December 2003 - cypherpunks-legacy

Internet Relay Chat
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Is it legal to hack IRC??? Just wondering..

3 2

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by jim bell 17 Dec '03

17 Dec '03

At 11:27 PM 7/12/96 -0700, Bill Frantz wrote: >At 9:21 PM 7/12/96 -0400, Michael Froomkin wrote: >>> could claim that MIT came very close to violating ITAR, but the same claim >> >>"The ITAR do not apply to books" > >I'm not sure the exact legalities apply here. I think it is more like the >mob pressuring business men for protection and punishing those who do not >comply. And that's what "our" government's coming to! Does anybody still think that they're not going to deserve what they get? Jim Bell jimbell(a)pacifier.com

1 0

Re: CDT Policy Post 2.27 - No New News on Crypto:
by jim bell 17 Dec '03

17 Dec '03

At 06:23 PM 7/12/96 -0400, Bob Palacios wrote: >----------------------------------------------------------------------------- > _____ _____ _______ > / ____| __ \__ __| ____ ___ ____ __ > | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ > | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ > | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ > \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ > The Center for Democracy and Technology /____/ Volume 2, Number 27 >---------------------------------------------------------------------------- > A briefing on public policy issues affecting civil liberties online >---------------------------------------------------------------------------- > CDT POLICY POST Volume 2, Number 27 July 12, 1996 >(1) NO NEW NEWS ON ENCRYPTION - VP GORE REITERATES SUPPORT FOR KEY ESCROW > >Despite the growing pressure from Congress, privacy advocates, the computer >industry, and the public for the reform of US encryption policy, the >Administration continues to embrace its Clipper III key-escrow encryption >proposal. Bob, I think I'd feel a lot better about CDT if you'd explicitly withdraw any support for the Leahy encryption bill. Jim Bell jimbell(a)pacifier.com

1 0

SECURE + PGP
by Remo Pini 17 Dec '03

17 Dec '03

I played around with secure (eudora plugin) a little bit, but it seems to be unable to decrypt anything it encrypted. (eudora 16-bit on winnt 4.0) Any hints? Also, I wan't to write a mail-program (like eudora), with built-in PGP. Is the algorithm published anywhere (including the protocols)? ie.: key generation, signing, en- and de-crypting, u.s.w. I presume the algorithms are of the shelf (DES and IDEA), but what about the hash-algorithms and key-ring management? ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

2 1

Re: I@Week on crypto export loophole 6/24/96
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:03 PM 7/13/96 +0200, you wrote: >Will Rodger wrote: >> >> The odds the US would go after a foreign company would seem pretty remote, >> unless based in a country that strongly suppported US policy. > >Er, right ... Just like they don't go after the Swiss bankers who >choose to have dealings with Columbians, or German businessmen who >have dealings with Cubans ... > You're right. I should have be more specific: I was thinking the odds the US could successfully prosecute a non-US citizen for violating those laws seems pretty remote if that person was from a country not in agreement with US crypto policy. "Go after" is a bit vague. Shame on me. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMefTA0cByjT5n+LZAQFPIAgA1CePSpY1wJm8CCQEloxIZMQMXNuaOC3U Un6JpPtIIDY8X/uSFP7wg8Mgbt+bKBNp1Ehgx6dPMavs8JnMTQWZGGuSDlIdc+5Y 41sTEA6ig6iIls3NqnnVz+0F6JTRF20gKCR1KH++7EdG/zJKJJN833N9NU4QP3od vXQ8jkaNILWzawsh83d9ZngC3ublDFU9onDOx6XIJAoSFNUn39hN8198BCtixCSq FzIDsR2cuiWe4k1PcrUAtKCOlqRxjNqrgc/sy5Gf56qIdjbgJ/rfvO9Rf6JVFZ3i 6dIqw37OEZZ89+pm5hWnjjRQUj2O3oFgO6psBdLkfXkYF6w9ryVbAw== =+1IU -----END PGP SIGNATURE-----

1 0

e-mail spam solution by Bryce Re: ADMIN: Please ignore HLD publishing
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [this is an e-mail reply to a Usenet post, carbon-copied to cypherpunks list.] In comp.os.linux.announce you, Lars Wirzenius <liw(a)iki.fi>, wrote: > >Meanwhile, I'm beginning to feel rather annoyed by the general spam >problem, especially e-mail spam. Me too. > During the worst days, about half of my non-mailing-list mail is spam. > I am in the process of installing a filter that will make it more > difficult to reach me via e-mail. I am going to require strangers to > use a password in the subject line to reach me (people I know will be > put onto a whitelist). It will be easy to get the password, but > I doubt that spammers will bother. This filtering is not in effect > yet. I'll inform you when it is. I have a great idea for an upgrade to your filter, for that fateful day when spammers start using your password: Have your filter reject any incoming mail which is not 1) from one of your white-listed friends or 2) accompanied by a one U.S. Dollar "good faith" deposit. Spammers will not find it worthwhile to send unwanted mail, because it costs them one dollar each time. But people who sincerely have interesting information for you, even if they are not people on your whitelist, can send the one dollar "good faith" deposit with a good chance that you will give the money back to them once you have read their letter. Just another example of how Ecash(tm) is going to improve the Net. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: www.c2.net/~bryce -- 'BAP' Easy-PGP v1.1b2 iQCVAwUBMejncPWZSllhfG25AQEypAQAkiC1O4nab+aLMo6v3stbHUm/VLtHo+lC kIOD+UU+ckc4/vHEMLWgT4LfQ2EH338GxOkA7zgcBe9nhcBxIqvlqU5BurmLie/X j7xXFcQTzf+D+fIaD3xBjQrs/g2oOwqiGrCKCkEf3MWzYu1J7Bw1W458vjziizyu +Q8VBY6cVV0= =nRLB -----END PGP SIGNATURE-----

