December 2003 - cypherpunks-legacy

alpha.c2.org IS UP AND RUNNING
by test921148＠alpha.c2.org 17 Dec '03

17 Dec '03

alpha.c2.org is working well.

1 0

Whalepunks, Marginpunks, Gunpunks, Clintonpunks, and Politics
by tcmay＠got.net 17 Dec '03

17 Dec '03

To all the Whalepunks, Marginpunks, and Gunpunks, I've been deleting after only a brief glance the dozens of posts on these subjects (funny how some people who issue "pissograms" telling people things are "off-topic" apparently think their own long rants on off-topic subjects are just fine). However, this misstatement caught my eye: At 6:30 PM 6/8/96, hallam(a)Etna.ai.mit.edu wrote: >by government. I have even heard it stated that had gun ownership been >more widespread >in the UK the Dunblane massacre would not have occurred. Whether the >teacher was >expected to gun down Hamilton with the Kalashnikov she carried to school >each day or >whether the tots were expected to come to her aid with Smith and Westons >I'm not sure. >In short I don't think that there is any type of piffle that the "most >fuzzy headed free >market types" cannot offer. Some of the folks I know would point out the logical flaws in this model. First, a Smith and Wesson is not what the tots should be carrying. An MP-5K would fit nicely in their bookpacks (especially now that all yuppie kids carry de rigeur designer backpacks, though mostly for designer water). More firepower. Second, the preferred "trans-humanist" solution is much cleaner: blow up the classroom and then restore the innocents from backups. (High-tech variant: "Kill them all and let the nanotech truth machines sort them out.") My point of view is that while schools should be free of guns, adult citizens should probably have access to guns. There are, sadly, nutty people who will use nearly any available weapon to commit mayhem and mass murder. Rifles, shotguns, axes, knives... The "Luby's" cafeteria massacre in Texas several years back is a better example than the Dunblane school shooting (or the one in Tasmania, or the one in California....). There, had some of the restaurant patrons been armed, it is likely that at least one of them could have gotten off a shot. Further, many of these nutcase killers are basically cowards, according to profiles I've read, and might be fearful of sitiuations where there victims can shoot back. When they know their victims are unarmed, are sheep for the slaughterhouse, I think this causes more such "mukkings" (to use Brunner's prescient term from "Stand on Zanzibar...Christ, what an imagination he had). Remember, "Guns don't kill people, postal workers do." In general, I think Phill raises some good points about the efficiency of free markets. However, I doubt that Cypherpunks is the proper forum for debating economic theory, for various reasons. I lean strongly toward the free market side, inasmuch as I think most non-free market economies are actually just cases where the government controls the _single_ corporation they let run an industry, and thus one gets a worse situation that with the grossest excesses of capitalism. More pollution, more strip-mining, more denudation of forests, more destruction of lakes, etc. Look at the former U.S.S.R. and Eastern Europe for a glimpse of what "state capitalism" can do. However, the reason many of us don't jump in and write defenses of free markets here (and I would not have except to make my transhumanist joke--so sue me) is that this list is not "Libernet" nor any of the similar political discussion lists. Secondly, there is almost zero chance that any of us will have our views changed by such political arguments, so why bother? (I do discuss what I think are the _logical implications_ of strong cryptography and cryptoprivacy, and even the implications of crypto anarchy, and I think these issues are "on-topic" for this list. Even if one is a socialist, a fascist, a royalist, or a Wobbly, the implications remain important.) But arguing the merits of capitalism vs. socialism, for example, has rarely been fruitful in the past 10 years of the Usenet, or on mailing lists, and I doubt the debate will be more fruitful here. The same goes for debate about Clinton, Hillary, Vince Foster, Whitewater, etc. The fact that someone forwarded a Brock Meeks story in which he (apparently, as I skimmed-then-deleted the story) make negative comments about the Clintons, and then someone chimed in with points about her allegedly illegal stock trades....well, these are clearly not list topics, in my view of course. (I claim no right to set the list agenda. Nor do I accept Perry's oft-repeated claim that I am "causing" the list's decline by stating my views on this point.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Internet solution for law enforcement
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

