December 2003 - cypherpunks-legacy

Re: Information [for new PGP user]
by Dale Thorn 17 Dec '03

17 Dec '03

Adamsc wrote: > On Thu, 07 Nov 1996 07:08:52 -0800, Dale Thorn wrote: > >> >> > I'm a new Cyberpunk! > >> Probably wearing a set of Ono-Sendai eyeballs.... > >> >> > Last, I would like to know once and for all, is PGP compromised, is > >> >> > there a back door, and have we been fooled by NSA to believe it's secure? > >> You can read and compile the source code yourself. > >Really? All 60,000 or so lines, including all 'includes' or attachments? > >I'll bet you can't find 10 out of 1,000 users who have read the total source, > >let alone comprehended and validated it. > That's not necessary - it's the fact that it's possible that matters; most > of us are content to trust the various people who actually have. However, > I'd probably be inclined to look into it seriously if I was going to use it > on anything incriminating or potentially linked to my checkbook... My main point, which is really difficult to make, since software issues are so complex today, is that I've been involved with projects on a similar scale as PGP, where several programmers contributed code to a particular executable program, and when this is the case (especially where the source is not obvious as would be data entry code and the like), it's just not practical for one person working alone, unpaid, to break the source down into manageable chunks and study it and make enough notes so that every portion of it is clearly understood and validated. People in the past have discussed 50 million line Fortran programs to set up jet training simulators and so forth, and by comparison a 60,000 line source in 'C' might look doable, as far as complete annotation is concerned. To illustrate the point, then, I recently had a chance to estimate the cost of converting a non-'C' program to 'C', which would result in a 'C' program of about 6,000 lines, or about 1/10 the size of PGP. My best guess was about 500 to 1,000 hours, and to analogize that to PGP, where I wouldn't be writing or converting code ostensibly, just annotating it, I would still guess 2,500 to 5,000 hours, if the job were done correctly and thoroughly. If the job is not practical/feasible, then IMO I can say it's not doable. OTOH, if some one or a handful of people wanted to make the source code of PGP really accessible to the masses (of programmers at least), they should start with a plan to make sure it's broken down into a heirarchy of functions so that: 1. No one function is too large (say, no more than 50 lines or so). 2. All functions use reasonably short variable names (ex: 'iTrapon'). 3. Variable names are consistent in capitalization. 4. Function names follow the heirarchy and are logically intuitive. 5. Constant and #define names follow a heirarchy as well. 6. Where a choice is possible between setting out a construct that (visually speaking) looks very complex and is difficult to follow, and making it simpler, take the simpler path.

1 0

Proxies
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

Is there a list of http proxy servers one could go through? I think its a nice [rather sutle] way of achieving web.anonymity without using more apparent anonymizers.... Vipul -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2233328 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

Re: ideal secure personal computer system
by Joel McNamara 17 Dec '03

17 Dec '03

See the CryptoBook link at http://www.eskimo.com/~joelm While the concepts were originally developed for a laptop, they're easily applied to a desktop machine running Win95. Joel >Here's a question: if one were designing for oneself a secure personal >computer system, for use in, say, word processing, spreadsheet, >communications, the usuals - what system would one purchase and how would >one set it up? > >For example, on the Mac I would envision this as the ideal system: > >(1) Get a power mac >(2) Partition the hard drive into two partitions: > install the system folder on one and a copy of CryptDisk > make this the startup partition and make it READ ONLY with aliases to > folders you want to be modiyfable (such as Eudora Folder in the sys folder) > place these folders on the encrypted partition >(3) Completely fill the other partition with a CryptDisk file so there is no > room for other stuff to be written. Adjust the partition size if needed. >(4) Install a screen saver (such as shareware Eclipse) that will password lock > the screen after a few minutes of inactivity, and set CryptDisk to dismount > the external partition after a few minutes of inactivity (or longer) > >This would be a basic setup. If one had more complex ideas, such as setting >it up so casual onlookers would not notice the system was protected, you >could do things like have a decoy normal partition with system folder to >boot from by default, to be bypassed with an external locked system folder >disk, after which one could dismount the decoy partition and mount the >encrypted partition. > >If locking the startup volume turns out to be too much of a pain, one could >install trashguard from Highware software and set it to triple overwrite >deleted files, and otherwise not lock the startup partition. > >How would things work on Windows 95? I imagine most of the old DOS-based >encryption utilities may have compatibility problems with W95. What would a >similar ideal system be for a PC? > >Tom > > > >

