December 2003 - cypherpunks-legacy

Internet plug pulled on Colombia's guerrillas
by Chris Adams 17 Dec '03

17 Dec '03

Internet plug pulled on Colombia's guerrillas 3:05pm EDT, 9/26/96 BOGOTA, Colombia - A Colombian guerrilla group currently involved in a bloody offensive in the mountains and jungles, suffered a setback in its propaganda battle when its new-tech voice on the Internet was mysteriously silenced. The Revolutionary Armed Forces of Colombia (FARC), which has periodically paralyzed half the country with road blocks, found its route to the information superhighway barred. The Communist insurgents, who rose up in arms in 1964, embraced new technology last year in their fight to overthrow the government by launching a home page on the Internet. But in unexplained circumstances, which a spokeswoman for the Mexico City-based Internet provider Teesnet said may or may not be linked to external pressures, the plug was pulled on the service Monday -- a day after being publicized in Colombia's leading daily, El Tiempo. The FARC's Mexico City-based international spokesman Marco LeDon CalarcDa admitted the loss of the Internet page was a serious reversal but vowed the computer-age conflict was far from over. "This is an attack on freedom of expression because we were not doing anything illegal. I cannot say exactly how it happened but the hand of the Colombian government is in this," he said. "The FARC is used to difficulties and this is just the latest challenge. One way or another we will get back on to the Internet." The Colombian guerrillas used their worldwide web site to publish their political magazine Resistencia, whose distribution is banned in Colombia, and to offer explanations about their latest armed actions. FARC, labeled narcoguerrillas since the 1980s when U.S. ambassador Lewis Tambs highlighted the group's alleged connections with Colombia's drugs trade, have been dubbed Cyberspace guerrillas since their appearance on the Internet. "Cyberspace guerrillas may seem a fun name but I think it is pejorative and belittles what we're doing," said LeDon CalarcDa. "We are looking to topple the government and set up a new Colombia. "Using weapons naturally comes within the logic of the armed struggle. Just fighting through the Internet would be like shooting rubber bullets. Not using it would be like continuing to fight the army with a 12-bore shotgun," he said. In the four weeks since the FARC unleashed its latest offensive with an attack on a jungle base in southern Putumayo province, more than 150 soldiers, police and civilians have died.

1 0

Re: ssh - How widely used?
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Black Unicorn <unicorn(a)schloss.li> writes: > Does anyone know if there are MS-Dos or Mac versions of the ssh client? There is no MS-DOS client. The authors claim that, "a Macintosh version is in the works, and first versions are expected to be available in August/September 1996." There are Windoze and OS/2 clients. > How much is ssh used? >From the FAQ: 6.2 How widespread is use of ssh? As with every piece of freely available software, this is difficult to find out. The best current estimates are that at least 1000 insitutions in 40 countries use it. This estimate is based on The number of people on the ssh mailing list, around 600, from 40 different countries and several hundred domains. Each week, the ssh home pages are accessed from roughly 5000 different machines, many of them web caches; also, these machines often are different from week to week. > I've not seen much discussion of it but poking around an ISP yielded this: > > Ssh (Secure Shell) a program for logging into a remote > machine and for executing commands in a remote machine. > It is intended to replace rlogin and rsh, and provide > secure encrypted communications between two untrusted > hosts over an insecure network. X11 connections and arbi- > trary TCP/IP ports can also be forwarded over the secure > channel. [ Snip ] > Looks like a nice little implementation. > > Comments anyone? For further information about it, see: http://www.cs.hut.fi/ssh/ There is also a mailing list. Subscription requests should be directed to majordomo(a)clinet.fi with "subscribe ssh" in the message body. I think that it's technically a great program. However, I have heard some pretty unpleasant stories about legal issues using it in a commercial environment. Dana W. Albrecht dwa(a)corsair.com

1 0

PGP interfaces for MS Internet Mail
by ! Drive 17 Dec '03

17 Dec '03

Does anyone know of any PGP programs that interface well with Microsofts Internet Mail (not Exchange mail) Thanks

