December 2003 - cypherpunks-legacy

Councilman/Usenet porn case...
by Bruce Zambini 17 Dec '03

17 Dec '03

What's most interesting about this is that whoever forged the email headers forged anon.penet.fi in there... Other than that, I'm not sure what the point is.... but that caught my eye. Jon Lasser ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA. ---------- Forwarded message ---------- Date: Wed, 27 Mar 1996 12:16:01 -0500 From: Bruce Zambini <jlasser(a)rwd.goucher.edu> To: jlasser(a)goucher.edu Subject: web.html TIME Magazine April 1, 1996 Volume 147, No. 14 _________________________________________________________________ Return to Contents page _________________________________________________________________ WAY WRONG NUMBER HELL HATH NO FURY LIKE A CITY COUNCILMAN PORNED JOSHUA QUITTNER This is a tale about how an online prank grows into an international incident. It also goes a long way toward explaining the fear many non-Internet people have about this out-of-control thing called cyberspace. Our story begins on the banks of Lake Erie, in Willowick, Ohio (pop. 15,469). It is the last Monday night in January, about 9 o'clock. City councilman Frank Suponcic is home with his wife Linda when the phone rings. Linda answers. "Hi, this is Mike," says the man at the other end, politely enough. Linda chats with Mike, figuring he must be a constituent. (As Willowick's longest-serving ward councilman, Suponcic has lots of voters calling him at home.) After a while, Mike asks for Annette. Linda tells him he has the wrong number. Mike apologizes and hangs up. The phone rings again at 11:30 p.m. And again. And again. Wrong numbers until 4:30 a.m. A weary Suponcic wonders what's up and checks the Caller-ID logs on his phone. The first call was from British Columbia. The next was from Connecticut. There was one from Indianapolis and a few from California. Clearly these are not constituents. But who are they? Suponcic calls the Canadian back--it is now 5:30 a.m. in that time zone, and he is only too happy to wake the dude up--and he demands to know what is going on. The guy explains, vaguely, that he was merely answering an "ad on the Internet. You know, the one about horny housewives..." So now we have a problem. Suponcic, like a lot of people, has a new computer. But like most people, he hardly knows what the Internet is. Now, somewhere there's an ad on it. For horny housewives. With his home phone number. That night, when the next wrong number came in, Suponcic interrogated the caller and learned that the councilman's phone number was printed at the bottom of some pictures of naked women that had been posted to a Usenet newsgroup called alt.binaries.pictures.erotica, which, naturally, Suponcic had never heard of. But he had a friend in Cleveland who was something of a computer buff. So the next day the two of them jacked into Usenet and spent three hours sifting through about 7,400 files on alt. binaries.etc. Eventually, they found two with Suponcic's phone number. One featured a topless brunet wearing only a string of pearls and offering phone calls for "as low as 87 [cents] per minute." The other showed a blond woman advertising "hot amateur wives ready for you from there [sic] own bed." Yikes. Over the next week, Suponcic received more than 75 calls a day from lusty Netizens. "You just could not make phone calls," says the exasperated councilman. "And when you went to bed, you had to take your phone off the hook." It was the sorcerer's apprentice scenario, and there was no way to stop it. Suponcic, being a public official, knew his way around the local police department, and soon a detective started pounding the Net. By tracing the header information on the Usenet postings, the detective determined--O.K., this part is murky, we admit--that the messages had originated in Ohio, passed through Florida Online, an Internet provider in the Sunshine State, and then through anon.penet.fi, a free E-mail remailer service based in Finland that allows Internet users to post messages anonymously. The identity of the poster was, and is, unknown, though Suponcic has his suspicions. "It's my personal belief that the root of this is political," says the councilman, who had to get an unlisted telephone number and whose wife now wants to move. On Feb. 6, at Suponcic's urging, the Willowick city council passed a resolution asking the state and federal governments to close the "loopholes" that allowed anonymous remailers to operate outside the authority of U.S. law-enforcement officials. "Once you've achieved one of these anonymous identities, you're dangerous, and there's no way law enforcement can track it," Suponcic says. "The animal's out of control." Still not content, Suponcic contacted Steven LaTourette, the U.S. Congressman who represents his district. LaTourette's staff suspects that the problem lies with Julf Helsingius, the Finn who runs the anonymous remailer. They wrote a letter to the Finnish ambassador and sent copies to the Secretary of State and the chairman of the House Committee on International Relations. The State Department agreed last week to look into the complaint. But here's a reality check. The Finnish remailer could not have been used, since anon.penet.fi no longer transmits binary image files. Jerry Russell, who runs Florida Online and who looked into the case, says he figures the whole thing was a relatively simple prank called a sendmail spoof, in which the prankster posts a message with a phony return address. He says the Willowick police never produced a copy of the posting for him so that he could unravel the tangle for them. Indeed, when the policeman called, "he didn't really understand what he was trying to tell me," says Russell. "The average Joe Blow police detective doesn't know flip about the Internet." Neither does the average public official. And that, friends, is why stuff like the Communications Decency Act--the Christian Coalition's attempt to remove pornography from the Internet--sails through Congress. --With reporting by Noah Robischon/New York _________________________________________________________________ [IMAGE] Text Only