2 1

Re: a retort + a comment + a question = [RANT]
by John Young 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: A brilliant mini essay, which most succinctly answers Samuel P. Huntington's long essay in November Foreign Affairs. And recaps the ancient struggle between "public-governmental" in the "public interest" and "private-anti-governmental" in the "private interest." Those who argue that the public needs protection from internal and external enemies -- "national security" -- gloss over that this ideology has a long heritage as a big-time, self-interested business, or racketeer influenced organized crime, to be blunt. Colin Powellism breast-fed on Fight the Day's Devil milk, like two thousand generations of fundamentalist up-and-comers. For governmental and military and priestly careerism is no different that the profit or organizational kinds. Each have religio-philosophical underpinnings backed by shrewd legislative pie-slicing-and-distribution with crucial physical enforcement to fend off those who didn't get a slice and are hungrily pissed at the collusive exclusion. A lot of this smoke is PR machines blowing hard for each of the Big Bands: Gov, Mil, Com, Org, Edu, Etc. Blurring the distinctions, stealing from one another, swapping personnel and programs, doling out contracts, racing to copy the latest ploy, apology, attack, whine, while securing those ancient by-the-rule perks against the ruthless up-and-comers. Mafia, military, crypto shooters -- taking orders for small kisses of blessing/death, climbing the ladder of earthly reward. Still, global anarcho-bands of mercenary bandits, hmm, what's that 411 for International Terrorist Gun Show -- er, military-industrial showcases of megadeath?

1 0

Cypherpunks, Inc?
by azur＠netcom.com 17 Dec '03

17 Dec '03

Now why don't the cypherpunks put together something like the item below? In fact, why don't we form some sort of Guild, trademark the term cypherpunks (I'll volunteer) and offer cracking and security products (like the one below) or services? A product security endorsement from Cypherpunks Inc. could carry a lot of weight :-) >From: security.admin77(a)safest.you >To: >Date: Sun, 10 Nov 1996 10:43:01 PST >Subject: Your Email Privacy Has Been Compromised > > > > >This Message Contains Important Information About Violations >of Your On-Line Privacy. > > > >*Email and Online Security Violations.* >Please be advised that information contained in email is similar >to a post card. It can easily be read in transit and does not go >directly from your computer, to the computer of the recipient. >Your message often passes through the hands of countless >computer systems on its path to where you sent it. Because of >this, it can easily be seen by many prying eyes on the way to its >destination. If you are mailing personal, business or financial >data it is unwise to use traditional email. There are many people >on the net who profit by snooping in the open "post card" style >email that most account holders utilize. Programs are readily >available to make this task simple. Additionally, many people >are purchasing mailing lists which contain your email address. >If you do not wish to receive unsolicited email, there are a >number of free and highly effective steps you can take to >recapture your privacy. > >The personal exposure spoken of is not limited to email. If you >make use of other internet services such as the World Wide >Web, your privacy is at even greater risk. Unless secure, any >information you enter on a form can be read in transit, just like >email. Additionally, most of the information providers you contact >on the web routinely collect information about you in high detail. >This information goes right down to where you are located, and >what kind of computer and operating system you use! > >To combat this problem, many countermeasures have been >developed of which most account holders remain unaware. The >on line criminals would like to keep it that way. Every net citizen >needs to learn to stop sending "Post Cards" and stop allowing >distant machines to accumulate large amounts of information >about who they are and their interests. > >There are many simple things you should be doing right now to >protect your privacy. Most of the best countermeasures available >are FREE. This is because there is still a very strong vein of >computer experts on the net who believe in an individual's right to >privacy. There are excellent, completely free programs that you >should be using right now to browse the web in an untraceable >and private manner, and send email that only the recipient can >read! > >You don't need to be a computer expert to use these tools. They >often take little or no additional time and are designed to be very >simple for the computer illiterate to use. The computer gurus >that designed these programs know that it is extremely important >that average net citizens make use of them. They have designed >and continually revised them with that in mind. > >My name is Jeff Martin, my associates and I have spent a great >deal of time researching this subject. It is my goal to provide you >with access to the best resources available to keep your >communications private. My information relates to both email >and other aspects of the internet such as the World Wide Web. >This information was put together because I don't feel that others >are making it available in this form of wide distribution, and it >needs to be done. The internet is just like a city in that you need >some street smarts to keep yourself as safe as possible. That's >the kind of information I wish would have been provided to me >when I began to go on line, and it is what I have tried hard to put >together to help you out. > >In my program you'll learn: > >*How to send email that cannot be traced. > >*How to send email to your friends and associates that cannot >be read in transit. > >*How to post anonymously to Newsgroups. > >*How to browse the web and download files anonymously. > >*Why you should (almost) never send financial information over >the net. > >*How to prevent your name from being gathered and sold for >bulk email use. > >*And Much, Much, Much, More .... > >My package is a treasure trove of valuable information collected >to guarantee your privacy! > >This is the first time I am making this information available. In a >short while, the program will be retailing for $59.95. However, if >you respond within the next 7 days of receiving this message you >will receive the special price of $19.95. Because of the amazing >expansion of the internet, I have decided to make this offer so >that everyone can afford to learn how to protect themselves from >the net's growing criminal element. After seven days you may >still order the program at its retail price of $59.95. > >Additionally, if you order within the next 48 hours, I'll include a >very special report about how you can get a free email address >and account to use from just about anywhere in the U.S. I'll >show you how, but you must order within the next 48 hours! > >HOW TO ORDER >I strive very hard to protect your security. I do not accept >unsecure credit card or check information by email, because it is >too easily intercepted. While this could increase my orders, I feel >that your security as a customer is more important. I am a small >business person and keeping up with phoned and faxed in orders >has proven to be too difficult for me. Therefore I now only accept >orders via postal (snail) mail. Please be certain to give me your >email address when ordering. I prefer to ship orders via email >so that you can have my information as soon as possible. > >To order send a check, money order, or credit card information >(Visa, MasterCard, Discover) to me at: > >Jeff Martin >POB 72106 >Newport, Kentucky 41072 > >Any credit card orders must use the attached form below. >Thank you very much for your time. > >Best Wishes, > >Jeff Martin > > >This information will always be held in the strictest confidence. > > Credit Card: Visa Mastercard Discover > > Card #:______________________________________ > > Expiration Date:__________________ > > Name on Card:________________________________ > > Please indicate amount $__________ ($19.95) or (59.95) > > > SIGNATURE:x________________________ > >DATE:x__________________ > > >Copyright 1996, Jeff Martin. All rights reserved.

