December 2003 - cypherpunks-legacy

Re: SAFE Forum--some comments
by jim bell 17 Dec '03

17 Dec '03

At 07:00 PM 7/2/96 -0700, Bill Frantz wrote: >At 2:47 PM 7/2/96 -0700, Lile Elam wrote: >>The comment I kept hearing over and over was that we have to >>educate the public about what cryptography is and why it's important >>to everyone using computers to communicate. This public includes >>people who are not on the net and those who don't even know what the >>Internet is. > >Absolutely! The image of postcards vs. letters may be the most effective >metaphor. However, that AT+T fellow who revealed the phone records to the militia group would also be an appropriate comparison to destroy the "key-escrow" idea. I assume AT+T had procedures in place which were SUPPOSED TO prevent this. Well, key-escrow agents "will" also have similar procedures. Why should we assume they will be more reliable? Jim Bell jimbell(a)pacifier.com

1 0

Re: Sameer on C-SPAN
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:42 PM 7/2/96 -0700, you wrote: >bluebreeze(a)nym.jpunix.com (Blue Breeze) wrote: >> >> Not everything. No picture of Sameer!? That's what I'd like to see. > >There's one in the latest WebSmith magazine. As well as his article on writing modules for Apache servers... [BTW, the issue number is no 4.] A worthwhile magazine if you write code for web servers. Now all I have to do is come up with a few ideas for modules... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: But what about the poor?
by jim bell 17 Dec '03

17 Dec '03

At 10:16 PM 7/2/96 -0500, snow wrote: >On Tue, 2 Jul 1996, jim bell wrote: >> stated policy of the escrow agent is that the key owner MUST be informed, >> what are the cops gonna do about it? >> >> Further, how are the cops going to evidence the existence of a valid >> warrant? (As opposed to a forgery?) > > The judge that issues it will digitally sign it. You can check the >signature block. However, what about an UNCOOPERATIVE escrow agent? (one who insists on signed paper, or for that matter insists that the judge himself shows up.) Or one, at least, who sites himself in Borneo, on the top of a 4000 foot mountain, with a 386 laptop computer and a box of floppies, and who promises 2 hour services to anybody who shows up? No email, no fax, no phone, no light, no motor car, not a single luxury....oooops....sorry about that...not even radio. Moreover, if the escrow agent is out of the country, can any domestic laws force him to divulge keys? Jim Bell jimbell(a)pacifier.com

1 0

RE: fbi botches intel "ecspionage" case
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Black Unicorn > >On Sat, 29 Jun 1996, Vladimir Z. Nuri wrote: > >> 3. hence, one wonders if the FBI could do a better job of >> combating ecspionage > >I believe you mean economic intelligence here, not economic espionage, >or >industrial espionage, or "ecspionage." ............................................................... One day in a future galaxy, "ecspionage" will involve locating "flits"..... .. Blanc

1 0

CWD -- Jacking in from the "Keys to the Kingdom" Port
by declan＠well.com 17 Dec '03

