December 2003 - cypherpunks-legacy

EFA attitude to crypto
by Sherry Mayo 17 Dec '03

17 Dec '03

Just to clear up Rich Grave's comment regarding the Electronic Frontiers Australia's attitude to crypto. EFA did not object the the ABA's report and it's comment about crypto. They did object to an earlier government report which said that crypto should be *mandatory* - since turning people into criminals for transmitting plaintext is just as daft as turning them into criminals for transmitting encrypted text. Hope this puts things straight. Sherry

1 0

Re: Another bad idea
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 10:23, Alan Olsen wrote: [..] > Of course this is all a moot point, because it has been proven by computer > projections that all informative net traffic will be buried under > advertisements by the year 2000 anyways. I expect some legislative body to > try and make money fast on the net by selling ad space on IP packet headers. Yes. They can follow the American model and rather than censor communications, allow advertising. Nobody will be able to get an inteeligent thought from the net without being interrupted by an ad every five minutes... and people will pay good money for this 'privledge' (sp?) too. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Another bad idea
by Deranged Mutant 17 Dec '03

17 Dec '03

Note that my main point was sort-of vague. Let me re-iterate it: crypto-activism should go along with the other activism for democratizing countries like China, Iraq, Burma, etc. Most of the activists involved with those issues know about the culture (and many are already PGP-aware)... so for specific situations some of the ideas presents may not be appropriate for others. It might be ok to direct-mail someone in one country, but dangerous for someone in another. Also don't take for granted the relative access of privacy one has in the US or Europe compared to some regime where you can only net surf with a policement watching over your shoulder at the police station's internet kiosks (hypothetical...). Using an anonymous remailer or web anonymizer may be reason enough to get somebody in another country in trouble. The thought of blindly being a k00l krypt0 activist and getting some poor guy in another country thrown in jail doesn't do much to help democratize that country. Spam and unsolicited mail aren't the way to go. Better, more subtle ideas, might be to say 'check out this page' ot 'i've got source code for that on my page at...', which has techie or even entertainment info but also has political info (that already happens quite unintentionally). I wonder what web users in places like Singapore thought when they kept running across blacked-out anti-CDA pages... If one is familiar with the culture, one can even be really subtle and seem to be talking about an unreleated story or even techie or sports but actually be discussing the political situation in that country (look at many Soviet films, some Chinese films, Spanish films under Franco's regime, Cuban films, etc.) On 12 Jul 96 at 18:30, E. ALLEN SMITH wrote: [..] > If these countries didn't value their technical people and what they > can do, they wouldn't be allowing them on the Internet (even in a restricted > way) in the first place. The above would only be a likely scenario if the [..] Don't underestimate people's stupidity. The party loyalists or bootlickers may get away with more naughtiness on the 'net, but those borderline techies who are about due for another month at a re-education camp or loyalty counseling may get screwed. If such countries really valued their techies, then why do they allow them to emmigrate to Western countries? [..] > How, precisely, is one going to filter out graphics from web sites in > Chinese? Ascii text and ideographs don't exactly get along. One interesting [..] By filtering out all photographs, which from what I heard the Chinese were contemplating. Whether is it truly feasible is another matter, of course. But since when has infeasability prevented anyone from trying it? Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: ANI Blocking! Fast, Easy, Effective! (fwd)
by Bruce M. 17 Dec '03

17 Dec '03

> ---------- Forwarded message ---------- > Date: Thu, 4 JUL 1996 14:48:28 GMT > From: Glen L. Roberts <glr(a)ripco.com> > Newgroups: alt.2600, alt.privacy, alt.private.investigator, > alt.dcom.telecom, > comp.dcom.telecom.tech, alt.security, misc.consumers > Subject: ANI Blocking! Fast, Easy, Effective! > We are in the beta teating phase of a new service to block ANI. > You'll be able to call any toll-free number and prevent them from > getting your phone number. We do not charge for this service (you > do have to call a long distance number). > Complete details are on our web page. As we are beta testing, we > can't say for such what problems might crop up, but let us know. > http://pages.ripco.com:8080/~glr/block.html > ------ > Purity of Opinion through force of Intimidation: > http://pages.ripco.com:8080/~glr/rogue > Web Site for FBI File Access! You, too can be like Pres Clinton! > http://pages.ripco.com:8080/~glr/fbi.html > ------ I thought this might be of interest due of the recent discussions about ANI and privacy. I've seen this type of service before, but this one is apparently free (besides the cost of calling their area code if you aren't local). ________________________________ [ Bruce M. - Feist Systems, Inc. ] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "Official estimates show that more than 120 countries have or are developing [information warfare] capabilities." -GAO/AIMD-96-84