1 0

Rarity: Crypto question enclosed
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Nov 10 15:03:35 1996 Sorry that this message doesn't include any flames, "outings", denigrations, or other stuff...... My simple question is regarding key/certificate distribution: Is there any particular reason that such can't be accomplished via on-line lists, and made available via a service on a port, using standard (textual) commands, like mail and such are now? The things that come to mind are a 'client' request for a key, a 'client' submission of a key, an external host requesting a key exchange, and the host itself requesting a key exchange with another system (only new/changed keys being swapped). The way I see it working is similar to (but not as slow as, or requiring the human intervention) of the key servers already existing. Granted that the first few such servers might carry a higher load, but I'd think that would taper off as the (presumably free) software became available, similar to the growth of remailer software (which would seem to be a fairly reasonable relationship....). Hooks into existing PGP-fluent software shouldn't be difficult with a standardized protocol, and I wouldn't think that the servers would be that difficult to code and implement on a 'standard' (consistently used, that is) port. I'm willing to have a try at the first server, if the parameters can be defined. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMoV+S8VrTvyYOzAZAQHlMQP/eU3F2JyaQcU6tQ+J5iCdAdPKiBNORJGT chgNauyaH/dHwj+DzcKZzhmjabsICGZjPbJvH+DIvnbGx3eGF1Y2HUAHvt5ab4ww gfPJ7xfjwNUJPyrTQtp7lXVdB5BVfSw/I2lHzSg1ssRvTo4iF+gIoAQypOT1Z617 Fo/c1h77KgA= =pkk/ -----END PGP SIGNATURE-----

3 2

Re: Another possible remailer attack?
by Steve Reid 17 Dec '03

17 Dec '03

>> You want to know if Dimitri is the person regularly posting these >> messages. So, you use your powers as ISP to block his access to all >> remailers. If the public messages suddenly stop then you can be >> reasonably certain that Dimitri was sending them. > I'm not following something...just how to your "powers as ISP" affect a > remailer in, say, Holland, or one for that matter on another ISP? (As a Packet filtering at the ISP's router. If Dimitri can't connect to a remailer, he can't send anonymous messages. Sure there are a lot of hacks that could be done (like have sendmail on another system send it to a remailer) but such things could be detected and blocked by clever filters. In fact, the ISP could just claim to be "going down for maintenance" and completely block Dimitri from the internet for a while. > Just as the Nazis could isolate spy transmitters by selectively > turning off electricity to different neigborhoods, so, too, can various Isolating spy transmitters by selectively cutting power is exactly alalogous to what I have suggested.

