December 2003 - cypherpunks-legacy

Re: Redlining
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"mjmiski(a)execpc.com" "Matthew J. Miszewski" 11-DEC-1996 03:35:52.25 >My question was a real one. The basis of it comes from my work with the >homeless in which they have a difficult time getting a job because they >have no "home address" to put on the forms, some do not have or remember >their SSNs, etc. This causes a cyclic problem for the homeless. My >question to Tim was, in the real world, how is the protection of this data >feasible. And what institution ultimately requires the SSN and a considerable number of these other pieces of information? What institution puts a considerable number of roadblocks in the way of getting a post office box, for use as a home address, without a "home address"? >I do have responses to each of your "points" in your last post, but have >found the process of responding point-by-point tedious and non-productive If you've got such responses, please give them. They may very well be tedious; I'd disagree about them being non-productive, based on my past experience. Without such responses from you to some very well-reasoned arguments, we are left with the equivalent of the Feds on cryptography, i.e., "if you knew what we know you'd agree with us." -Allen

2 1

Cypherpunks December Meeting (SF Bay Area)
by Dave Del Torto 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [wide distribution: please excuse any duplicates you may receive] Salutations, The Cypherpunks December 96 Physical Meeting is being hosted by Pretty Good Privacy, Inc. We've rented a meeting room at the Hotel Sofitel (see below) that can accomodate ~100 people. There will be munchies, and I think this qualifies as a cypherpunk milestone of sorts, so I hope lots of you show up. Please see <http://www.pgp.com/961214.html>. General Info: 1) RSVP's Please RSVP ASAP to <mailto:ddt@pgp.com?subject=cpunks-mtg-rsvp> if you plan to attend (reply to this with "cpunks-mtg-rsvp" as the Subject). It's very important that I have a clear idea of how many humans plan to attend as soon as possible, because we're also providing refreshments/snacks which we need to order from the hotel in advance. Thanks. 2) Location/Time We'll be holding this "Open Meeting on US Soil" at the: Hotel Sofitel 223 Twin Dolphin Drive Redwood Shores CA 94065 415.598.9000 tel Meeting time is 11 AM - 5 PM (a Sofitel time slot), as we have to be out of the room shortly after 5 PM for a wedding setup). The Sofitel is a block or two south of the shining Oracle towers on Twin Dolphin Drive, which is easily accessible from Hwy 101 (on the east/SF Bay side of the freeway) in Redwood City (12 miles south of SFO airport and a few miles south of the Hwy 92/San Mateo Bridge junction as references). There are directions and a simple GIF map at the meeting info URL. <http://www.pgp.com/961214.html>. NOTE: when you arrive at the Sofitel, look for signage pointing to the exact room we're meeting in, or inquire at the main desk. Bring your friends. 3) Demos If you want to demo something at the meeting, tell me ASAP(!). We encourage anyone who has anything Cypherpunks-related to present (even stuff that's already been seen before but which has been updated) to bring/show it. I'm going to set the arbitrary cutoff date for demo reservations as 11:59 PM on Thursday 12 December: we can have the right equipment ready for you if you list what you need in detail. If you wait until the last minute and bandwidth is limited, we may not be able to fit you in, unless you have something very simple to show, so please bear that in mind. There will be overhead projection and an RGB projector available. Net connections can be arranged with advance notice. Right now, we have not arranged anything beyond a Metricom modem (28.8Kbps), but we can arrange an analog modem line or even an ISDN if there's a specific need. Tell me soon(!). 4) Handouts/Door Prizes/Raffle Handouts are welcome: please give me your stack of handouts for the table when you arrive. If you want to pass out detailed mailbomb instructions, please do it outside the building at your own risk (inside the meeting, please refrain from getting PGP Inc in trouble, we do enough of that ourselves already ;). There will be door-prizes from PGP, but supplies are limited if 100 people show up. We may also raffle off some software (upgradable when our new stuff comes out). 5) PGP Key "Thing" Bring a printout of your key fingerprint/key. Or a diskette version, or both. We'll have a key exchange/signing session at the end of the meeting. 6) PGP/MIME BOF at the IETF The IETF's PGP/MIME BOF is Friday 13 Dec, 9:00-11:30 AM (Crystal Room, Fairmont Hotel, 170 South Market St. in Downtown San Jose, 408.998.1900 main). Since it's a Birds Of a Feather session, I think interested people in the San Jose area can show up if they want. Please come by if you want to help support RFC 2015 so PGP/MIME can take the next step toward IETF Working Group discussion so we can eventually move it to the IETF Standards Track process. Anyone who's at the IETF is encouraged to stay over until Saturday and come to the Cypherpunks meeting too! - -- I hope to see everyone there! If you have questions about any of this, email me (I'm at IETF this week, but I'm wireless). If there are any last-minute announcements before Saturday, I'll post them. dave ________________________________________________________________________ Dave Del Torto +1.415.65432.31 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv Comment: Verbum sapienti satis est. iQCVAwUBMq7z7KHBOF9KrwDlAQHcRQP/b/FOYPca2tN9mRlJXoLhgeI1swGESUHs 5CzTNcFq92EeiEeNYgq6Ri/itAzovTbt75AvJdfULrHrA48sQ9QGZy/qedRjNv+q w29a0olc9sRh3EpRvW83ioeju2pyJ5zynpu3wua8H5j6p4NAKJmnte0VzxL9n4KA Ezgov90jxuc= =j4Q1 -----END PGP SIGNATURE-----