1 0

Public domain SHA-1 in C
by Steve Reid 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've written an implementation of SHA-1 in C. Public domain, so you can hack it to your hearts content and/or use it however you want. You can download it from http://www.edmweb.com/steve/sha1.c It's not hard to use. Allocate a SHA1_CTX, initialize it with SHA1Init() run over the data with SHA1Update() and finally extract the result using SHA1Final(). Or just compile the program as-is and use it to hash files. It's reasonably fast (the 80 core SHA operations look good) but I'm certain that there's room for improvement. Tested under FreeBSD 2.1.0-RELEASE on an i486SX. The three test vectors from FIPS PUB 180-1 hash correctly. ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:) -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEVAwUBMksSsNtVWdufMXJpAQFV3AgApaK+upwWtBJZUwq5Pr4cpvjWQcxFHxv6 XEoZmwgwzR94lpjdEK5GPXt7U9HTp+xiwiaeQ7Hjg+iuR/qtofwZlZhQ5EmyBl2M 8rnFSRgwR4NH1y2PwAxQKSo2SaHU8JZ3X3D6Yk1WXAqk90vN8dzQAIa8B409IuhM tBPixrS6d0KsySSOHQkWO7Mqij43wZOnrgikJF3IDCvSf0us8gGC9wZjdIax3Rgr soswtQvT6QpZDZ/+39UiA2RSMFuER/S3NbZZSJdfIGK1XzUeU2MUC4NmURlc/ntz 3B1pd+jovxuHW1D/TQ2jHSIdg1Yol/zeu1OeuuhL37QOQAVkupgVUA== =B73M -----END PGP SIGNATURE-----