3 4

Crypto-activism
by Deranged Mutant 17 Dec '03

17 Dec '03

On 13 Jul 96 at 0:37, Arun Mehta wrote: [..] > >> 1) Collect the e-mail addresses as Allen suggested (including those in > >> Hongkong), and send them a single, short message offering to teach them free > >> of cost how to use pgp and all the goodies at > >> http://www.eskimo.com/~joelm/cbsw.html > > > >Might be condescending. 'Civilized white man brings PGP to the > >barbarians...' > > Look around you: while "civilized", "white" and "man" might characterize the > vast (?) majority on this list, I'm sure that's not the universe on > cypherpunks. And how does it matter? I'm suggesting an e-mail course that My point is that a lot of people in those countries are aware of PGP etc. than make it out to be. Certainly many activists are. They focus on the human rights issues at hand, to which PGP etc. may be a tool... but isn't the central focus. It would be condescending to email to many people in a domain saying "hey, have you heard of PGP?..." Chances are they'll think it's a strange commercial spam anyway. The "civilized white man" comment was more of a metaphor. Change that to "Cypherpunks bring gifts of crypto to the natives" or maybe "Cypherpunks civilized the barbarians with PGP"... [..] > > They may well know about PGP, but not in a position > >to make that knowledge widely known. > > That's no good to the rest of the world. Forget them: the question is, are > *you* in a position to share your knowledge? Yep. But there's a proper way to share knowledge. You don't want to do it in such a way as to get the person you're sharing it with in trouble (esp. for something like crypto, where you could go to jail or be shot in some jurisdictions). If that person isn't interested, there's not much you can do... you may end up turning someone off. If you want someone to listen, and be interested (if they're not already), you have to do it in an appropriate way. You also have to know what you're talking about: if you're not familiar with the nitty -gritty of politics in such countries, you'll come off as the "cypherpunk bearing gifts of crypto for the natives"... the politics going on in places like Cuba, China, Iraq, Russia are a bit more complex than what comes off through the media (to some extent no matter where you are and what media you watch). For example... there are many anti-Castro 'democratic' socialists in Cuba. If you approach them as if they were anti-Communists you'll be seen as a clueless kook. Some Chinese I have spoken to are suspicious of the Tiennamen Sq. activists, claiming they were more 'reformists' than true democratizers who were unknown before Tiennamen. Many Iranians will insist Iran is a democratic country where fundamentalists hold a lot of popular power, and that Western tinkering will only strengthen fundamentalists rather than allow a transition to a more moderate party. I'm not saying any of these are true... they are just examples of how people in the respective territories view their situations differently, and that one can do more harm mistaking the situations in those countries. One more important issue: people have to trust you. You can't go into a strange environment and expect trust if you come off as a tourist. As for sharing knowledge... share crypto with activists involved with other issues. If one right, they're likely to use it in ways one hasn't imagined. [..] > >I'd leave the specifics to activists who are already familiar with > >the respective cultures, societies, politics, etc.... > > I'm one. Be glad to tell you more,... Yes, do tell. [..] > It's only crypto, not the Bible or Koran. And let them be their own judges? > You seem to want to protect people in the Third World the way the US > government wants to keep cyberporn from kids. No. I don't want to see somebody do something annoying and counterproductive that can get people it's allegedly meant to help in trouble and perhaps make a case for strengthening crypto regulations. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:21 PM 7/12/96 -0400, Michael Froomkin wrote: >> could claim that MIT came very close to violating ITAR, but the same claim > >"The ITAR do not apply to books" I'm not sure the exact legalities apply here. I think it is more like the mob pressuring business men for protection and punishing those who do not comply. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