1 0

Re: Redlining
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 9:04 AM 12/10/1996, Black Unicorn wrote: >On Tue, 10 Dec 1996, Huge Cajones Remailer wrote: >> I believe that ten, or a hundred, or a thousand people should be able >> to pool their money and lend it to whomever they please for whatever >> reason they like. >> >> That, essentially, is what a bank is. I do not believe the government >> should dictate which people you, or your bank, are allowed to lend to. > >Create a bank where the identity of the customers are unknown and you >solve the redlining problem. I can imagine a bank whose depositors are not known. I can also imagine a bank which itself operates anonymously. How would people borrow money against real estate and remain anonymous? It seems to me that the borrower cannot do so if the real estate will act as collateral. Also, how would an anonymous bank foreclose on a mortgage? Red Rackham

3 2

The Sword of Damocles
by Timothy C. May 17 Dec '03

17 Dec '03

The recent discussion of the dangers of PICS--especially the dangers that a widely-deployed PICS system might encourage/enable governments to mandate PICS ratings in various ways--is just one of several "swords of Damocles" we have talked about for several years. By a "sword of Damocles" I mean any technology or system which, if deployed, could present an almost overwhelming temptation for governments or special interest groups to direct in directions most of us would find highly objectionable and even dangerous. (I use the metaphor of this sword of Damocles--the king of some place placed Damocles under a sword suspended by the thinnest of threads, to remind Damocles of who had the power--because no other metaphor seems to fit as well. Another metaphor is that of the danger of any technology which could become oppressive by the "flip of a switch." For example, if key recovery becomes widespread, with limited numbers of recovery centers, then governments could quite easily use administrative or executive orders to limit the options available for choosing such centers, or the licensing requirements for such centers...by the "stroke of a pen" ("flip of a a switch," or "flag day" in computerese), the voluntary system becomes much less voluntary. At the most extreme level, nearly all of us would object mightily to any system in which cyanide release systems were installed in our homes, no matter the assurances that the cyanide would only be released if proper legal orders were gotten!)) Some of the debates over crypto policy have involved people who don't see what the concern is about future actions, who basically trust the government to keep a system voluntary when it was promised to be voluntary. (David Sternlight comes to mind...from 1993 onward several of us just could not convince him that the Clipper danger lay in the potential for key escrow eventually being mandated...he just kept focussing on the "voluntary" aspects of Clipper sales, and thought our criticism of Clipper as an attempt to interfere with "free markets." Nonsense of course, but because of the "sword of Damocles" concerns, not the particular situation at some present instant.) To make this issue clearer, I'll just list several sorts of examples. Not all are the same, but the themes are similar. 1. An implantable ID device is developed for humans, along the lines of the "Pet I.D." chips which are already gaining wide acceptance. (And which we've discussed several times on this list. See archives or use Alta Vista, etc.) While such a "voluntary" system is "unexceptionable" to most civil libertarians, in the sense that libertarians do not object to the non-aggressive choices of others to do with their bodies as they please, there are clearly some "sword of Damocles" concerns. For example, a widely-used system of implants could be mandated first for schoolchildren (gotta stop those kidnappings), then for released criminals (part of parole), then for deadbeat dads (don't want them to flee), then for other classes. This is of course a serious issue, despite some marginalization in the press as being primarily a concern of the religious Right and their fixation on "the mark of the Beast." 2. Key Escrow, a la Clipper, the latest Key Recovery plans, etc. Even if announced as "voluntary," as of course Clipper was, our concern was largely with the "sword of Damocles" aspects, that the government appeared to be interested in driving out non-escrow alternatives and widely-deploying a nominally voluntary system which could, at the stroke of a pen, become mandatory. The various issues surrounding key escrow have been so well-covered I won't repeat points here. This is just a classical sword of Damocles issue. 