4 3

Random Number Testing
by Fred 17 Dec '03

17 Dec '03

JonWienke(a)aol.com writes: > > The "randomness" of the output of my sieve is obviously not perfect. > > However, it will remove bytes from a data stream that "randomness" tests > > describe as "nonrandom". And Perry writes: > You are displaying a profound ignorance of the notion of "random" > here. An individual byte cannot be random or nonrandom. Random is a > statistical property, and therefore can only apply to a mass of > data. The limitation seems to be in the testing process. An inviolable rule of test and measurement is that the testing process must have a higher degree of accuracy and precision than is expected from the item under test. If all you have is a non-graduated stick one meter long, you can't measure increments of less than one meter unless you add some additional resolution to the system (such as a human's judgment that the object is four sticks, plus about another third of a stick, long). Our ability to synthesize pseudo-random data, and the degree to which it approaches true random data, is limited by our ability to discern between the two. If the best testing process available yields the same results for the output of a true RNG and a particular PRNG, what can be done to improve the randomness of the PRNG? How could we tell the difference based on the data itself? About all you could do would be to critique the PRNG or sieving process from an empirical perspective and hope that you weren't introducing some other non-random bias to the system. I'm sure that some perfectly random data would be discarded as being non-random, especially for a small sample size. The sequence HHHHTTTT doesn't look random, but this outcome of 8 flips is equally probable for a "perfect" coin. Do you keep this data or toss it because it doesn't "look" random? If you toss it, aren't you removing entropy from the sample? It may be (relatively) easy to say that radioactive decay is a truly random process and a sieve which discards certain re-occuring values is not. Improving the testing process, and increasing the size of the data used for that testing, will improve the sieve output. However, it looks like an asymptotic situation: the PRNG can approach, but never quite reach, the true RNG case. As long as human analysis and discretion is involved, there will always be a certain amount of non-randomness in the output of a PRNG. My question: if you don't know the source of the data, how can you _really_ determine if it's random enough for crypto use? Given any PRNG string of a certain length, does the fact that I might be able to find that exact same data string buried in a mountain of truly random data mean that it's suitable for crypto use? If you knew that I created the data from the clock of my workstation, then maybe not. But otherwise? Fred <admin(a)dcwill.com>