1 0

[IGNORE unless your name is Sandfort]
by Black Unicorn 17 Dec '03

17 Dec '03

Mail to you currently bounces. Is an alternative address available? -- Forward complaints to : European Association of Envelope Manufactures Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern Vote Monarchist Switzerland

1 0

RE: Pyramid Schemes
by John Fricker 17 Dec '03

17 Dec '03

Pyramid schemes invalidate the worth of one's word. By gaining financially from one's recommendation said recommendation becomes of dubious trustworthiness. Traditionally, personal experience and anecdotes about products, goods and services have served as reputable guides in consumer culture. By gaining financially from one's word, one is cashing in their reputation. --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

Scientists for Labour conf on encryption/escrow/data protection Nov 14th
by Caspar Bowden 17 Dec '03

17 Dec '03

Full details: http://www.shef.ac.uk/~sfl/meetings/itconf.html PLEASE DISTRIBUTE AND LINK TO YOUR WEB-SITE: Scientists for Labour - IT & Communications Group Conference on Information Superhighway Policy --------------------------------------------------------------------- "Liberty on the Line : Opportunities and Dangers of the Superhighway" --------------------------------------------------------------------- Chaired by Geoff Hoon MP, Shadow Minister for IT Thursday 14th November 1996, 9am - 5:30pm MSF Centre, 33-37 Moreland Street, London EC1 (Angel tube) --------------------------------------------------------------------- For further details or to reserve a place contact: Caspar Bowden, SfL IT & Comms co-ordinator (qualia(a)dircon.co.uk) The debate over Internet regulation in the UK has focused mainly on censorship, but the standards for control of "encryption keys", currently being formulated nationally and internationally, will lay the permanent foundations on which the Information Society is built. The long-term implications for civil liberties have received little public attention outside the Internet community. Scientists for Labour is hosting a conference to look at the data protection and economic issues arising from the integration of digital signatures, electronic copyright management, and digital cash. What kind of regulatory apparatus will allow rapid growth of an information economy, but prevent misuse of personal data ? *) New government proposals on "Trusted Third Parties", which aim to preserve law enforcement and national security capabilities for warranted interception of communications (to fight crime and terrorism), place only procedural not technical limits on the scope of Superhighway surveillance. *) Super-computers have the potential to conduct random electronic "fishing expeditions" against the whole population. Telephone and letter interception cannot be automated : digital monitoring can. Will legal safeguards against abuse offer adequate protection in perpetuity, or can cryptographic protocols be designed which make Superhighway mass- surveillance impossible, while still allowing criminals to be targeted ? Computer and legal policy experts will explain the principles of the different technologies, and the international and commercial context, in a search for interdisciplinary solutions. The attendance fee is ?5 (?2 unwaged ; SfL members free) For press information please contact : Bobbie Nicholls, SfL Press Officer, Fax: 01235 529172 The Scientists for Labour home page (http://www.shef.ac.uk/~sfl/) has information on how to join SfL, or contact the Secretary : Dr Robin Walters (R.G.Walters(a)shef.ac.uk) Programme --------- 9.00-9.30 Registration SfL members free, non-members ?5 (?2 unwaged) 9.30-9.45 Geoff Hoon MP Introduction 9.45-10.45 Dr.John Leach Cryptography and developments in Trusted Third Party policy 10.45-11.45 Dr.Ross Anderson Some problems with the Trusted Third Party programme 11.45-12.00 Coffee 12.00-12.30 Elizabeth France (Data Protection Registrar) 12.30-1.00 Simon Davies Escrow and the hidden threat to human rights and privacy 1.00-2.00 Buffet lunch 2.00-2.45 Prof. Charles Public policy and legal aspects of Intellectual Oppenheim Property Rights 2:45-3.30 Alistair Kelman Electronic Copyright Management : Possibilities and Problems 3.30-3.45 Tea 3:45-4:45 Andrew Graham Will the Information Superhighway enhance or diminish democracy ? 4.45-5.30 Panel Session Discussion (inc. Robert Schifreen) ---------------------------------------------------------------------

1 0