2 1

CWD -- Wiretap In the Night
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 26 Sep 1996 16:32:01 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: CWD -- Wiretap In the Night CyberWire Dispatch // September // Copyright (c) 1996 // Jacking in from the "Smoked Filled Room" Port: Washington, DC -- Federal provisions funding the digital telephony bill and roving wiretaps, surgically removed earlier this year from an anti-terrorism bill, have quietly been wedged into a $600 billion omnibus spending bill. The bill creates a Justice Department "telecommunications carrier compliance fund" to pay for the provisions called for in the digital telephony bill, formally known as the Communications Assistance in Law Enforcement Act (CALEA). In reality, this is a slush fund. Congress originally budgeted $500 million for CALEA, far short of the billions actually needed to build in instant wiretap capabilities into America's telephone, cable, cellular and PCS networks. This bill now approves a slush fund of pooled dollars from the budgets of "any agency" with "law enforcement, national security or intelligence responsibilities." That means the FBI, CIA, NSA and DEA, among others, will now have a vested interest in how the majority of your communications are tapped. The spending bill also provides for "multipoint wiretaps." This is the tricked up code phase for what amounts to roving wiretaps. Where the FBI can only tap one phone at a time in conjunction with an investigation, it now wants the ability to "follow" a conversation from phone to phone; meaning that if your neighbor is under investigation and happens to use your phone for some reason, your phone gets tapped. It also means that the FBI can tap public pay phones... think about that next time you call 1-800-COLLECT. In addition, all the public and congressional accountability provisions for how CALEA money was spent, which were in the original House version (H.R. 3814), got torpedoed in the Senate Appropriations Committee. Provisions stripped out by the Senate: -- GONE: Money isn't to be spent unless an implementation plan is sent to each member of the Judiciary Committee and Appropriations committees. -- GONE: Requirement that the FBI provide public details of how its new wiretap plan exceeds or differs from current capabilities. -- GONE: Report on the "actual and maximum number of simultaneous surveillance/intercepts" the FBI expects. The FBI ran into a fire storm earlier this year when it botched its long overdue report that said it wanted the capability to tap one out of every 100 phones *simultaneously*. Now, thanks to this funding bill, rather than having to defend that request, it doesn't have to say shit. -- GONE: Complete estimate of the full costs of deploying and developing the digital wiretapping plan. -- GONE: An annual report to Congress "specifically detailing" how all taxpayer money -- YOUR money -- is spent to carry out these new wiretap provisions. "No matter what side you come down on this (digital wiretapping) issue, the stakes for democracy are that we need to have public accountability," said Jerry Berman, executive director of the Center for Democracy and Technology. Although it appeared that no one in congress had the balls to take on the issue, one stalwart has stepped forward, Rep. Bob Barr (R-Ga.). He has succeeded in getting some of the accountability provisions back into the bill, according to a Barr staffer. But the fight couldn't have been an easy one. The FBI has worked congress relentlessly in an effort to skirt the original reporting and implementation requirements as outlined in CALEA. Further, Barr isn't exactly on the FBI's Christmas card list. Last year it was primarily Barr who scotched the funding for CALEA during the 104th Congress' first session. But Barr has won again. He has, with backing from the Senate, succeeded in *putting back* the requirement that the FBI must justify all CALEA expenditures to the Judiciary Committee. Further, the implementation plan, "though somewhat modified" will "still have some punch," Barr's staffer assured me. That includes making the FBI report on its expected capacities and capabilities for digital wiretapping. In other words, the FBI won't be able to "cook the books" on the wiretap figures in secret. Barr also was successful in making the Justice Department submit an annual report detailing its CALEA spending to Congress. However, the funding for digital wiretaps remains. Stuffing the funding measures into a huge omnibus spending bill almost certainly assures its passage. Congress is twitchy now, anxious to leave. They are chomping at the bit, sensing the end of the 104th Congress' tortured run as the legislative calender is due to run out sometime early next week. Then they will all literally race from Capitol Hill at the final gavel, heading for the parking lot, jumping in their cars like stock car drivers as they make a made dash for National Airport to return to their home districts in an effort to campaign for another term in the loopy world of national politics. Congress is "going to try to sneak this (spending bill) through the back door in the middle of the night," says Leslie Hagan, legislative director for the National Association of Criminal Defense Lawyers. She calls this a "worst case scenario" that is "particularly dangerous" because the "deliberative legislative process is short-circuited." Such matters as wiretapping deserve to be aired in the full sunlight of congressional hearings, not stuffed into an 11th hour spending bill. This is legislative cowardice. Sadly, it will most likely succeed. And through this all, the Net sits mute. Unlike a few months ago, on the shameful day the Net cried "wolf" over these same provisions, mindlessly flooding congressional switchboards and any Email box within keyboard reach, despite the fact that the funding provisions had been already been stripped from the anti-terrorism bill, there has been no hue-and-cry about these most recent moves. Yes, some groups, such as the ACLU, EPIC and the Center for Democracy and Technology have been working the congressional back channels, buzzing around the frenzied legislators like crazed gnats. But why haven't we heard about all this before now? Why has this bill come down to the wire without the now expected flurry of "alerts" "bulletins" and other assorted red-flag waving by our esteemed Net guardians? Barr's had his ass hanging in the wind, fighting FBI Director Louis "Teflon" Freeh; he could have used some political cover from the cyberspace community. Yet, if he'd gone to that digital well, he'd have found only the echo of his own voice. And while the efforts of Rep. Barr are encouraging, it's anything from a done deal. "As long as the door is cracked... there is room for mischief," said Barr's staffer. Meaning, until the bill is reported and voted on, some snapperhead congressman could fuck up the process yet again. We all caught a bit of a reprieve here, but I wouldn't sleep well. This community still has a lot to learn about the Washington boneyard. Personally, I'm a little tired of getting beat up at every turn. Muscle up, folks, the fight doesn't get any easier. Meeks out... ------------ Declan McCullagh <declan(a)well.com> contributed to this report. ###

1 0

Re: An idle thought on CBC and block lengths
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

Well I do believe that your spam would be illegal if that was the case. And secondly there are no laws here in australia that you can use to prosecute me from the US for an email bomb, not that this is one, and if it is than so is your spam. >> It is illegal to use a invalid return email address. If this continues, I >> will >> be forced to prosecute the return email address - which they are >> making to look like you. >Is it? I beleive that if you look closely, you will discover hat all the >laws which would have made lying illegal on the 'Net have now been >repealed by more Federal judges than I can count on 1 hand... ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