1 0

Re: Crypto CD UpDate
by Henry Huang 17 Dec '03

17 Dec '03

On Mar 26, 21:18, Timothy C. May wrote: > At 10:16 PM 3/26/96, aba(a)atlas.ex.ac.uk wrote: > >The idea of putting together a CD with crypto stuff is an excellent > >IDEA, and one which I very much welcome. > > > >However a question .. are you (Ben) located in the US? If so... > > > >that rules out overseas buyers unless you fancy messing with ITAR... > >Is it possible that you could come to some arrangement with some one > >outside the ITAR fence who has a CD writer (any one reading have one?) > >put together the same CD for those outside the US? ITAR is going to be a mess either way. If the CD is put together outside the U.S., you'd have to only use non-U.S. executables/source (or else put site owners at risk of violating the anti-export language in the ITAR). Of course, a lot of people don't take this seriously, so pick your poison ... > 1. The CD-ROM "freezes" the various programs, archives, etc. at the moment > the files are finalized and the CD-ROMs are pressed (or burned individually > on a CD-R, at somewhat higher per-copy price). If the author of the CD-ROM > is not committed to updating the CD-ROM at frequent intervals--say, every > few months--then the programs will exhibit "version decay" and be nearly > useless. > The next point is the reason. > > 2. The Web does a better job at making the latest versions instantly > accessible. True, a CD-ROM will generally have faster access, but I care > more about getting the _latest_ version of PGP, even if takes a minute or > two to snarf off the Web. That I could get an _older_ version of PGP in > fractions of a second off this CD-ROM is not compelling to me. I'd argue that having a slightly out-of-date CD-ROM is better than nothing, because: - It gives you an idea of what sorts of crypto applications are out there, - It gives you working versions of programs without having to crawl all over the Net hunting for one, - If the authors are smart they'll include URL's to an update site in the documentation (or the CD-ROM producer can do it), - Not everyone out there is Net-savvy, or has the time to go trudging around looking for the latest cutting-edge versions of software. Time *IS* money. I'd almost argue that Tim's emphasis on using the Web to get crypto assumes a sort of Net-centric view of how the crypto is going to be used -- similar to reported provisions in the Leahy bill. The idea that people who just want to encrypt personal data might not need the latest versions of everything out there is reasonable -- as long as the latest versions aren't BUG FIXES. In that case, Tim's argument about stale versions would carry some merit. But this is the case for ALL non-Net distributed software; you don't see companies refusing to cut CD-ROMs simply because they're worried their users won't be able to get the latest bug fixes. In the ideal case, they'd do the best they can to make sure that people did, but you have to be realistic. (Of course, if you're cynical, and believe that software companies care more about money than about helping their customers, then it doesn't matter. ;) > (And fractions of a second is too charitable: in actuality, I'd have > to locate the CD-ROM, dismount anything already mounted, mount the > CD-ROM, search it for "PGP," etc. Probably not even faster than > using Alta Vista and downloading.) Um, whatever. If you have a CD-ROM, you'll at least have SOME idea of what software is available on it. Not so with the Web (unless somebody wants to do the equivalent of this CD-ROM and put together a page with a HUGE number of links to crypto programs -- not to mention the protections necessary to avoid violating ITAR, e.g. the anti-export measures built into the PGP distribution site) Plus, comparing the speed of a CD-ROM to a modem is like comparing the speed of a station wagon to a skateboard. CD-ROMs aren't exactly fast, but they sure as hell aren't anywhere near as slow as the water-torture speeds of your average v.42bis modem. > 3. Where CD-ROMs really shine over modem alternatives is, of course, for > very large files. Images, MPEG or Quicktime movies, etc. "Multimedia" being > the operative term. For crypto, this is not an issue. (Except for list > archives, where having a few hundred megabytes of articles might be nice. > However, the absolute KILLER of this idea is the staleness problem mentione > in Point #1: if the archives on CD-ROM lack the most recent month or two, > their usefullness drops precipitously. If the CD-ROM is a year old, and no > updates have appeared, then its archives are useful only to list > historians. I don't buy this. Many of the well-known/widely-used Net-distributed crypto apps haven't put out updates for a LONG time. Even if it was the case that they were throwing out bug fixes every two weeks, my previous comments still hold. (And anyhow, you probably wouldn't WANT to have software THAT unstable in your collection anyway. ;) I'm starting to think that the question of whether this CD-ROM is useful depends on who you're selling it to. People who hang out on Coderpunks, or are "in the loop" as to version updates and crypto sites won't want this. People who want to buy the CD just to be "cool" aren't an issue. The SOHO market (i.e. people who don't normally use the Net, and who ordinarily wouldn't care too much about crypto) seems to be the ideal target. But how do you sell a piece of software to an audience that doesn't know it needs it? Perhaps this could be a chance to spread the gospel, so to speak. However, that would mean the CD would have to be designed around these people -- i.e. for ease of use, etc. These issues have probably been beaten to death a long time ago (e.g. PGP shells), and shouldn't be too difficult to resolve. The multi-platform stuff (DOS/Mac/**IX on one disc) will be harder; you'll need to code a different interface to the CD for each platform. > (In other words, I will almost always go to up-to-date archives on a Web > site rather than dusting off a CD-ROM that was issued several months ago. As would I. But we're "in the loop". Many people aren't. And the real issue being addressed here (getting easy-to-digest crypto to the masses) is a lot more difficult than just pressing a CD-ROM. Ben may need to rethink his strategy on this, in terms of how to most effectively promote this CD to that market. > 4. The Web approach allows powerful search engines, links from other pages, > and--importantly--multiple jurisdictions. The PGP could come from the U.S., > the Digital Postage code from Sweden, and so on. And, again as noted in # > 1, the developers could keep improving and iterating the code. Hmm, do I hear a volunteer for writing that Crypto Software Web page? ;) -H

