December 2003 - cypherpunks-legacy

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 03:46 PM 4/8/96 -0400, Black Unicorn wrote: >> Spooner's quote follows: >> >> "Doubtless the most miserable of men, under the most oppressive >> government in the world, if allowed the ballot, would use it, if they >> could see any chance of thereby meliorating their condition. But it >> would not, therefore, be a legitimate inference that the government >> itself, that crushes them, was one which they had voluntarily set up, or >> even consented to." >> >> Lysander Spooner > >I didn't respond to this part originally because I grew tired of typing >"Yadda yadda yadda" everytime Mr. Bell lapsed into another >psycho-political babble session. And the rest of us are tired of seeing those non-responses! >What this has to do with Mr. Bell's position, that citizens as a whole had >grown so discontented in the United States that they were prepared to rebell >actively in large numbers, is unclear. In fact the Spooner quote adds >more to my position than Mr. Bell's: > >"if allowed the ballot, would use it, if they could see any chance of >thereby meliorating their condition." > >Seems that even according to Spooner, the citizens of the U.S. aren't >hopeless yet. Aside from the fact that Lysander Spooner has been dead for a LONG time, and thus has no opinion concerning 1996 America, your "logic" is atrocious. He is saying: "If people think it might help, they might use the ballot." He is _not_ saying: "If people use the ballot, it means they think it might help." Maybe such subtleties of logic are beyond you... >In fact there is ample evidence that citizens who have come to believe >that a sovereign is beyond redemption refuse to participate in the >political process any longer. Iran, Iraq, the former Soviet Union, >Turkey, the Baltic States are all examples. I think that the main reason this observation is hilarious is that one frequent complaint from media types is (and has been, for decades) that there is a nearly steadily-decreasing voter turnout at the polls in the US. It is not my intention to make the same foolish logical error that you did. I won't claim, absolutely, that failure to participate in an election _must_ be evidence that people believe "a sovereign is beyond redemption." But since you've stepped into it, I intend to rub your nose in it as well. To whatever extent you believe your last claim, you should be willing to accept the obvious conclusion that many of the American public don't believe that the government is worth trying to retrieve, and they haven't for years. Which means that, as usual, you've ended up shooting yourself in your own foot. When you said: >>> >Funny, the latest primary has been one of the highest voter turn outs in >>> >quite a while (except in Deleware). Considering those are the law-and-order >>> >types who are most likely to invade personal liberities, I think its a >>> >bit hard to make the case that the temper of the country is anything but >>> >very pro-political process. I pointed out, correctly, that mere participation in the vote doesn't evidence any claim that a person is "very pro-political process." You've done a piss-poor job defending this. And you've forgotten that to whatever extent voter turnout is up with respect to past years, it is only "up" because it has been dramatically down for decades. You need to explain why a citizen, or citizens as a group, should be obligated to tolerate this political situation for decades without doing anything to bypass the political system when they appear to not believe in a reasonable likelihood that it'll fix itself. Jim Bell jimbell(a)pacifier.com

1 0

Re: Open Systems, Closed Systems, & Killer Apps
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:33 AM 4/9/96 -0400, Duncan Frissell wrote: >I should have known this before since it is implicit in my favorite article >from the Economist "THE INCREDIBLE SHRINKING COMPANY" 15 December 1990 > >(http://www.ios.com/~lroth/CLIPS/Bussiz.html) Try http://www.ios.com/~lroth/clips/bussiz.html instead. DCF

