December 2003 - cypherpunks-legacy

Re: entropy masking (was Re: Multiple spinners as sources of entropy?)
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-13 18:35:51 EST, Matt Blaze writes: >I would go even further than this. I wouldn't trust ANY >environmentally-based random source (cycle spinner, keyboard >timer, disk noise, whatever) against adversaries on the >same system. In DOS, the keyboard, mouse, and disk drives run on interrupts, not timers. If you use a timer as a spinner, such as the Windows GetCurrentTime() function, (I MSec. resolution) and check its value each time a key is pressed and released, It would appear that the results should be quite random, because the keystroke is not processed in conjunction with the timer, but rather whenever the interrupt occurs. My tests in this area indicate that any 8 bit value can be achieved with this method, with a fairly uniform distribution. My tests are not thorough (I haven't sat down and typed for 2 hours to test the distribution of the output), but results look reasonably good so far. Jonathan Wienke

2 1

Anon email accounts available
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just letting folks know that shellback.com is offering anon email accounts. Price is $5/month, prepaid via cash or money order. Weekly notices starting 30 days before account expires. See our page at http://www.shellback.com/anonmail.htm (yes, we're really leaving the last 'l' off :-) Also want to let folks know that the remailer is not _yet_ functioning (saw a couple messages try to fly through while setting up the mail server). Real Soon Now. Honest. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUbmAMVrTvyYOzAZAQEE0QP/Tg5wqn49bFVx8hwYbGP9UK3SsU7bgh+U yt6rZRrxTfIpJk01emWY6SXPL1XjCSSV8YXnukaScJdpmIJ9vRZkG1wpznNFWeER GtLP8YTdcyQxOzC7qY9UWwebweVTNjwH998x09jiUhp2wY1qkTjHqk2qMxSStZrZ 2U1IQc/BDt0= =uH+x -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re:LACC: PC Phones Home?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:41 AM 3/14/96, Jim McCoy wrote: >A few questions: > >1- How does the PC know where it is? >2- How does the PC know it has been stolen? The Web reveals all: 1. If the PC has been _reported_ stolen by the owner, any call from that PC triggers a phone trace, says the company. 2. See #1 (the key is that owner must call and report a particular PC stolen). >Since this is a software product I am assuming that the answer to #1 >is the use of CallerID on the line when the software calls, which is >defeated by the use of line blocking by the thief. The obvious answer >to #2 seems to me to have the system call the CompuTrace office at >odd intervals to see if it has been reported stolen yet... > >Obvious solution for potential thieves: wipe the disks and reinstall >an OS once you steal a PC. This should be done anyway to remove any >bits of data which might identify the original owner. These points assume the thief is relatively sophisticated and that the thief is aware that the CompuTrace system is installed. I suspect that neither is likely, at least not until the system gets sufficient publicity so that the first thing thieves and purchasers of suspected-to-be-hot PCs do is to make plans to avoid this (reformat disks, etc.). I think the scenario I described in my earlier post on this topic covers about 97% of all PC thefts: relatively unsophisticated thieves who warehouse the merchandise until buyers are found. The buyers, in turn, are also relatively unsophisticated. They may be immigrant businesses looking for a really good deal on PCs, they may be school systems strapped for cash, they may be your mother buying her first PC at a flea market. And they may be any of us, buying a surplus PC. In none of these cases is the user likely to take steps to disable Caller ID (and the company may actually do old-fashioned tracing). >Conclusion: Yet another useless piece of software riding the >computer security bandwagon. I'm not convinced it's software I would want to buy, but it fills a niche, I think. And it's definitely not the snake oil we've seen recently, as it makes no outrageous technical claims and seems to be going after a limited market. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

House Votes to Weaken Anti Terror Bill
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

House Votes to Weaken Anti Terror Bill Washington, March 13 (Reuter) -- The House of Representatives Wednesday removed major provisions of an anti-terrorism bill in a vote that sponsors of the legislation said would gut the measure. An amendment, adopted 246-171 by conservative Republicans and some liberal Democrats, removed language that would give the government authority to label groups as terrorist so foreign members can be deported more easily. It also prohibits use of wiretap evidence obtained without a warrant. "We do not need to give our government vast new powers," Georgia Republican Bob Barr, the amendment's author, said before the vote. He said current laws were strong enough. "With the Barr amendment this is not a real anti-terrorism bill," said Republican Henry Hyde of Illinois, the bill's main sponsor and chairman of the House Judiciary Committee. Hyde said an unusual coalition of groups including the conservative National Rifle Association and the liberal American Civil Liberties Union were opposing the bill because they thought it gave the federal government too much power. Hyde said one Republican colleague told him privately, " 'I trust Hamas (the militant Islamic group) more than my own government.' "