2 1

Cypher of former eastern intelligence agency broken?
by stoll＠as200.zi-mannheim.de 17 Dec '03

17 Dec '03

Here is an abstract of a report the German newsmagazine Focus published on March 11, 1996 (p. 16) - "Spaete Ermittlungen gegen Techno-Spione" (late/belated investigations against technology spies). I do not include a translation of the whole original text for copyright reasons. "Specialists of the German Federal Police Agency (BKA) have decrypted 44 floppy disks from the former [East German] Ministry for State Security" (MfS). A defector had handed over the floppies to the German Federal Intelligence Agency (BND) in spring 1990. The disks contain information on East German spies in former West Germany. Judicial inquiries against 29 suspects have started now. Apparently, the BKA got the data no sooner than 1994. This is because the BND did not tell law authorities about the floppy disks. German federal DAs learned about the data in late summer 1994 by chance. The article does not say whether the defector came over with the keys. - Probably not, otherwise prosecution should have started much earlier. It is likely that the extremely paranoic MfS used a cipher and a key length it believed to be sufficiently strong. According to Bruce Schneier's Applied Cryptography East Germany was quite aware of DES, it even produced DES chips. Another possibly strong algorithm used in the former Soviet block is GOST (a block cipher derived from the concepts of DES, also described by Schneier). Let us assume BKA specialists have broken the code using a combination of cryptoanalysis, brute force and good luck. They are policemen, not espionage professionals. Further, the BKA is much smaller than the FBI. Imagine what code breaking capabilities a well-funded, big intelligence agency should have then!

1 0

Re: Pepsi World - Gotta Have It!
by geeman＠best.com 17 Dec '03

17 Dec '03

hoax, I presume? At 06:46 PM 3/20/96 -0600, you wrote: >Hey Squatter! > >Don't forget to cruise back by Pepsi World! > > >We're gonna keep showing ya the coolest, hippest stuff out there, including: > >- Shaq/Pepsi World's Slammin' Techno Dream Contest >- The Bev-o-Matic Contest >- An exciting, original Shockwave game >- Chat Rooms >- And basically, more entertainment than you can shake a stick at! > > > >Don't forget your squatter id 'cypherpunk' and password >'cypherpunk', you'll need them to maintain your Squatter's >rights in Pepsi World. > >

