December 2003 - cypherpunks-legacy

(NOISE) Re: Free Pronto Secure Offer
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: unicorn(a)schloss.li, cypherpunks(a)toad.com Date: Fri Aug 16 02:41:34 1996 Unicorn, > No, I was merely pointing out that if the review revealed that it > had problems (one assumed that the intent of peer review is to reveal > such problems in the first place, but perhaps you just like giving > software away?) then the offered reward was valueless. Peer review seems to have voted that their risk paid off. > A lot of people use DES on this list too I'll wager. and... > I "tried out" your promotional scheme when I read your message, and > it was that scheme which my opinion targeted. You misinterpreted my reply to a list member's enquiry about whether our offer of Pronto Secure in exchange for feedback was still available. > This is a subjective question. Yes. > Cypherpunks is always getting the cash poor developer who thinks he > very clever because he has to pay testers no money if he offers his > new product free to the person who discovers a flaw, or writes a > review. Unicorn, you are again letting your fingers move faster than your brain. On what do you base your evaluation of our liquidity ? (not that it is relevant). Most Cypherpunks are technically savvy and crypto aware people, they provide a perfect community for evaluating and debugging a security enabling product. I would strongly recommend this route to any developer of serious security enhancing software. My sincere thanks to all c'punks who have and continue to provide incredibly valuable input into Pronto Secure. > From your home page, I would guess that you request that reviewers > allow you to make their comments public. That's called an > endorsement, and, by the way, people are usually paid for them. > Sometimes in the millions. Think Michael Jordan is getting a deal > when you use his name to promote your product and then give him a > $99.00 piece of software (which is effectively worth the amount of > time it takes to write a few kiss ass paragraphs on the software, not > $99.00)? Unicorn, you are again making groundless assumptions. I suggest that you do some fence painting before you enlighten us with your opinions about our "kiss ass paragraphs" of code. Unless Michael Jordon is reading Schneier on the sly, his endorsement of Pronto secure is not worth 99c. > Alturisim is a pipe dream. Depends what you are putting in your pipe :) I venture that most c'punks would agree that moving strong e-mail security into mainstream is a good thing. This is not going to happen without people making money from it. >> Unicorn, you are invited to whitewash my fence :) > Do I have to review pronto secure first? Yes. Geoff. - --------------------------------------------------------------- Geoff Klein, Pronto Secure Product Manager; www.commtouch.com My PGP public Key 1814AD45 can be obtained by sending a message to geoff(a)commtouch.co.il with "Get PGP Key" as the subject. - ---------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMhO1s0Lv5OMYFK1FAQG5WAP/XoLteaVpdhnLpj/pk/1aPiWX7Nx/h1cc 5Sf0mgOWv3Q9MASWHV2lKrgqF9jc15ZaymfJZDq1duGttrPj6SJqX/nwOTcYi006 Hh3qh+LnXWnBd7QA/mZL5Fn4SLAOBno/uspqwMbM+6DCw39MpCY2NG0jQ2Qi8vMH n1IG+PYYTAs= =5HnW -----END PGP SIGNATURE-----

2 1

Floating DataHaven
by Vincent Cate 17 Dec '03

17 Dec '03

William Knowles <erehwon(a)c2.org> > > Something that I thought would make an excellent data haven would > be older offshore oil platforms, > [...] > You have to wonder how cheap these could sell > for just to get them off the oil companies hands? A floating DataHaven is probably the way to get the ultimate in freedom. There is someone on Anguilla that bought a used floating oil platform for $1 million. It is big enough for 200 people to live on. It is not here, so I have not seen it. There is someone else here who says that there are some really old ones that you can get just for hauling them away. Some countries will not let owners just sink them. You can get Internet via radio links for reasonable prices. And via satellite for almost affordable prices. When Bill Gates 900 satellites get up there it should be very affordable. -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