1 0

Background on Singapore net-censorship
by Declan McCullagh 17 Dec '03

17 Dec '03

Michael, here's the message I was forwarded. Thanks to Joon-Nie for corrections to the articles I included, mainly from the NYT/WP and the Reuters/AP wire. -Declan ---------- Forwarded message ---------- Date: Wed, 10 Apr 96 03:57:22 EDT From: Lau Joon-Nie <joonlau(a)pacific.net.sg> Subject: [Fwd: Re: International Net-Censorship Efforts Update] Spotted this in a newsgroup, but I would caution readers against wholesale reliance on its contents without some official verification as not all of it may be entirely correct (at least the Singapore bits weren't - which I have amended). rgds, joon-nie =========BEGIN FORWARDED MESSAGE========= In soc.culture.singapore, "Declan B. McCullagh" <declan+(a)CMU.EDU> wrote: >I've just doubled the number of international net-censorship efforts >that I track on my web page: <http://www.cs.cmu.edu/~declan/zambia/>. >Included are new updates reporting on Germany, France, Australia, >Singapore, Canada, and China, among others. Please send me reports on >countries I've missed! >-Declan >-------------------------------------------------------------------------- > > OTHER INTERNATIONAL NET-CENSOR EFFORTS > By Declan McCullagh > declan(a)well.com > http://www.cs.cmu.edu/~declan/zambia/ > > France, China, Germany, Singapore, Jordan, the U.S., and many other > countries are moving towards tighter control of the Internet. France > and Germany want to see an international agreement of information > controls emerge. Recently China required all of its estimated 40,000 > Internet users to register at the local police station. This > international crackdown marks a turning point in the development of > the Net. > > Germany > > Germany cuts off access to holocaust revisionist web site (1/96) > German Internet update, new laws planned (3/29/96) > Los Angeles Times on German vs. U.S. netcensorship (3/13/96) > German minister predicts collapse of governments (3/12/96) > Germany's CompuServe net-censorship (12/31/95) > > France > > French government bans controversial book (1/96) > French Jewish students sue ISPs for revisionist materials (3/14/96) > French Jewish students sue ISPs for revisionist materials (3/15/96) > France calls for "global Internet rules" (2/3/96) > > Europe > > Swiss statement on voice over Internet (3/16/96) > Sweden proposes CDA-type law to control Internet (4/3/96) > Italian net-censorship necessary, says Simon Wiesenthal Ctr (1/11/96) > Turkey cracks down on Internet (2/18/96) > Belgium bans non-escrowed encryption (1/10/96) > > Asia and Pacific Rim > > Singapore leader condemns Net (3/7/96) ^^^^^^^^^^^^^^^^^^^^^^^^ This phrase is at best vague. My guess is that he's referring to the news conference on 5 Mar 96 given by S'pore's Information and the Arts Minister Brig-Gen George Yeo where it was announced that S'pore would be implementing a regulatory framework to inter alia, block off objectionable sites, deem all content providers (except those "acting in personal capacity" - yet to be defined) as licensed, and requiring certain types of content providers (those publishing religious, political or racial content/discussions on websites, and certain online newspapers, in particular those already selling hardcopy versions in S'pore) to register themselves with the S'pore Broadcasting Authority. BG Yeo did not in any way "condemn" the internet. On the contrary, if my memory serves me correctly, he said S'pore was going full steam ahead with providing people with access eg. through schools, and that there were already an estimated 100,000 internet users in S'pore. For full text of the news release, see: http://www.antcrc.utas.edu.au/~kwe_chia/sef/SBA.html > Indonesia attacks Net (3/11/96) > Malaysia complains about uncensored Net, censors it (3/11/96) Again, this is not entirely accurate. If I recall correctly, Malaysian Information Minister said some censorship was necessary and agreed with S'pore that ASEAN should work tog to come up with some standards. A day or two later, M'sian Prime Minister Mahathir said something to the effect that censorship was not possible and that education was the key. No active measures by M'sia as far as I'm aware of. Perhaps TM Tan can enlighten us. :) > Singapore censors political, religious net.info (3/6/96) This was in relation to the news conference on 5 Mar 96 mentioned above on the *planned* regulatory framework. Details and legislation have yet to be tabled in Parliament so none of the proposals mentioned in the release have been carried out as yet although S'pore IASPs have, for several months now, been blocking off access to some 40-50 "objectionable sites" (read: pornographic) from a list given to them by the authorities. Framework details are expected within the next 2 months. Meanwhile a S'pore netter has submitted on 30/3/96 a petition supported by 40 signatories to the authorities against inter alia, regulation of political, religious, racial expression of ideas, and suggesting that govt ministries set up PR depts to counter such ideas if need be. > China > > China cracks down on Internet, "state security" cited (1/24/96) > China's anti-cyberporn efforts (2/4/96) > New York Times on China's net.crackdown (2/5/96) > China's history of Net-regulation, cyberporn concerns (1/1/96) > China requires Internet users to register with police (2/16/96) > U.S. State Dept criticizes China's net.censorship (3/8/96) > China applauds German net.censorship (1/11/96) > > Australia > > Australia considers net.legislation (2/13/96) > New South Wales tries net-censorship (4/3/96) > Australians upset by German Zundelcensorship (4/7/96) > > Canada > > Letter to Canadian minister (3/19/96) > Canada needs to regulate Net, says Simon Wiesenthal Ctr (2/20/96) > > Middle East > > Persian Gulf States reluctant to move online (4/6/96) > Jordan installs Internet screening facility (1/8/96) > Saudi Arabian government says no unrestricted Net access (1/10/96) >-------------------------------------------------------------------------- =========END FORWARDED MESSAGE========= *---------------------------* Lau Joon-Nie joonlau(a)pacific.net.sg "Even God has a Geiger-complex" - Dr Aaron Shut, Chicago Hope - *---------------------------*

