December 2003 - cypherpunks-legacy

the VTW---FBI Connection
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

We have received information that VTW is run and supported by the FBI, which we have suspected for reasons listed here. I) They appear to have no financial support or funding source. They do not accept donations. They have no corporate funds. And yet they appear to be a thriving business. II) They are secretive about their location, and do not seem to have a headquarters. The address listed in the NIC is a vacant lot in of all places Brooklyn, NY. They do not have a listed telephone. III) On a tip from a "friend" we learned that the power leader behind VTW is a cleancut man with the unusual name "Shabbir M. Safdar." Not exactly a common name. Several people say they've met him. Our "friend" says that Mr. Safdar is in reality an agent of the FBI. IIII) We didn't believe this without external verification. So we called the Brooklyn office of the FBI and asked for Agent Safdar. No such person. I called the Washington office. No such person. Checked if there is any agent named Safdar. They don't give out this info. Then we tried to find ANY public records on a Safdar, with no luck. No driver's license in NY, DC, NJ, etc. No phone, etc. Odd that such a person does not exist and yet runs a "human rights" organization? Then Alice called the NY FBI office. Asked for Agent Safdar. Guess what? "He's not in. Can I take a message". No message, thanks. He'll get the message all right. Now the big question: What is the FBI trying to do getting all these names? What else has "VTW" been doing? And what other organizations like them are there? Who else is in on it? What does this say about EPIC, CDT, EFF? Are Blaze and Schneier dupes, or willing participants? What about their ISP? I think we are all owed an explanation. This is serious. Maybe FOIA or a lawsuit before they burn the files. What do you want to bet "VTW" quietly fades away after a few prefunctory denials, and gets replaced by another organization in due course? Faithfully, Net reporter team Alice and Bob

7 6

VTWW
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

Any of you New Yorkers know the Society for Electronic Access (SEA)? Maybe you can comment on Mr. Safdar. --j

3 2

Re: Firewall Penetration
by Frank Willoughby 17 Dec '03

17 Dec '03

At 10:09 PM 7/21/96 -0400, you wrote: >Frank Willoughby <frankw(a)in.net> wrote: > >>FWIW, of @70 firwalls on the market, only @5 are adequate to protect >>a company from the hazards of the Internet. > > Ah, Frank, are you talking here about session hijacking and is >end-to-end crypto the defining factor of the robust five? Of course (Vin already knew the answer). 8^) To answer the other questions posed on this list, the vendors who are relatively immune to the above attacks AND are Application Gateway type firewalls are: (in alphabetical order): Digital's Firewall for Unix - *IF* the IP Encryption Tunnel is also used Raptor's Eagle Technologics' firewall (This is a stretch. They claim they have encryption, but I'm not wild about the implementation) 1/2 a point TIS Gauntlet V-One's SmartWall Interestingly enough, the reason the 5 are so robust is that they employ user->firewall encryption to help prevent session hijacking attacks. FWIW, session hijacking isn't a theoretical attack. It is a serious threat and (sadly) it's as simple as "point & click". Another plus for good crypto - it not only helps protect the privacy of data, it also helps prevent some types of hacking attacks. Anyone can do firewall->firewall encryption (and most serious vendors do). The hard part is getting the user->firewall encryption part to work well. Again, as stated in my previous mail, my company doesn't sell firewalls, so I can call things the way I see them. As the above list will probably draw the flames of firewall vendors who feel insulted that they aren't part of the list, I think it would be best to move this topic over to the firewalls mailing list (where it really belongs). See you there. > Suerte, > _Vin > > Vin McLellan +The Privacy Guild+ <vin(a)shore.net> > 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 > <*><*><*><*><*><*><*><*><*> Best Regards, Frank Any sufficiently advanced bug is indistinguishable from a feature. -- Rich Kulawiec <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Information Security Consulting http://www.fortified.com Phone: (317) 573-0800 FAX: (317) 573-0817 Home of the Free Internet Firewall Evaluation Checklist

1 0

Re: NSA Lawyers Believe ITARs Would be Overturned if Tested in Court
by jim bell 17 Dec '03

17 Dec '03

At 02:25 AM 7/22/96 -0700, Timothy C. May wrote: >(Not all of them, presumably. Shipment of hardware ("arms") would likely >not be affected. But the ITARs that stop the spread of knowledge, published >papers, and speech (such as speaking where a foreigner can hear!) would >likely be overturned.) >--Tim May Which raises an interesting question: Why aren't they (still) restricting PC-type computers for export? While it might not appear to make a great deal of sense either, a PC is just as much a tool for encryption as the software which runs on it. And it's obvious that given the two scenarios below: 1. You have a $1000 computer and no (freebie) software yet. or 2. You have freebie software and no $1000 computer. You're closer ($) to being able to do encryption with the former set of equipment. And, of course, nobody's under the illusion that the government can keep the software bottled up, but they'd at least have a prayer keeping most 486 and Pentium-based computers from being exported. I don't mean to give the idiots any ideas, and it's too late anyway, but... Jim Bell jimbell(a)pacifier.com

1 0

Re: Info War
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:15 PM 7/20/96 -0400, EVERHART(a)Arisia.GCE.Com wrote: >* I'd expect some comments on the automatic running of downloaded images >and how to secure them. Java? Reported at Princeton to be totally >unsecurable....no models exist. I think a more accurate assessment of what the Princeton people think is that the state of Java security is much like the state of Unix (pick your flavor) security when people first started attacking Unix. Since then it has been fix the holes as they are found. Neither has a coherent security model. Now the Princeton people can tell us all how I miss-interpreted their position. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Special Agent Safdar
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

