December 2003 - cypherpunks-legacy

linux ipsec question
by Alex Strasheim 17 Dec '03

17 Dec '03

I've been off the list for quite awhile, so if this has been beat to death already, I apologize. Is there any kind of consensus of opinion on the linux-ipsec project? What do people outside of the project think about it? It seems like a very good thing to me, but I don't know much about s/wan, so my opinion isn't worth much. I'm a little curious as to how this project fits in with other secure IP efforts. Will the linux-ipsec software interoperate with other packages? How does it relate to IPv6? Policymaker? Basically, I'm not very clear about the significance of this project. Is it going to be a good package that I could use to encrypt traffic between offices in NY and LA, or is it going to be a package that will let me communicate securely with the net at large, using a well accepted standard? Finally, what do you all think about the basic way this is set up? I mean, does it make sense to use a linux box with two net cards to protect a lan? Or should secip software be built into individual devices, like it is in IPv6? Is this a standard that might get picked up by someone like cisco? Etc. Thanks... -- Alex Strasheim, alex(a)proust.suba.com

2 1

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Rick Smith 17 Dec '03

17 Dec '03

Hal Finney wrote: : Are there other measures which parents could take while their children are : young to get them off to a good start, privacy-wise? I doubt it's ever too late to start. Sure, it seems as if old, crufty bits sit on the 'Net just waiting to embarass us ("oh, yeah, maybe I *did* post to alt.naughty.stuff 'way back then...") but there *is* such a thing as bit rot and perhaps it really is our friend after all. The first question, always, when evaluating security measures is to ask "What are you trying to protect?" This gets really weird when you don't know what the threats really are, which is true of this situation. I don't really see "privacy" itself as something you can pursue as an absolute objective. I think Black Unicorn's tale illustrates this well -- he doesn't try for non-existence, instead he describes a series of well reasoned and consistent steps. Basically, though, it has to be a personal choice. So it's hard to judge perfectly for another, even your own kids. IMHO you have to find a reasonable balance for your kids. The problem is that you don't want your kids to disappear -- there are times they will WANT their records found. The problem is to make verification easy when they're directly involved and difficult otherwise. The basic and obvious rule to most of us is to control the SSN and don't give out a correct one except when absolutely necessary. One of the banks in Minneapolis refuses to pay interest at all if you don't have your SSN on file. I toyed with the idea of manipulating birthdates, but it wasn't clear what the benefit was. Also, it required my wife's help, and I'll defer to Tim May's recent discussion of his'n'her anarchy if you wonder why this might be an impediment. If the kids know their "real" birthdate they'll *always* report it to their teachers. And if it's consistently incorrect in school records, then what does it mean for it to be different? When faced with peculiar situations I try to choose a disclosure that meets whatever the immediate requirements are but doesn't make it easy to automatically match up records. Often the best you can do is reduce certainty and increase the likelihood of multiple matches with other records. It doesn't hurt if you last name is Smith here in the U.S.A. Rick. smith(a)sctc.com

3 2

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear Sir, >>problem avoiding the photo (and thumbprint) on the license. You mean you guys have to have a thumbprint on your drivers licences as well? That is a real entry into the system! Appearances can be changed, but fingerprint changing isn't quite as easy for the average Joe. But who was it who said: "How can you convince people of the need for privacy when they are willing to leave detailed records of their shopping habits for 1/10000th of a flight to somewhere"? I think it may have been Mr.Schneier in his article on why Cryptography is difficult, I can't remember, but it definitely has the ring of truth to it. Yours Sincerely, Benjamin Grosman

1 0

[URGENT] Accounts payable
by nobody＠replay.com 17 Dec '03

17 Dec '03

What a joy to make a public mockery of Tim Mayonnaise!

