December 2003 - cypherpunks-legacy

Re: Internet Drivers' Licenses
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 13 Sep 96 at 22:51, Rabid Wombat wrote: > When even some on c'punk readers are calling for manditory > identification, where do you think the great unwashed position > themselves? As Auric Goldfinger :) once said: Once is happenstance... Twice is coincidence... The third time is enemy action! jfa Jean-Francois Avon, Montreal QC Canada "One of theses centuries, the brutes, private or public, who believe that they can rule their betters by force, will learn the lesson of what happens when brute force encounters mind and force." - Ragnar Danneskjold PGP key at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

1 0

Re: Internet Drivers' Licenses
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Rabid Wombat <wombat(a)mcfeely.bsfs.org> writes: > Well, it would seem some are helping to make my point; > M.Duvos is calling for government intervention, in the form > of an "Internet Driver's License." Nothing to do with the government. If people choose to voluntarily obtain a key with which to voluntarily sign their posts, and I set my newsreader to present only articles which correspond to keys having certain criteria, all is well and good. Anyone can still post anything they like, including unsigned articles, and the filter is at the reading end, which is where it should be. A given key could mean "I am Mike Duvos", "I am Tim May", or "I am Dorothy Denning." Or it could mean something more obscure, like "I showed my driver's license to get this key", or "10 leading Cypherpunks think I'm a Nym worth listening to", or even "I donate regularly to the 700 Club." > There goes anonimity, which has, in general, been a "good > thing" on the 'net. Here comes "big brother", to protect us > from the evil anonymous spammer. Bullfeathers. Encouraging people to sign posts, and permitting newsreaders to select based on signature characteristics is about as big a threat to anonymity as a procmail file which filters out everything having an anon remailer disclaimer attached to it. > Here comes more government infrastructure to enforce the > LAWS that "we", as a society, have subjected ourselves to, > so that "the few, the rude, the clueless" can no longer send > out their anonymously sourced spam. They can spam all they want. They can be as rude and clueless as they wish. It hardly requires additional government infrastructure if *I* want to only read posts signed by keys endorsed by persons or organizations I trust. > Less freedom, more taxes. How one moves from a system of voluntarily signing Usenet posts to more taxes is beyond my ability to comprehend. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