1 0

Re: Enforcing the CDA improperly may pervert Internet architecture
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:44 PM 4/9/96 -0500, Mike McNally wrote: >Scott Brickner wrote: >> Given your position, io.com is only accessible to adults in the world >> of the CDA advocates. Just upgrade your IP software to refuse >> connections from minors. > >It's not "my" IP software. I pay io for an account. What you're saying >is that every ISP would have to decide whether to be completely G-rated >or else open to anybody. Then they go on about how every school in the country needs to be connected to the net... I am wondering where they got the idea that the net is someplece they want their children to be. They don't let them play in distant parks inhabited by scary old men and drunks, yet they want them to play on the "information Superhighway". The CDA types seem to view the net the same way that they view TV in the classrooms. They expect it to be as easy to control as well. Get them all staring at the box and they will quiet down and do as they are told. What these people do not seem to understand is what is going to happen when their kids are exposed to the diverse opinions present on the net. Forget the porno... What are the parents who believe in Creationism going to do when little Johnny runs into a good skeptical site debunking all that crap? What are they going to do when the little liberal kids are exposed to the works of conservitives? Or Biblical Inerentists kidlets are exposed to the debunkings of that faith? Or Dorthy Denning's kids (if she has any) get exposed to the writings of the subversive known as Tim May? The CDA proponents want the ideas presented to their kids be controled ones. The existance of freedom on the net is a threat to that control. Porno is used as the (net)scapegoat, but there are far more threatening ideas out there to that kind of mindset. They just know that if they tell you their true goals, then people will not go along with them. If you want to know their real fears, read the stuff they write for the "faithful". It is far more revealing. ("Remember: It is not a conspiracy if you can subscribe to their newsletter.") >Sigh. That's probably what the CDA crowd wants. It's hard not to become >consumed by hatred. When reading Lovecraft, i always wondered what could be written down that would drive men mad. Lovecraft always described it as some cosmic horror. The cosmic is too far removed for most people to understand. I have always thought that instead, it described how the world worked and the driving motivations behind it, with the firm understanding that there was not a damn thing you could do to stop it. The understanding that the world is driven by the forces of ignorance and stupidity is enough to drive you to the brink. The Necronomicon was not written by the Mad Arab, it was written by Scott Adams. --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 07:08 PM 4/9/96 -0700, Bill Frantz wrote: >At 3:21 PM 4/9/96 -0800, jim bell wrote: >>And the rest of us are tired of seeing those non-responses! > >I wish to state that Jim Bell does not speak for me. Tell me, what is the most exciting, interesting, and imaginative usage of "Yadda Yadda Yadda" that _you_ remember, Bill?

1 0

Re: [NOISE] Federal Bureau of Indigestion
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 09, 1996 14:24:47, 'jim bell <jimbell(a)pacifier.com>' wrote: >At 09:15 AM 4/9/96 -0700, Dave Del Torto wrote: >>[forwards mercifully elided] >> >>FBI agents conducted a raid of a psychiatric hospital in San Diego that was >>under investigation for medical insurance fraud. After hours of reviewing >>thousands of medical records, the dozens of agents had worked up quite an >>appetite. The agent in charge of the investigation called a nearby pizza >>parlor with delivery service to order a quick dinner for his colleagues. > >Funny stuff deleted. > >>PM: And everyone at the psychiatric hospital is an FBI agent? >>Agent: That's right. We've been here all day and we're starving. >>PM: How are you going to pay for all of this? >>Agent: I have my checkbook right here. >>PM: And you're _all_ FBI agents? >>Agent: That's right. Everyone here is an FBI agent. Can you remember >> to bring the pizzas and sodas to the service entrance in the rear? >> We have the front doors locked. >>Pizza Guy: I don't _think_ so... >click< > >I'm waiting for Unicorn to claim that the next phone call to the pizza shop >was from a judge, who was placing a subpoena on the next 19 pizzas that shop >produced, and ordered them delivered to the hospital for psychiatric >evaluation. B^) > >Jim Bell >jimbell(a)pacifier.com > > Never trust or wait for lawyers, Jim. Go directly to the psychiatric hospital. Go to the back door. Tell them you're only there to do research. --tallpaul