1 0

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Harry Hochheiser 17 Dec '03

17 Dec '03

On 12 Jul 96 at 21:31, Arun Mehta wrote: > At 23:38 10/07/96 -0700, Will Price wrote: > >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download > > Sorry if this has been discussed before (please point me in the > right direction if that is the case), but VSNL, my government-owned > ISP (which also has a monopoly on all international traffic) made me > sign that I will not use my Internet connection for voice traffic. > Is there any way they could find out if I were using PGPfone, or > rather, could I prevent them from finding out? Arun: I can't give you a definitive answer here, but I'll take a shot. Most Internet telephony systems use UDP packets to transfer speech, since the lower overhead of UDP (as opposed to TCP) allows for better throughput. I assume (but I'm not certain) that PGPfone works the same way. Unfortunately, most of your other TCP/IP communication will be based on TCP packets. Therefore, it's theoretically possible for your ISP to monitor your traffic, watching for large numbers of UDP packets. --------------- Harry Hochheiser harry(a)tigger.jvnc.net 08 3A B5 F6 47 7F C7 C4 28 B4 8D D2 2E DF F6 1E

4 3

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Harry Hochheiser 17 Dec '03

17 Dec '03

On 12 Jul 96 at 21:31, Arun Mehta wrote: > At 23:38 10/07/96 -0700, Will Price wrote: > >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download > > Sorry if this has been discussed before (please point me in the > right direction if that is the case), but VSNL, my government-owned > ISP (which also has a monopoly on all international traffic) made me > sign that I will not use my Internet connection for voice traffic. > Is there any way they could find out if I were using PGPfone, or > rather, could I prevent them from finding out? Arun: I can't give you a definitive answer here, but I'll take a shot. Most Internet telephony systems use UDP packets to transfer speech, since the lower overhead of UDP (as opposed to TCP) allows for better throughput. I assume (but I'm not certain) that PGPfone works the same way. Unfortunately, most of your other TCP/IP communication will be based on TCP packets. Therefore, it's theoretically possible for your ISP to monitor your traffic, watching for large numbers of UDP packets. While a large amount of UDP traffic wouldn't _prove_ that you were using Internet telephony, they might _assume_ that the UDP traffic was voice traffic. It all depends on how sophisticated and heavy-handed they wanted to be about it. Now, I don't know if PGPfone uses UDP. However, if it did, it would be as easy to detect as any other Internet telephony product. An encrypted bunch of UDP bits is as easy to spot as an un-encrypted bunch, even if the contents can't be interpreted. I hope this helps. If any of this content is incorrect, my apologies. -Harry --------------- Harry Hochheiser harry(a)tigger.jvnc.net 08 3A B5 F6 47 7F C7 C4 28 B4 8D D2 2E DF F6 1E

1 0

Re: Execution of signed scripts received by e-mail
by Hal 17 Dec '03

17 Dec '03

That sounds very impressive! The one problem I've run into with mail filtering software is that each message asynchronously spawns a separate filter process. This can cause some conflicts with accessing disk files. I haven't used procmail so I don't know if it has this problem. But if so you may need to be careful if there are any cases where two processes could be accessing the same disk files. For example, what if two copies of an identical email message arrive at almost the same time, would your dup detection work. The other issue is the possibility of mail arriving out of order. Looking for increasing timestamps may cause spurious rejection of some messages. On the other hand this is a difficult problem to handle in general so probably the current solution is OK. Hal

2 1

Re: MIT harassed over publication of PGP book
by Carl Ellison 17 Dec '03

17 Dec '03

Hal, would such review have any material effect on MIT behavior? I appreciate the point about the sneakiness of the State Dept. However, I can't imagine publication of the next PGP source (or whatever) to be funded by Sandia. I would also hope they would have no fingers into any crypto research. Prior review of crypto research publications is what Adm. Inman wanted back in 1978, in response to which both Cryptologia and ICAR were founded (from my POV). MIT was a strong force in backing NSA down on its attempt to get prior review of publications and I'd hate to see them knuckle under in any way on this point. - Carl

1 0