"Alan Horowitz" alanh(a)infi.net wrote: >It appears that someone has figured out that medium-sized jurisdictions >don't want to be left out of the trendiness. And has put together a >product that can be peddled at the trade shows where Police Chiefs go. > >I recall reading that there's something like 25,000 different police >departments in America. It's a sizeable market. And a very politically >correct one, right now. > >Do these managers _need_ this stuff? Well, did they _need_ all those >black-ninja hollywood flavored SWAT uniforms? > >Now, if they could just get a few more PC-of-the-month phraseologies into >the title of their product, they'd sell twice as many. Start with >"anti-deadbeat-dad software", maybe. "Pro Diversity". "Environmentally >Friendly Software". > >Is America great, or what? You bet. PC stuff is essential. Here in Tucson, the cops came up with a novel, simple, cheap, and efficacious method to determine cocaine HCl usage: Put a strip of Scotch (TM) tape across the nostrils of a suspectee/apprehendee and see if there's any toot on it. Local judges disallowed this procedure because, in the absence of a substantial presence of African-Americans in the "community" (they comprise <2% of local population), almost all of those arrested were Hispanic-surnamed Latinos.

1 0

lets hack German Telekom
by Christian.K＠t-online.de 17 Dec '03

17 Dec '03

Hello guys, i am from Germany and i want to ask you, if you know something about the password-encryption of the T-Online Decoder from German Telekom! I tried to crack it, but it is not easy! The password is hidden in a file called DBSERVER.INI. If someone know how to crack it or has any programms please let me know! -------------------------------------------------------------------- written by Atomic (christian.k(a)t-online.de) ;-) But remember! A Homepage will soon be variable, too. :-o --------------------------------------------------------------------

1 0

Reference Correction Re: Thank you for the Archives 100 messages
by foodie＠netcom.com 17 Dec '03

17 Dec '03

Careful Alan; I didn't write that. That was qut(a)netcom.com, the latest addition to my killfile, who replied to my private email on Cypherpunks, and, rather oddly, called me a Mormon. Message in question appended. -j >> REAL crypto-anarchists, > > Like the folks who brought us Tiannemen Square? > >> of course, want the >> destruction of copyrights, trademarks, and >> other weapons of capitali$m, and will > > > > > >> Kill your Television > > Threw mine out in 1987. There's more people who don't have indoor >bathrooms, than don't have a TV. (source: 1990 Bureau of the Census). I'm >in a pretty elite group. ------------------ Return-Path: <qut> Received: (from qut@localhost) by netcom13.netcom.com (8.6.13/Netcom) id AAA24004; Sat, 8 Jun 1996 00:30:50 -0700 From: qut (Be Good) Message-Id: <199606080730.AAA24004(a)netcom13.netcom.com> Subject: Re: Thank you for the Archives 100 messages To: foodie(a)netcom.com Date: Sat, 8 Jun 1996 00:30:50 -0700 (PDT) Cc: cypherpunks(a)toad.com Reply-To: foodie(a)netcom.com In-Reply-To: <31B91EA0.16F(a)netcom.com> from "Jamie Lawrence" at Jun 7, 96 10:33:09 pm X-Mailer: ELM [version 2.4 PL23] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Content-Length: 1582 > qut4.qut(a)netcom.com wrote: > > > > Apologies, but rich has deleted me from > > his mailboxes, and for a few days now, > > As I have, too, now. > > > somebody has placed a global cancel bot on > > me. I'm gonna have plenty of fun figuring > > this out. Kwow any good sniffers? > > I'm glad! If my processor/filtering software doesn't > have to deal with your garbage, that's more time I have > to spend with folks who have something to say. The only thing your type of "cypherpunk" has to say, is blather about liability, copyrights, and other capitali$t bs. REAL crypto-anarchists, of course, want the destruction of copyrights, trademarks, and other weapons of capitali$m, and will implement crypto-anonymonity to proceed forthwith. > No, I don't know of any better "sniffers" (I assume you > mean, "software that can detect a cancelbot"), as such > software is impossible to detect. Of course, unless Rich > (or whomever cares so much about a moron) has either root > on toad.com, or at least as many resources as the NSA, he > can't cancel your mail to Cypherpunks (or anywhere else). I was talking about netnews, mormon. > > I agree the list should be public usenet: > > A mail gate-way to a usenet group that > > ALSO permits unmoderated posts. This > > would be a nice way to combine a strict > > moderated mail-list, with a standard > > netnews group. > > Er, what? > > That paragraph makes absolutely no sense whatsoever. There's already hundreds of groups like that, stupid. It will be implemented, whether you like it or not. -- Kill Your Television -- The signal is the noise. ____________________________________________________________________ Jamie Lawrence mailto:jal@cyborganic.net mailto:foodie@netcom.com