1 0

No Subject
by anonymous＠nowhere 17 Dec '03

17 Dec '03

Borrowing inspiration from May, a page from Scheier and some code from Gutman... Hard disk space being cheap now, Bob creates several distinct disk partitions and uses Peter Gutman's Secure File System, or equivalent, to encrypt all of them. First, Bob fills all of them with innocous data. Next, Bob writes one or more partition with secrets. Bob arranges that no one knows the pass phrases for some of the innocous partitions by luring the cat across the keyboard or having his six year old punch something in while he is out of the room. Bob carefully and publically documents the fact that he did this without indicating which partitions and how many partitions are actually useful. In addition to regularly using the secret partitions, Bob periodically updates the innocous partitions, who's pass phrases he does know, with more uninteresting but contemporary data. When ordered to do so, Bob could reveal the pass phrases to the innocuous data and to as much of the secret data as he felt necessary. Bob could not be forced to reveal all of the pass phrases as he does not know all of them. Naturally, the disk encryption routines would not store pass phrases but only a validating hash, that even Bob could not reproduce for all of the partitions. Practically, Bob cannot be forced to reveal the pass phrases to any alleged remaining secret data, since this might not exist. To further encourage this belief Bob might associate innocous data with a first pass phrase, mildly embarrasing data with a second, and so on, and then, after revealing the first, gradually allow himself to be be coaxed into revealing the second and disclose a third only after the rubber hoses came out. Since all of the partitions have similar content, no statistic should reveal which is which. Bob might have a bit refresher routine periodically nibble read and rewrite the whole disk so that no electronic characteristic exists that reveals record age. No doubt, a judge might whimsically keep Bob in jail for a while, trying to assure that he has revealed all of the pass phrases, but the judge can never be certain, even when Bob has disclosed everything. This situation creates doubt that Bob is in contempt, even when he is, and makes a prison term relatively pointless, unless for revenge.