3. Government regulation in general. Anytime the government gains the power to regulate some product class or industry, there is this sword of Damocles effect. A recent example is the area of _vitamins_, with the vitamin and health food store industry vigorously fighting proposals that the Food and Drug Administration (FDA) step in to the "vitamin anarchy" arena and place restrictions on vitamins, advertising, licensing, etc. The sword of Damocles comes from the very real possibility that initially quite "reasonable" limits will "open the door" for later, more draconian actions. (Whew, I've mixed a couple of metaphors with a couple of classical Greek allusions. Sorry.) 4. Gun control. Gun _registration_ is almost the canonical sword of Damocles, in terms of what gun rights folks fear the most. They know that once the locations and quantities of guns are known, it is a much simpler matter for some later government to order such guns turned in to be melted down. It happened in the 1930s in Germany, it happened in other countries more recently, and it is even happening with the U.S. military "disarming the civilians" in places like Somalia, Bosnia, Zaire, and any other place the U.S. military is sent in as a "peacekeeper." (Note: In Somalia, the U.S. disarmed the "soft targets:: simple farmers who had rifles they'd had in their families for generations. This had the tragic effect of making these very farmers then easier prey for jeeploads of looters and Somali "soldiers," who often followed the U.S. "pacification" squads and looted the homes and farms of the now-disarmed villagers! Some tradition for the U.S. to uphold, eh? No "right to keep and bear arms" for the peasants we are supposedly there to help.) Whatever one thinks of guns and gun rights, clearly this is a good example of why registration is fought by so many people, even if "assurances" are given that the registration has nothing to do with confiscation. (Right.) 5. "Voluntary self-ratings." The PICS discussion, and earlier discussions of "voluntary self-ratings" of CDs, videos, and other entertainment, brings up these same issues of Damoclean swords. Could a nominally voluntary ratings system be mandated by the courts, or by Congress? Depending on the outcome of the CDA case, I think so. If the Supreme Court upholds the CDA, it could be argued that anyone who fails to voluntarily self-label his speech faces sanctions if anyone finds his speech in violation of community standards, blah blah. (If one's speech is "non-explicit," as, say, this post of mine is here, then of course it almost certainly would not have to be self-rated...unless I said "Fuck," in which case I'd better consult the various PICS ratings and pick one to protect me to the maximum extent...I consider this scenario probable if the CDA is upheld and a major step away from "free speech" and "cabeat emptor" and a step toward wide self-suppression of controversial speech.) So, these are various examples of "swords of Damocles." That is, systems or technologies which are so potentially dangerous to deploy--in the sense that governments, do-gooders, and lawyers are so tempted to make them mandatory or to use coercion to drive out alternatives--that we should try to anticipate the Damoclean dangers of such technologies and work to head off such futures. Cypherpunks don't trust governments which say "Trust us" or "We're here to help." Governments, like that king in the myth, can cut that threat holding up that sword with little effort. "The Position Escrow System is voluntary. Citizen-units who wish to wear the Localizer (tm) are encouraged to do so, This has been shown to help the police in deterring kidnappings and is helping rescue units find lost hikers and skiers. Those citizen-units who wish not to cooperate in such efforts are free at this time to be rogues, but rogue-units will of course be treated with more suspicion and the failure to wear a Localizer (tm) may of course, as the Supreme Court ruled in 2003, be considered probable cause for a search. And since there are now twice as many laws as there were in 1996, most citizen-units are choosing not to be rogue-units." --Citizen-Unit Timothy C. May ID: 7734%-sd123227-666 Location at 19:09 UCT: 37 02 30 N / 121 48 45 W Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: Java DES breaker?
by Mullen Patrick 17 Dec '03

