December 2003 - cypherpunks-legacy

Re: Recent Web site cracks
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

but even after you get through the firewall, you still need to crack the web host. i suppose that anyone that would leave their firewall open would not have very good security on their hosts either. -paul > From cypherpunks-errors(a)toad.com Wed Oct 9 07:02:07 1996 > To: cypherpunks(a)toad.com > Subject: Re: Recent Web site cracks > From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > Comments: Dole/Kemp '96! > Date: Tue, 08 Oct 96 16:53:43 EDT > Organization: Brighton Beach Boardwalk BBS, Forest Hills, N.Y. > Sender: owner-cypherpunks(a)toad.com > Content-Length: 307 > > stewarts(a)ix.netcom.com writes: > > The DOJ and CIA sites were actually cracked; don't know the mechanisms. > > They used firewalls that are known to be easily crackable. > > --- > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps >

1 0

Re: Microsoft CAPI
by Peter Trei 17 Dec '03

17 Dec '03

> Ravi Pandya wrote: > > ... You can't load an encryption engine into Windows 95 or > > Windows NT unless that engine has been specially signed by > > Microsoft's corporate key. > > And so what happens when the Microsoft key is compromised? It might > be hard to break by purely cryptographic means, but surely there are > some people at Microsoft who aren't millionaires. Much easier would be to patch the OS to disable the signature check by the CryptoAPI. A patching program, once written, would require no particular skill to run. Sort of like 'rechipping' a high-end sportscar. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

RE: "Soul Catcher" Computer Chip (fwd)
by Alex Filacchione 17 Dec '03

17 Dec '03

QUOTE SOUL CATCHER IMPLANTS British scientists are developing a concept for a computer chip which, when implanted into the skull behind the eye, will be able to record a person's every life time thought ands sensation. =-=-=-=-=-=- Hahaha! That's a good one. Maybe these guys should share some of their findings w/ the worlds leading neurologists, since they seem to know so much. "Every lifetime thought"?????? Even one thought. Hmmm, perhaps they would care to explain human emotions in scientific terms, fully explained, no vagueness allowed? Care to share "translation tables" for neuro-electric impulses that show signature of certain emotions? This is just so ridiculous. I would just like to ask them one question. "How?" Record what someone sees? Maybe.... Alex F alexf(a)iss.net

3 2

Jewell shows warrants are frauds
by jim bell 17 Dec '03

17 Dec '03

There was yet another item on Richard Jewell today on the national news. If our goal is to return this country to allowing the government to do only the "reasonable" searches that the Constitution allows, we shouldn't miss the opportunity to take the Jewell case and shove it up their...well...use it to our best advantage. The _theory_ is that the only way the government could have gotten a warrant against Richard Jewell ONLY by showing some likelihood that evidence of the crime would be found. The facts, the end result is quite the opposite; the FBI has had a full opportunity to do their investigation and they've found...nothing. Or, at least nothing they're now willing to leak. Nothing, certainly, which they feel justifies filing charges. So they're probably going to just drop the investigation of Jewell. But at this point, we should consider that practically an engraved invitation: The theory behind ALL warrants is that they are granted only upon a showing to a judge of a legally satisfactory reason to grant the warrant. Given the outcome, it is almost certain that no such showing ever occurred. What happened, on the other hand, was probably just another fraud. Some prosecutor or investigator did some magic dance in front of a judge, pretending to tell the truth, and the judge pretended to believe him. The difference with this case, however, is that a few hundred million people heard about it. That's why this case, unlike nearly all others, presents a marvelous opportunity. All of the various Clipper/GAK proposals are based, ultimately, on the same weakness: The idea that we, the people should be able to trust some overpaid government-thug-sympathizer in a black robe to decide whether or not a given set of evidence is sufficient to decide to grant a warrant. Perhaps the best challenge to this idea is to show a clear example of how the system fails, precisely when it's expected to WORK! The Jewell incident is a good test-case, if for no other reason that it was highly publicized and many if not most people know the basics. In addition, unlike a case which was thought insignificant before and only later became well-known, all of the officials who had anything to do with it were, presumably, fully aware how important it was and could be expected to be "on their toes" about ensuring that they do their jobs correctly. Quite simply, the authorities had every reason to get this one RIGHT, as opposed to getting it wrong. They got it wrong. We should insist that the details of this disaster be exposed to show them for the lying frauds they are. Jim Bell jimbell(a)pacifier.com

