December 2003 - cypherpunks-legacy

Banned Zambian newspaper now on the Web
by Declan McCullagh 17 Dec '03

17 Dec '03

We now have the banned February 6 issue of _The Post_ online! Frank Stuart kindly provided a copy of the text. I've HTMLized it, added background documents and information about other international censorship efforts, and put it online at: http://www.cs.cmu.edu/~declan/zambia/ Zambia's president-cum-tyrant Frederick Chiluba has plenty of practice censoring local dissidents, broadcasters, and newspapermen. Now, if he likes, he can take on the Net. I've copied this message to the state news service, Zambia Today. Please redistribute as appropriate. -Declan ------------------------------------------------------------------------ http://www.cs.cmu.edu/~declan/zambia/ ------------------------------------------------------------------------ NET CENSORSHIP AND ZAMBIAN DICTATORS By Declan McCullagh declan(a)well.com Zambian President and Dictator-for-Life Frederick Chiluba has made a career of intimidating, harassing, arresting, and censoring those who disagree with him. Now his attempts to muzzle his critics have reached the Net -- specificially, Zamnet, the only Internet service provider in this impoverished African country. Chiluba has plenty of experience intimidating traditional media. At Chiluba's bidding, in December 1994 an armed paramilitary unit raided the Lusaka offices of The Post newspaper and its printer Printpak in Ndola looking for "seditious and defamatory material" -- just as the presses were starting to roll. Germany's ambassador to Zambia, Peter Schmidt, who witnessed the raid, told InterPress Service that "the raid amounted to an attempt to intimidate the free press." A few days later, police arrested the top editors of the weekly Crime News and held them without bail and without filing charges. The journalists' offense? The newsweekly had revealed that Chiluba's wife was involved in drug trafficking. The year before, Chiluba sued The Weekly Post for libel after the paper reported on his shady financial dealings with South Africa. Chiluba also fired the head of the Zambia National Broadcasting Corporation for not broadcasting appropriately pro-government programming. In 1994, the ever-vigilant Chiluba introduced legislation to make the Zambian media answerable to a government-appointed secret tribunal with broad, undefined powers of censure and punishment. Chiluba's latest state-sponsored terrorism came in early February 1996, after The Post published a report revealing the government's plans to hold a referendum on the adoption of a new constitution -- plans Chilbua hoped to keep secret to the disadvantage of his political opponents. True to form, the hypersensitive Chiluba ordered his forces to invade the newspaper's office, ransack the paper's files, arrest the editors, and stop the presses. Security forces then sealed the offices of The Post. Chiluba's despotic behavior is reprehensible. Foreign governments immediately should yank the $1.8 billion in foreign aid Zambia receives each year and demand Chiluba's ouster. That failing, it's high time for the Zambian people to kick their thin-skinned tyrant out of office. February 16, 1996: Zamnet Communication Systems, which hosts the the web version of The Post, removes the online copy of the February 5 issue after police threaten a raid. David Lush of the Media Institute of Southern Africa publishes an advisory. February 18, 1996: After reading Lush's advisory, I send an appeal requesting the text to several mailing lists. February 19, 1996: Frank Stuart contacts me when I'm logged into the WELL, saying he has a copy of the banned issue of the newspaper. February 20, 1996: This archive goes online after I translate Frank's text into HTML. ###

2 3

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 6:46 PM 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this <...> IPG, why don't you sit down and draw up the terms of a challenge? Specify: * what information and/or materials IPG will release * to whom it will release them and when * who is or isn't elligible * what you will and won't accept as "breaking your system" * the arbitrating body * a starting time and a deadline * the award You'd do well to be _very_ thorough in these terms, since any perception that IPG was trying to throw the game would draw that much more fire. You'd also do well to make terms terms conform to real-world circumstances: for example, if someone hacking the office machines on which which you generate, store, and/or disseminate RNs is a practical threat to your product, then admit that as an acceptable part of a "break." Ted

5 7

Web Browsers and Anonymous Mail (Was: NSA net trolling)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Wayne Madsen wrote somewhere: > A knowledgeable government source claims that > the NSA has concluded agreements with [...] Netscape to > permit the introduction of the means to prevent the anonymity of > Internet electronic mail, [...] I suspect this may actually mean that they're pushing Netscape to incorporate cryptographic authentication into browser email, which I think is a useful development. I'm not aware of any public remailers previously operated by Netscape Communications Corp. that have now shut down. ;) At any rate, it's an excuse for me to ask some questions: (0) I'm not aware of any class library objects or methods in stand-alone Java for calling the local mail transport agent. Is there any class library support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, etc.} for applet calls to the local mail agent that's configured in the browser ? I would prefer not to reimplement SMTP using the Socket class in my own applets. Ideally I'd like to have an applet that presents a form with some entry boxes and check boxes, quantizes and encrypts the input according to the check box settings, and spews the resulting byte streams to the MTA. (1) As I recall, I used to be able to set (as an Option) the path and name of the local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That seems to have disappeared in Navigator 2.0. Is there indeed no longer a way to set that ? It occurs to me that we could have achieved partial integration of remailing into Navigator quite cheaply with that option. Comments from Sun and/or Netscape and/or anyone else would be welcome. Thanks :) -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