It's more than "White Punks on Dope"
by Brad Shantz 17 Dec '03

17 Dec '03

Tim May Wrote: > In recent decades, do-gooders have taken upon themselves to intervene > in the parenting process and have essentially succeeded in making such > sanctions harder for parents to impose. Schools routinely teach young > children to inform on their parents if they have been spanked, touched, > talked to "inappropriately," etc. Check out the parent's rights > newsgroups (and father's rights) for tales of interrogations by agents of > Child Protective Services, who are empowered to remove a child > immediately and without court proceedings if they merely _suspect_ a > child has been treated in ways the State has deemed no longer >appropriate. ...yadda yadda yadda...more on how we all agree that burning children is not a viable option....etc. It is so much more than what the "State" deems appropriate. Having grown up with both parents being teachers in the public school system and my wife a teacher in a private Montessori school system, I've seen that the feeling in society is, "Everyone is a victim." In seattle a few years ago, there was a teenager who killed his girlfriend. (beat her face in with a rock) Yes, he was caught, yes he went to trial. This 19 year old lame-o used this as his defense, "Fetal Alcohol Syndrome." THEY LET THE MURDERER GO ON THE PRECEDENT IT WAS HIS MOTHER'S FAULT BECAUSE SHE HAD A FEW DRINKS WHILE SHE WAS PREGNANT WITH HIM. So, he wasn't in control of his own actions? I say bullshit to that. At my wife's school the kids are being taught that the definition of harassment is if someone is doing something to you that you don't like. Oh, the third graders have a heyday with this one. "Chris is looking at me and I don't like it." Immediately, Chris is repremanded because he is harassing the other kid. What's wrong with this picture? Well, it's not Chris' problem, is it? The teachers need to be a little more understanding of what harassment is. Chris could turn around and say, "By reprimanding me, you are harassing me for something totally stupid." There are so many different "syndromes" and "conditions" that you can't keep track of them all. ADD, Hyperactivity, Fetal Alchohol Syndrome, Chronic Fatigue, Repetitive Stress (which is a physical ailment, but it came to mind), they are all names to psychological conditions. Some because they are serious problems...like ADD in some children, but not all. Some however are lame attempts by psychologists to put the human psyche into a bunch of prepackaged little boxes. Eventually, you could build the perfect beast by just grabbing a handfull of syndromes from this box over here, mixing them with a few neuroses from this box over here. Pour in a little Free Love, a little Self Preservation and give the entity a stopwatch in the shape of a heart and a scroll for a brain and you've got an average human being. Sorry, no, thank you. We are more a part of our environment than that. Some people grow up to be just like their parents. Some grow up to be the exact opposite. However, our "raising" does have an effect on us. > So, what to do with children who are otherwise uncontrollable? > > Ah, the State has the answer. And its name begins with "R." 'Nuff said. At my wife's school, they do not use Ritalin. They have started using a product called PhytoBears. Don't laugh. These are GummiBears made out of all natural vegetable extracts. One of those, "100% of all the vitamins and minerals needed by the human body and mind in a day" kind of things. Apparently, the kids who were on Ritalin are now getting on much better with PhytoBears than they were with Ritalin. >> I will admit to the possibility of ADD being a "disease", but I >> think that the number of children who really have the disease is small >> compared to the number of childern recieving drugs for it. Yes, I've read this entire thread, I don't need loads of flame mail telling me to go back and read the ENTIRE THREAD again. I just want to say that in many schools, at least in Washington, ADD is no longer being treated strictly with drugs. Someone mentioned being put in a "special" class while his brother was in a regular class (or the other way around). That is more common than an automatic prescription for Ritalin. I still claim that ADD is a syndrome that is serious in some kids and for others it's a crutch. The diagnoses in Washington are getting better. > This is the point I have been making. Not that ADD (aka ADHD, > hyperactivity, etc.) does not sometimes exist, but that giving Ritalin > and suchlike drugs to children has been a panacea for fidgeting, > wandering attention, boredom, "cutting up" in class, class clowns, > and so on. Dr. Cynthia Tobias (who just happens to be from Seattle Pacific University, just a coincidence) has done studies for her entire doctoral carreer on the subject of learning patterns. Her findings are interesting. They aren't practical in a public school system, but interesting nonetheless. There are a number of different learning styles. I won't go into all of them for the sake of brevity (I know, too late.) One of the learnign styles that she has spent much time working on is the Kinetic/Kinesthetic learner. These are the kids who wander around, and fidget as Tim put it. The goal of the teacher with a Kinetic learner is not to get them to sit down, but to get them to not distract others. If the kid likes to do his work laying on the floor and he's not bothering anyone, let him. There are some people (like me) who can't stand to sit at a desk all day long. I get my work done, but I often lay on the floor, sit on the desk, walk around the office, etc. Anyway, my point is that there are teaching practices that could be used to teach the child without resorting to labelling (as I think ADD is sometimes used) or drugs. > And perhaps worse, _parents_, such as the example I provided, are using > it to control children. Where once they would've paddled the kid for > using obscene language, or refusing to get dressed for school, now they > pop a pill in the child's mouth. That is only in the example you provided, Tim. Yes, if one person is doing it, there are probably more. (It's like Cockaroaches....where there's one...) > I didn't have ADD. I was simply bored by a system that either taught > me stuff that was irrelevant > > I suspect this was true of 90% or more of us on this list...we're a > bright lot, and it's hard to imagine that _any_ school could keep us from > being bored a lot of the time. (And hard classes can be boring, too.) Agreed. The teachers at my High School and even at Oregon State University always had trouble convincing me of the validity of some of the topics we were learning. I'm sure it bugged them when I asked. Brad