FBI Special Agent Safdar is upset enough by the revelation of his true identity to issue a quick denial (on a sunday night, to get more OT no doubt), but he doesn't even bother to try to refute the central truth that his cover has been blown by a careless operator at his home office who verified his employment and offered to take a message for him. We don't have to wonder a second longer about the motives behind Safdar\VTW\FBI's collection of names of crypto-dissidents, their support of the Leahy crypto control bill, their refusal to denounce it even today, their support of the digital telephone act, the disinformation to make us believe otherwise and all the other lies. And what about the money? We must call on the other organizations, like EPIC, EFF, CDT, and ACLU to denounce the VTW\FBI fraud. Their board of directories, Blaze and Schneier to face the truth in public that they they have been used. The net as a whole to demand its pound of cyberflesh. There are very big questions to be answered now and we must not forget to keep asking them until they have been. How high did this operation go? Agent Safdar is no Olly North! He didn't do this on his own. Who ordered this? This is exactly like the FBI in the 1960s and civil rights groups. In the hands of the right reporter, this could and should bring slick willie right on down.

4 3

Re: Does JPUNIX Remailer Have a Help File?
by John A. Perry 17 Dec '03

17 Dec '03

On Fri, 1 Sep 1989, Damien Lucifer wrote: > I beleive the jpunix nym server is running the alpha nym package, the > documentation of which should be all but identical to the docs for > alpha.c2.org. You can see that document at http://alpha.c2.org This will also work. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers.

1 0

SHI_fty
by jya＠pipeline.com 17 Dec '03

17 Dec '03

7-22-96. NYP, Page One: "Microsoft Sees A Major Shift For Computers." John Markoff MS is preparing to release new software that would bring the most fundamental change to personal computers since the machines were invented in the 1970's. Demonstrated last week and to be distributed free to the public, the software is designed to blend the multimedia technology of the Web with Windows 95. PCs would treat each parcel of material as a document with all the stand-alone capabilities of a Web page. Each of these documents would have hyperlinks so that the creator of a document could make it available for reading, listening or viewing anywhere on the Web. "This is going to make enormous changes possible," said Jesse Berst, editor of Windows Watcher. "It's analogous to the advent of the automobile." "We're moving into a new world; we now have a new metaphor," said John Seely Brown, director of the Xerox Corporation's Palo Alto Research Center. A potentially troublesome aspect to Microsoft's new thrust is the extent to which it will further blur the distinctions between data that sit safely on a person's own computer and data flowing around the Internet. While certain measures of privacy and security control are built into Microsoft's current and planned software, it is still working to develop better security for Internet software. ----- http://jya.com/shifty.txt SHI_fty

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 alpha) (flame replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 22 Jul 96 6:49:22 PDT remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca ***-**+***** 17:17 99.99% replay remailer(a)replay.com ***+****+*** 6:16 99.98% alumni hal(a)alumni.caltech.edu *##+*+#*#### 2:13 99.98% nymrod nymrod(a)nym.jpunix.com +##++#*##### 2:54 99.98% lead mix(a)zifi.genetics.utah.edu +++-++++++++ 39:07 99.90% portal hfinney(a)shell.portal.com +##+**###### 1:56 99.87% amnesia amnesia(a)chardos.connix.com ----------+ 2:57:13 99.84% alpha alias(a)alpha.c2.org +**-+ .-+*++ 5:10:18 99.75% c2 remail(a)c2.org +++-+ .-+++* 5:36:10 99.57% vegas remailer(a)vegas.gateway.com * * *-**#*#* 22:44 99.39% extropia remail(a)miron.vip.best.com ____.------ 18:58:11 99.29% mix mixmaster(a)remail.obscura.com ++--+-+---+ 1:53:12 99.26% treehole remailer(a)mockingbird.alias.net -.--+ --+-- 4:28:09 98.80% penet anon(a)anon.penet.fi ---+------- 11:01:15 98.58% haystack haystack(a)holy.cow.net # *# +##+# 9:28 97.42% ncognito ncognito(a)rigel.cyberpass.net --._--+-.- 13:38:58 97.03% lucifer lucifer(a)dhp.com -++-++++ ++ 47:19 89.37% nemesis remailer(a)meaning.com + ***** 34:32 86.49% flame remailer(a)flame.alias.net -.----- 4:18:14 52.45% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

3 2

Re: Borders *are* transparent
by Peter Trei 17 Dec '03

17 Dec '03

Jeff wrote: > The retail version of Netscape Navigator sold in US stores > has been the US version for almost a year now. The first run > were the export version, because the marketing people thought > it would be easier. When I explained the issue, they made the > change to the stronger US version immediately. > --Jeff This, I think, is one place where the activities of members of this list have had a real effect. Last September, three or four semi-overlapping efforts succeeded in brute-forcing 40 bit RC4 (used in export-quality SSL). This had three main effects: 1. Raising the issue in the media, and thus in the public consciousness. 2. Within a month, the government was starting to talk about permitting the export of stronger (but GAK'd) encryption products. 3. It enabled people like Jeff to argue successfully that releasing only an export-strength product was no longer a viable option.In practical terms is probably the most important effect of the crack: I know of at least one other company where it led directly to the release of both domestic and export versions. Any one up for a distributed brute force attack on single DES? My back-of-the-envelope calculations and guesstimates put this on the hairy edge of doability (the critical factor is how many machines can be recruited - a non-trivial cash prize would help). Peter Trei trei(a)process.com "Exportable strong encryption" is an oxymoron.

12 18