December 2003 - cypherpunks-legacy

Re: Missionaries (was: "Mormon Asshole?" re: GAK)
by Michael Peponis 17 Dec '03

17 Dec '03

> On Sat, 5 Oct 1996 15:55:42 -0700 (PDT), John C. Randolph wrote: > > >What's really sad is the way that every cult member tries to convince > >himself that *his* franchise has more to offer than Lifespring, > > Food for thought: suppose he didn't - why would any rational individual > follow a religion he thought was wrong? Simple, the average shuck does not have the backbone to stand up for something he/she thinks is full of garbage. They would rather let the bullshit slide than to make an issue of it, and risk being ostersized or worse. Peace and Tranqility are what people want, not truth(which is relative) and freedom(which is not). I guess I should clarify the distiction. Truth is subjective, there are many things I think are true, but I can't prove them beond a shadow af a doubt. Absolute freedom is easy, it boils down to one simple question. "Can I do what ever I want". If the answer is yes, I am free, if the answer is no, I am not free. ----------------------------------------------------------------------- I have no return e-mail, my ISP cut me off for violating community decency standards. BOYCOT FACSIT ISP, BOYCOT COMMUNITIES DECENCY STANDARDS

1 0

Re: Sun's GAK position
by Frank Stuart 17 Dec '03

17 Dec '03

Bill Stewart (stewarts(a)ix.netcom.com) wrote: [...] >That's not looking for someone to do GAK work at Sun; that's just looking for >someone to help Sun sell stuff to the Feds. They've been doing secure [...] The two aren't mutually exclusive. I suspect the government plans to buy lots and lots of GAK'ed products that come out of this consortium. Not only will this sweeten the pot for otherwise reluctant companies, it will also help make the products the defacto standard. In any event, the things that caught my attention most were the date (October 1), and the phrases "Export controls as they apply to encryption and security products", and "Public policy issues of cryptography and Key Escrow". | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0

"Drift net fishing," GAK, FBI, and NSA
by Timothy C. May 17 Dec '03

17 Dec '03

A couple of posters have talked about "drift net fishing" of communications, where random stuff is sampled and intelligence items gleaned. (I think it was Ernest Hua who cited the example in a Tom Clancy book/movie.) Perhaps, but let's go back to the discussions at the EPIC "SAFE" conference in Palo Alto several months ago. Some convincing evidence was presented that the moving force behind GAK is *not* the NSA, but is rather the *FBI*. Specifically, even 40-bit keys are probably too long for massive "drift net fishing," in that the cost per break is probably still too high. The cost for a "focussed attack" (I can't think of a fishing parallel...maybe "spear fishing"?) is of course low. The speaker at SAFE pointed out that the FBI is pushing for the 40-bit keys (and now is accepting the 56-bit keys?) because for focussed attacks, e.g., on the communications of a person under observation, they can call on other agencies to break the ciphers for them (even if they don't yet have their own such machines). In a nutshell, almost any level of encryption above, say, 30something bits, is too much when millions of messages per day are to be "drift-netted" is too much. (The exact number that is "too much" depends on a lot of factors, including the cost of the cipher-breaking machines, the number of messages to be read per day, etc. This number will change with time.) The FBI's interest may be changing, too. Their lead role in the TWA 800 investigation may have them sorely wanting "drift net" capabilities, as all other leads are exhausted. If we see more of these sorts of terrorist (maybe) incidents, it may be that more "drift net" capabilities are sought. A note on _contact analysis_. One thing the FBI probably wants badly are databases of who has travelled where, and when, for correlation analysis. Note that the crackdown on "valid IDs" for travel, for airlines, helps in this regard. I would not be surprised to learn that the airline databases are routinely fed to the Feds, so to speak. (Possibly via the FAA, acting as a kind of cutout.) Were I the head of the FBI, this is what I would want. The next step will be collecting hotel reservation databases. (Unlike the case with the FAA and the airlines, I don't know what kind of authority would grant them access to private hotel databases, but I expect they are working to find such authority somewhere. Maybe the infinitely malleable "regulation of commerce" clause, even if hotel stays are canonically _not_ interstate trade!) (They already got access to the credit card databases, decades ago, of course.) --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Voice Stress Analysis of Debates?
by jim bell 17 Dec '03