2 1

SEARCH> Social Security Death Index Search (fwd)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 5 Jul 1996 12:41:15 -0300 (ADT) From: Todd Smith <tsmith(a)admin.fsu.edu> To: Multiple recipients of list <inet-news(a)nstn.ca> Subject: SEARCH> Social Security Death Index Search Social Security Death Index Search http://www.infobases.com/ssdi/query01.htm To search the Social Security Death Master File (a.k.a. Social Security Death Index or simply SSDI), fill in any or all of the fields below and press "Submit." A list of some Social Security Death Index information is available here. The SSDI search indexes are currently under development. Indexs are currently available for surnames beginning with the following letters: A B C D E . . . I J . . M N O P Q R . . U V . X Y Z Last Name: First Name: SSN: Location Issued: Birth Information Date: Month: Year: Death Information Date: Month: Year: Last Residence / Lump Sum Payment Information: City: County: State: Zip Code: ------------------------------

1 0

Re: Crypto-Activism & PGP
by William Knowles 17 Dec '03

17 Dec '03

Does anyone know how many languages PGP's help files and documentation has been translated into? A good start I would think would be translating PGP into Chinese? and mirroring it on sites around the world. William Knowles erehwon(a)c2.org -- William Knowles <erehwon(a)c2.org> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key --