1 0

NIST conference
by P. J. Ponder 17 Dec '03

17 Dec '03

Following is an announcement about a NIST conference on leveraging the distributed nature of the Internet to accomplish tasks that might be otherwise not feasible. The abstract notes that this type of activity has 'important economic, social, and political consequences'. This may already be old news, I was off the list for the past few days. Date: Thu, 26 Sep 1996 15:18:08 -0400 From: Liz Lennon <elizabeth.lennon(a)NIST.GOV> Subject: Cyber Conference Announcement To: csl-bulletin(a)NIST.GOV >Return-Path: <moline(a)sst.ncsl.nist.gov> >Date: Thu, 26 Sep 1996 15:00:46 -0400 (EDT) >From: Judi Moline <moline(a)sst.ncsl.nist.gov> >Subject: Cyber Conference Announcement >To: elizabeth.lennon(a)NIST.GOV >Cc: moline(a)sst.ncsl.nist.gov > > >Event: Conference on Leveraging Cyberspace > >Date: October 8-9, 1996 > >Purpose: People with shared interests are using the Internet to >solve problems, accomplish tasks, and create resources that would be well >beyond the reach of any one person or organization. The ability to leverage >the efforts of large numbers of networked users has important economic, >social, and political consequences. This conference is designed to explore >this phenomenon from both a technical and social science perspective. >Additionally, the closing session of the conference will cap off several >weeks of virtual discussions on the conference's web site. > >Location: Xerox Palo Alto Research Center (PARC) > Palo Alto, Calif. > >Keynote by: John Seely Brown, Vice President and Chief Scientist, > Xerox > >Program: Web: http://nii.nist.gov/cyber/cyber_conf.html > >Registration: $200 > >Sponsors: White House National Economic Council > Commerce's National Institute of Standards and > Technology > Xerox Palo Alto Research Center > >Technical contact: Judi Moline, NIST > (301) 975-4601 > email: jmoline(a)nist.gov > >Information: Web: http://nii.nist.gov/cyber/cyber_conf.html > >To register: Print registration form from web site and return with > payment to: > Office of the Comptroller > NIST > A807 Administration Building > Gaithersburg, Md. 20899-0001 USA > > Or fax to: > Lori Phillips, NIST > fax: (301) 948-2067 > > Or: > Lori.Phillips(a)nist.gov > > >

1 0

Re: Hallam-Baker demands more repudiations or he'll write!
by jim bell 17 Dec '03