2 3

Re: NSA net trolling
by Eric Murray 17 Dec '03

17 Dec '03

Here's a copy of your message back to you as you requested: lmccarth(a)cs.umass.edu writes: > > Wayne Madsen wrote somewhere: > > A knowledgeable government source claims that > > the NSA has concluded agreements with [...] Netscape to > > permit the introduction of the means to prevent the anonymity of > > Internet electronic mail, [...] > > I suspect this may actually mean that they're pushing Netscape to > incorporate cryptographic authentication into browser email, which I think is > a useful development. (Hey, I read that Netscape employees get fined $1 for > referring to Navigator as a "browser".) > > At any rate, it's an excuse for me to ask some questions: > > (0) > I'm not aware of any class library objects or methods in stand-alone Java > for calling the local mail transport agent. Is there any class library > support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, > etc.} for calls to the local mail agent configured in the browser ? > > I would prefer not to reinvent SMTP using the Socket class in my own applets. > Ideally I'd like to have an applet that presents a form with some entry boxes > and check boxes, quantizes and encrypts the input according to the check box > settings, and spews the resulting byte streams to the MTA. > > (1) > As I recall, I used to be able to set (as an Option) the path and name of the > local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That > seems to have disappeared in Navigator 2.0. Is there indeed no longer a way > to set that ? > > It occurs to me that we could have achieved partial integration of > remailing into Navigator quite cheaply with that option. > > Comments from Sun and/or Netscape and/or anyone else would be welcome. > Thanks :) > > -Lewis "You're always disappointed, nothing seems to keep you high -- drive > your bargains, push your papers, win your medals, fuck your strangers; > don't it leave you on the empty side ?" (Joni Mitchell, 1972) > > -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

IBM Breakthrough?
by John Young 17 Dec '03

17 Dec '03

IBM has an ad in the Feb 26 New Yorker where a joker e- mails a recipe-swapping friend in Osaka that "I'll teleport you some goulash." The text then states: Margit is a little premature, but we are working on it. An IBM scientist and his colleagues have discovered a way to make an object disintegrate in one place and reappear intact in another. It sounds like magic. But their breakthrough could affect everything from the future of computers to our knowledge of the cosmos. What is this breakthrough or is it just a chump tease?

3 2

mixmaster info?
by David K. Merriman 17 Dec '03

17 Dec '03

I hate to bring up the topic of privacy/crypto (yech! :-), but could someone point me at the 'specs' for Mixmaster remailers? I'm after how messages are sliced, diced, repackaged, and shipped, etc. Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:46 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this in my first >reply - in addition to giving you the company if you can break the >system, we will give you the company if you can establish, through our >employees or any other method, that we retain any Ocopies of the TPs, >any! - for very large systems, we maintain a temporary copy to insure >safe arrival, by excuting the check system menu item - >it is immediate destroyed upon system notification. Anyone that wants to >audit us cazn do so, unannounced at any time - subject to payment ofd >expenses! We do not keep copies, we would not be in business 30 days if >we did. It is irrelevant if you keep copies of the OTPs or not. The point is that you might. There is no way to prove to me or anyone else that you don't keep copies. [why this is true is left as an exercise to the reader]. I would not trust anyone outside my company to create keys for us. I would urge any others interested in keeping their data inaccessible to outsiders to exercise the same fundamental caution. There is no further need to look at IPG's source code or algorithms. As I said, end of story. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by dan＠milliways.org 17 Dec '03

17 Dec '03

Perhaps you should apply for an export license for your software. I'm sure that the ability to use your system across national borders fits nicely within your marketing strategy. To do so, you simply submit your product to the U.S. National Security Agency, and submit a Commodity Jurisdiction application to the State Department. After the NSA evaluates its security, you'll be able to sell your product overseas. Please see pages 610-618 of Applied Cryptography, Second Edition for general information on the process. By the way, you might note that Cypherpunks is only a mailing list, there is no way to get the signed consent of everyone on the list to agree to anything, much less formal rules of a contest. My suggestion is to post the OTP-expansion algorithm to sci.crypt. It's really in all of our best interests to have the greatest number of people examining your product. Think of the publicity it will generate. Your work will remain protected with whatever patents or copyrights you have applied for. This approach is nothing new, RC2 and RC4 were both posted to sci.crypt. Both are in wider use today because of it. Both algorithms stood up to many people's tight scrutiny. I think your algorithm should be given the chance to do the same. Dan ************************************************************************** Support your local info-calypse dan(a)milliways.org "The Internet cannot be regulated. It's not that laws aren't relevant, it's that the nation state is not relevant." Nicholas Negroponte, 1996 The Cypherpunks: Civil liberties through complex mathematics. **************************************************************************

4 5

CoFR Report Site
by John Young 17 Dec '03

17 Dec '03

Thanks to KLP, the Council on Foreign Relations report on the future of US intelligence: http://www.tc.umn.edu/~klp/CoFR.txt (text) and http://www.tc.umn.edu/~klp/CoFR.gz

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 06:10 PM 2/20/96 -0600, you wrote: >> ** fairly remarkable coincidences. Or is it that great minds >> think alike? > >heh, actually the Elementrix POTP sounds like plaintext-driven autokey >cipher and probably wouldn't be offensive if they weren't touting it as a >'OTP'... > Yes, that's true, but they also allude to "a large number of randomly spinning dice" [rotors?] of which some are selected by contents [perhaps] the autokey stream. This from a discussion held with the POTP people. The allusion to the numerous 'dice' is what suggested to me a similarity with the new [unknown but perfect, of course] system. The autokey of POTP was supposedly only part of the scheme....

1 0