17 Dec '03

A few small bugs in this idea, at least for the masses -- 1) This would only appeal to people who have unlimited usage 2) ...and don't care about not having their phone available (I know they're asleep at the time) 3) ...and don't have an ISP that will kick them off when a timeout period expires. ...But if you implement it in a way where the user can hang up the phone and leave the browser on with the applet running, that would probably work. It would be easier to use than downloading executable code and a keyspace manually... PM _______________________________________________________________________________ From: Ray Arachelian on Tue, Dec 10, 1996 15:57 Subject: Java DES breaker? To: cypherpunks(a)toad.com Here's a thought, While Java isn't a workhorse performance wise, it's very simple for anyone with a half decent browser to use java applets. Writing an implementation of DES in Java should be fairly easy, however it will run slow on most browsers. This performance drop will make it far easier for Joe Webuser to easily help break DES for us. Previous efforts at breaking DES and RSA have done quite well, but the number of people involved can be greatly increased if you tell someone just go to this page and leave your browser on overnight, every night. The applets would get a key range from the server, process them, and return a yeah or nay back for however far they manage to process before the user returns in the morning. With JIT's (Just In Time Compilers) and the sheer numbers of users that this can attract, the efforts at breaking weaker cyphers can be increased. =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;10 Dec 1996 15:57:37 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Tue, 10 Dec 1996 20:57:29 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id IAA21427 for cypherpunks-outgoing; Tue, 10 Dec 1996 08:23:56 -0800 (PST) Received: from beast.brainlink.com (sunder(a)beast.brainlink.com [206.127.58.17]) by toad.com (8.7.5/8.7.3) with ESMTP id IAA21422 for <cypherpunks(a)toad.com>; Tue, 10 Dec 1996 08:23:53 -0800 (PST) Received: (from sunder@localhost) by beast.brainlink.com (8.8.2/8.6.12) id LAA01432; Tue, 10 Dec 1996 11:26:19 -0500 (EST) Date: Tue, 10 Dec 1996 11:26:19 -0500 (EST) From: Ray Arachelian <sunder(a)brainlink.com> To: cypherpunks(a)toad.com Subject: Java DES breaker? Message-ID: <Pine.SUN.3.91.961210112058.1282A-100000(a)beast.brainlink.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-cypherpunks(a)toad.com Precedence: bulk