1 0

Have you had your privacy invaded? Be on Oprah!!!
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 8 Oct 1996 15:02:14 -0500 From: marsha-w(a)uiuc.edu (Marsha Woodbury) Subject: Have you had your privacy invaded? Hi-- I am looking for someone who lost a feeling of privacy-- I need a "victim" to tell a story about how he or she had her privacy invaded and how he/she felt about it. The Oprah Show is looking for a real-life example of someone whose name got on a strange list, or whose unlisted phone number was given out, or whose medical records were made known to insurance companies--anything like that. The show is next Wed. and they will pay to get you there if you have a good story to tell (and it had better be a true story!!) Call Dana Newton of the Show if you have story to tell... 312-633-0808 Thanks! Marsha Woodbury, Ph.D. Director of Information Technology Graduate School of Library and Information Science UIUC Chair, CPSR http://alexia.lis.uiuc.edu/~woodbury/ Work: 217- 244-4643 FAX: 217- 244-3302 marsha-w(a)uiuc.edu CPSR's Annual Meeting and Conference, "Communications Unleashed" will be held Oct 19-20 at Georgetown University in Washington DC. For information or to register, see http://www.cpsr.org or e-mail cpsrannmtg(a)cpsr.org

1 0

BBS generator
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Does anyone here know the approximate ammount of output from a BBS PRNG needed to predict with some certainty the next bit or bits? - is the generator totally secure, ie. do you need to factor to predict or is there an attack using the output? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Govt wants to read your e-mail
by Christian Claborne 17 Dec '03

17 Dec '03

In case you haven't heard.... "AN ALLIANCE OF 11 SOFTWARE AND HARDWARE COMPANIES HAS JUST ANNOUNCED ITS FORMATION TO DEVELOP KEY-RECOVERY SOLUTIONS FOR ELECTRONIC ENCRYPTION, a crucial component of the Clinton administration's latest plan to loosen the export of encryption technology. Announced yesterday, the administration's plan gives exporters of encryption or encrypted software a two- year window starting Jan. 1, 1997, to build what the administration calls 'key recovery' into their products. [The alliance will] develop systems that will give the [U.S.] government what it wants, which is access to suspicious encrypted messages, so that compliant software companies will be able to get export licenses for hard-to-crack encryption codes. . . . " 'The fact that 56-bit DES [a type of encryption] will be available from significant sources is going to jump-start electronic commerce,' said Ken Kay, executive director of the Computer Systems Policy Project, a public policy group comprised of 12 computer industry CEOs. . . . While Gore directly stated yesterday that domestic use of encryption will remain unregulated, the double standard for domestic and international products might discourage U.S. companies from developing two different versions, leaving U.S. and Canadian customers with the same products that the federal government has deemed safe to ship overseas." ["C/Net" Oct. 2; also covered by "Reuter" and "Dow Jones"] ... __o .. -\<, Claborne(a)CYBERTHOUGHT.com ...(*)/(*)._ Providing thoughts on your computing needs. http://www.CYBERTHOUGHT.com/cyberthought/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

2 1

Re: Creative Wiretap Arguments [Was :Re: Put up or shut up]
by jim bell 17 Dec '03