17 Dec '03

CyberWire Dispatch // Copyright (c) 1996 // Jacking in from the "Keys to the Kingdom" Port: Washington, DC -- This is a tale of broken codes, betrayal of a social contract, morality run amuck, and a kind of twisted John Le Carre meets the Crying Game encounter. For a range of companies producing so-called "blocking software" designed to keep kids from accessing undesirable material in cyberspace, the road to such a moral high ground turns out to be a slippery slope. These programs, spawned in the wake of the hysteria over how much porn Junior might find on the Net, have chosen the role of online guardians. The resulting array of applications, including names like SurfWatch, CyberPatrol, NetNanny and CyberSitter, acts as a kind of digital moral compass for parents, educators, paranoid Congressmen, and puritanical PTAs. Install the programs and Junior can't access porn. No fuss, no muss, no bother. "Parental empowerment" is the buzzword. Indeed, it was these programs that helped sway the three-judge panel in Philly to knock down the Communications Decency Act as unconstitutional. But there's a darker side. A close look at the actual range of sites blocked by these apps shows they go far beyond just restricting "pornography." Indeed, some programs ban access to newsgroups discussing gay and lesbian issues or topics such as feminism. Entire *domains* are restricted, such as HotWired. Even a web site dedicated to the safe use of fireworks is blocked. All this might be reasonable, in a twisted sort of way, if parents were actually aware of what the programs banned. But here's the rub: Each company holds its database of blocked sites in the highest security. Companies fight for market share based on how well they upgrade and maintain thhat blocking database. All encrypt that list to protect it from prying eyes --- until now. Dispatch received a copy of each of those lists. With the codes cracked, we now held the keys to the kingdom: the results of hundreds, no, thousands of manhours of smut-surfing dedicated to digging up the most obscene and pornographic sites in the world. And it's in our possession. But it didn't come easy... I'd just spent the better part of a muggy Washington night knocking back boilermakers in an all-night Georgetown bistro waiting for a couple of NSA spooks that never showed. I tried to stumble to the door and an arm reached out and gently shoved me back to my table. At the end of that arm was a leggy redhead; she had a fast figure and even faster smile. There was a wildness about her eyes and I knew it was the crank. But something else wasn't quite right. As I fought with my booze-addled brain, struggling to focus my eyes, I noticed her adam's apple. "Who needs this distraction," I thought, again wondering what kind of comic hellhole I fell into that put me in the middle of yet another bizarre adventure. "I have something for you," she/he deadpanned. Red had the voice of a baritone and a body you could break bricks on. No introductions, no chit-chat. This was strictly business and for a moment I thought I was being set up by the missing spooks. The hair on the back of my neck stood on end. Out from Red's purse came a CD-ROM. She/he shoved the jewel box across the table. It was labeled: "The keys to the kingdom." What the fuck was this? I must be on Candid Camera. Red anticipated my question: "I can't say; I won't say. Just take it, use it. That's all I'm supposed to say." And she/he got up, stretched those mile-high legs, and loped into the night. The next morning I slipped the disc in my Mac and the secret innards of the net-blocking programs flowed across my screen. CyberPatrol, SurfWatch, NetNanny, CyberSitter. Their encrypted files -- thousands and thousands of web pages and newsgroups with the best porn on the Net. Not surprising, really -- the net-blocking software companies collect smut-reports from customers and pay college kids to grope around the Net for porn. This shit was good. Even half-awake with a major league hangover, I could tell the smut-censoring software folks would go ballistic over Red's delivery. To Junior, these lists would be a one-stop-porn-shop. Susan Getgood from CyberPatrol emphasized this to Dispatch. She said: "The printout of the 'Cybernot' list never *ever* leaves this building. It's under lock and key... Once it left this building we'd see it posted on the Net tomorrow. It would be contributing to the problem it was designed to solve -- [it would be] the best source of indecent material anywhere." She's right. A recent version of CyberPatrol's so-called "Cybernot" list featured 4,800 web sites and 250 newsgroups. That's a lot of balloon-breasted babes. CyberPatrol is easily the largest and most extensive smut-blocker. It assigns each undesirable web site to at least one and often multiple categories that range from "violence/profanity" to "sexual acts," "drugs and drug culture," and "gross depictions." The last category, which includes pix of syphilis-infected