6 6

Re: Burden of proof
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:25 PM 8/15/96, Scottauge(a)aol.com wrote: >In a message dated 96-08-15 17:35:20 EDT, you write: > >> This relates to something I have been wondering about: If one could >> get one's company to pay one in electronic cash, what is to stop one >> from piling the coins in a Datahaven somewhere (assuming one existed >> that would be usable for these purposes) and say to the IRS: Money? >> What money? Can you find any of my money? I, uhh... lost it! Yeah, >> that's it!! > >But then how do you spend it? What if instructions are given to the banking >system to not deal with such and such bank (or datahaven)? How are you going >to get it out and spend them deniros? This is practically the least of the concerns. Assuming one could, say, be paid reliably and without True Name attached, in a country like Anguilla (to use a current example), it would be simple enough to fly to Anguilla for a vacation, pick up the money, and return to the U.S. I've never had my bags searched on an incoming flight, and even if one is fearful of this, there are multiple ways to get the cash back. This is not an ideal, pure crypto anarchist solution, but it certainly shows that getting the payments made to an offshore account is much more than half the battle. (I hear that some consultants to offshore companies are already doing something like this--they consult for some large fee, e.g., $200K, and then arrange to be paid out over a period of many years on a contingency basis. This reduces taxes, at least on this payment, considerably. And they can, while in Macao, or Singapore, etc., transfer money around the world to various locales they may visit in the future....) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Burden of proof
by mike＠fionn.lbl.gov 17 Dec '03

17 Dec '03

On Aug 15, 7:25pm, Scottauge(a)aol.com wrote: > system to not deal with such and such bank (or datahaven)? How are you going > to get it out and spend them deniros? Make 'em an offer they can't refuse ?^)

1 0

Re: Anguilla - A DataHaven?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:55 PM 8/15/96, William Knowles wrote: >On Thu, 15 Aug 1996, Arun Mehta wrote: > >> I'm sure this has come up before, but what would prevent a server >> being located on a buoy or something at sea outside territorial >> limits (or when satellites become cheaper, on a satellite itself) >> offering such services? > >Something that I thought would make an excellent data haven would >be older offshore oil platforms, Their size would allow extended >living periods, electrcity and communications are in place, They >are generally built outside of the territorial waters of most >countries to avoid any damage to the shorelines if oil spilled >(possibility for becoming its own country?) and with the hoops >that Shell Oil went through to please Greenpeace with its last >oil platform. You have to wonder how cheap these could sell >for just to get them off the oil companies hands? > >Comments or suggestions? As with offshore buoys, how long do you think such an entity would last? You mentioned Greepeace...don't forget that the French intelligence apparatus sunks a Greenpeace ship in a New Zealand harbor. Don't forget the way the U.S. mined Managua's harbor. And so on. Think of how any of these schemes are vulnerable to a cheap torpedo, "anonymously mailed" from several miles away. Oil rigs, buoys, pirate ships....these are all examples of hopelessly insecure systems. I could say more, but what's the point? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Anguilla - A DataHaven?
by Greg Kucharo 17 Dec '03