1 0

Execution of signed scripts received by e-mail
by Matt Carpenter 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is a rough description of a perl script I'm working on to allow the automated execution of PGP signed scripts received by e-mail. I call it emscrypt. Right now it is in the volatile-ware stage. Hopefully I'll have it tested enough to post here shortly, if I feel i can pull myself away from my research for a few hours. But I thought I would post a description now to see if anyone can find any problems with the way I'm going about this or has any suggestions. I apologize for the possibly inscrutable descriptions; it's been a while since I last slept. Let me know if anything needs clarification. First, a basic description of the idea: 1. Write a script (perl, sh, etc.) to be executed on a remote machine. 2. Sign the script with PGP. It can also be encrypted using the public key for the emscrypt installation on the remote machine. 3. Mail the signed/encrypted script (a.k.a. emscrypted mail) to the address where emscrypt is installed. 4. The script is received and piped to emscrypt (using procmail or something similar). 5. Emscrypt checks the PGP signature on the message, and checks for replay attacks based on the time stamp from the signature. 6. Emscrypt executes the script, gets the results, encrypts them, and sends them back to you. The install procedure: Create a directory to hold the PGP keyrings and the emscript temporary files. Generate a secret/public key pair for the emscrypt software and place in the emscrypt directory. These need to be DIFFERENT for each installation of emscrypt. Otherwise you are subject to a "same play" attack. I suppose you could create two or more installations with the same key if you will ALWAYS be sending all the same scripts to every installation. Generate a public keyring in the emscrypt directory which has only the keys with which you want to be able to validate incoming scripts. Make them "trusted" by the emscrypt key. Update the PGPPASS, PGPPATH, and emscryptPath variables in the emscrypt script. This is very important since if the PGPPATH is pointing to your normal pubring ANYONE with a key in that ring would be able to run scripts on your system. Actually only the keys which are "trusted", but there may be lots of "trusted" keys which you wouldn't trust to run arbitrary scripts on your computer. Test the script to make sure it seems to work alright on your system. After that, you can set it up to be automatically called when you receive e-mail with the magic subject line of your choosing (or in some other way I suppose). I've been using something resembling the following procmail recipe: :0: * ^Subject.*SQUEAMISH OSSIFRAGE |/MY_PATH/emscrypt How emscrypt works: * Get input Get one input line at a time, and look for Reply-To: and From: headers to get a reply address. As we are slurping up lines, watch for '-----BEGIN PGP' lines. If it is for encryption or a signed message (i.e. as long as it is not for a key block), get all the lines up to and including the appropriate '-----END PGP' line, and save them to a temp file. Note that several scripts can be batched together in a single input file. Just generate the scripts and sign them separately and the combine all the PGP messages into a single file. Also, they may be signed with different keys. * Verify signature Run PGP on the temp file to verify/decrypt it. Save the stderr results from the PGP process in another temporary file. Get the verified(?)/decrypted output from a pipe, and save in memory. (QUESTION: is it possible to have stderr redirected to a separate input pipe and avoid writing to disk? How? (This is in Perl.) I was combining the the stderr and stdout from the PGP process into a single input pipe, but that may allow for leakage of PGP stderr output into the script we are verifying/decrypting if we aren't careful.) Search through the PGP process stderr output to look for important stuff like whether the signature was good, what the time stamp was, and what the key user string is. I'm not real happy with this method. Probably doesn't work well with versions other than 2.6.2 or non english language versions. I'm waiting for the signature code and such in the PGP library from Systemics (an announcement showed up here a couple days ago, http://www.systemics.com/software/ ) which will allow this to be much cleaner. (QUESTION: Any other ideas for handling this?) * Check for replay If the signature is good then we need to check for the dreaded replay attack. This is how I have it working: there is a separate file for each PGP public key which keeps track of the time stamp for the last executed script which was signed by that key. Right now the file names are generated from the key ID string for the pgp key. Mainly because we get that for free when we check the signature. Will probably run 'pgp -kv "ID string"' so that I can get the hex key ID, since that would probably make a more reasonable file name. Besides the value saved to disk, we store a separate time stamp for this "batch" of messages in an associative array by key ID. Each separate mail message is a batch, but we may have more than a single PGP signed script in each message. So the batch time stamp is the stamp we read from a time stamp file for a key ID when we process the first message in a batch for that specific key ID. The batch time stamp is then constant for the remainder of this run of the script. Anyway, we generate a file name based on the key ID, save it in an associative array by key ID for later use, and see if the file actually exists. If the file doesn't exist, create it and save the time stamp from the current signature to the file. Put a timestamp of 100000000000 in an associative array by key ID for later use (this is the batch time stamp: the time stamp is formatted as YYYYMMDDHHmm. I use 100000000000 here since I explicitly check the time stamp format each time to make sure it is composed of exactly 12 digits. Also, if the file doesn't exist, we need to use a batch time stamp that will be lower than that of any of the messages in the current batch for this key ID. I suppose it might be better to generate a time stamp something like (CURRENT_TIME - (some reasonable amount of time)) to limit what is accepted. I also plan to allow a limit for the amount of time which can elapse between the script being signed and being received by emscrypt for cases where the file does exist. If the file did exist on disk, read the time stamp from the file and save in the batch time stamp associative array by key ID. So now we have a replay prevention time stamp to compare to the time stamp from this PGP signed script. If the script stamp is more recent, then we can execute the script. But first, check to see if the script stamp is more recent then the stamp saved in the file. If it is, then replace the file time stamp with the script stamp, and update the associative array which keeps track of these values (this is the "most recent stamp" array, not the "batch stamp" array). * Execute the script Check the variable status to make sure that both the signature and time stamp were acceptable. If not, then generate an appropriate error message explaining why the script was rejected, include a copy of the script, encrypt the message using the submitter's public key, and mail it back. Then go back to the top of the loop to deal with the rest of the input. If it everything checks out, then prepare a file to receive the stderr output, save the script to a file, set the script to executable, and open (execute) it as an input pipe. Get the results from stdout. Open the stderr file, and get the stderr results. Combine the stdout, stderr, and the script (with separators so we can tell what is what), encrypt the whole bundle with the submitter's public key and mail it off. Repeat loop for rest of input. Problems? Suggestions? Let me know. Thanks, - --Matt - -- mcarpent(a)mailhost.tcs.tulane.edu Finger for PGP public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMedc/SjtJAMyBnp9AQF83wf+J9P1Lmr8sca12R89LUYcFxRms1gJro/9 E5Ni1kqivWKYJ+JP9geP+k7VLWbq5miby8RMfKemuz77BuK9UIQG1pd6bGNjlSg9 O+XkiB5dbHX6+hZ23wPABzeuu6+3klLfNnzQEuNZ4/jxeNwFIIY3ifYglhWIPoeG a3kpd2DXY1HVjO674TQNGBYn6bnDPi5wMzYSTxJLukKHBzlgaLt4nssv/8N2jhcg XHWqEEvHc2lY0UvBk+wuqJHigzI03NzpFkh7mgF6ll5gEuG0qGgvLIKb+ir4vF1Q k46mNHq03M+Vc5/loLjFfQzcuu24GdjlFY2pHEpHz7rhYG25ONJeDg== =Lm22 -----END PGP SIGNATURE-----

3 3