17 Dec '03

At 01:37 AM 10/9/96 -0400, Black Unicorn wrote: >On Tue, 8 Oct 1996, jim bell wrote: >> Maybe you're missing the point? Even if you accept the idea of wiretapping >> telephone lines, one of the things that _isn't_ settled is how law is going >> to start treating ISP's. That, let me point out, IS NOT settled law, and in >> fact it hasn't really even started, so those lawyers who have a knee-jerk >> tendency to accept precedent don't have any precedent to accept! (unless, >> of course, they "pre-accept" the assumption that what the government can do >> WRT ISP's is somehow identical to what they do with telephones.) > >I disagree. There is lots of potential precident. The entire concept >that data voluntarily turned over to a 3rd party is not entitled to 4th >amendment protection (i.e., pen registers) is just the one that happens to >jump to mind. Given that the "constitutionality" of pen registers is pretty intimately tied up with the ADMITTEDLY illegal usage of wiretaps before 1968, that hardly qualifies as a settled issue. (I say this from the standpoint of "what really oughtta be" rather than "what those nine morons will accept.") BTW, it is unclear why this argument ("data voluntarily turned over to a 3rd party") couldn't "automatically" be applied to telephone audio itself. After all, in order to get the audio to the other end, you have to convert it into varying electical signals, which are "turned over to a 3rd party", the telephone company. The distinction between these two forms of information is pretty flimsy. (Chances are excellent that the only reason for any distinction between them at all originated back before 1968, when wiretaps themselves were considered illegal, and the cops wanted to be able to justify what they probably called a "minimal" violation of privacy short of being able to hear the audio itself. Now that the wiretaps themselves are called "legal" I suspect that the cops will have reverted to the assertion that this information is essentially identical from a warrant standpoint.) Another possibility is that this is simply a holdover from the time when automated switching of telephone lines was essentially unknown: To make a telephone call, you "had to" tell the operator the number you were calling, and thus presumably you'd "voluntarily" turned it over. However, that presumption evaporated once automated switching took over, and there's no requirement that the telephone switch makes a permanent record of any given phone call. "Naturally," the cops would have argued that the advance of technology (automatic switching) would "make futile law-enforcement access" (much as they are now claiming the advance of encryption will do) and would have argued that the new technology shouldn't prevent them from knowing who is making phone calls to whom. Isn't it interesting that when an advance in technology allows the cops to do something they hadn't been able to do before, they accept it as if it's a done deal, whereas when technology starts taking away an ability they howl "like a stuck pig." Sounds pretty selfish to me. > The fact that the government has had to deal with >the breakup of ma bell and cooperate with several different phone >companies now suggests to me that not much of a leap is required to >include ISPs. Constitutional arguments that ISPs are somehow different >from phone companies and therefore not required to comply with wiretap >orders? Good luck. All of which are still monopolies, at least in their defined areas of business. And customers have no choice of who to deal with, as a result. Thus, phone companies never had any motivation to satisfy their customers by fighting wiretap warrants in court. Etc. ISP's are not monopolies, they are not common carriers, etc. ISP's, quite simply, are entitled to write their OWN rules about how they deal with customers. One the whole, I'd say there are plenty of differences between a plain-vanilla telephone company and an ISP. >I know its fun to make the argument that ISPs and E-mail and NetPhone are >all new technologies and so it must be unconstitutional to regulate them >but the amusement in these cases stems from a wish that it was so, not >fact or reason. I didn't mention, "unconstitutional"; it's possible that it's simply "illegal", as in, "there's no law yet which allows "ISP-tapping." In the same sense as wiretapping was illegal before 1968. BTW, I'm not saying that "normal" wiretapping can't be done on an ISP. In other words, arguendo the cops would only be entitled to connect to the phone line(s), as in an ordinary wiretap. But that might be pretty damn ineffective, given that even a typical small ISP probably has a hundred or more phone lines to monitor. In other words, there's no single point where the cops can clip on the clip leads and get the data they want. Which raises the issue, "Is the ISP required to install 'wiretap-friendly' capability?" Apparently not, if the cellular phone industry is any precedent: For awhile, cops couldn't easily tap cell phones because no such capability had been designed into the cell-site software. Such an omission was not considered a violation of law. >> I contend that an ISP should be entitled to enter into a contract with his >> customers in a way which obligates him to structure his business to minimize >> his ability to cooperate with police when given a search warrant. > >"I content that a phone company should be entitled to enter into a >contract with his customers in a way which obligates him to structure his >business to minimize his ability to cooperate with police when given a >search warrant." Yeah. Good luck. It looks like you're not very perceptive. Notice I said "minimize his ability to cooperate." As far as I'm aware, telephone companies are not required to keep many of the records they currently keep. If they contract with a customer to not keep those records, the inability of the cops to get those records is not any sort of violation of law. Jim Bell jimbell(a)pacifier.com

2 1

Tim May is a fine person.
by anonymous＠miron.vip.best.com 17 Dec '03

17 Dec '03

Tim May is a fine person. You people should not be sending out some many negative vibes. We all owe Tim a gread debt for his help an advancing cryptography.

4 3

Not content with the CDA, Sen. Exon derails Pro-CODE
by declan＠well.com 17 Dec '03

17 Dec '03

********* Date: Tue, 8 Oct 1996 17:54:52 -0500 To: fight-censorship-announce(a)vorlon.mit.edu From: declan(a)well.com (Declan McCullagh) Subject: Not content with the CDA, Sen. Exon derails Pro-CODE When the White House wanted to derail pro-encryption legislation, they knew where to turn: to the infamous author of the even more infamous Communications Decency Act. Last month Sen. Jim Exon (D-Nebraska) wrote the attached letter to Sen. Pressler, chair of the commerce committee, days before the ProCODE pro-crypto bill would have cleared its last hurdle in committee then moved to the floor of the Senate for a vote. Because of Exon's threatened "several amendments" that would defang the bill, the markup never happened. Thanks to Exon, it didn't have a chance. But don't blame the retiring senator from Nebraska. Not only are your electrons wasted, he's not the true culprit. It was the White House, in thrall to the Justice Department: Gore advisor Greg Simon made the calls to Exon's office that prompted this letter to Pressler. -Declan http://fight-censorship.dementia.org/top/ Background: http://www.hotwired.com/muckraker/96/36/index4a.html ****** September 9, 1996 The Honorable Larry Pressler Chairman Senate Commerce, Science and Transportation Committee 243 Russell Senate Office Building United States Senate Washington, DC 20510 Dear Senator Pressler: I understand that the Senate Commerce Committee may have a markup this week to consider the so-called Pro-CODE computer encryption bill. As you know, the computer industry has had a series of high-level discussions with the President, Vice President, and the government's national security experts. I am hopeful that these discussions will produce substantial and meaningful reform in the current export regime for encryption software. Given the national security and law enforcement implications of the proposed legislation, to rush into a mark-up before these concerns are resolved would be a mistake. If the measure is taken up on Thursday, I would expect that there would be several amendments. With best wishes, Sincerely, Jim Exon United States Senator cc The Honorable Fritz Hollings ###

1 0