1 0

RE: So how does the crypto crackdown go?
by nobody＠replay.com 17 Dec '03

17 Dec '03

> >One question is whether they would also try to make it illegal to use >(rather than to distribute) crypto software. On the one hand, if they >don't do that, they have a problem with all the installed base of code. >But the legalities of stopping people from encrypting code on their own >computers, or writing crypto programs for personal use, seem a lot more >questionable to me, and I don't know how much precedent there would be >for that kind of restriction. Not at all questionable. A ban on crypto would follow the current trend in regulating technology. Consider the case of Bernie S. who is in jail for possessing electronic parts that could be used for telco fraud. Any government action towards banning crypto will include possession of crypto as a crime. The "cat's out of the bag" argument is ineffective as well as the governments just don't care. They'll just say in effect: "It's illegal. Destroy it if you got it." Now it's doubtful if enforcement would make unprovoked searches and arrest people solely for possession of crypto. And it is also unlikely that DA's (except perhaps the most bored) would follow up on "My neighbor is using crypto" tips. But it is not uncommon for prosecutors to heap additional charges on criminals (alleged) such as the case in robbery: 1 count robbery, 1 count using a gun in robbery. or perhaps 1 count tax evasion, 1 count using crypto to commit tax evasion. While the former charge may end up being unproven the later often sticks. > >So as I see it the main target of the ban would be distributors of >software rather than end users. This would be in line with the often >stated goal of the law enforcement people that their main concern is with >crypto that is built in, transparent, and trivial to use, rather than >hacker's crypto. Hmmm. Hackers built the ubiquitous CryptoFS for Linux, no? And the nascent S/WAN too. I don't see a distinction between popular and subculture crypto. The two invariably mix. A program may have it's origins in the subculture but it will often meet the needs of the popular culture as well and be adopted, accepted, and so on. Consider PGP and such add-ons as Brainless-PGP, WinPGP, and the various auto PGP tools. It seems to me that banning distribution would just be too generous. What is distribution? Are time share accounts distribution? I created it but many can use it but the actual bits (well are there actual bits?) never left my single computer. But the nature of "distribution" is to move something from one person to another. Now nothing really moved but a few electrons. But multiple people did use it. Book 'em. Distribution is an archaic term here and the regulations will involve controlling what software may be run on personal computers. The stated goal is a posture designed to sound reasonable. Only time will tell if the actual goal is the regulation of computer uses as I suspect. The security establishment fears crypto. Fears loss of control. I suspect that with Clinton back in the White House (was there a choice?) we will enter a period where the Clipper chip seemed like a good idea. In comparison. Unless some fundamental changes occur to the Security, Intelligence and Law Enforcement agencies (a new acronym? SILE? Pronounced with a long E of course <g>) we will see more business as usual and some completely draconian steps taken against strong encryption. The only recourse is to take an active role now. We must go on the offensive and : 1) Deploy S/WAN 2) Write more strong ubiquitous crypto 3) Attack the SILE agencies directly by challenging their purpose, gutting their budgets, exposing their falacies (umm is that almost freudian or what), flooding international communications with strong crypto messages (content need not apply), and of course ridiculing their every effort. 4) Finding allies in the legal community and educating fence sitters, critical judges, legislators, and so on. Now is the time to act. diGriz

1 0

Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

What do you do if you are operating a remailer and somebody complains they are getting spammed? That's easy, you keep a list of people that you don't send mail to. What's hard is if that person wants to receive other anonymous mail. The solution is easy: charge e-cash to send mail to certain addresses and send the money to the owner of the account. Never put an address on a kill list, just raise the price of sending mail to it. This generates lots of positive publicity for your remailer. People will beg to be spammed! And, since the remailer operator handles the financial parts of the deal, the technically naive "victim" does not have to have specialized knowledge or even an e-cash account. This also eliminates the spam problem generally. If you are plagued by spam, create a list of names you will accept mail from. When a message comes in that is not on the list, return a message directing them to send you the mail through a paying remailer. This solves a problem for famous people, too. They get lots of mail but they don't have time to read it all. How to sort it? Raise the price of sending a message. (I heard that Arnold Schwarzeneggar was once paid $1 million just to read a script and look at the set of a movie with no obligation to act in it.) Okay, now lets go to mailing lists. We like to read anonymous mail on this list, but we don't like getting spammed. It's hard to filter anonymous mail for obvious reasons. The solution: don't accept anonymous mail. Only people on the "approved" list would be allowed to post. People who wish to post anonymously could then send mail through the paying remailer to people on the "approved" list and request that their message be relayed. Most people on the list would be happy to accept a dollar or two to provide this service. This would eliminate inappropriate mail while allowing anybody to post. For that matter, postings to the list itself could be priced at, say, a dollar to cut down on the noise levels. Payments, and addresses which complicate payment, make it harder to rely on the remailer network. When you send a message through a few remailers and make a faux pax on the last one, you won't know what happened. Did one of the remailers go down? Did you make a mistake? I think I know a solution to this one, too. If somebody wants to get error messages, they include a random 128 bit number with their message. This is a different number for each remailer in the chain. When an error occurs, the remailer distributes an error message with the number attached. Error message distribution is pretty easy. The remailer operator could publish a web page with the errors. Or, the messages could be bundled and made available through anonymous ftp, or mailed to an error message mailing list, or posted to a newsgroup. Peter Hendrickson ph(a)netcom.com

1 0

Federal Reserve Bank is ILLEGAL?
by Doug Renner 17 Dec '03

17 Dec '03

http://feustel.mixi.net/GOV/DEPTS/fedres.html Most list members would be very interested in the above link.