Re: Erasing Disks
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:12 PM 9/11/96 -0700, you wrote: >The paper starts with the comment that most secure data destruction guides >are classified. There is the suspicion that the unclassified ones do not >cover the newer recording materials and techniques, and will not protect >you against government attackers. I disagree. The methods for declassification in the Army and Defense Department security manuals included several approaches: 1) Physical destruction - acid, sandblasters, etc. 2) NSA-Approved Whopping Big Magnets 3) NSA-Approved Hopefully-Bugfree computer programs for some computers. The most secure methods were the unclassified ones - after we sandblasted our RM05 disk packs, the NSA and KGB can't read anything. The less secure methods are the ones that require NSA approval - how strong is a Whopping Big Magnet this year? (Too strong to put near MY computer lab, thank you! :-) The answer tells you something about what the NSA can crack, which they not only don't want known, they don't want to encourage the KGB to erase their own disks better or to use the knowledge to become better at reading stolen Yankee disks. And NSA-Approved computer programs presumably have weaknesses and bugs, like all computer programs; they carry the risk that Reverse Engineers can figure out how to find the data the NSA missed. But shredding the floppy? No need to classify that, no secrets leaked by saying "Yeah, if you dissolve the magnetic film in acid we can't read anything on the etch marks in the mylar." It's Dumb and Safe (as long as you do the paperwork to make sure that you know which magtapes were fed to the shredder, which ones were overwritten with other RILLY SEKRET DATA, and which ones were stolen by the Tape Drive Repair Truck driver.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: really undetectable crypto
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:26 PM 9/12/96 -0700, Jim_Miller(a)bilbo.suite.com wrote: >Most everybody on the list is familiar with the technique of hiding >encrypted messages in the LSBs of image files. Personally, I would not >use such a technique because don't I believe it's really undetectable. >I assume, without proof, that the LSBs of images files have statistical >properties that are sufficiently different from encrypted data that a >clever person could determine whether or not an image file contained an >imbedded encrypted message. First of all, they should at most be able to tell that there are random-looking-noise bits in there - if they start seeing patterns of ------BEGIN PGP ENCRYPTED SECRET MESSAGE------ you haven't done your job, though there are more subtle patterns that are more annoying to hide, like the slight bias of an RSA-encrypted piece of data; Hal Finney and others have written about this in the past. Hiding Depends substantially on the image source and the compression methods, if any, used on the image. For instance, a 24-bit true-color image or 8-bit grey-scale image from a scanner with 6-bit resolution will be pretty noisy in the LSBs, and if the Bad Guys are clever enough to find the patterns in them, you can be clever enough to find them and encode your initially-pseudorandom cyphertext stegobits in a way that matches the stats of the noise. On the other hand, if you take the LSBs of cartoon data, with large areas of solid colors, and start dithering them with stegobits, it's obvious you're up to something, if not necessarily what it is - be careful. Ron Rivest posted a message on coderpunks mentioning somebody's suggestion of building an internet-phone sort of program that shoves stegobits into the voice compression. I'd be extremely surprised if you could do that with the fancier compression algorithms, such as CELP, LPC, and friends, but it shouldn't be too hard with the looser compression algorithms such as ADPCM and Delta-Modulation, which need 16-32kbps and can run on really dumb processors - you've got more bits per second to hide in, can get away with stealing more of them, and there isn't any real subtle prediction stuff going on that you've got to work around. Given that most of the popular Internet Phone products don't do encryption (sigh...), this would at least be a good cover. (Well, assuming you've got a credible voice conversation going and aren't saying things like "OK, Carlos, let me send you the secret message starting ... NOW".) [tricks #1,2 - picking your cleartext so the RC4/40 cyphertext or MD5s have chunks of the real stego-cyphertext you want - cute.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Juno Newbies are Great!
by Bill Stewart 17 Dec '03

17 Dec '03

OK, there are lots of spammers, clueless newbies, and wannabes there. There are some cool things about Juno - it's free. Anybody can get on it. Easily. Anonymously, more or less, since they don't need to have your whole credit history to be able to charge you money. At most you need a maildrop. - it's free. Anybody can get on it. Without a government. Without a bureaucracy from Washington who are Here To Help Us Provide Universal Access to the Nationalist Infotainment Infrastructure. Without telling us how to run _our_ systems. - it's free. Anybody can get on it. Anybody can try to compete. There aren't any subsidies, so there aren't any rules, except the usual "make sure you've got positive cash flow soon" and "reputation capital can sell lots of stock." - it's free. Nobody has to be on it. If you don't like the management, you can bail, with minimal investments, and go find better. - it's free. Nobody has to be on it, unlike a government-run NII that you need to pay your taxes, do your banking, register cars, keep your draft card up to date and your papers in order, and can get thrown off if they suspend your Internet Driver's License for six months. - it's free. _I_ don't have to pay for it if I don't want it. - it's free. Any newbie, spammer, or 3133T D00D can get on it, act as stupid as they want, and it's ok, because the public knows (or will soon enough) that clueless people live there and not to take any email from juno.com too seriously - it's not like mail from whitehouse.gov or kremvax.su or cnn.com that you know you'd better read and believe every word of. It's as accurate as the National Enquirer, it's the Net Of A Million Lies, and like Television, nothing to panic over. So, like, relax, chill out, and get procmail or BozoWatch or some other filter, and you not only can get rid of most of the junobots, you can use it to get rid of lots of other spam, and use that new Distributed Reputation Service Platform that Anon(a)juno.com is developing to find the interesting 100 messages per day of the 1000 you receive. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Domain names - Alternic - Authority
by Bill Stewart 17 Dec '03