2 1

FW: **VIRUS ALERT***
by andis＠taa.com 17 Dec '03

17 Dec '03

>Return-Path: <cdoss(a)taa.com> >Received: from cdoss.taa.com ([204.140.196.68]) by taa.com > (post.office MTA v1.7.1.1 ID# 0-11167) with SMTP id AAA62; > Tue, 10 Dec 1996 11:48:10 -0800 >X-Sender: cdoss(a)204.140.196.66 >X-Mailer: Windows Eudora Version 1.4.4 >Mime-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Date: Tue, 10 Dec 1996 11:48:11 -0500 >To: andis(a)taa.com >From: cdoss(a)taa.com (Carl Doss) >Subject: FW: **VIRUS ALERT*** >Cc: bill.burbank(a)taa.com >Message-ID: <19961210194810338.AAA62(a)cdoss.taa.com> > >>Return-Path: <Tom.Fillmore(a)Grubb-Ellis.com> >>Received: from mail.grubb-ellis.com ([206.171.46.58]) by taa.com >> (post.office MTA v1.7.1.1 ID# 0-11167) with SMTP id AAA97 >> for <cdoss(a)taa.com>; Tue, 10 Dec 1996 10:09:28 -0800 >>Received: by mail.grubb-ellis.com with SMTP (Microsoft Exchange Server >Internet Mail Connector Version 4.0.993.5) >> id <01BBE682.370D0E00(a)mail.grubb-ellis.com>; Tue, 10 Dec 1996 10:09:22 -0800 >>Message-ID: ><c=US%a=_%p=Grubb-Ellis%l=PNW/CORPORATE/00027F83(a)mail.grubb-ellis.com> >>From: "Fillmore, Tom" <Tom.Fillmore(a)Grubb-Ellis.com> >>To: "'Carl Doss (NEW)'" <cdoss(a)taa.com> >>Subject: FW: **VIRUS ALERT*** >>Date: Tue, 10 Dec 1996 09:56:21 -0800 >>Return-Receipt-To: <Tom.Fillmore(a)Grubb-Ellis.com> >>X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5 >>Encoding: 69 TEXT >> >>Danger, Will Robinson!!! >> >>>---------- >>>From: Paul.Goldenberg(a)cwi.cablew.com >>>To: Frye, Doug; INTERNET-us2b7ak6 (052); INTERNET-shellyka (052); >>>INTERNET-ORDNGaol (052); INTERNET-metracom (052); INTERNET-mdobiepf (052); >>>INTERNET-KAGSEFao (052); INTERNET-HVoldtof (052); INTERNET-HAGERMAN (052); >>>INTERNET-goldnson (052); INTERNET-georgebr (052); INTERNET-dmenkenw (052); >>>INTERNET-ChrisShr (052); INTERNET-BSledzva (052); INTERNET-bnorwood (052); >>>INTERNET-AGolden9 (052); INTERNET-8442po5n (052); INTERNET-498038OV (052) >>>Subject: FW: **VIRUS ALERT*** >>>Date: Tuesday, December 10, 1996 1:20AM >>> >>> >>> >>>**********VIRUS ALERT********** >>> >>>VERY IMPORTANT INFORMATION, PLEASE >>>READ! >>> >>>There is a computer virus that is being sent across the Internet. Ifyou >>>receive an email message with the subject line "Deeyenda", DO NOT >>>read the message, DELETE it immediately! DO NOT OPEN !!! >>> >>>Some miscreant is sending email under the title "Deeyenda" nationwide,if >>>you get anything like this DON'T DOWNLOAD THE FILE! It has a virus that >>>rewrites your hard drive, obliterates anything on it. Please be careful >>>and forward this e-mail to anyone you care about. >>> >>>Please read the message below. >>> >>>FCC WARNING!!!!! -----DEEYENDA PLAGUES INTERNET >>> >>>The Internet community has again been plagued by another computer >>>virus. This message is being spread throughout the >>>Internet, including USENET posting, EMAIL, and other Internet >>>activities. The reason for all >>>the attention is because of the nature of this virus and the >>>potential security risk it makes. >>> >>>Instead of a destructive Trojan virus (like most viruses!), this >>>virus, referred to as Deeyenda Maddick, performs a comprehensive >>>search on your computer, looking for valuable >>>information, such as email and login passwords, credit cards, >>>personal info., etc. >>> >>>The Deeyenda virus also has the capability to stay memory resident >>>while running a host of applications and operation systems, such >>>as Windows 3.11 and Windows 95. What this means to Internet users is >>>that when a login and password are send to the server, this virus >>>can copy this information and SEND IT OUT TO AN UNKNOWN ADDRESS >>>(varies). >>> >>>The reason for this warning is because the Deeyenda virus is >>>virtually undetectable. Once attacked, your computer will be >>>unsecure. Although it can attack any O/S, this virus is most likely >>>to attack those users viewing Java enhanced Web Pages >>>(Netscape 2.0+ and Microsoft >>>Internet Explorer 3.0+ which are running under Windows 95). >>> >>>Researchers at Princeton University have found this virus on a >>>number of World Wide Web pages and fear its spread. >>> >>>Please pass this on, for we must alert the general public of the >>>security risks. >>> >>> >>> >>> >> > >

1 0

Re: Secure Erase for PCs?
by Mark Rosen 17 Dec '03

17 Dec '03

> > Though, technically, no disk can be securely erased, my program, Read Peter Gutmann's paper on securely deleting files at: http://www.cs.auckland.ac.nz/~pgut001/secure_del.html. > > Very Good Privacy, can securely delete files after they have been encrypted. > > Thought you said "no disk...". So how does VGP do it? I should have added quotes around "securely delete." The end of Peter Gutmann's paper states "it is effectively impossible to sanitise storage locations by simple overwriting them, no matter how many overwrite passes are made or what data patterns are written. However by using the relatively simple methods presented in this paper the task of an attacker can be made significantly more difficult, if not prohibitively expensive." VGP tries to make is prohibitively expensive (that is, in essence, what all ciphers do; someone can break just about any cipher if they have enough money). VGP can be downloaded at: http://www.geocities.com/SiliconValley/Pines/2690 If you have any questions, please e-mail vgp(a)cryogen.com

1 0

The product formerly known as VGP
by Mark Rosen 17 Dec '03

17 Dec '03

I am just announcing that I am changing the name of my program, Very Good Privacy (distinct from Pretty Good Privacy) in response to a complaint from PGP, Inc. It was cool, though, because I got an e-mail message from Phil, which is akin to talking with God. Just to quell the trademark questions some people might have, a trademark violation is defined as something where there is a possibility of confusion with another product; as made obvious by the hundreds (literally) of messages I have received asking about the features of this new version of PGP (which it is not). I have not changed the name of the product on the web page, and will just post a notice of clarification until I think of a new name. Does anyone have any ideas? Thanks. The product formerly known as VGP can be downloaded at: http://www.geocities.com/SiliconValley/Pines/2690 If you have any questions, please e-mail vgp(a)cryogen.com

