December 2003 - cypherpunks-legacy

Re: Game Theory and its Relevance to Cypherpunks
by tcmay＠got.net 17 Dec '03

17 Dec '03

Steve Tonnesen <stonnes(a)ix.netcom.com> is the winner of the 5 point prize, for his submission to me, the first I received with the correct answer: At 3:24 AM 7/22/96, Steve Tonnesen wrote: >>"I have a .45 and a shovel; I doubt you'll be missed." (5 points to >>whomever first identifies the movie this was in) > >"Clueless", I believe. > --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Netscape
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: llurch(a)networking.stanford.edu, cypherpunks(a)toad.com Date: Sun Jul 21 22:19:11 1996 > > The government has yet to enforce ITAR. The only thing they have been doing > > is threatening companies who make products with strong crypto. If anyone was > > ever actually put on trial for a violation of ITAR, it would almost > certainly > > be found to be unconstitutional. > > So do it. None of this anonymous bullshit, or trying to drag Netscape > into > it. > > I'd donate whatever I could to a Cypherpunk Legal Defense Fund. We only > need > one volunteer with a lot of time on his/her hands. > > -rich > Could be fun. I haven't been in a lawsuit in quite a while (i.e. never). I'd love to spend some time in court, as a thought exercise and a token claim to fame. I'll be uploading something to hacktic as soon as I can get into Netscape's server to download it myself :) dave - ---- David E. Smith POB 324 Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail of 'send pgp-key' subject for my PGP public key "If a train station is where a train stops ... ... then just what is a workstation?" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automagically signed with Pronto Secure for Windows. iQEVAwUBMfLzOTVTwUKWHSsJAQGEfAf/Su1LVpvIzhwuFKtMbR3j38gB+HnRjfvs /yveJSWh5q+KooVHUvaKdkRwGFvs3Q/xpBaxnUTiZqsdpRcbAh6uKC/w8mYAe/Vt GuaZl/eIz7FGRk5IF/yY691/R2yknxdujDSuzw5B+r9YJBvRqO5sCWbBfJFkElR0 3hDEy6PXddG69ujN+OYiqTAbgatee0jIycAZg5lYl45JVaNer0GcrJtNWqzfyMnI 5c91JAg/raOclYZPHqqNjqUqi1oTY+ItSeVgZ3QpBIs1ggG5wADG1uLsQZh4W6jn e93PFYXJWC4AzNYxLIuI/eMj22yCn7d2EEniwH6gtmRK/k5oBiuOvA== =hz7e -----END PGP SIGNATURE-----

1 0

Re: NSA Lawyers Believe ITARs Would be Overturned if Tested in Court
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:32 AM 7/22/96, jim bell wrote: >At 02:25 AM 7/22/96 -0700, Timothy C. May wrote: > >>(Not all of them, presumably. Shipment of hardware ("arms") would likely >>not be affected. But the ITARs that stop the spread of knowledge, published >>papers, and speech (such as speaking where a foreigner can hear!) would >>likely be overturned.) >>--Tim May > >Which raises an interesting question: Why aren't they (still) restricting >PC-type computers for export? While it might not appear to make a great >deal of sense either, a PC is just as much a tool for encryption as the >software which runs on it. And it's obvious that given the two scenarios >below: But they _are_ (so far as I know, though I haven't checked recently). That is, there are export restrictions on computers and programs which can perform certain mathematical operations faster than some specfied limit. For example, FFTs faster than a certain rate. My copy of Mathematica, updated less than 18 months ago, says "Not for Export," and this was not because it contained any crypto code, but because of the performance on certain algorithms (on commonly available machines). COCOM-type restrictions were relaxed several years ago, of course. And a lot of the old COCOM restrictions were not on export per se, but on export to specific countries. Including by transshipment ("CPU-laundering"). --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: CDT Policy Post 2.28 - FBI Director to Testify at Senate Crypto Hearing
by jim bell 17 Dec '03

17 Dec '03

At 11:15 PM 7/21/96 -0400, Shabbir J. Safdar wrote: > >I would disagree with you here jim. Perhaps you have a selective memory, >but representatives from all the organizations attended the Clipper II >hearings at NIST in Maryland and gave the pro-GAK folks a good drubbing. >(with NIST's microphone too. They're such good sports...) > >Person after person got up at the first of those (and subsequent ones) and >grilled representatives from the FBI, NSA, NIST, and the White House. >The ACLU, EPIC, EFF, CDT, and VTW were all there and pitched in. Somehow Okay, I should remember "never say never." However, wasn't Clipper II about a year ago? They're a little gun shy if they haven't arranged something since then. I guess that's progress. In any case, a gentle reminder: I think you should withdraw the official position you originally publicized concerning the Leahy encryption bill. Fair enough? Jim Bell jimbell(a)pacifier.com

1 0

the VTW---FBI Connection
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

We have received information that VTW is run and supported by the FBI, which we have suspected for reasons listed here. I) They appear to have no financial support or funding source. They do not accept donations. They have no corporate funds. And yet they appear to be a thriving business. II) They are secretive about their location, and do not seem to have a headquarters. The address listed in the NIC is a vacant lot in of all places Brooklyn, NY. They do not have a listed telephone. III) On a tip from a "friend" we learned that the power leader behind VTW is a cleancut man with the unusual name "Shabbir M. Safdar." Not exactly a common name. Several people say they've met him. Our "friend" says that Mr. Safdar is in reality an agent of the FBI. IIII) We didn't believe this without external verification. So we called the Brooklyn office of the FBI and asked for Agent Safdar. No such person. I called the Washington office. No such person. Checked if there is any agent named Safdar. They don't give out this info. Then we tried to find ANY public records on a Safdar, with no luck. No driver's license in NY, DC, NJ, etc. No phone, etc. Odd that such a person does not exist and yet runs a "human rights" organization? Then Alice called the NY FBI office. Asked for Agent Safdar. Guess what? "He's not in. Can I take a message". No message, thanks. He'll get the message all right. Now the big question: What is the FBI trying to do getting all these names? What else has "VTW" been doing? And what other organizations like them are there? Who else is in on it? What does this say about EPIC, CDT, EFF? Are Blaze and Schneier dupes, or willing participants? What about their ISP? I think we are all owed an explanation. This is serious. Maybe FOIA or a lawsuit before they burn the files. What do you want to bet "VTW" quietly fades away after a few prefunctory denials, and gets replaced by another organization in due course? Faithfully, Net reporter team Alice and Bob

