews, and I didn't speak up because I wasn't a Jew. Then they came for the trade unionists, and I didn't speak up because I wasn't a trade unionist. Then they came for Catholics, and I didn't speak up because I was a Protestant. Then they came for me-and by that time no one was left to speak up..." Pastor Martin Niemoller ++++++++++++ ************************************** * Matthew Murphy ------------ eggplant(a)inlink.com * ---------- * http://www.inlink.com/~eggplant * The Web page is under construciton at this time though.. * Please don't mind the mess.... * ************************************** ++++++++++++ finger eggplant(a)inlink.com for my PGP key.

1 0

Re: Another Motivation for the CDA (Federal Sentencing Guid
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jamesd(a)echeque.com wrote: > In theory one would expect the law to have this unjust effect, > but in practice most of the poster boys that people give as > examples of the injustice of this law are folk that one would > like to see taken behind a barn and shot out of hand. Three strikes you're fried eh? Dont even bother cutting off their hands - straight to old sparky thats what I say! In theory one would expect the law to deter folk from committing crimes, but in practice folk (a) don't expect to get caught which means there aint no deterrent, or (b) the folk don't consider the crime to be serious, eg. smoking pot. Mutant Rob wrote: > Bill Stewart wrote: > [..] > > And the guys who just got busted for having fertilizer, diesel oil, > > and drugs on their farm had a whole three ounces of marijuana and > > personal-use quantities of crank. Maybe they were planning to blow up > > buildings rather than stumps; but the Feds are trying to paint them > > as max evil just to build up their case. > > Perhaps they were going to use the fertilizer for the grass and the > heating oil to keep warm (or to keep the plants warm). It's possible... Yeah, but it don't go off by itself, it needs a big kick. Did they find any dynamite or other real explosives? I doubt it. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUGAOSoZzwIn1bdtAQH73gGAhV1UF2rU4lYz2Dc1jEi+GnYIds6aDOsX ymKYkdjoDo6+z4ypYbLJsOq9eM6es/AS =TvUJ -----END PGP SIGNATURE-----

1 0

Boycott TCSM
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Posted to alt.security: Crypto relevance - TSCM are a counter-intelligence site with an attitude. I need some advise of Latent prints. Just got a assignment from a client concerning a large qty of empty "Ziploc" and Glazine <sp?> packets found around the plant. Most of the packets test positive (Nik-Kit) for Meth (Biker Crank), the problem is that I am having a tough time pulling decent prints off the little envelopes. Any suggestions?? I am going to try Nile Red (530nm) in ethanol instead of Rhodamine 6G, any thoughts or experiences?? And yes the plant has a full ten finger set on all employees, all we have to do is provide photos of any (9 point) prints <groan> -jma =============================================================== James M. Atkinson "...Shaken, not Stirred..." TSCM.COM 127 Eastern Avenue #291 Gloucester, MA 01931-8008 URL: http://www.tscm.com/ E-Mail: jmatk(a)tscm.com =============================================================== The First, The Largest, The Most Popular, and the Most Complete TSCM Counterintelligence Site on the Internet ===============================================================

1 0

SurfWatch
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:53 PM 3/8/96, Henry Huang wrote: >Thanks for the clarification. However, this line of argument applies >only to "third-party" ratings systems. Right now, Microsoft/RSAC/SurfWatch >and SafeSurf/Cybersitter/etc. are setting up competing standards which would >essentially force people to "self-rate" their own sites, or else be blocked ^^^^^ >out by browsers configured to reject unrated sites (a feature Microsoft plans >to add to its Internet Explorer). "Force"? Are Cypherpunks now using the language of those who talk about how Safeway's or KMart's choice of products to carry "forces" customers to buy certain products? What sort of "force" is being used? Mere handguns, or is heavy artillery also being used? Are the police called out to raid the houses of those who refuse to "self-rate"? Ah, then it really isn't force, is it? The proper solution is for people unhappy with SurfWatch, ChristianGuardian, JewScape, and AllahAllowed services is to boycott places that insist on ratings, create multiple ratings, etc. (Frankly, with several ratings schemes, and with more coming every day, just how is Microsoft supposed to "demand" that all posts be rated or they won't carry them? Or that all sites be labelled as Allah-friendly, Homo-hostile, whatever? The Usenet is the Usenet, for example, and if Microsoft cuts its customers off from entire threads, or gaps in threads interfere with the ability to follow discussions, then they'll clamor for Microsoft to get the fuck out of interfering. >The question I have is if these systems were widely implemented, could >an Web page author or provider of content be sued for "mislabeling" >their page? If so, under what circumstances? Could the RSAC attach Again, I ask about what sort of _contract_ is involved? (In my case, none. So, suppose I decide that my post, explaining the fraud that is Islam, should be read by all Muslims. AllahAllowed, an Islamic rating service, is upset. Just what is their recourse? I have no contract with them and have not arranged to label my posts. So, who can sue? The government? Try the First Amendment. (By the way, adult magazines voluntary label themselves as "adult": my understanding from several comments by lawyers and adult industry spokesmen, is that they are under no obligation to "voluntarily label" their stuff. And some libraries have an _explicit_ policy that says any card-holder, of any age, may check out or look at _any_ item the library carries.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

rhetorical trickery
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I noticed a rhetorical trick/trap that I've seen a lot lately, in the recent article posted about Phil Zimmermann. there is an infamous case of a child pornographer or pedophile in California that is sometimes cited by law enforcement representatives as a good example of the evils of encryption: supposedly he encrypted his diary and it couldn't be unlocked by them. this was mentioned in the article. but I have a question: how did they know it was his diary? I've noticed that people tend to often make conceptual leaps like this that are wholly unjustified. it is easy to get their opposition to bite down on the trap, when they start arguing about things like "well, everyone should be free to encrypt whatever they like". the next time you run into someone using arguments with words like "criminals" in it, ask them, "how do you know they are criminals"? when you use their terminology, and argue in terms of it, you have almost already lost the argument. there is a big mindset in law enforcement to see "suspects" as "criminals". but that is mistaking means and ends. the process identifies criminals in the end, after a trial, but at no prior date. here's another example: I was watching a talk show in which the recent Israeli bombing was discussed by a bunch of very obviously frenzied commentators who were calling for Arafat's head on a stick. one of them insisted that our government had given the names of the involved terrorists to Arafat some time ago and that he did nothing. well, the question is: how do we know those names on the list are the actual terrorists? how do we know Arafat did nothing? but the other commentators were totally lost this basic rhetorical trap. they said, "well, assuming what you say is true, then... blah blah". but the obvious question is, "how do we know these names mean anything"? there is an amazing tendency in our culture in elsewhere not to question authority. when we see some law enforcement agent at a press conference, and they talk about "criminals", the press immediately latches onto the terminology and asks things like "when will they be caught"? etc. instead of, "how do you know they are culpable?" in crypto arguments as well where there is a lot of emotional rhetoric, I have noticed people have a tendency to try to debunk things that require no debunking, such as the FUD that has been sown over that infamous CA pedophile. the test is avoiding tricky rhetorical traps. there are some battles that don't need to be fought. just remember that calm, deadly retort whenever you hear someone getting excited, and ask them, "how do you know they are his diaries?"

3 2