December 2003 - cypherpunks-legacy

photographed license plates
by i am not a number! 17 Dec '03

17 Dec '03

At 21:55 8/8/96, i am not a number! wrote: >CBS radio news this morning: 80,000 commuters traveling the central >f'way in SF will have information mailed to them regarding the quake >retrofit blah blah. > >How? Their license plates have been photographed. >... and the cheery "news" anchorwoman sweetly moved on to the next >story..... >> You *are* making this up, right? Please say you did. ------------------------------------------ I AM NOT making this up, unfortunately. The news story contents may be bolluxed, of course, maybe they got it wrong. But this is what she said, no joking. O, and I think they're talking more about putting up cameras at some troubling intersections to take pictures of cars running red-lights. And cameras on transit vehicles (buses primarily). Gee, I am starting to feel so warm and safe!

4 3

Re: Why should we trust the system?
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> wrote: >When supporting plans like GAK ("key escrow") and wiretaps... <snip> >If we allow this fiasco to die without a full analysis, >particularly in light of the government's repeated assurances >with regards to search warrants, we will be as incompetent as >the police were. Further, my original question, phoned in anonymously to the FBI, mailed in anonymously to this list, and asked to the media (I guess I like wasting my time) has never been either asked or answered. I will restate it in stronger terms: "Why the hell, when you have a tape of the perp. saying something, do you not air it in the middle of a city chock full of people who could very well know this guy's voice/mannerisms?" Why didn't the media ask for it, and then give the answer (the fibbieclerk had no answer at all for me) the FBI gave?? Am I missing something? We hear 911 tapes ALL THE TIME of various stuff happening. Has the FBI suddenly become a bunch of civil liberties activists WRT the privacy of terrorist bombers? Just asking. me

2 1

Re: Going Postal (Was: Boom!)
by David.K.Merriman＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Fri Aug 09 10:12:37 1996 > The Post Office has now jumped on the terrorist bandwagon by > announcing that it will no longer be legal to drop any package > weighing over 16 ounces into a collection box. > ... > > I suspect one could do a lot of damage to a mailbox with under 16 > ounces of the proper explosive. Perhaps one of our resident > Cypherpunks bomb experts could expand on this subject. Don't know that I'm a 'bomb expert', but it would appear reasonable that 6 just-under-a-pound bombs would do approximately as much damage as a similarly sized larger device. Even if the 6 devices got scattered to two or more aircraft, the terror factor would be significant Dave Merriman - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCUAwUBMgqeo8VrTvyYOzAZAQFGfAP3ZL7pgWjadNN93mtwdG4cm60VjGcdP4G9 JlwS96gs6QJ0lD1CImMQL82KUIYe1IpPidC3bq5kTQhGbdM69yFiUmCxOGNwnH1L pEbeEZ/OGDf0bnk/BYhoRKp1ufgdTVVSB1T0WZEYIaLe2zX1zzQPli4LW4UPUrds 5tmjt4QMEg== =AZ0H -----END PGP SIGNATURE-----

