December 2003 - cypherpunks-legacy

Keyserver at jpunix.com on WWW
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, I just got through implementing and testing Brian LaMacchia's code for WWW access to the PGP keyserver at jpunix.com. This means that the Web page for jpunix.com can now perform interactive, realtime searches and adds against the keyserver database. If you would like to try it, the URL is: http://www.jpunix.com/pks-toplev.html John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp2.0, a Pine/PGP interface. iQCVAwUBMYN2llOTpEThrthvAQEyqwP5AT14+2NbvdXdEnr8nxaSUVcLUmA2M0+z PDdOXidleU4P5BesHe0cIO0FdrpLC7EHi7mhg3XgwEeooCv2wGsOf59oGGikaqSl 4WLEvoQQOftVQNeE5vv7mbiYo4M5CZBm/QSu1QK3SD37ohT/pRy+RFu0ldRuxrAl aPSro/koBN8= =pFGr -----END PGP SIGNATURE-----

1 0

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:12 AM 4/27/96 -0700, Rich Graves wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >If you are involved with the affairs of a large organization, I urge you >to check www.whoswhere.com to see if they have a bunch of user email >addresses that they shouldn't. They also have some information that is seriously outdated. They have two e-mail addresses for me that are about 2-3 years out of date. (I wonder how some of this information was collected. One was from my Fidonet point address of years back. Not something accesable from finger.) >Of course there is little that one can do about this kind of invasion of >privacy. But they don't have to be so fucking blatant and stupid about it. >They have the email addresses of DAEMONS from our password files in their >database. I wonder if those addresses are from a "finger @sitename.org" hack. It becomes worrysome when the methods of hackers intersect with those of database compilers. >There is no need for mailbombing, or anything like that. Our lawyers are >simply going to nuke them from orbit. Please check them out before they go >offline, so that you will have a shot at whatever is left. Keep us informed as to the fireworks. it will be fun to watch. --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

3 2

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

My 9th grade classmate Rick Smith wrote: >Having penned the response to Jeffrey Flinn on the unlikelihood of >processor back doors, I'll comment on jim bell's response: >> More likely,I think, an organization like the NSA >>might build a pin-compatible version of an existing, commonly-used product >>like a keyboard encoder chip that is designed to transmit (by RFI signals) >>the contents of what is typed at the keyboard. It's simple, it's hard to >>detect, and it gets what they want. > >Simple, no. Hard to detect, somewhat. Gets what they want, unclear. I haven't been commenting on this part of the thread, but since I am asked to (below), I'll say that I agree with Rick on these points. Though there have been fictional accounts--e.g. the French novel "Softwar"--about replacement of chips with TLA versions, this tack is very hard to pull off. (The Infoworld "April Fool's Day" 1991 report that the NSA had arranged for printers entering Iraq to be modified so as to send intelligence info was gullibly picked up by several outfits that should've known better and reported as fact.) >My experience with processor design and development is rather ancient >and my knowledge of IC work is third hand, so I'll gladly defer to >someone with closer knowledge of the process (Tim?). However, I've >never heard anything to imply that a processor architecture can be >cleverly and reliably dinked with in this manner without lots of >expensive engineering. Where does the chip real estate come from? Is >there room in the microcode for this? Will it destabilize other >behaviors? Will the victim detect it through RFI testing? For high-volume parts, such as the chips in the usual PCs we all use, such a replacement would almost certainly need the cooperation of the chip makers. Not impossible to obtain, but not easy. A new "stepping" of the chip would probably be needed, though I suppose a chip with downloadable microcode could be used. Much more like, in my opinion, would be subversion of the software, a la Thompson's point about subverting compilers. And the work already done on "subliminal channels" that leak information (deliberately in this case) is apropos. I know that such channels were a major concern during the discussions of nuclear arms treaties. Speculatively, if such a hardware replacement is likely, this is where I would look first; but of course the parties to nuclear arms agreements know this as well. Anyway, there are all sorts of "maybes" and "possibles" here. Certainly there is no _technical_ reason why a "Pentium--NSA-enabled" variant of the Pentium could not be made...all things are possible. But how likely? And where in the spectrum of real concerns does it lie? And would Intel dare to cooperate with such a plan? And so on. This'll have to be my last word on this topic. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Book: The President's Eyes Only
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