1 0

Re:LACC: PC Phones Home?
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Dennis Hilliard writes: > >"Software to the rescue: >If somoeone steals your PC, you may be able to get it back because of >software that acts as a kind of tracking device. Home Office Computing >magazine reports that the software CompuTrace TRS will automatically dial >the office of its creator, Absolute Software, if a thief hooks up a stolen >PC's modem to a phone line. The software reveals the location of the PC and >Absolute Software will call the police" - Providence Journal-Bulletin - >March 12, 1996. > >Any Comments? A few questions: 1- How does the PC know where it is? 2- How does the PC know it has been stolen? Since this is a software product I am assuming that the answer to #1 is the use of CallerID on the line when the software calls, which is defeated by the use of line blocking by the thief. The obvious answer to #2 seems to me to have the system call the CompuTrace office at odd intervals to see if it has been reported stolen yet... Obvious solution for potential thieves: wipe the disks and reinstall an OS once you steal a PC. This should be done anyway to remove any bits of data which might identify the original owner. Conclusion: Yet another useless piece of software riding the computer security bandwagon. jim

2 1

Re: Remailer passphrases
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-14 01:52:14 EST, you write: >It is probably possible. Put a clip across the CPU chip, and take over >from it by raising it's chip disable will work with some microprocessors. >However, the proper application of various kinds of rubber hose to the >operator should make that kind of attack unnecessary. In general, this is an excellent way to make smoke and big sparks, which (since shorts tend to overtax the power supply and drop voltage levels) is a good way to clear system RAM, thus defeating the purpose of the exercise. Software hacks can do the job just as well, and don't require special breathing apparatus. Jonathan Wienke

1 0

e$ and markets and meta-markets. quote with little comment
by bryce＠digicash.com 17 Dec '03

17 Dec '03

I just thought I would re-print this extract from the recent press release regarding the EUNet/Merita ecash roll-out. Favorite phrase: "interesting new possibilities." Follow-ups directed toward e$. If you post to cpunks without Cc'ing me I probably won't see it. Bryce ******* begin quote from the "companies that accept ecash" section SOM -- SOM, the Finnish Securities and Derivatives Exchange and Clearing House, established in 1987, serves as a neutral integrated securities and derivatives exchange and clearing house. SOM offers real-time financial market information on stocks, options and futures via the Internet, with invoices payable in ecash. Somtel for Windows -the application that offers real-time feed, as well as simulation and position-analysis functions-, is already available via leased line. "The use of money makes stock trading less complicated, with money acting as a practical intermediary between the transactions." states Asko Schrey, President of SOM. "However, since stock trades, as well as the shares themselves, are electronic nowadays, this conventional transmission of money has actually become a bottleneck and a threat to the development of the financial world. Therefore, SOM actively participates in projects to promote and improve the efficiency of payment traffic. We believe that electronic money will offer interesting new possibilities."

1 0

New paper on crypto regulation and the right to privacy available
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

A paper exploring various aspects of cryptography and cryptography regulation has just been published in the Journal of Universal Computer Science (J.UCS). J.UCS is a Springer-Verlag electronic publication available at <A HREF="http://hyperg.iicm.tu-graz.ac.at/0x811b9908_0x0008eaac;sk=74BEC6EF"> J.UCS</A>. It's coming off a non-HTTP server so I can't give a direct URL, you need to follow the links to Volume 2, No.3 to find: Government, Cryptography, and the Right to Privacy J.Shearer, P.Gutmann The notion of a right to privacy of citizens in their communications is discussed in the context of an international movement by governments towards regulation of cryptography, and consideration of key forfeiture systems in national cryptography use. The authors argue that the right to privacy in communications networks is an issue of major importance, assuring freedom of the individual in national and global communications. Regulation and control of cryptography use on the Internet by national governments may lead to an imbalance in the citizen/government power relationship, with sequelae including unprecedented surveillance of citizens, disruption of international commerce due to lack of powerful cryptography (and lack of standardisation), human rights abuses by less democratic or non-democratic governments, and limiting of the political potential of an Internet global political system. Peter.