17 Dec '03

(The Top-Level Domain Name Wars have been breaking out in Cyberia-L, not a usual place for technical discussion, plus popping up and down in Cypherpunks. Hope y'all don't mind me mixing this to both.) Back when domain names first came in, a number of us didn't believe that a centralized organization could pull it off, especially when it was being done by a collaboration of the US military types and the European Phone Companies, who were well known to be clueless. The email world wasn't just the ARPAnet, it included all of UUCP-land, PCs were starting to occupy their spaces, and there were various DECish things and Berknets and other radically non-conformable architectures and overlapping namespaces. UUCPland worked because a few dedicated people, mainly at Bell Labs and some universities, with lots of time and non-beancounted-non-billed funds, kept track of where machines lived, phone-polled sites that couldn't afford it, tried to keep track of which of the umpty-seven machines named "bilbo" or "mozart" could talk to which others so you could occasionally get mail to someone who lived at ucbvax!allegra!mozart!zorro!bilbo!gandalf and know it was the same bilbo!gandalf you'd talked to last week and maybe get mail to people reliably across complex paths. Pathalias was a cool program that took link data and Dijkstra'd it together into a relatively connected bunch of shortest paths. The idea that Somebody Thought They Were In Charge was annoying to many of us, especially Somebody Bureaucratic. Peter Honeyman set up a bunch of his machines as the .FUN domain for a while; it was run by fun people. Rob Pike and Ken Thompson later wrote a marvelous technical rant called "The Hideous Name" about how locally-based addressing makes far more sense than global - it both reflects reality and lets the decisions about naming and such be made by the people and processes that need to make them. Well, domain names eventually became a raving success, just because it was so much easier to say where someone was (administratively, if not physically) than to guess how to get there hop-by-hop. Separating administrative addresses from routing was an important mental step. Stuff like .BITNET and .CSNET were workable, .UUCP had its real problems but eventually became sort-of-defined relative to uunet, a machine set up as a research project that had turned into a small business. One of the things that made it work well was that any given machine only had to know a manageable amount of stuff - you needed your own subdomains, a path to the top of your organization, a way to recognize that given patterns were high-level domains, and a path to the Root Servers - plus you needed somebody Higher Up to enter your name and address in their administrative database so other people could find you. It's easy to find where to look among a few hundred entries (a few technically-cooperative countries, a few zones for non-countries, and a few hundred countries that didn't really have email :-) Occasionally a country comes on board that your internal nameservers didn't recognize, and you need to get your administrator to add .nl or .kr or whatever. >From that relatively short list, which you don't need any blazingly complex database to administer, you can get anywhere. The standard DNS BIND tries to solve a bunch of complex _local_ problems and work portably in many different environments, but doesn't need to be tuned blazingly complexly to work almost anywhere. The systems that need to go beyond that are the servers for .com and to some extent .edu, which have to keep track of a lot more sites, and places that have complex internal structures or are trying to solve fancy problems like mobile users. But www.joesgarage.com doesn't need to do most of that. I think polluting the top-level domain name space is a bad move. While geographically-based names aren't a great choice for representing non-small organizations, they're short, and if you open up the entire top-level you just complicate everyone's life and in a year or two you'll have as many people carving out space at the toplevel as you currently have in .com, raising the ego levels without making the name space any bigger. Now, I suppose there's a certain nice philosophical position of being able to say "You're .gov.fr - we're .microsoft, and we're at a higher level than you!" or "You're .gov.uk - we're .gov.AnTir, and everybody in _our_ kingdom is there because they want to be!" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Internet Drivers' Licenses
by Johnny Eriksson 17 Dec '03

17 Dec '03

Mike Duvos writes: > I am now getting more junk email than email from people I > care to correspond with. It seems one can't even read the > scholarly newsgroups anymore without "Come Watch Us Lick > Ourselves on the Web" messages popping up regularly. How inappropriate. Such messages belongs in rec.pets.cats. --Johnny

1 0

EGO_war
by jya＠pipeline.com 17 Dec '03

17 Dec '03

9-13-96. FiTi: "On manoeuvres in the modern military mind." The most interesting challenge is psychological. Participants learn the hard way that they cannot simply command. They must persuade, cajole and win over subordinates, allies and politicians, who may have varying agendas. While lower level command requires physical courage and speed of decision, higher commmand involves moral courage, intellectual vision and perseverance. "Politicians are being pressed by interest groups on all sides, while the military will usually only focus on their aspect of the task. The collision of those two sets of values can be quite a shock." The more subtle message from the historians is the lethal potential of petty jealousies, warring ambitions and clashing egos. ----- http://jya.com/egowar.txt (16 kb) EGO_war

