December 2003 - cypherpunks-legacy

Re: WaPo on Crypto-Genie Terrorism
by Deranged Mutant 17 Dec '03

17 Dec '03

On 28 Jul 96 at 12:59, David Sternlight wrote: > >IMO, the US does not have a comfortable lead. It's already falling > >behind considering some of the stronger crypto programs available (at > >least as freeware) are made outside the US. Many of the stronger > >algorithms were invented outside of the US (IDEA for instance). > > This, and similar remarks by others, consistently misses the point which I > have been making for about a year now, and which Director Freeh finally > made explicit in his testimony last week. That is--the government is > concerned with mass market software incorporating robust crypto, used > overseas, and recognizes that they can't keep niche products off the [..] Really? The RAR archiver is getting quite popular (DOS and OS/2), and uses a variation of DES in the encryption (according to the authors). An Italian archiver called CODEC also uses DES. PGP gets more publicity than any crypto product around (CNN, NPR, Pacifica, NYTimes, etc.) and will likely get bigger as time goes on and as the arguments over escrow proposals get louder. MS's C[r]API and Netscape also make people more aware of strong crypto... > Though I've no connection with Freeh, it's interesting that his language is > almost word for word the same as what I've been using. Do you suppose some > of his staff reads my stuff? Actually, I don't care one whit. > >So why should criminals bother with using standards if they are > >readable by authorities? > > See above. Doesn't counter my question/argument. Serious criminals with a few braincells who care about wiretapping or protecting their files from the authorities will obviously not use anything that the government can read. Even a ban on unescrowed crypto worldwide will not help. Every copy of strong crypto software will not magically disappear upon the signing of such treaties and laws. [..] > >Are they going to magically erase all copies of strong software that > >is already currently available? (Side note: the Pacifica news report > >on Friday notes that while Freeh gave his testimony, over 100 copies > >of PGP were downloaded from MIT's site.) > > What he's saying is that US-exported copies of the Lotus Lockshens, > Microsoft Machayas, and Netscape Niguns of the world still do not contain > robust crypto the USG cannot read. So? People can use alternate programs to encrypt the software, such as PGP. [..] > >It's not clear that terrorism can be tracked, even if it's unencrypted. > >The OK and WTC bombings were apparently not encrypted, and there's > >some allegations that the authorities had advanced warnings of the > >latter. > > He says it can, and suggests following the banking trail among other > things. We know the government has already had good success with this [..] Apparently not successful enough, as the two examples I posted happened successfully. Banking trails will exist with or without escrow. [..] > >Particularly absent in the WaPo-ed is that many do not trust the > >authorities (in the US and elsewhere)--particularly the FBI, which > >has a long history of extra-legal surveillance. > > So as Netanyahu says at length we need to build in protections against > abuses, using both the legislature and the judiciary. 1. The damage is already done if rights are violated, irregardless of the law. If the police listen in on your phone conversations because of your political views, you may have legal recourse.... but they've already listened in. 2. Legislative/judicial protections are meaningless if judges don't follow up on them. Historically they give leeway to the police, and as of late judges that enforce the technicalities are lambasted publicly for letting criminals go free. 3. Israel isn't exactly a prime example of human rights, especially if you're a Palestinian. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

9 9

A Libertine Question
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My opinions are just that, MINE but here's a question .. In the event that drugs are legalized like alcohol ( also a drug ) and tobacco and cafeine, who will take responsibility for housing and feeding those, who are now blameless, individuals who can't or won't take responsibility for themselves and work or whatever. With freedom and liberty come a lot of responsibility. Too many people today balme every damn thing in the world for their problems - and get away with it.... 1. My grear grand parents were slaves, I suffer because of that, so I killed 30 White people. 2. My momma didn't give me no tit so I raped those women and killed them and on, and on............... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMfysk+J+JZd/Y4yVAQEAaQQLBX5NMGRRbjP+uWSv4cxMJsI5jBq/QsIy k9Q9a4csLhfOvVJ1ZbLszIR9xsb0oQkaK2l/2oX3igVB8+jwN8SZL0p4RJp00Tf+ D5DYVKTcF/JdwsHSSGLpdGWRExpiPxJqKlaNS7oL0R1Zx6Cqz8LlRxRMnnLkUgCo lLNUKKkMJZ5FuQ== =a8IV -----END PGP SIGNATURE----- Charles E. Sparks<sparks(a)bah.com> In God we trust, all others we encrypt ! http:/www.clark.net/pub/charley/index.htm Public Key At http://www.clark.net/pub/charley/cp_1.htm