2 1

US: Domestic Encryption Protected by US Constitution?
by C Matthew Curtin 17 Dec '03

17 Dec '03

Something that has come up in my recent random thoughts... Given that the US State Department classifies strong crypto as munitions, is it possible that any laws passed outlawing the use of strong crypto among US citizens could be declared unconsitutional, in violation of the second amendment? Are there any legal precedents that apply here? Is the question purely academic (i.e., no such laws exist, no such bills are in the works, or none have been tried)? Does anyone know of any laws on the books that might be relevant to my question? -- C Matthew Curtin Chief Hacker Fahlgren, Inc. 655 Metro Pl S, Ste 700, Box 7159 Dublin OH 43017-7159 http://www.local.com/~cmcurtin/ cmcurtin(a)fahlgren.com PGP Mail Preferred

1 0

Anonymous return addresses
by Hal 17 Dec '03

17 Dec '03

Browsing through the 1995 IEEE Symposium on Security and Privacy proceedings at the library, I found two articles of interest here. The first, "Preserving Privacy in a Network of Mobile Computers", is really a method for anonymously receiving mail via reading it from a large database such that no one knows which part you are reading. This is a topic which we discussed here at some length a year or two ago, but I think this article has a new idea about it which I will discuss below. The other one was "Holding Intruders Accountable on the Internet" and it had one strange comment. Basically it was about a way of trying to track down cracker types who break into systems. One strategy these people use is to log into a whole series of insecure hosts, one after the other, before attacking their target. Then tracing back where they came from is very difficult. Cliff Stoll's "The Cuckoo's Egg" is the classic account of how hard it is to trace these people. Probably the new books about Mitnick talk about the same thing. The idea in this article is that you monitor the whole net and track all the rlogin and telnet traffic between pairs of hosts. Then they describe a statistical technique for determining that two different telnet sessions are chained together by recognizing the same patterns of traffic on them. Basically they count the frequency of spaces and punctuation marks on minute-long time slices and try to correlate them. This way you can tell that the intruder attacking here is also using these other hosts over there, and try to track him down that way. I don't think this is very practical, and I have mixed feelings about the technology - I don't favor breakins, but the kinds of surveillance that would be necessary to implement their technique seem very threatening. Also they do mention the obvious countermeasure of using encryption at each stage, which would be easy with such things as the secure remote shell programs around now. The interesting comment came when they were discussing an alternative scheme, which would be to have all hosts keep track of their incoming and outgoing connections: "The difficulty with all such host-based tracing systems is that, when an extended connection crosses a host which is not running the system, accountability is altogether lost at that point.... Even if most hosts could be secured, the intruder community could easily maintain a set of machines to launder connections, just as they maintain anonymous remailers." So apparently in the view of these authors anonymous remailers are maintained by "the intruder community." It is unfortunate that we have this image among some member of the larger community. BTW, there are periodic suggestions here to run general-purpose connection redirectors, but people should be aware of the problem that cracker types would seize on these as another shield for their crimes. These would have to be limited to specific uses, such as port 80 which is the http port and which hopefully can't easily be used for attacks. In any case, let me describe the message-receipt idea from the other paper I mentioned above, which is by David A. Cooper and Kenneth P. Birman of Cornell. They have a few ideas, among them exchanging message labels for the next message in an ongoing conversation, so that later messages don't have any identifying information on them, but just opaque message labels which can be scanned for matches to those of interest. This is a concept we have discussed before. However you still have the problem at least for the first message to an anonymous recipient of getting it to him anonymously even though the