1 0

Crypto Interface in Netscape
by Adam Shostack 17 Dec '03

17 Dec '03

Is it just my windows machine or are the security dialogs in Netscape3.0b6 completely unreadable? I get a dithered grey background behind black text. Can'tread the dialog boxes that show up when I see a new cert. (Speaking of which, there seems to be a new long list of acceptable CA's. Has Netscape published a policy doc explaining how Adam's Quik & EZ CA can get on the list? And, those CA's should have hyperlinks, so I can easily find their policies for key signing, so I can decide rationally that I don't trust the Post Office to certify things. Right now, its just a gut feeling that they can't be trusted. "Please don't call them junk certificates.") Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Oregon License Plate Site in the News Tonight!
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 11:23 PM 8/8/96 -0700, Timothy C. May wrote: >At 2:49 AM 8/9/96, John F. Fricker wrote: > >>Isn't that the role of legislation? To implement solutions that society >>would not do on it's own? >> >>The enabling technology is obviously off the self. >> >>I think you may have misinterpretted my last sentence which was supposed to >>have had a ? at the end. Where's the proof reader when you need one! > >"To implement solutions that society would not do on it's own?" > >Would not do, or could not do? It is within anyone's power to ask their >psychiatrist what form of encryption he uses to protect his files. Likewise >with doctors and hospitals. > Well where there's a will there's a way. I agree that the general public and the market place often lacks the power to affect particular events. Central planning can facility certain processes. Free-marketers may argue that I can query and select based upon my encryption criteria but chances are my psychiatrist will do nothing more than "make note" of paranoia and ponder it's significance: "Do you resent your mother?" >(Though I freely admit that one would not be likely to get very far. For at >least the next decade or two, the reaction will likely be "Huh?" But >"legislation" mandating a form of encryption is not the answer. For many >reasons.) > >On this list at least, calls for passing laws to implement societal >solutions are not usually smiled upon. This is not to say such discussions >are out of bounds, only that you'd better make some persuasive arguments >and not just appeal to our common sense sympathies for social engineering >and more laws. I am not a great fan of social engineering and regulations. Yet the legisture in Oregon may get called for a special session to address this issue and I see this an opportunity for a grander arguement than merely acccess to the DMV data. And as much as we dislike the presence of the governments they do indeed exist. Living within their domain limits our choices to either: complacency through inaction (cynicism et al), attempts at isolation (back to the land), or taking an active role through voting, education, civil disobedience or participation in the process (a pox on party politics! the latter choice is easily the least enticing while civil disobedience can be truly fun! >g<). Ok so call me a statist and shove me out the door, but I am not argueing for the existance of a state. It does currently exist and I am not self-sufficient. But I digress. So. #1) My state legislature may very well get called to address this issue. Do they have any concept of the big picture here? That the DMV data is one small part of a debate regarding privacy which needs to be addressed. This is an opportunity for some education and by the end of the day I should know if my representatives are willing to listen. #2) The records industry (for lack of a better term to encompass all companies that accumulate data on individuals) needs some standards and guidelines. Or walls and fences. Maybe even bars and a moat! And the sooner the better. Federally imposed software requirements are not uncommon in certain industries. It is time for standards for the personal data maintained by co-operating entities (ie agencies the public co-operates with such as doctors, the DMV, and so on). #3) The goal is the anonymous citizen. The first step it to secure the data currently exposed. Can this be done _without_ legislation? --j

2 1

SecurID
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

someone at my firm is about to press the securid system down our collective throats. please point me to the recent thread on this subject, and/or point me to some url's or the like, or to someone who has some firsthand knowledge of the pitfalls and/or vulnerbilities of secirid. cheers, -paul

3 2

Re: Why should we trust the system?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:19 PM 8/9/96, Anonymous wrote: >Further, my original question, phoned in anonymously to the FBI, >mailed in anonymously to this list, and asked to the media (I >guess I like wasting my time) has never been either asked or >answered. I will restate it in stronger terms: >"Why the hell, when you have a tape of the perp. saying something, >do you not air it in the middle of a city chock full of people >who could very well know this guy's voice/mannerisms?" Why didn't >the media ask for it, and then give the answer (the fibbieclerk >had no answer at all for me) the FBI gave?? Am I missing something? >We hear 911 tapes ALL THE TIME of various stuff happening. Has the >FBI suddenly become a bunch of civil liberties activists WRT the >privacy of terrorist bombers? >Just asking. This is the single best suggestion/question I have heard about this entire case! Why, indeed, has the 911 threat not been aired publically, where someone might recognize the voice as being that of their brother, or boss, or whatever? And might hear immediately that whomever it is, it ain't Richard Jewell. If any of you cyber-journalists who hang out here in the wings on Cypherpunks, collecting material for stories, are reading this, please ask your journalists covering the Atlanta bombing about this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