I just finished reading "For the President's Eyes Only", a book by Christopher Andrew. It describes the uses that US presidents have made of intelligence and intelligence organizations, from George Washington to George Bush. What caught my eye first was a quotation by David Kahn that says: "This is the most important book ever written about American intelligence." The cypherpunks relevance (Besides the David Kahn quote) is the frequent mention of NSA decrypts and SIGINT. The frequency that nations and individuals have used (and apparently continue to use) breakable encryption is incredible. The intelligence that has been derived by breaking them is worth a great deal, in dollars and maybe lives. This book has made me understand a bit, why a government might try to limit strong cryptography. I suppose I tended to look upon ITAR restrictions on cryptography as a sign of a power-hungry, self-agrandizing, government that has lost track of the fact that its legitimacy depends on protecting the blessings of liberty for its citizens. That's partly true, but there's more to it than that. After reading "For the President's Eyes Only", I can understand that many in government believe that they are protecting the public by outlawing cryptography. After careful reconsideration, I still believe in strong free crypto, but it made me think very hard. I think that some on this list and in sci.crypt should be ashamed of their ad hominem attacks in an area where reasonable people disagree. The crypto-game is being played "for keeps". Someday, all crypto may be too strong to break, but for right now, many "bad guys" (and whatever your philosophy, I bet you can find some) use weak crypto, and this allows the US Govt. to know more about what goes on in the world. As long as Uncle Sam keeps his finger on a nuclear trigger, I can see a strong case that knowing what he's doing and not getting too surprised are (mostly) good things. There will be a price to pay when everyone uses strong crypto. There will be great benefits derived, as well. It will be very expensive, but worth it. If we want to make it happen sooner, we should understand (and respect) our opponents in this debate. Rick F. Hoselton (who doesn't claim to present opinions for others)

2 1

Re: Click here to become an International Arms Trafficker
by David K. Merriman 17 Dec '03

17 Dec '03

At 02:46 PM 04/26/96 -0400, Vince Cate wrote: > > "Click here to become an International Arms Trafficker" > >Offshore Information Services Ltd. has set up a web page to make it really >easy for people to become International Arms Traffickers. All they have to >do is fill in their name and email address and then click. Check out: > > http://online.offshore.com.ai/arms-trafficker/ > >If you think this is half as funny as I do, please make a link from >one of your pages to this one. > Well, I'm ITAR violator # 6 :-) Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

3 2

code vs cypher
by hochiminh＠alpha.c2.org 17 Dec '03

17 Dec '03

Perry E. Metzger" <perry(a)piermont.com> writes: pm> tm> Timothy C. May writes: pm> tm> Well, I was not invited to join the elite and secret pm> tm> coderpunks list, pm> It is neither elite nor secret. It is fairly high signal to noise. pm> I think only about one in every fifty or so cypherpunks pm> messages has any content at all worth mentioning. Agreed! I wasn't "invited". I simply requested access and was quickly welcomed to the list. pm> tm> but I still have some thoughts on coding and, pm> tm> especially, on the opportunities offered by Java. pm> tm> Sorry if this interferes with discussions of Rabbi pm> tm> Heir and Morris Dees. pm> You have no right to grumble about the situation here. pm> It is exactly what you wanted. Here you were, a person pm> of some personal gravitas and moral authority, and you pm> put your stamp on the "post whatever you like; don't let pm> the grumbling censors stop you". Well, as you sow, so pm> shall you reap. Its your fault, more than anyone else's. TC May was not the first person to substantialy digress from chartered topics but he certainly "ran with the ball" when he got his chance to expose his ignorance and intolerance of other races and religions ( the cypher-relevance or "charter topicality of which always escaped me). I was discouraged by the encouragement given to the murder advocating moron, Jim Bell to post his insance littany. pm> If Cypherpunks has become a cesspit, well, its YOUR cesspit, pm> Tim. Its the list you always strove to create, but it appears pm> that you now don't like the smell of your own wallow. Well, pm> sorry. Deal with it. Well put, Perry!