1 0

Re: unsubscrive
by Kim Johansson 17 Dec '03

17 Dec '03

At 09:18 09.04.96 +0000, Brad Shantz wrote: >Time May Wrote: > >>Maybe these dweebs are posting from an alternate universe? A universe in >>which not even messages explaining that "unsubscrive," "unsuscribe," >>"undescribe," "unscribe," and "unimbibe" are not valid alternate spellings >>of "unsubscribe." >> >>I've copied my short explanation of how to subscribe and unsubcribe too >>many times to do it again; and it is clear that these folks are either >>doing this out of spite, are not reading any of the messages we send them, >>or think it funny. > >I agree with you to a point, Tim. They probably haven't read the >messages about how to properly unsubscrive. Not because they are >dweebs or because they think it's funny. they probably haven't read >the messages because they have 2 or 3 thousand messages in their >inbox and they're all from cpunks. Unfortunately, this time, I have >to give them the benefit of the doubt for being ignorant. I don't >think they're being vindictive. > >How many of them have posted Unsub messages after being told the >proper way to unsub? > >Brad > I want off. Please help me.

2 1

Tips on Tapping Taps
by Dave Del Torto 17 Dec '03

17 Dec '03

Vernor, What's your thinking on some privacy protection measures for these types of "embedded systems?" Shouldn't these kinds of "instruments" (one ringy-dingy) have some user-defeats or -definable permissions settings built in from Day One? Do we risk e$ accounts being billed automatically by water/gas/electric meters on a daily basis without the possibility of users disputing the readings in a timely way? Is anyone proposing permissions on such boxes? What're the proposals, if any, for how the automated calls they make get billed, get scheduled and show up on customer phone bills? I wonder if the bills decrease, since this all saves the companies lots of money? I'm all for "smart houses" but I'd prefer they learn the tricks _I_ teach 'em. dave ................................. cut here ................................. >Date: 10 Apr 96 19:03:05 EDT >From: Dan Druck <73543.2304(a)CompuServe.COM> >Subject: H2O Phone Taps > >WATER METER PHONE TAPS > >Recently, I received notice from our local water department (Algonquin, >Illinois) that new water meters are to be installed in every residence. >The twist is that the new meter taps into our telephone line and >periodically and automatically reports the meter reading to the water >department. > >Perhaps this is innocent enough but, being ever vigilant about my privacy, >I've contacted the water department to get more info which they've >promised to send. Interestingly, they told me I didn't have to accept this >phone-tap meter, however they asked to install a different meter with a >similar type of reporting device which is triggered via a device that also >receives the meter reading (from just outside my house). I can only assume >this transmission is made via a radio transmitter on the meter (which >isn't really much of a consolation for me). This seems a bit oxymoronical >since there already exists an external meter gauge on the exterior of my >house. What is the advantage to standing outside my home with a >transmitter/receiver over visually reading the external meter gauge??? > >Obviously, how can one tell what the little micro-chip within the gizmo is >*really* programmed to do? As you might imagine, I'm not at all >comfortable with this thing wired into my phone line. I know..... if Big >Brother wants to, he can listen in to my phone conversations or even into >my house without such hard-wire tap. But I don't feel compelled to >willingly submit to a potential invasion of my privacy, none-the-less! > >I can only assume resisting the installation of this Orwellian device will >result in putting my name on every Barney Fife "what's he got to hide" >list - who knows. > >I urge everyone who reads this to be vigilant about such things. If you >receive such a notice from a public utility, you might be well advised to >question them as I am doing. Sadly, most of my neighbors are probably >submitting to this without a thought as I've not seen any letters of >protest to the editor of the local newspaper ....a sign of the times, I >guess. > >Dan Druck, Council on Domestic Relations >Congressional Candidate / 8th District, Illinois > >Permission to repost/reprint (in whole or in part) >is granted so long as such is accurate and proper >credit is given. 96MML12 > >Council on Domestic Relations web page: > http://www.logoplex.com/shops/cdr/cdr.html > (last update 1/5/96) >Druck for Congress web page: > http://ourworld.compuserve.com/homepages/ddruck > (last update 2/1/96) >"CDR Info Hour" Radio Program / every Saturday @ 6:00p.m. CST > Shortwave 9.400 MHz > Satellite - Galaxy 6, Trnspndr 23, 6.1 Wide Band

2 1