message says what pseudonym it is for. A simple idea is to put all such messages into a database and to let everyone scan the message headers to see whom they are for. Then when they see one for them they download, decrypt, and read it. For more security, let the database machine be trusted, and let the download request and response be sent encrypted. Now only the database machine knows which person asked for which message. This provides a level of security analogous to sending through a single remailer. (Another idea is to download all messages, but that is generally infeasable if there are a lot of people using the system.) The new idea is to use multiple databases to get security similar to using multiple remailers. I'll describe it using two machines. Each holds a database of messages, and the two databases are exactly alike. Some mechanism keeps the two synchronized. Furthermore, all the messages need to be the same size. There will need to be some padding and fragmentation/assembly mechanism to arrange for this. Someone who wants to receive some mail anonymously first downloads all the message headers as before, and determines which messages are for them. Suppose just one is, and it is message number 20 out of a database of, say, 50 messages. Now what the reader does is to choose a random 50 bit number (where 50 is the total number of messages in the database). He makes a copy of this number, and toggles bit 20 in one of them (20 is the message he wants to receive). Then he sends one number to one of the database servers, and the other to the other server. Each one receives a random-looking 50 bit number. What each server does is to take the messages from the database which correspondo to 1 bits in the 50 bit number, and XOR all those messages together, byte for byte. The resulting output will be the same size as a quantized message. It is sent, encrypted, back to the requestor. Now all he does is to XOR the two messages he got back from the servers. All of them will cancel out except for message 20, which is the one he wants. This can be generalized to more than two servers, by creating multiple bit strings and arranging so that the XOR of all of them will just leave the bit set for the message he wants. If he wants more than one message the protocol has to be repeated separately for each message. There is no large amount of traffic needed, as each server only sends an amount of data equal to one message. The individual servers do not get any information about which message the requestor wants (other than that it is one of the 50). Only by colluding and XOR'ing their bit strings can they figure that out. The same kind of collusion is needed to trace a sent message using two remailers, so the security is similar to what we get sending messages. Messages would have a finite lifetime and would expire and be removed from the database after a while. The authors propose breaking the database up into batches with a fixed number of messages, but I don't fully follow the reasoning behind this. I guess it reduces the load on the server when it does its XOR's. I'm not sure whether this particular scheme was proposed when we discussed this concept in the past, but it does seem like an interesting alternative way to receive messages. Hal

5 5

Re:
by jim bell 17 Dec '03

17 Dec '03

At 05:09 PM 6/8/96 -0500, Igor Chudov @ home wrote: >jim bell wrote: >> >> While I appreciate your...uh...appreciation, let me remind you that part of >> my "pronouncements" are that the current political and social system is >> sick. Many people around here seem to agree with this assessment. What I >> advocate is a comparatively simple change in the rules that could have the >> effect of vastly changing the way things are done. Whether these changes >> are in "the best interests of the inhabitants of this nation" is still an >> open question, and many people have agreed with me on this matter. >> > >Since corrupt officials are likely to have more anonymous cash that >phreedom phighters, guess who will win. The people, that's who. The reason is that while "corrupt officials" may have more money, per person, that ordinary citizens, there are FAR more ordinary citizens than officials. Further, these corrupt officials only have more money because they rob it from ordinary citizens, which means that they start out the game hated by the public. Finally, officials are, by definition, identified or identifiable, while disaffected citizens are not. Jim Bell jimbell(a)pacifier.com