monkeys and greyhounds tossed in a garbage dump, has some animal-rights groups in a tizzy. They told Dispatch that having portions of their sites labeled as "gross depictions" is defamatory -- and they intend to sue the bastards. "We're somewhat incensed," said Christina Springer, managing director of Envirolink, a Pittsburgh-based company that provides web space to environmental and animal-rights groups. "Pending whether [our attorney] thinks we have a case or not, we will actually pursue legal actions against CyberPatrol." Said Springer: "Animal rights is usually the first step that children take in being involved in the environment. Ignoring companies like Mary Kay that do these things to animals and allowing them to promote themselves like good corporate citizens is a 'gross depiction.'" CyberPatrol's Getgood responded: "We sent a note back to [the Envirolink director] and haven't heard back from him. Apparently he's happy with our decision. I still think the monkey with its eye gouged out is a gross depiction." Rick O'Donnell from the Progress and Freedom Foundation is amazed that Envirolink would threaten legal action. "It's new technology. It's trial-and-error... There will be glitches." "Filtering software firms have the right to choose whatever site they want to block since it's voluntary... Government-imposed [blocking] is censorship. Privately-chosen is editing, discernment, freedom of choice," he said. The Gay and Lesbian Alliance Against Defamation (GLAAD) is as unhappy as Envirolink. When Dispatch spoke with GLAAD's Alan Klein and rattled off a list of online gay and lesbian resources that the overeager blocking software censored, he was horrified. "We take this very seriously," said Klein. "Lesbian and gay users shouldn't be treated as second-class users on the Net. These companies need to understand that they can't discriminate against lesbian and gay users... We will take an active stance on this." CyberPatrol blocks a mirror of the Queer Resources Directory (QRD) at http://qrd.tcp.com/ and USENET newsgroups including clari.news.gays (home to AP and Reuters articles) alt.journalism.gay-press, and soc.support.youth.gay-lesbian-bi, Red's list revealed. CyberSitter also bans alt.politics.homosexual and the QRD at qrd.org. NetNanny blocks IRC chatrooms such as #gaysf and #ozgay, presumably discussions by San Francisco and Australian gays. GLAAD told Dispatch they were especially surprised that CyberPatrol blocked gay political and journalism groups since the anti-defamation organization has a representative on the "Cybernot" oversight committee, which meets every few weeks to set policies. However, Dispatch learned the oversight group never actually sees the previously top-secret "Cybernot" list. They don't know what's *really* banned. Why should alt.journalism.gay-press, for instance, be blocked? There's no excuse for it, said GLAAD's Klein. "A journalism newsgroup shouldn't be blocked. It's completely unacceptable... This is such an important resource for gay youth around the country. If it weren't for the Net, maybe thousands of gay teens around the country would not have come out and known there were resources for them." He's right. Even a single directory at the QRD, such as the Health/AIDS area, has vital information from the Centers for Disease Control and Prevention, the AIDS Book Review Journal, and AIDS Treatment News. In response to Dispatch's questions about these sites being blocked, CyberPatrol's Getgood said: "It doesn't block materials based on sexual preference. If a site would be blocked if there are two heterosexuals kissing, we'd block it if there are two homosexuals kissing." Fine, but we're not talking about gay porn here. What about some of the political groups? "We'll look into it," said Getgood. NetNanny is just as bad, argues GLAAD's Loren Javier, who called the software's logging features "dangerous." (The program lets parents review what their kids have been doing online.) "If you have someone who has homophobic parents, it gives them a way of keeping tabs on their kid and possibly making it worse for their children," said Javier. Worse yet, CyberPatrol doesn't store the complete URL for blocking -- it abbreviates the last three characters. So when it blocks the "CyberOS" gay video site by banning http://www.webcom.com/~cyb, children are barred from attending the first "Cyber High School" at ~cyberhi, along with 16 other accounts that start with "cyb." In attacking Shawn Knight's occult resources at http://loiosh.andrew.cmu.edu/~sha, the program cuts off 23 "sha" accounts at Carnegie Mellon University, including Derrick "Shadow" Brashear's web page on Pittsburgh radio stations. The geeks at CMU's School of Computer Science had fun with this. In March they cobbled together a "Banned by CyberPatrol" logo that they merrily added to their blocked homepages: http://nut.compose.cs.cmu.edu/images/ban3.gif NetNanny also has a fetish for computer scientists. For instance, it blocks