2 1

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 12:25 AM 4/27/96 -0500, Snow wrote: >On Thu, 25 Apr 1996, jim bell wrote: >> >> This analysis seems to assume that the entire production run of a standard >> product is subverted. More likely,I think, an organization like the NSA >> might build a pin-compatible version of an existing, commonly-used product >> like a keyboard encoder chip that is designed to transmit (by RFI signals) >> the contents of what is typed at the keyboard. It's simple, it's hard to >> detect, and it gets what they want. > > I thought that most (all?) chips already radiated on the >electromagnetic spectrum? Isn't that what tempest is about? There's a difference between trying to find a needle in a haystack, and finding a day-glo, red-hot needle that plays music at 110 decibels in that same haystack. Digital logic chips do radiate EMI, but some radiate very little (because their are few logic transitions or they occur relatively infrequently) or are buried within other circuitry and they don't have a particularly good antenna. The Trojan horse chip I'm hypothesizing would be specifically designed to radiate a fairly loud, continuous signal, on wires that are long enough to make a good antenna. Ideally, the chip would have a crystal to produce a very constant frequency, so that other noise not on that frequency could be ignored. The best place to put such a chip would be a location outside the computer's case, or at least it would have access to the outside. I think that a keyboard controller would be optimum, because I suspect that there are a relatively small number of different designs. Jim Bell jimbell(a)pacifier.com

3 2

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:30 AM 4/27/96 -0700, Mark Allyn 206-860-9454 wrote: >They are gone now. > >mark.allyn.com% lynx http://www.WhosWhere.com Try http://www.whowhere.com/ . (Rich Graves mistyped the address.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

8 12

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:51 AM 4/27/96, Dan Busarow wrote: >At Usenix 96 in San Diego it was pointed out that applets are an abberation. >This is a complete language designed to displace C++, Visual Basic and >other OO languages. Thinking of Java as simpy a Web enhancement tool >is short sighted. > >Personally it is more attractive than C++ for product development and >we are trying to get it on FreeBSD, SCO UnixWare and SCO OSR5. Using >Java for applets _only_ is like fucking your mother... Most of us are >not into it. Ignoring the gross violation of the CDA, I agree. I think of it (and so do a lot of others) as: - a cleaned-up C++, with features of Smalltalk, Objective-C, and Lisp - a tool with built-in hooks for Net-centric computing - some safety features that distinguish it from C++ and the like - a bytecode/virtual machine approach that means the same code can be run on any platform for which a VM exists (the key to applets, but also the key to portability...what the world might have looked like for the past 15 years has the UCSD p-system succeeded instead of MS-DOS) Is it safe to run untrusted applets on your machine? Probably not. Running strange programs probably is never safe. I don't view this as something any new language is likely to solve, unless it's a language with such limited expressability as to be "safe and boring." As Perry has noted, financial institutions can ill afford to have applets being dropped into their main computers unless they are safe and secure. Not too surprising. But, then, they also have other security issues they constantly have to deal with that others don't. I suspect the safety issues will continue to crop up, but will be dealt with in other ways. The signed classes approach, the approaches used in E, etc. Netscape's limits on what applets can do, for example, may be extended in other ways (a kind of firewall approach?). To borrow a viewpoint, I don't expect the Java-based gargoyles in "True Names" to be "trustworthy"...TANSTAAFL. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6

Re: Smartcards are coming to the US
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"shamrock(a)netcom.com" 21-APR-1996 21:08:17.34 >At 15:15 4/21/96, Brad Dolan wrote: >>Saw a CNN story Friday about an interesting special debit card >>application in Mexico. They're being issued to poor Mexicans, who can >>use them to buy tortillas and a few other foodstuffs. The cards are tied to >>a behavior-control database and failure to send kids to school, get >>mandatory medical exams/treatments/vaccinations, etc. results in card >>deactivation. >My first response was: he is making this up. But it shoudn't come as a >surprise to any reader of this list. Expect to see more of it. Ever read _The Bell Curve_? -Allen

1 0