1 0

ISC Meeting Agenda
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sat, 14 Sep 1996 08:53:40 -0400 (EDT) From: Michael S Baum <baum(a)world.std.com> To: www-buyinfo(a)allegra.att.com Subject: ISC Meeting Agenda Mime-Version: 1.0 ========================================================== MEETING NOTICE ========================================================== Please correspond with: Michael S. Baum, Esq. 33 Tremont Street Cambridge, MA 02139-1227 USA V: +1 617.661.1234 F: +1 617.661.0716 E: michael(a)verisign.com Subject: INFORMATION SECURITY COMMITTEE MEETING NOTICE Dear Committee Member: You are cordially invited to participate in a meeting of the Information Security Committee, Section of Science & Technology, American Bar Association, on Friday/Saturday, October 18-19, 1996, in Boston. The Committee will advance its development of commercial key escrow guidelines as well as consider digital signature legislative initiatives in the several States and other jurisdictions, and continue its consideration of digital signature evidence and liability. Consistent with Section policy, ISC meeting participants MUST be members of both the ABA and the ABA Section of Science and Technology. Please contact Ann Kowalsky, Manager Section of Science & Technology, at ABA offices in Chicago by phone: +1 312.988.5599, fax: +1 312.988.5628, or email: sciencetech(a)attmail.com for membership information. It is possible to become a paid member of the ABA and the ISC at the meeting. Dan Greenwood, ISC member, has kindly agreed to host the meeting at the Information Technology Division of the Commonwealth of Massachusetts. Dan can be reached at 617.973.0071 or DGreenwood(a)state.ma.us for directions & logistical information. Meeting details appear below. I look forward to seeing you in Boston. Sincerely, Michael S. Baum Chair, Information Security Committee Section of Science & Technology, ABA --------------- INFORMATION SECURITY COMMITTEE October 18-19, 1996 Tentative Agenda (see "Meeting Details," next page) (In extended sessions, breaks will be taken as needed.) October 18, 1996 Friday 8:30-9:00 Greetings, breakfast, administrative matters. 9:00-9:30 Introductions, meeting logistics, Guidelines update, questions; PKI-relevant standards reports. 9:30-12:00 Legislative/Regulatory Update (including open conference call with digital signature leg./reg. drafting committee representatives in the US and abroad). 12:00-13:00 Joint lunch with Boston Bar Assn, Computer Law Committee. 13:00-18:00 Continuation of legislative/regulatory update with digital signature leg./reg. drafting committee representatives. 18:00-???? Watering hole discussions; possible continuation of work group meetings. October 19, 1996 Saturday 8:30-9:00 Breakfast, et cetera. 9:00-10:00 Presentation by Key Escrow work group. 10:00-12:00 Breakout sessions on work groups. 12:00-13:00 Working lunch and guest presentation on "Assuring Quality and the Accreditation of Certification Authorities" by invited representative of the Nat'l Inst. of Standards and Tech. 13:00-15:00 Presentations by Work Groups. 15:00-15:30 Path Forward; wrap-up. ISC MEETING DETAILS October 18-19, 1996 Members are urged to participate in one of the work groups that will be presenting/meeting during the ISC's meeting. "Addendum" Work Group Contact: Ruven Schwartz (rschwart(a)research.westlaw.com) Tom Smedinghoff (tsmed(a)mbc.com) Joe Wackerman (jwackerm(a)email.usps.gov) The Addendum Work Group will continue drafting a digital signature trading partner agreement -- integrating the principles of the Digital Signature Guidelines, and developing additional practical commentary for this model form of electronic commerce agreement. Evidentiary Work Group Contact: Stan Kurzban (qbjw99a(a)prodigy.com) or Serge Parisien (parisise(a)droit.umontreal.ca) The Evidentiary Work Group will complete and present a provisional outline for a tutorial on the evidentiary implications of digitally signed information and advance drafting of material for each section of the tutorial. Key Escrow Work Group (KEWG) Contact: Dwight Olson (73522.3542(a)compuserve.com) or Randy Sabett (rsabett(a)venable.com) The KEWG will focus on the legal and technical aspects of commercial key escrow. The group will seek to accurately explore all major issues surrounding this topic, and produce a set of draft guidelines for comment. The proposed guidelines are intended to facilitate secure electronic commerce by