17 Dec '03

At 04:51 PM 9/26/96 -0700, Declan McCullagh wrote: >Anonymity and nonescrowed crypto are the linchpins of AP and its more >general case, Maysian crypto anarchy. The withering of the nation-state. >Whatever you want to call it. >To prevent it, governments will ban both. A criminal law, passed in the >wake of say a bombing this fall in Washington, DC, banning nonescrowed >crypto. (Freeh will assert he has evidence the terrorists used PGPhone.) >And another law banning online anonymity. >What then, Mr. Bell? While we should continue resist such developments, I (like many others) tend to believe that the government is going to have a great deal of difficulty implementing such restrictions, for reasons which have been discussed here ad nauseum. I happen to believe that the really crucial reason Clipper was proposed is so that it would exclude non-escrowed encryption using market forces, because they understood that banning encryption or non-escrowed encryption would be essentially impossible. Remember the VHS/Beta VCR wars? With a fairly equal market in about 1978, Beta died 10 years later because the market couldn't support two incompatible standards. It wasn't that one was dramatically better than the other, it was simply that having two standards forced the market to duplicate stocks, for the machines as well as tapes, particularly pre-recorded tapes. Notice, however, that VCR's are relatively "isolated": It doesn't really matter if you have one format and your neighbor has another, unless you want to swap tapes. But crypto telephones inherently require (in the long term) full intercompability. If you didn't have that, there'd be half a world of people you couldn't call! (This kind of situation is remeniscent of a recollection my mother has of a small town she grew up in, in which there were two competing telephone companies serving the same area, but customers of company "A" couldn't call company "B." The most popular girl in town was the daughter of a doctor, who as a consequence of his profession had telephones from both companies. That girl was constantly being called to relay information between people on opposite telephone companies!) The government understood this, and realized that the best way to derail the advent of a good crypto telephone standard was to produce one of their own, which they figured would pre-empt and kill off any competing system. It turns out that an essential element to this killing-off process is to ensure that the telephones aren't compatible, so I was a bit surprised to have to wait a long time to hear that one of the requirements for Clipper-phone approval is that they NOT co-operate with non-escrowed telephones. (I was surprised to have to WAIT to hear this, NOT that they said it eventually...) I think they realize that Clipper was their last opportunity to implement a de-facto market ban on good encryption, but it isn't working. As for a ban on anonymity I don't think that'll fly either. There are too many interactions we do today (off the 'net as well as on) which are already anonymous, even if we don't normally think of it that way. Visit a theater, pay cash, and nobody records your name, for instance. Buy groceries, pay cash. Throw coins in toll booth. Put coins in Coke machine, ride on bus, etc. It would be very hard to prohibit non-anonymous interactions on the net, with so many opportunities for unrestricted anonymity. There's even less reason to ID non-economic transactions too. Since most interactions on the 'net are not a financial transaction, there is even less reason to identify the people involved. So at the risk of being overly optimistic, I think the government isn't going to be able to pull off the kind of anti-crypto/anti-anonymity coup you describe. But nevertheless, I think that if they "progress" towards that goal against the odds, that could easily be an excellent justification for actions which you know they'll describe as "terrorism." Jim Bell jimbell(a)pacifier.com

2 1

NISSC
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The National Information Systems Security Conference in Baltimore on October 22-25 is bountifully described at: http://csrc.nist.gov/nissc/program Section No. 10, Solutions, will interest those who want a peek at what the Puzzle Palace gang is up to. The other nine sessions cover everything the info-sec gov-biz wants to do to make the infoworld safe from everyone except them.

1 0

Re: CWD--Wiretap In the Night
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Adding to the CWD wiretap alarm by Brock and Declan: The Washington Post, September 26, 1996, p. A30. Wiretaps and Money Bills [Editorial] Legislators who have pet projects but not enough support to get them passed have a way of turning desperate during the closing days of the congressional session. Their thoughts turn ineluctably to unrelated appropriations bills. Only last week, Rep. Frank Wolf used the transportation funding bill as a vehicle for usurping the courts' role in a specific domestic relations dispute. Now senators working on the Commerce, State and Justice appropriations bill have slipped in provisions relating to wiretaps that have been before the Congress for 18 months but have not been adopted. The law should not be changed by means of these stealthy riders. One of the substantive changes in the criminal laws ordered by the money committee, for example, would make it easier to obtain court orders authorizing "roving" wiretaps. This would permit putting taps on any phone a suspect might use -- including unspecified public phones -- without requiring, as the law now does, that the government show that the suspect is attempting to thwart a home or office tap by repeatedly changing phones. This may or may not be reasonable, but Congress considered and rejected it earlier this year. It shouldn't be shoved through on an appropriations bill. The committee bill also increased the number of crimes for which a wiretap can be issued, adding a list of new, relatively imprecise offenses related to terrorism such as "providing material support to terrorists" and "terrorist acts transcending national borders." Taps already are allowed for just about every major crime in which a terrorist might engage, including bombing, arson, murder, kidnapping, extortion, espionage, sabotage, treason, hostage-taking and the destruction of trains ships, aircraft and aircraft facilities. What, then, is the reason for adding these new elastic terms, which could include far less serious offenses that someone thinks might be linked to terrorism? The committees that dealt with the subject in April did not see fit to do so. Why now has the Appropriations Committee intervened? The competing values of security and privacy rights require a much better sorting out. It's best done by people who have had the benefit of relevant testimony and experience. The appropriations committees are the wrong setting to deal with such questions, which should not be presented in a take-it-or-leave-it package with the government's continued operation at stake. [End]

1 0