2 1

International Standards
by Duncan Frissell 17 Dec '03

17 Dec '03

Mr. Freeh, testifying at Thursday's hearing in favor of an optional key escrow plan, noted that the point is not to prevent all copies of uncrackable code from going abroad -- that's clearly impossible -- but to prevent such high-level code from becoming the international standard, with architecture and transmission channels all unreadable to world authorities. Looks like the fibbies (FBI) haven't been reading the "Proceedings of the IETF". Strong crypto is already an international standard. DCF

1 0

Re: cypherpunks vs hacker
by pjn＠nworks.com 17 Dec '03

17 Dec '03

> It is interesting to note that while both groups have opposite > objectives (Hackers want all information free, where cypherpunks want > everbody to be able to have privacy), and yet in there own ways, they > are both right. In> I don't entirely agree with this. I think both groups want In> information to be free, but also want people to be able to have In> privacy. Most hackers (used in the sense of people who break into In> computers) attack computers owned by such companies as TRW and the In> phone companies. Both of these systems have little regard for privacy. In> Most non-malicious hackers promote system security, but at the same In> time, don't like government-controlled monopolies and agencies to be In> able to keep secret information that should be free. A very In> interesting paper by Dorothy Denning (she used to be regarded very In> highly by the hacker community before she started to support Clipper) In> expresses some of the concerns and morals of hackers. It's called In> "Concerning Hackers Who Break Into Computer Systems" and is in Phrack In> issue 32. > I have read the file (I have all Phracks from the beginning. Crypt is good too, but they dont have the same level of information as Phrack) and I though that it was very inciteful (sp). > I think what we need to define is the diffrence between hackers and > crackers. A hacker breaks into a computer like a cracker (but the > similarities end there). The hacker just want to look and learn, > possably "map out" the system just to see how everything works with > everything else. Crackers break into computers for the sake of > destroying or stealing information or the system itself. In> That's debatable. I think many people incorrectly consider these In> terms to be mutually exclusive. There are many hackers (used in the In> sense defined in the Jargon File) who also break into systems and could In> therefore be considered crackers also. Most hackers definitely have In> the knowledge to break into computer systems, but many crackers aren't In> very well versed in programming and learn how to break into computers In> by using canned programs and G-files. I am saying that hackers do break into computers, but crackers are more malicious in their intent. And yes, pathetic hackers rely on programs. I have respect for hackers who do all the work themselfs. > > Both cypherpunks and hackers think that the government is wrong > in many things that they do. In> Agreed. P.J. pjn(a)nworks.com ... Sorry, the dog ate my Blue Wave packet. ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: A Libertine Question
by Seth I. Rich 17 Dec '03

17 Dec '03

>My opinions are just that, MINE but here's a question .. You mean "libertarian" -- not "libertine". Got me all hopeful for something juicy and fun. Seth --------------------------------------------------------------------------- Seth I. Rich - seth(a)hygnet.com "Info-Puritan elitist crapola!!" Systems Administrator / Webmaster, HYGNet (pbeilard(a)direct.ca) Rabbits on walls, no problem.