1 0

RISKS: Compuserve "secure" login
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Thu, 04 Apr 1996 19:34:12 +0200 From: Heinz-Bernd Eggenstein <eggenste(a)noether.informatik.uni-dortmund.de> Subject: CompuServe's "secure login protocol": two steps forward, one back Summary: a new CompuServe Information Service (CIS) logon protocol was designed to prevent passive and active attacks (where the attacker impersonates a CompuServe node) but a flawed implementation in the WinCIM 2.0(.1) client software still allows active attacks. Version 2.0 of the "WinCIM" access software introduced a new logon protocol. Previous versions of the software had transmitted the user's UID AND his/her password in plaintext during logon. The risks are obvious, especially when connecting via the Internet to CompuServe (e.g. to save long distance telephone charges). The new, "secure logon protocol" is a challenge-response type protocol where the "challenge" is to compute a keyed hash-function, the key is derived from the shared secret, the user's password: 1) The client (WinCIM) generates a pseudorandom string of bits, its "nonce" (RB) 2) The client transmits the user's UID (e.g. 12345,6789) and the additional parameter "/secure:1" to request a secure login. 3) The host transmits its pseudo random nonce (RA) (The old protocol would instead prompt for the password) 4) client sends RB to the host 5) client computes UR:=MD5(S|Z|RA|RB|S) and sends it to the host (where S (128 bits) is a function of the password, "|" stands for concatenation, Z is a 128bits block of 0s and MD5 is the well known message digest function.) 6) The host performs the same calculation with it's copy of the user's password. If the results match, the host sends HR:=MD5(S|Z|RB|RA|S) (Note the symmetry in the calculation of HR and UR) 7) The client software verifies HR with it's copy of the password to make sure the host is really a CIS node (!) (See the script-files cserve.scr and seclog.scr in the subdirectory SCRIPTS of a WINCIM 2.0(.1) installation, WinCim is available via anon. ftp at ftp.compuserve.com) Weaknesses: a) The scriptfile cserve.scr (versions 3.8 & 3.8.1) has the following bug: even after requesting a secure logon, the client software will fall back into the old protocol when receiving a "Password" prompt (Client: "I want a secure logon" Host:"OK, but anyway, give me your password" Client "Well ok then, here it is ..."). It will send the password in plaintext! This makes the protection against active attacks (see step 7) obsolete. b) A timeout condition or even an invalid HR response form the host will (seclog.scr & cserve.scr version 3.8.1) restart the protocol (it won't disconnect!), using *the same* client-nonce RB again, instead of generating a new one. If a spoofing host can predict RB as in this situation, it can pick the same nonce, leading to HR=UR=MD5(S|Z|RB|RB|S), so the host can just send back UR as HR. Note that unlike a), b) does not compromise the user's password. There may be other ways to predict the client software's nonce e.g. *if* the PRNG used by WinCIM is predictable (this calls for further investigation). Note that *offline* dictionary attacks to guess the password are possible after a passive, eavesdropping attack (so you still have to pick a "good" password). It's debatable whether CIS's password recommendation (<word><non-alphanum. char.><word>, both words unrelated, e.g. apple@battery) is adequate in this context). I notified CIS about these weaknesses and I was informed that they are "fixed" now, no details were given about the fix (source: Britta Herbst, German customer support (11111.754(a)compuserve.com)) Risks? The new protocol is obviously an improvement over the old, plaintext-password-only version. It's debatable whether protection against active attacks is at all necessary for access to an online service. However, CIS itself designed it's protocol to prevent spoofing attacks. Anyway, I think this a good example how to half-ruin a good protocol by embedding it into carelessly written code. Credits: Thanks to Gary Brown (70003.1215(a)compuserve.com) for sending me information on the implementation of the new protocol). Heinz-Bernd Eggenstein [usual disclaimers] ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: why compression doesn't perfectly even out entropy
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-08 21:04:26 EDT, Perry Metzger writes: >Jon asked why it is that I contend that a compression algorithm won't >in the general case even out the entropy of a semi-random stream. I am not talking about any "general case," I proposed compressing spinner data, which has sequences of repeating numbers interspersed with occasional quasi-random fluctuations. I am not saying that compression is a "magic wand" that will fix data streams with a lot of "fake" entropy, such as the RND() function available in many BASIC's, which I think most of us will agree blows chunks. >The answer can be obtained by simply trying to run gzip over an image, >preferably one that hasn't been compressed. The results are, in >general, very bad, even though images are highly compressable (even >losslessly). I leave the why up as an exercise to the reader. I have ZIPed the aforementioned spinner data with the built-in ZIP routines in the PC Tools for Windows file manager. Except for some very slight banding (which appears to be caused by the ZIP headers) the noise sphere plots look pretty good. All files are available upon request for independent verification. >I have said before and I will say again that the only reliable way of >dealing with a stream that has some amount of randomness mixed in with >it that you wish to distil down into pure random bits is to use solid >reasoning to figure out how many bits of entropy per unit of input you >can actually expect to see, add a large fudge factor to cover your >ass, and then distil down using a cryptographic hash. I have no disagreements with this. I merely proposed using the compression function as a means of roughly estimating entropy and preventing the seeding of the hash/PRNG with potentially "weak key" type data. >Anything else >makes me highly nervous. If you can't estimate the amount of entropy >in an input stream from first principles, then you are probably in >trouble and should seek an input stream that you have a better handle >on. Would anyone like to propose a means of measuring entropy that we can all agree on? I haven't seen anything yet that everyone likes. Jonathan Wienke

1 0

Job at C2.NET
by sameer＠c2.org 17 Dec '03

17 Dec '03

See http://www.c2.net/jobs/ JUNIOR SYSTEM ADMINISTRATOR / TECHNICAL SUPPORT Responsibilities: Responsible for day-to-day administration of UNIX servers, network, and dialin modem pool. Configure and install new servers and network connections. Handle account creation, web server maintanence, DNS setup. Maintain newsserver, webserver, nameserver. Communicate with customers and respond to customer inquiries regarding products and services. Perform low-level technical support for basic customer concerns. Maintain website. Requirements: UNIX (SunOS and FreeBSD) administration experience. Experience with BIND, Apache, INN. Strong C, Perl, general programming background. Good communication skills. Experience dealing with customers and related support issues. -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.net/ (or login as "guest") sameer(a)c2.net

2 1