5 4

Re: cypher-PUNKS...
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: dlv(a)bwalk.dm.com, cypherpunks(a)toad.com Date: Tue Dec 10 17:03:21 1996 Dimitri hath written... (and the killfiles sang...) > > That charge is every bit as foundless as the charges that you are > > responsible for the "A Daily Warning Regarding Tim May" posts > > of a while back, or the current round of remailed messages featuring > > the sickeningly cutesy ASCII graphics at the bottom. > Tim must have been a heinous baby... I would call this a non sequitur, but I can honestly say that I have no idea what the hell that sentence is supposed to mean. > The real identities of people who use the "anonymous" remails to send > out "homophobic" or otherwise "politically incorrect" materials are > frequently disclosed on the "remailer-operators" mailing list. For > example: > > ]To: remailer-operators(a)c2.net > ]Someone who proports to be from ******************* is sending out a > ]huge spam/mailbomb right now. I suggest you sourceblock the prick > ]now. How did you translate "huge spam" into "homophobic"? Are you using the Windows translation of the Russian character set, or what? You are obviously seeing something that just ain't there. dave - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key "Remember: King Kong died for your sins" - Principia Discordia -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMq3sRnEZTZHwCEpFAQF7GAf+JvaozDbAgY+kXv2dhi8Z43i1XusRzRzK gvJmWF5gafgdxWyBiBxjuEYNdca24jreIVWG8YbSSauvl2xt4al/jzhGLoOcBAC1 7KwydcwaEn3p1vkRmp4rwT8gxQ/Nb68z1NYZzktBxl3/Evo2kgUCkVG6xpAUBixA LKKtMAmiZlqqiTYmB/Se+RMBPjhgiGsuAosca7S/Ia3m2f7mBmyKAB7khcbgHUJ8 ARr9zfj4+pykt9z0W6SCPlxMoXNzu1ozmmHIojDVMBSAY26reGNWkLclLSrOCzyU pktVLlVMyL95TKjXomByCuNC9Dp23wHmCBKQufNRQN70c87eIbh09A== =L6ZG -----END PGP SIGNATURE-----

1 0

RE: Secure Erase for PCs?
by John Fricker 17 Dec '03

17 Dec '03

Peter's paper is an interesting overview of data recovery technology. He does conclude that his 35 write regiment will overwrite all signals on hard disk media. It would seem that performing the 35 writes multiple times would yield an securely erased drive. Yet he clearly is not an expert in data recovery, is organizing others research, and does not provide evidence or tests for his postulates such as the need for a good PRNG. It would be quite interesting to send a disk off to a data recovery company after running through Peter's method with perhaps different parts of the disk treated differently. Also, the section on RAM talks about data persistance but does not cover recovery methods other than SRAM power up bias. Nor is the RAM section referenced. RAM is so active that it would seem little pertinent data could be recovered if any. So, in spite of not being an expert myself I am not convinced that any very well funded entity can recover data that has been overwritten an arbitrarily large number of times. Of course the relative value of my personal data is low and my level of paranoia follows. One can not be called reactionary by recommending a "no-trust" policy. Reading the paper reminds me how long ago it was that I studied the physics of microelectronic devices. Yow! >Bill Frantz (frantz(a)netcom.com) said >At 8:05 PM -0800 12/9/96, John Fricker wrote: >>> Though, technically, no disk can be securely erased, my program, >> >>Sure it can. Ten overwrites will rendered remnant data obscure. So says the >>electron microscope waving data recovery experts anyway. > >You should really check out Peter Gutmann's paper in the 1996 Usenix >Security Conference Proceedings. After reading it, I think you will come >to the conclusion that the only secure data destruction technique, against >a well-funded attacker, is destruction of the disk. I like thermite myself. > > >------------------------------------------------------------------------- >Bill Frantz | I still read when I should | Periwinkle -- Consulting >(408)356-8506 | be doing something else. | 16345 Englewood Ave. >frantz(a)netcom.com | It's a vice. - R. Heinlein | Los Gatos, CA 95032, USA > --j --------------------------------------------------------------------------------- ------------------------ | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending | me email with subject "send pgp key". | www.Program.com is a good programmer web site. -------------------------------------------------------------------------------------------------------- -

1 0