all mailing lists run out of cs.colorado.edu -- including such salacious ones as parallel-compilers, systems+software, and computer-architecture. Guess those computer geeks talk blue when they're not pumping out C code. Dispatch asked Getgood why CyberPatrol blocks access to other seemingly unobjectionable web sites including the University of Newcastle's computer science department, the Electronic Frontier Foundation's censorship archive, and the League for Programming Freedom at MIT, a group that opposes software patents. Getgood replied via email: "I'll forward this message to our Internet Research Supervisor and have her look into the specific sites you mention..." She said there is a "fair process" for appeals of unwarranted blocking. But CyberPatrol doesn't stop at EFF and MIT. It also goes after gun and Second Amendment pages including http://www.shooters.com/, http://www.taurususa.com/, http://206.31.73.39/, and http://www-199.webnexus.com/nra-sv/, according to a recent "Cybernot" list. The last site is run by the National Rifle Association (NRA) Members' Council of Silicon Valley, and bills itself as "the NRA's grass roots political action and education group for the San Jose, Santa Clara, Milpitas, and surrounding areas." Peter Nesbitt, an air-traffic controller who volunteers as part of the Silicon Valley NRA group, says "it's terrible" that CyberPatrol blocks gun-rights web sites. "The people who are engaging in censoring gun rights or gun advocates groups are the opposition who want to censor us to further their anti-gun agenda." An unlikely bedfellow, the National Organization of Women (NOW) ain't too pleased neither. Of course, they're unlikely to feel any other way -- CyberSitter blocks their web site at www.now.org. Not to be outdone, NetNanny blocks feminist newsgroups while CyberSitter slams anything dealing with "bisexual" or "lesbian" themes." CyberPatrol beats 'em all by going after alt.feminism, alt.feminism.individualism, soc.feminism, clari.news.women, soc.support.pregnancy.loss, alt.homosexual.lesbian, and soc.support.fat-acceptance. Dispatch reached Kim Gandy, NOW's executive vice president, at home as she was preparing dinner for her 3-year old daughter. Gandy charged the companies with "suppressing information" about feminism. She said: "As a mother myself, I'd like to limit my kids from looking at pornography but I wouldn't want my teenage daughter [prevented] from reading and participating in online discussions of important current issues relating to womens rights." An indignant NOW? Let 'em rant, says CyberSitter's Brian Milburn. "If NOW doesn't like it, tough... We have not and will not bow to any pressure from any organization that disagrees with our philosophy." Unlike the others, CyberSitter doesn't hide the fact that they're trying to enforce a moral code. "We don't simply block pornography. That's not the intention of the product," said Milburn. "The majority of our customers are strong family-oriented people with traditional family values. Our product is sold by Focus on the Family because we allow the parents to select fairly strict guidelines." (Focus on the Family, of course, is a conservative group that strongly supports the CDA.) Dispatch particularly enjoyed CyberSitter's database, which reads like a fucking how-to of conversations the programmers thought distasteful: [up][the,his,her,your,my][ass,cunt,twat][,hole] [wild,wet,net,cyber,have,making,having,getting,giving,phone][sex...] [,up][the,his,her,your,my][butt,cunt,pussy,asshole,rectum,anus] [,suck,lick][the,his,her,your,my][cock,dong,dick,penis,hard on...] [gay,queer,bisexual][male,men,boy,group,rights,community,activities...] [gay,queer,homosexual,lesbian,bisexual][society,culture] [you][are][,a,an,too,to][stupid,dumb,ugly,fat,idiot,ass,fag,dolt,dummy] CyberSitter's Milburn added: "I wouldn't even care to debate the issues if gay and lesbian issues are suitable for teenagers. If they [parents] want it they can buy SurfWatch... We filter anything that has to do with sex. Sexual orientation [is about sex] by virtue of the fact that it has sex in the name." That's the rub. It's a bait and switch maneuver. The smut-censors say they're going after porn, but they quietly restrict political speech. All this proves is that anyone setting themselves up as a kind of digital moral compass quickly finds themselves plunged into a kind of virtual Bermuda Triangle, where vertigo reigns and you hope to hell you pop out the other side still on course. Technology is never a substitute for conscience. And for anyone thinking of making an offer for the disc, forget it. Like a scene out of Mission Impossible, we came back from a late-night binge to find the CD-ROM melted and the drive smoldering. Thank God there's a backup somewhere. Red, get in touch. Meeks and McCullagh out... ------------- While Brock N. Meeks (brock(a)well.com) did the heaving drinking for this article, Declan B. McCullagh (declan(a)well.com) did the heavy reporting.