clarifying the rights and obligations of the parties involved in voluntary commercial key escrow. The work product may take one or more forms including: (i) a "restatement" of the relevant law and practice, (ii) a model state or federal law or international convention, (iii) a set of principles that can be incorporated by reference into agreements or used for the interpretation of legal aspects of voluntary key escrow, or (iv) a set of "gap filler" provisions. Liability Work Group Contact: Maureen Adamache (rmadama(a)magi.com) The liability work group will meet as necessary to discuss the apportionment of liabilities among PKI providers and users. Previously, this task was considered in the ISC's own work-product, the Digital Signature Guidelines. Future documents that will be considered include Certification Practice Statements, and digital signature legislative and regulatory work product. State Government Digital Signatures Laws & Regulations Contact: Dan Greenwood (DGreenwood(a)state.ma.us) The digital signature legislative and regulatory working group will compile, evaluate and compare the various emerging approaches by states and other jurisdictions. Work product will include a web-based comprehensive "one-stop shop" for jurisdictions wishing to review current approaches. First-time participants (who plan to attend the October 18-19, 1996 meeting) must request attendance and submit a brief work-product (typically 3-5 pages) relevant to the subject matter. Please contact Ruven Schwartz (v: 612.687.8095, f: 612.687.7907, or e: rschwart(a)research.westlaw.com) for details. Meeting Location: McCormack Building (Across Bowdoin Street from the State House) 1 Ashburton Place Room 1, 21st Floor Boston, Massachusetts USA (Contact: Dan Greenwood +1 617.973.0071) Meals: The cafeteria will be available for lunch on Friday for those ISC Members who choose to work through the joint lunch session. On Saturday we will probably order in pizza. Lodging: A very nearby hotel is the Holiday Inn, Government Center, 5 Blossom Street, Boston. The regular rate during our meeting dates is $219.95/night. However, the Reservation Supervisor (Kim) has offered a rate of $199.95 to Committee members who request the "Great Rate" plan. Call reservations at +1 617.742.7630. For a better (but more expensive) hotel near Government Center, try the Parker House at +1 617.227.8600. The Omni Parker House (nicer than Holiday Inn) quoted a rate of $169/night for a single with a king or queen bed and $119/night for a single with a double bed. The rooms are very small - but the hotel is nice. See also a Greater Boston Bed & Breakfast directory: http://www.inovatec.com/bb/resservc/GREATER/GREATER.htm. RSVP: Please confirm your intention to participate to Ann Kowalsky, Section Manager, Section of Science and Technology (sciencetech(a)attmail.com) as soon as possible. See you in Boston! =========================================================================== --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: unwanted mail..what can I do?
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-09-14 01:18:49 EDT, dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes: << AwakenToMe(a)aol.com writes: > I recieved mail from netfree.com.. > I tried mailing it back (it def. had a forged address, but I got the netfree > from the mail header.....) > So anyway..... I tried sending to root@netfree....my mail was rejected (not > unknown ...it was rejected by the system) said it wasnt authorized... so I > tried support@netfree...same thing. > It ISSSSS rather annoying...any sugestions? Yes, a bunch of them: 1. Get a life. Learn to delete unwanted e-mail. Get a real shell account. 2. Ask AOL to let its users decide what e-mail to reject automatically (like procmail). They've been promising this capability by the end of September. Then you can set up your account to get no more e-mail from netfree. >> Typical asshole response. I must thank chuck@nova..etc. for his TRULY helpful response. But you........get a real shell account?? I do thank you. netcom and a school system. I can delete unwanted mail. But maybe I LIKE to yell at people who spam me. And ive never received mail from netfree before..nor since... thats NOT my problem. Learn to comprehend what pthers write. I wanted to know what I can do about getting in coontact with them. It is in my opinion not right to forge email addresses...people dont do it when the send me us postal mail

1 0