7 6

VTWW
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

Any of you New Yorkers know the Society for Electronic Access (SEA)? Maybe you can comment on Mr. Safdar. --j

3 2

Re: Firewall Penetration
by Frank Willoughby 17 Dec '03

17 Dec '03

At 10:09 PM 7/21/96 -0400, you wrote: >Frank Willoughby <frankw(a)in.net> wrote: > >>FWIW, of @70 firwalls on the market, only @5 are adequate to protect >>a company from the hazards of the Internet. > > Ah, Frank, are you talking here about session hijacking and is >end-to-end crypto the defining factor of the robust five? Of course (Vin already knew the answer). 8^) To answer the other questions posed on this list, the vendors who are relatively immune to the above attacks AND are Application Gateway type firewalls are: (in alphabetical order): Digital's Firewall for Unix - *IF* the IP Encryption Tunnel is also used Raptor's Eagle Technologics' firewall (This is a stretch. They claim they have encryption, but I'm not wild about the implementation) 1/2 a point TIS Gauntlet V-One's SmartWall Interestingly enough, the reason the 5 are so robust is that they employ user->firewall encryption to help prevent session hijacking attacks. FWIW, session hijacking isn't a theoretical attack. It is a serious threat and (sadly) it's as simple as "point & click". Another plus for good crypto - it not only helps protect the privacy of data, it also helps prevent some types of hacking attacks. Anyone can do firewall->firewall encryption (and most serious vendors do). The hard part is getting the user->firewall encryption part to work well. Again, as stated in my previous mail, my company doesn't sell firewalls, so I can call things the way I see them. As the above list will probably draw the flames of firewall vendors who feel insulted that they aren't part of the list, I think it would be best to move this topic over to the firewalls mailing list (where it really belongs). See you there. > Suerte, > _Vin > > Vin McLellan +The Privacy Guild+ <vin(a)shore.net> > 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 > <*><*><*><*><*><*><*><*><*> Best Regards, Frank Any sufficiently advanced bug is indistinguishable from a feature. -- Rich Kulawiec <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Information Security Consulting http://www.fortified.com Phone: (317) 573-0800 FAX: (317) 573-0817 Home of the Free Internet Firewall Evaluation Checklist

1 0

Re: NSA Lawyers Believe ITARs Would be Overturned if Tested in Court
by jim bell 17 Dec '03

17 Dec '03

At 02:25 AM 7/22/96 -0700, Timothy C. May wrote: >(Not all of them, presumably. Shipment of hardware ("arms") would likely >not be affected. But the ITARs that stop the spread of knowledge, published >papers, and speech (such as speaking where a foreigner can hear!) would >likely be overturned.) >--Tim May Which raises an interesting question: Why aren't they (still) restricting PC-type computers for export? While it might not appear to make a great deal of sense either, a PC is just as much a tool for encryption as the software which runs on it. And it's obvious that given the two scenarios below: 1. You have a $1000 computer and no (freebie) software yet. or 2. You have freebie software and no $1000 computer. You're closer ($) to being able to do encryption with the former set of equipment. And, of course, nobody's under the illusion that the government can keep the software bottled up, but they'd at least have a prayer keeping most 486 and Pentium-based computers from being exported. I don't mean to give the idiots any ideas, and it's too late anyway, but... Jim Bell jimbell(a)pacifier.com

1 0

Re: Info War
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:15 PM 7/20/96 -0400, EVERHART(a)Arisia.GCE.Com wrote: >* I'd expect some comments on the automatic running of downloaded images >and how to secure them. Java? Reported at Princeton to be totally >unsecurable....no models exist. I think a more accurate assessment of what the Princeton people think is that the state of Java security is much like the state of Unix (pick your flavor) security when people first started attacking Unix. Since then it has been fix the holes as they are found. Neither has a coherent security model. Now the Princeton people can tell us all how I miss-interpreted their position. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Special Agent Safdar
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

FBI Special Agent Safdar is upset enough by the revelation of his true identity to issue a quick denial (on a sunday night, to get more OT no doubt), but he doesn't even bother to try to refute the central truth that his cover has been blown by a careless operator at his home office who verified his employment and offered to take a message for him. We don't have to wonder a second longer about the motives behind Safdar\VTW\FBI's collection of names of crypto-dissidents, their support of the Leahy crypto control bill, their refusal to denounce it even today, their support of the digital telephone act, the disinformation to make us believe otherwise and all the other lies. And what about the money? We must call on the other organizations, like EPIC, EFF, CDT, and ACLU to denounce the VTW\FBI fraud. Their board of directories, Blaze and Schneier to face the truth in public that they they have been used. The net as a whole to demand its pound of cyberflesh. There are very big questions to be answered now and we must not forget to keep asking them until they have been. How high did this operation go? Agent Safdar is no Olly North! He didn't do this on his own. Who ordered this? This is exactly like the FBI in the 1960s and civil rights groups. In the hands of the right reporter, this could and should bring slick willie right on down.

4 3