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 alpha) (flame replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 29 Jul 96 6:47:32 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nymrod nymrod(a)nym.jpunix.com ######*-**-+ 13:54 100.00% alumni hal(a)alumni.caltech.edu *####*#*##+* 2:27 100.00% replay remailer(a)replay.com *+********** 4:59 100.00% mix mixmaster(a)remail.obscura.com ---+----+--+ 1:46:21 99.98% portal hfinney(a)shell.portal.com ####*#####+# 1:44 99.97% alpha alias(a)alpha.c2.org -+*++++*++++ 1:43:56 99.94% c2 remail(a)c2.org -+++*+++++++ 1:53:47 99.89% winsock winsock(a)c2.org --..-- 7:27:06 99.89% treehole remailer(a)mockingbird.alias.net -+---++-+--- 3:36:15 99.85% vegas remailer(a)vegas.gateway.com *#*#***-*#-* 18:48 99.84% lead mix(a)zifi.genetics.utah.edu ++++++++++ + 38:33 99.61% penet anon(a)anon.penet.fi ----------- 9:09:35 99.57% haystack haystack(a)holy.cow.net +##+#+*###+* 3:57 99.38% ncognito ncognito(a)rigel.cyberpass.net -.-_...--. 16:44:18 99.15% amnesia amnesia(a)chardos.connix.com ---++---- - 3:24:07 98.92% lucifer lucifer(a)dhp.com + +++++++++ 44:40 97.98% nemesis remailer(a)meaning.com *******+**** 30:09 97.48% extropia remail(a)miron.vip.best.com ---------- 9:40:29 93.46% jam remailer(a)cypherpunks.ca ***** *** 18:42 76.47% flame remailer(a)flame.alias.net 4:18:14 4.27% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Secure drive?
by Geoffrey C. Grabow 17 Dec '03

17 Dec '03

Greetings all, Does anyone know if the 1.4a version works correctly with Win95? If not, is there an updated version? If not, will there be one anytime soon? If not, will PGPLIB (aka PGP3.0) provide a similar function? If not... heck! G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | Great people talk about ideas. | | Oyster Bay, New York | Average people talk about things. | | gcg(a)pb.net | Small people talk about people. | |-----------------------------------------------------------------------| |That which does not kill us, makes us stranger. - Trevor Goodchild | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: "privatizing" phones?
by Geoffrey C. Grabow 17 Dec '03

17 Dec '03

At 12:26 07/28/96 +0200, Remo Pini wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >To: cypherpunks(a)toad.com >Date: Sun Jul 28 12:24:57 1996 >> Even if they did change the frequency the call was on, >> it would be a simple matter to decode how the frequency >> change was negotiated, and "follow" the call (also easily >> accomplished with cellular calls). Failing that, there is >> a very limited range of frequencies allocated for cordless >> fones, and simply re-scanning for the conversation is a >> trivial inconvenience. //cerridwyn// >> > >Most of those systems do also change the order of the transmitted data, and >that's not limited to a few possibilities. If it's digital, they usually >encrypt it (only weak, but hey, you normally have to find the key real >time!) >> The key doesn't need to be found in real time! You can always record the call and decrypt it later. If the information deals with an event in the future, you could have plenty of time to crack it. G.C.G.

2 1

(Don't laugh *too* hard now...) "Filter"software for moneylaundering
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Encoding: 17 TEXT Date: Mon, 29 Jul 1996 16:06:53 +-200 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Andrzej Adamski <aadamski(a)CC.UNI.TORUN.PL> Subject: "Filter"software for money laundering Comments: cc: "comcri-l(a)man.torun.pl" <comcri-l(a)man.torun.pl>, "lacc(a)suburbia.net" <lacc(a)suburbia.net> To: Multiple recipients of list CYBERIA-L <CYBERIA-L(a)LISTSERV.AOL.COM> Sorry for cross-posting this message: Dear All, Are you familiar with any software or any listing of producers of software to be used in tracking money-laundering? If so, let me know. Regards, Andrzej Adamski Chair of Criminal Law & Criminal Policy Nicolas Copernicus Univwersity 87-100 Torun, Poland aadamski(a)cc.uni.torun.pl --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

RE: Implementing DSS Fortezza KEA
by geeman＠best.com 17 Dec '03

17 Dec '03

---------- From: source@iaccess.za[SMTP:source@iaccess.za] Sent: Monday, July 29, 1996 7:05 AM To: coderpunks(a)toad.com Subject: Implementing DSS Fortezza KEA We have almost completed our SSL 3.0 implementation, and are looking for the specs on Fortezza DSS and KEA and would like to know where it is available. >From the US National Security Agency. As another respondee said, the details of KEA are not available, but information on implementation of the protocol is. It's in the public domain.

1 0