3 2

Re: How I Would Ban Strong Crypto in the U.S.
by jim bell 17 Dec '03

17 Dec '03

At 09:58 AM 7/15/96 -0400, Raph Levien wrote: >[much, much elided from Tim's post] >> ... and by opposition to Clipper I, >> Clipper II, and now Clipper III. > >Is this Clipper III or Clipper IV? I seem to have lost count. I think it's Clipper 3.14159. They seem to be going around in circles. Jim Bell jimbell(a)pacifier.com

1 0

Global Government Access to Keys (GGAK)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:37 AM 7/15/96, Bill Frantz wrote: >At 2:05 PM 7/13/96 +0000, Deranged Mutant wrote: >>Or what if some terrorist was using keys escrowed in a country that >>sponsered terrorist acts? > >Deranged Mutant is absolutely right. There are about 150 (or so) >governments in the world. When people talk about making keys available to >government (or law enforcement), always ask, "Which governments can access >these keys?" If I were a non-French corporation, I would feel distinctly >nervous if the answer included France. (There are a number of other >countries where the security services have also been suspected of engaging >in industrial espionage.) There are some interesting "public relations" stunts we can use to undermine support for the concept of GAK: * Announce in corporate press releases (for some Cypherpunkish company?) that "As per the laws of the Libyan Arab Jamahiriya, we have provided Col. Qaddaffi's Office of People's Security with our encryption keys for all communications passing into, out of, or over Libyan soil." (This would likely horrify the U.S. security establishment, were it to be actually true. But it is of course essentially symmetrical with the fear those in Germany, India, Iraq, etc. would have if told to deposit copies of their keys with the U.S. National Security Agency or any other "trusted third party" mandated.) (I can't resist another aside. Sorry. In addition to the abuse of the English language with using "escrow" in this warped sense, we now have "trusted third party" used in a warped sense. "We're not saying _you_ trust them, we're saying the NSA trusts them.") * "The U.S. has designated J. P. Morgan and Company as a Designated Trusted Authority for the deposit of encryption keys for Jewish persons wishing to communicate in primarily Islamic countries." (Making the point that any international key escrow scheme which complies with various nation's laws must collide with American values about such things. In many Arab countries, Jews are restricted in various ways. Do we want the government of the U.S. participating in such restrictions? And what about the Arab boycott? It may be in decline now, but not with all countries.) * "The United States Office of Communications Security has turned over to the government of Singapore a list of all persons suspected of circumventing Singaporan law regarding encryption." (ObNazi Reference: One can imagine how a GAK program would've worked during the Third Reich. Not only would communications have been read, regardless of the supposed legal protections, but GAK would have been used to compile contact lists of people to be rounded up. Sort of the way the U.S. government violated the laws about the U.S. Census to illegally use census records to locate "Japs" for assignment to concentration camps.) And so forth, concentrating on the essentially intractable problem of how to "escrow" keys with foreign governments imimical to Western values. (The crypto literature, esp. the Proceedings of the Crypto Conference, circa the mid-80s, refers to this as the "rogue government" problem, esp. with regard to the issuance of false "is-a-person" credentials. That is, suppose a Global Identification Infrastructure (GII) is implemented, consistent with Global Government Access to Keys (GGAK). What about some countries, whether they be the Free Republic of Libertaria or the Libyan Arab Jamahiriya, who either refuse to play along or who subvert the system with false information? What if the United States itself issues false identities to its secret agents, its informants, and its 60,000+ people in the so-called Witness Security program?) There are other aspects of GAK which also collide with basic values. For example, consider several classes of communications we consider "privileged": -- attorney-client discussions, in person or over phone lines. -- doctor-patient discussions -- psychiatrist--patient discussions -- priest--penitent confessions Are the computer communications (likely in the future to increase, even if not common now) of these groups to be GAKked? Even with "safeguards," the priest--penitent relationship will be forever compromised, with neither side knowing whether some secret policemen is listening. These are not new issues; we talked about them several years ago. But now that GAK is being discussed again.... --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0