17 Dec '03

At 09:23 AM 10/6/96 -0700, Dale Thorn wrote: >jim bell wrote: >> This reminds me... Years ago, somebody developed a technique called >> "Voice Stress Analysis," which was supposed to detect small variations >> in a person's voice in response to stress. Not exactly a lie-detector, >> but it was supposed to do nearly the same thing. Does anybody plan >> to analyze the debates for stress? Is there software to do this? >> (Tried to do a web-search; didn't see anything.) > >Pardon me for butting in. Some remailer says I post too much, and I >should cut out some. They didn't say which posts I should cut out, tho'. Cryptography is, basically, the area of hidden meanings. In a sense, a voice-stress analyzer is intended to seek out hidden meanings in a person's statements. So I'd say it's as on-topic as most of the stuff 'round here. >Anyway, as I understand it, the current technology in voice/stress >analysis goes way beyond the polygraph at its best (current) level of >technology. There was at least one agency that did voice analysis >during the Simpson debacle, and the results were (as I recall) very >promising. Apparently, a person who can beat a polygraph cannot beat a >voice/stress analysis. One thing I wonder is this: Can the stress indications be removed from a voice-containing signal by some sophisticated DSP processing? Just look for whatever effect that indicates stress, add it in equal and negative amounts to eliminate the apparent stress, etc. It might not make sense for anything less "critical" than debates, but if the control of the debates is as monopolized as we think it is, it is reasonable to think that debate participants would insist on a certain level of control over the audio signal. >BTW, the rule for these debates (as all presidential discourse) is: >"He's lying." >"How can you tell?" >"His lips are moving." Well, I sorta assumed this. But I would still be interested to get some kind of quantitative feedback on the debates. If anything, the ABSENSE of the news media's attempting to use voice-stress analysis is telling. Jim Bell jimbell(a)pacifier.com

4 3

Re: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 6 Oct 1996 01:28:16 -0500 (CDT), snow wrote: >> An NT machine running off the shelf protocols and services is certainly mor= >> e secure than your average linux install. Of course clueless administrators= >> for either (any) platform can leave the door wide open easily enough.=20 > How about an "average" NT install versus a "average" linux install? Or, better yet, the typical "rent-a-loser" admin install. You know, the one who installs everything in the root directory? (I've seen this happen; don't laugh) > Neither of my machines are all that secure, but they don't have to >be right now. Neither has more than 5 users, all of whom I either trust >personally, or don't know enough to do anything. On the other hand, I >would be willing to bet that Mr. Metzger, or adamsc (sorry, I forgot your >full name) could lock a linux box down as tight as a networked NT machine. With enough time and net access, just about anyone could - if they thought it was important. Unfortunately, many people just don't realize how open their system is... > Hell, I'd bet 20 bucks I could. The machine wouldn't DO a whole lot, >but it would be tough to break into. (basically, don't run telnetd, ftpd, >sendmail, run sshd for incoming/outgoing connections, use a secure httpd >IF NECESSARY, NO NFS, shadow passwords etc.) ++agree. >> But what do you mean by secure? > Safe from undesired intrusion. Now, the much harder one is: safe from undesired usage by authorized users. As in that guy from the Dept of Health who was handing out the AIDS info... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

You can be forced to turn over your encryption keys?
by Geoffrey C. Grabow 17 Dec '03

17 Dec '03

I thought we had a 5th amendment. Isn't turning over your key that may (or may not) expose encriminating evidence an extension of self-encrimination? Haven't there been dozens of famous witnesses (Patty Hurst, Oliver North, etc) that "take the 5th" dozens of times on the stand. Why couldn't I "take the 5th" when asked for my encryption keys? When asked for your key, can't you say: "I'm sorry your honor, but I respectfully refuse to answer that question on the grounds that it may incriminate me.". Any legal-eagles out there? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | Great people talk about ideas. | | Oyster Bay, New York | Average people talk about things. | | gcg(a)pb.net | Small people talk about people. | |----------------------------------------------------------------------| | PGP 2.6.2 public key available at http://www.pb.net/~wizard | | and on a plethora of key servers around the world. | | Key ID = 0E818EC1 | | Fingerprint = A6 7B 67 D7 E9 96 37 7D E7 16 BD 5E F4 5A B2 E4 | |----------------------------------------------------------------------| | That which does not kill us, makes us stranger. - Trevor Goodchild | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

David Sternlight knows 1000 times more about cryptograpjy than Timmy May
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Cryptanalysis by David Sternlight: >From: David Sternlight <david(a)sternlight.com> >Newsgroups: phl.food,alt.food.wine,ne.food,rec.food.drink.coffee,rec.arts.fine,rec.food.cooking,austin.food,triangle.dining,la.eats,soc.culture.jewish,chi.eats,memphis.dining,nyc.food >Subject: Re: 2nd Avenue Kosher Deli is on the Web, and they do mail order! Go to http://www.quicklink.com/~nycdeli/ >Message-ID: <32574E6F.64F1(a)sternlight.com> >Date: Sat, 05 Oct 1996 23:15:11 -0700 >References: <01bbb2c8$efc52a60$29a5c0d0@dell-xps-p200s> <5366ac$qtj(a)news1.panix.com> <slrn55dmhj.4r.jamie(a)apm5-190.realtime.net> >Reply-To: david(a)sternlight.com >Organization: DSI/USCRPAC >Lines: 14 >NNTP-Posting-Host: sternlight.com >Mime-Version: 1.0 >Content-Type: text/plain; charset=us-ascii >Content-Transfer-Encoding: 7bit > >jamie wrote: >> >> On Sat, 05 Oct 1996 19:46:07 GMT, Andrew Mathis <fresh(a)panix.com> wrote: >> >Two observations >> >1) From the most Orthodox standpoint, 2nd Ave. Deli is not Kosher >> >because they are open on Shabbat. Many frum Jews I know refuse to eat >> >there >> >> Ah....kosher style, then? > >Congregant: "What does "kosher style" mean? >Rabbi: "Tref". > >David