The Ostrich Security Principle
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:47 PM 8/9/96, Sandy Sandfort wrote: >It probably needs a whole new domain. How 'bout: > > burglary.org > >That way, when burglars see an Oregon car loaded with a family >heading south into California on vacation, they can just go on >line and get those folks' address from the database. > >Afterwards, a thank you note to Oregon's DMV would be in order. Sounds like a market niche to me...people at the border could sell the plate numbers (and even full DMV searches) of cars they see....maybe with a higher price paid for "real-time quotes," and a lower price paid for "15-minute-delayed quotes." Just like the stock market. By the way, I'm watching MSNBC and they're engaging in a fretfest about this Oregon situation, with calls for "regulating the Internet." "There is no good reason for this to be on the Internet." is one line I heard. (If the stuff is legal to own, and is "public information," just what exception to the First Amendment could be used to bar publishing?) BTW, this latest issue is similar to the flap several years ago over Lotus' plan to sell to the public a CD-ROM of zipcodes and whatnot. (I think it was called "Lotus Neighborhoods.") So-called "privacy activists" raised a hue and cry and the plan was cancelled. Of course, corporations and other such interest groups can get the data, so not much was accomplished. Many of us thought it was a blow to real privacy issues. The Ostrich Security Principle: "It is more important to have the _illusion_ of privacy than to have real privacy." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

secret sharing protocol - new or reinvented ?
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Schneier in That Book 2nd Ed p73 refers to "secret sharing with disenrollment", but without giving details of such a scheme. He gives a reference [1004] I think, by K Martin, which has about 10 pages on the subject. But I have not got it. I planned a "secret sharing with disenrollment" scheme last night. Here is a brief description and if somebody with the book tells me it's new (unlikely I think) I'll write it up in more formally. It has a resemblance to S/Key, but in the other direction and using a keyed hash function. If you see snags with this, I'd like to know. Peter Allan peter.allan(a)aeat.co.uk Trent chooses his shareholders, a block cypher (or keyed hash), a threshold, and a number of steps. The threshold should be more than half the number of shareholders. (Say 15 shareholders for a 10 out of 15 scheme, using DES, over 20 steps.) Trent generates 15 64-bit DES keys (not caring about parity), and gives them securely one to each shareholder. He introduces all shareholders to each other so they can recognise each other later. He also tells them the number of steps (here 20). Trent (in possession of all shares) calculates the secret, which is a 64-bit number. Obviously this could just be a key for a secret not yet created at share distribution time. Secret calculation is performed by executing the required number of steps, and the result of the last step is the secret. Disenrollment (conducted by shareholders, presumably under orders from Trent) is the performance of one step, omitting those to be disenrolled. (The number of possible disenrollments is limited by the threshold.) One step is this set of actions: Using a normal threshold scheme, such as Shamir's Lagrange Polynomials a sufficient number of shareholders construct a single secret from their shares. Call this M. M is then used to update all their shares using a keyed hash function. Table 18.1 suggests H_i = E H_i-1 (M) XOR M M and every H_i-1 is destroyed. Now those absent from the meeting have no M value to advance their share, and nobody (even the other shareholders following a change of heart) can reproduce it for them. Shareholders deduct 1 from the number of steps still to be performed.

1 0

Re: Drive the SF Central Freeway, have your license plate photo'ed.
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

How about a cypherpunks group activity for the SF area? 2 per car, one to drive, and one to moon.... Ryan ---------- Previous Message ---------- To: geeman, cypherpunks cc: From: shamrock @ netcom.com (Lucky Green) @ smtp Date: 08/08/96 10:45:06 PM Subject: Re: Drive the SF Central Freeway, have your license plate photo'ed. At 21:55 8/8/96, i am not a number! wrote: >CBS radio news this morning: 80,000 commuters traveling the central >f'way in SF will have information mailed to them regarding the quake >retrofit blah blah. > >How? Their license plates have been photographed. >... and the cheery "news" anchorwoman sweetly moved on to the next >story..... You *are* making this up, right? Please say you did. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0