1 0

Re: Let's *NOT* "Raise their Awareness"
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 06:07 PM 3/26/96 -5:00, Michael C. Peponis wrote: >On Tue, 26 Mar 1996 , David K. Merriman wrote: > The judge is correct in this matter, most people view it from the > rights of the parents, but what about the child who, because of > his/her parents egotism and ignorance, grows up not being able to > compete effectivly? I am sure the judge is right in this matter, but is in any of his damned business. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: (X:x)e$ 's other use
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 04:05 PM 3/26/96 EDT, E. ALLEN SMITH wrote: > The > Fed has done an actually rather admirable job of standing up to the pressure Every couple of years the politicians start leaning on Greenspan. Greenspan lets it be known they are leaning on him, the money markets mark the dollar down and the politicians stop leaning on him. The Greenspan standard is not a good as a gold standard, but its not bad. Only trouble is he is mortal, unlike gold. Come to think of it, there is actually some crypto relevance here: Internet currencies will be necessarily non physical and it will be difficult to go after the issuer in the event of default, so the best currency will have a value that depends on peoples belief that the issuer will defend the value of the currency. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

How to enter the US without a visa?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

This is somewhat off topic for cypherpunks, but alt.forgery is dead, so cypherpunks is probably the nearest group. Suppose (hypothetically) an American resident cypherpunk had a hypothetical friend who is most unlikely to obtain an American visa. Now the standard way of dealing with situation is for an American friend to get a certified birth certificate of someone born in America, concoct some photo ID, send it to the out-of-America friend, and then the out-of-America friend comes in through Montego Bay or some similar point where there is lots of tourist traffic. But the thought struck me that this might not work for some one who hypothetically has a foreign appearance and a truly terrible accent. Now a fake greencard would probably work, but greencards have age and sex etc encoded on them, and conceivably they check them against a database, in which case it would be necessary to obtain the greencard number of a real person of the right age and sex, which is not easy. Any suggestions? Surely lots of people have dealt with this problem already. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

vogon punk haiku
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

looking down his nose, Senator Exon banned it Haiku's not a crime Rights groups lobbying politicians waffl"ing Cypherpunks write code At First Virtual tense hot alien in barn encrypts no message Later releases in some communications there are signatures digicash tokens no one knows what you're buying follow the money Senator Exon! Imminent Death of the Net! GIFs at eleven! what they cannot read they don't want to let you say you must encrypt it Crypto power tools cannot be exported yet? how can they stop them? Freeh is watching you Big Brother is watching you NSA listens #ifdef crypto you cannot export this code #endif crypto if code is outlawed bhgynjf jvyy unir cevinpl talking to their friends Beating a dead horse idle thoughts typed on a train need more ideas Senator Exon And the horse he rode in on ******* indecent #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 01:59 AM 3/26/96 -0800, Timothy C. May wrote: >At 7:08 AM 3/26/96, Shabbir J. Safdar wrote: >My point is that I see no compelling legislation that is needed. If enough >people in Washington really want increased length in _exported products_ >(remember the "exported" part), the Congress and the President should find >it easy enough to get said products on to the Approved List. (I note that >the Leahy Bill really doesn't change this system anyway...some products go >on the list, some don't...the law only seems to say that when the horse has >already left the barn, i.e., when "comparable" products are already in >fairly wide use outside the U.S., then the products should be put on the >approved list. Big deal. There is, however, a slightly different way of looking at this. For centuries, there was a saying "Nature abhors a vacuum." While not scientifically correct, from the standpoint of people living below an ocean of atmosphere it seemed to be true. Likewise, the political system seems to abhor a situation where there is neither law, nor a proposed law. The best tactic might be to insist on modifications to the Leahy bill, most of which are quite justified, but cumulatively will be seen by "the enemy" as being so extreme as to be unacceptable. At that point, the enemy may actually agree with our assessment that no law is better than the corrected Leahy bill, and we'll both walk away satisified with the "no law" option. Think of it like pouring sugar into a gas tank. [stuff deleted] > >And, frankly and bluntly, while I am not as extreme (in some ways) as, say, >Jim Bell, in other ways I and many others of us are quite extreme. Hey, see, I'm useful! I make you look more, uh, "reasonable", right? Jim Bell jimbell(a)pacifier.com

1 0