4 4

Re: The Net and Terrorism
by jim bell 17 Dec '03

17 Dec '03

At 12:00 AM 7/3/96 -0700, Vladimir Z. Nuri wrote: > >keep in mind that Ruby Ridge and Waco happened only a few years >ago. that's a nanosecond in cosmic time, yet the terrorist >repercussions are being felt immediately. I would say its very >visceral evidene that terrorists are responding to events and >are not just madmen out for the fun of killing people. there's >a bit of that of course.. If you listen to the Feds discussing this most recent militia story, when they're asked what was the militia's motivation, they don't want to talk about it, and won't even speculate on more than the most unspecific, vacuous terms. Jim Bell jimbell(a)pacifier.com

1 0

Re: SAFE Forum--some comments
by jim bell 17 Dec '03

17 Dec '03

At 08:44 PM 7/2/96 -0700, Martin Minow wrote: >It's not quite that bad. Here are a few (more or less strong) crypto >products you might not know you have: > >1. Every Macintosh made since at least 1988 has a secure authentication > client module in the AppleShare Chooser dialog. When you use it to > connect to a remote server, it notes that the user information > is "two-way scrambled." (The server sends a random number challenge > that the client uses to encrypt the username and password. The > encrypted information is sent to the server.) All Macintosh systems > running System 7 or later have the corresponding server software. > What is interesting about this is that the encryption is completely > invisible to the user. How did this affect the Macintosh's exportability? >Note that the VCR companies have solved the vcr problem by receiving >a timecode from a local television station -- making the problem >invisible to the end user. We should be able to do the same with >strong crypto. I haven't bought a new VCR in a few years. Is this real? What prevented them from doing this 10 years ago? Jim Bell jimbell(a)pacifier.com

1 0

Re: hard drive encryption
by Anthony Daniel 17 Dec '03

17 Dec '03

Hi You could try using SECURE Desk-Top. It can encrypt your hard drive using a symmetrical key. The algorithms are DES and IDEA (128 bits). It's fast and you could choose exactly what part of the drive to encrypt, whether just some files or the entire drive. You can download the software from this url: http://www.systems.it/secure All the best Anthony > >What is the best utility freely available for encrypting an entire drive >that won't be used for a length of time? ie: I'm going away for a period >of time and wish to encrypt the drive while I'm gone, but have no interest >in actually using it while it's encrypted. I also have no real preference >in what algorithm is used, as long as it's relatively secure. Speed is >also not a big consideration, as it will be used once when I leave to encrypt, >and once when i return to decrypt. >Thanks in advance for the help... >//cerridwyn// > >btw, the OS is Win95 if that matters... >

1 0

NOISE.SYS v0.6.3 is released.
by Deranged Mutant 17 Dec '03

17 Dec '03

NOISE.SYS Version 0.6.3-Beta is now released. Check ftp.funet.fi in directory /pub/crypt/random. NOISE.SYS is a /dev/random-like driver for DOS systems, similar to the Linux implementation. It collects timings from keystrokes, disk access, mouse movement, and other system events as sources of randomness. Changes include: Ability to add samples by writing to RANDOM$ or URANDOM$ devices Fixes bug when reading RANDOM$ device in ASCII mode under MSDOS7 (Yes, it was a minor bug) If you have any questions, comments, or problems, drop me a line. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Lack of PGP signatures
by Brad Shantz 17 Dec '03

17 Dec '03

Mark M. Wrote: > > Is it because most mail programs are not PGP aware? > > I don't know of any mail programs that can use PGP (I know there are various > interfaces, sendmail wrappers, and other hacks, but I have yet to see a mailer > with an "Encrypt" or "Sign" option. Once upon a time last year or the year before, Tim May posted why he doesn't use PGP very often. And I have always stood by that same sentiment. Yes, it is a good encryption product, but it is not integrated seamlessly into other applications. Tim, feel free to whack me if you think I'm speaking for you. If, as cypherpunks, we want to spread the use of strong crypto, we need to have a better interface than what currently exists on PGP 2.6.2. I'm sure Derek and the other guys on PGPlib will make it easier to integrate into applications. Am I just blowing smoke, Mr. Atkins? PGP is a pain for encrypting or signing e-mail when you have to save your message out to a temp file, encrypt it, and load it back in to your mail package. Sure, there are things like Private Idaho, which I use on occasion. But, it is still a seperate application that just doesn't fit seamlessly into most applications. In my free time, I have been playing around with add ons for Microsoft Exchange. I've got an OLE 2.0 encryption object that embeds nicely into an Exchange message. I haven't tied it in to PGP yet, because I have been waiting for the release of PGPlib. However, that will allow at least some seamless integration. Brad Shantz TRIsource Windows Development Services

4 3