1 0

Re: "Drift net fishing," GAK, FBI, and NSA
by jim bell 17 Dec '03

17 Dec '03

At 10:07 AM 10/6/96 -0800, Timothy C. May wrote: >Some convincing evidence was presented >that the moving force behind GAK is *not* the NSA, but is rather the *FBI*. >Specifically, even 40-bit keys are probably too long for massive "drift net >fishing," in that the cost per break is probably still too high. The cost >for a "focussed attack" (I can't think of a fishing parallel...maybe "spear >fishing"?) How about "DuPont-lure fishing"? is of course low. The speaker at SAFE pointed out that the FBI >is pushing for the 40-bit keys (and now is accepting the 56-bit keys?) >because for focussed attacks, e.g., on the communications of a person under >observation, they can call on other agencies to break the ciphers for them >(even if they don't yet have their own such machines). > >In a nutshell, almost any level of encryption above, say, 30something bits, >is too much when millions of messages per day are to be "drift-netted" is >too much. (The exact number that is "too much" depends on a lot of factors, >including the cost of the cipher-breaking machines, the number of messages >to be read per day, etc. This number will change with time.) You should also factor in the government's ability to store what they can't immediately decrypt, which drastically changes the playing field with regard to encryption. It was at least five years ago when I first read about a system to record data on so-called "digital paper," which was actually a plastic with a photo-writable layer similar to write-once CD's. It could be formed in any configuration, but perhaps one of the more intriguing (due to the large writable area) is on large reels similar to 1/2" magtape. As I recall, they claimed that such a reel could hold 1 terabyte of data. Sure, such a capacity is small compared with the total Internet traffic, but I assume that most traffic could be excluded from recording if its source was known, etc. They'd exclude anything from "probably-okay" web pages, they'd trim space-hogging graphics, etc. "Just the facts, ma'am." Call the whole thing "retroactive-selective-drift-net-fishing," if you will. Once this data is stored away the government would determine (perhaps years after the fact?) which data they want to decrypt, possibly based on crimes committed long after the data was recorded. This information might reveal contacts, etc. Obviously they have no prayer of doing real-time analysis. Even so, it makes it far more practical to do the equivalent of drift-net fishing if they can exclude 99.9999%+ of the traffic from their decryption attempts. 56-bit encryption doesn't look so ominous to them in this case. Jim Bell jimbell(a)pacifier.com

2 1

Re: Voice Stress Analysis of Debates?
by azur＠netcom.com 17 Dec '03

17 Dec '03

> Jim Bell <jimbell(a)pacifier.com> wrote: >One thing I wonder is this: Can the stress indications be removed from a >voice-containing signal by some sophisticated DSP processing? Just look for >whatever effect that indicates stress, add it in equal and negative amounts >to eliminate the apparent stress, etc. It might not make sense for >anything less "critical" than debates, but if the control of the debates is >as monopolized as we think it is, it is reasonable to think that debate >participants would insist on a certain level of control over the audio signal. > > [snip] >But I would still be interested to get some >kind of quantitative feedback on the debates. If anything, the ABSENSE of >the news media's attempting to use voice-stress analysis is telling. > BTW, did anyone notice that some of the evening news anchors are imaged via a camera/DSP to render as more youthful (e.g., removing facial wrinkles)? PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: "Drift net fishing," GAK, FBI, and NSA
by azur＠netcom.com 17 Dec '03

17 Dec '03

>A note on _contact analysis_. One thing the FBI probably wants badly are >databases of who has travelled where, and when, for correlation analysis. >Note that the crackdown on "valid IDs" for travel, for airlines, helps in >this regard. I would not be surprised to learn that the airline databases >are routinely fed to the Feds, so to speak. (Possibly via the FAA, acting >as a kind of cutout.) Were I the head of the FBI, this is what I would >want. The airlines don't yet carefully check IDs (no SSN or DL # retained). They merely check that the name on your ID matches the reservation. > >The next step will be collecting hotel reservation databases. (Unlike the >case with the FAA and the airlines, I don't know what kind of authority >would grant them access to private hotel databases, but I expect they are >working to find such authority somewhere. Maybe the infinitely malleable >"regulation of commerce" clause, even if hotel stays are canonically _not_ >interstate trade!) > >(They already got access to the credit card databases, decades ago, of course.) > Are SSN and other ID required when opening a 'pre-paid' credit card account? That is, the ones for persons with poor credit who are required to maintain a balance sufficient to pay off the charges? Perhaps we could put our heads together and determine a way to become franchised by MC/VISA and offer 'affinity' type accounts with no address requirements (all statments are sent via remailer/nym email). -- Steve

10 13