17 Dec '03

The only ideal I can think of would be the fictional "Port Watson". What is you had a system that spanned countries, using the internet as a linking device. It would be the same service. But when you specified the kind of data you wanted to post, the system would route it to the appropriate server in a country where it wasn't illegal. ---------- > From: Vincent Cate <vince(a)offshore.com.ai> > To: cypherpunks(a)toad.com > Subject: Anguilla - A DataHaven? > Date: Wednesday, August 14, 1996 5:40 AM > > > Tim: > > Rather, there is an "archetype," if you will, of what a "remailer" is, what > > a "data haven" is, what a "tax shelter" is, etc. While we cannot reasonably > > expect a remailer to exactly match the archetype, we can point out obvious > > deficiencies. > > 1) Anguilla has secrecy laws. Professional relationships are confidential. > There are strong secrecy laws. I have not given out taxbomber's > name, nor will I as I could face legal action if I did. > > 2) Anguilla has no sales or income taxes. A business does not need to > report anything about income, sales, etc, to the government (or anyone > else). If a guy wants to sell his data and keep 100% of the profits > instead of 50% or 60%, then Anguilla would be a haven for him. > > 3) We don't have the same laws as other countries, so there are things > that can be done here. For example, we can export encryption > software. Also, we will have bingo.com in Anguilla. > > There are deficiencies from a cypherpunk or Libertarian point of view. And > these are interesting. And exactly what I want to do is changing. As I > said, Anguilla is not the datahaven of cypherpunks wet dreams. I am sure > there are no datahavens that match the cypherpunk concept of an ideal > datahaven, yet. > > But I think the term DataHaven applies as well to Anguilla as any other > place I know of. > > Tim, we would all be very happy if you were to locate a country that could > be the site of the ideal datahaven, and finance a couple cypherpunks to > setup there. It would be a big help to our cause. Could you do this? > > In the mean time, people may have to exist in cyberspace (like > www.taxbomber.com) without having a totally secure physical location. > This is not the end of the world, or really even that painful. If done > right you could be down for only an hour - just long enough for > nameservers to change. Taxbomber is now setup to do it very fast next > time, if the need ever comes. Tim, I think you have even advocated this > approach, not stressing the physical location, just the cyberspace > location. No? > > -- Vince > > ----------------------------------------------------------------------- > Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ > Offshore Information Services http://www.offshore.com.ai/

1 0

Re: [NOISE] Geek Apartments and Etherpunks
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:55 AM 8/14/96 -0400, Rabid Wombat <wombat(a)mcfeely.bsfs.org> wrote: >Most manufacturers offer SNMP-manageable hubs, but these don't offer >MAC-layer security. That usually costs a lot extra. The MAC-layer feature >is not widely used. AT&T was about the first vendor with that feature. Aside from solving a _lot_ of potential security problems, it was very convenient for finding out what device really _was_ connected to what hub port - the hub recorded the most recent MAC address received on each port, and you could compare that to ARP tables and untangle lots of problems. Not as fancy as a Sniffer, but let you do things that a Sniffer on ThinWire couldn't. (Of course, since it wasn't NSA-rated, the fact that it actually did solve security problems didn't give us extra slack on government jobs that needed it. ) A multi-port bridge gives you similar security capability, but generally costs more because it needs buffering and much more intelligence; the AT&T SmartHub was a lot simpler and (in its day) cheaper. It was about twice the cost of a regular hub, half the excess from cool features and half because it was from AT&T :-) It was less reliable than the regular hub, because it needed a fan to handle the extra heat from the processor board, and was also more awkward to mount. And the SNMP implementation was rather buggy, though it did have a convenient PC SNMP manager that knew how to use SNMP-over-MAC and the special features of the hub. Cool device. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Re: Stealth Buildings Was Re: "X-Ray Gun" for imperceptible searches
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:01 AM 8/16/96, Alan Horowitz wrote: >I repeat. Generations of sweating engineers have discovered and confirmed >that there is not an easy, "Silver Bullet" cure of the canonical problem >of shielding electromagnetic energy from reaching someone who knows how >to interpret it. > >Bill, you are welcome to look at a layer of tin foil and give a sigh of >relief that you've shielded your gun or your crypto diskette or your >private body parts feom someone who knows what they're doing. Go ahead, >chant a mantra too, if it makes you feel better.+- I've stayed out of this "tin foil" debate, but some basic physics is being missed, or misused. The invocation of TEMPEST and leakage of RF does not say much of anything about _imaging_. If a gun, for example, were _radiating_ RF energy of some particular sort, then it might indeed be true that tin foil/gold lame shielding would not stop _all_ of the emitted radiation, and that sensitive enough detectors might detect the characteristic signal 60 or 90 dB down. Maybe. But a gun is not a radiator, it is at most a _reflector_ of RF energy. Thus, the TEMPEST invocation is misleading. The signal would perhaps be down by 100-130 dB or more, as the "leakage" must first get around the shielding, be reflected, and then get back around the shielding. And what this does to "imaging" almost needs no explanation. What leaks around the periphery or through holes in a shielded container will provide essentially zero spatial information about the configuration of sources and reflectors inside the shielded container. (I spent much of 1972-73 working inside a Faraday cage on ultra-low-noise superconducting Josephson junctions. Believe me, what signals leaked in, or leaked out (by symmetry analysis) could not have been used to deduce the configuration of sources and reflectors inside the room.) I should say I'm skeptical that millimeter detectors will be widely deployed anytime soon. For detecting concealed weapons, "metal detectors" in specific locations are both cheaper and have fewer constitutional and "false positive" problems. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Scientology *really* tries to crack PGP...AGAIN?!?
by modemac＠netcom.com 17 Dec '03