4 6

Re: WebTV a "munition"
by Sean Roach 17 Dec '03

17 Dec '03

At 11:56 AM 11/11/96 -0800, Pablo Calamera wrote: ... >The WebTV Network is currently using a 128 bit encryption system that >gives our U.S. subscribers the most sophisticated security protection of >any online service today. It is our intent to offer our customers the most >secure environment for transactions and transmission with their WebTV >Network service. Our units, sold by Sony and Philips, include a sticker >that states that the product is not to be exported outside of the United >States. > >However, the government restriction does not prevent us from exporting our >product outside of the United States. WebTV Networks has always intended to >announce its expansion plans in early 1997, providing global communication >using either 40 bits, now authorized by the government, or 56 bits which >Bill Clinton recently endorsed. ... This may prove my ignorance, but I thought that the WebTV systems were going to use a propiatory service. I am assuming that this is true in this post. If the WebTV product is using a propietory ISP for its operation, I assume that WebTV sets sold outside of the United States will not be dialing up the same phone number. As the chip could easily communicate with the ISP, and the ISP communicate, perhaps through standard credit validation systems, with the merchants, why does the international version even need U.S. developed encryption. The international version could most likely be fitted with the locally available strong encryption. Since the WebTV ISP will probably have a virtually private wide area network, the "foreign" encryption could be replaced with a more standard type inside of the U.S., at the main offices. Why give the U.S. government the ability to look at the transaction information of non-U.S. citizens, off of U.S. soil. If, however, the WebTV system does not have the ability to maintain contact with its over-seas offices, this could be unfeasable. Granted, this idea would mean that some computer would have access to all of the relevant data,for the purpose of "trading" crypto, but I would rather put my trust in a company, which I could easily quit dealing with, than the U.S. government, which might easily institute an international sales tax system. Can PGP be compiled to an EEPROM? If so, PGP is well distributed and might easily be accepted for online transactions, also, Mr. Zimmerman might be willing to agree to a bulk liscense sale for the implemention of this idea. Just make sure that the chip is loaded outside of U.S. borders.

1 0

Re: two bogus messages to this list
by Sean Roach 17 Dec '03

17 Dec '03

At 11:08 PM 11/11/96 -0500, Ted Garret wrote: ... >Microsloth has, at the heart of it's system, a call which traps ALL >KEYSTROKES and EVENTS. This call exists from Win32s on, and can be >placed inside of a DLL which most users would have no idea was loaded. >Even under NT, this DLL can be made to remain resident and trapping >Keystrokes, events, and window contents. > >Does this just BEG to be exploited? ... I use Windows 3.11. Look at the Recorder in it. Its designed to create Macros. It can be set up, by anyone, to capture passwords in Eudora. I've tried it in a controled environment (my own machine), it works. The only defense is if the person were to have h[is,er] password left in Eudora, which is a serious mistake, or if that person Alt,Tabs through all of the resident programs to make sure it wasn't running. Half of the people I've told this to didn't even know that you could switch between windows programs, (one didn't even know that more than one windows program could be active at the same time). In an open lab environment, where the machines are left on, and the common user can't navigate outside of windows, and then only with the mouse, this would be a serious threat to privacy.

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 08:26 AM 11/11/96 -0800, Hal Finney wrote: ... >I have two kids entering their teens, and I'm sure other list members are >parents as well. What can we do for our children to help them enter their >adult lives with better chances to retain privacy? Unicorn mentions keeping >them absent from school on picture day, although I'm not sure how much this >helps. I suppose it makes it harder for an investigator to find out what >they look(ed) like. Then when they get old enough to drive you have a new >problem avoiding the photo (and thumbprint) on the license. ... As far as the drivers linscense goes, there are religions that do not allow its members to be photographed, and the government honers this,(at least the Tag Offices do). I don't know the name of the religion but I believe it is a Christian one. Convert once every four years to get your drivers liscense, and convert back within the week. No photograph on that little piece of plastic. P.S. In Oklahoma, there is no thumbprint on the current liscense. P.P.S You can always send your child to school with a note saying that you do not want your child in the class picture, I know of someone who did that, (on a side-note, we always wondered why.)

3 2