17 Dec '03

Newsgroups: alt.religion.scientology,alt.security.pgp From: grady(a)netcom.com (Grady Ward) Subject: Criminal cult begins PGP crack attempt Message-ID: <gradyDw7Cnt.I6A(a)netcom.com> The Special Master has informed me that Madame Kobrin has asked her to retain a PC expert to attempt to "crack" a series of pgp-encrypted multi-megabyte files that were seized along with more than a compressed gigabyte of other material from my safety deposit box. Ironically, they phoned to ask for assistance in supplying them with a prototype "crack" program that they could use in iterating and permuting possibilities. I did supply them a good core pgpcrack source that can search several tens of thousands of possible key phrases a seconds; I also suggested that they should at least be using a P6-200 workstation or better to make the search more efficient. The undercurrent is that this fresh hysterical attempt to "get" something on me coupled with the daily settlement pleas reflects the hopelessness of the litigation position of the criminal cult. It looks like the criminal cult has cast the die to ensure that the RTC vs Ward case is fought out to the bitter end. Which I modestly predict will be a devastating, humiliating defeat for them from a pauper pro per. I have given them a final settlement offer that they can leave or take. Actually they have a window of opportunity now to drop the suit since my counterclaims have been dismissed (although Jusge Whyte invited me to re-file a new counterclaim motion on more legally sufficiant basis). I think Keith and I have found a successful counter-strategy to the cult's system of litigation harassment. Meanwhile, I could use some help from veteran a.r.s'ers. I need any copy you have of the Cease and Desist letter that you may have received last year from Eliot Abelson quondam criminal cult attorney and Eugene Martin Ingram spokespiece. Physical mail: Grady Ward 3449 Martha Ct. Arcata, CA 95521-4884 JP's BMPs or fax-images to: grady(a)northcoast.com Thanks. Grady Ward Ps. I really do need all of your help and good wishes after all. Thanks for all of you keeping the net a safe place to insult kook kults. -- Reverend Modemac (modemac(a)netcom.com) First Online Church of "Bob" "There is no black and white." PGP Key Fingerprint: 47 90 41 70 B4 5B 06 90 7B 38 4E 11 8A ED 80 DF URL: http://www.tiac.net/users/modemac/ (FINGER modemac(a)netcom.com for a FREE SubGenius Pamphlet!)

1 0

Garage door openers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:34 PM 8/15/96, Douglas R. Floyd wrote: >That is known for cars. I double checked, and found some car alarms able >to do this. However, I have not found any house garage door openers able >to pull this off. Most still use the old blurt code method. > Sure, most garage door opener codes are easy to break....but how many thieves who do this know to enter the _second_ correct sequence within 45 seconds, the one that stops the poison gas from filling the garage? Steganographic entry codes have their uses. --Tim May (P.S. There were six (6) names copied on this post, besides CP. Can't we edit the cc: lines? I try to, so why don't you all?) Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0