December 2003 - cypherpunks-legacy

Re: ASM vs portable code [WAS: Re: Java DES breaker?]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Dec 1996 21:28:46 -0800, Dale Thorn wrote: >> Averaging several runs: >> "C": 102,300 crypts/sec >> ASM: 238,000 crypts/sec >Someone on this list should know if it is possible to maximize speed in >a typical 'C' routine, using Register variables (particularly for loops), >inlining everything possible, etc., to get executable code much closer >than a factor of 2x difference. Can it be done on a PC, and how hard >would it be to explain, to cover a representative variety of techniques? A good optimizing compiler comes _close_ to hand coded, especially with the many new concerns on Pentium+ processors (pipeline optimization, fpu tricks, etc). # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

permanent invasion of privacy
by attila＠primenet.com 17 Dec '03

17 Dec '03

I'll pass the article along... I'm not sure I wish to even comment on the two social worker do-gooders who are proposing [and have legislation introduced] something worse than Hillary's "It take a global village" other than $E^&*&@!!! the absolute ultimate on invasion of privacy imaginable. might as well add this one to: "...they get my weapon, still smoking, from my cooling hand." or maybe: "54-40 or fight" needless to say, any member of the cypherpunk list would be an automatic loser in this game of life. I for one believe ability and drive is signicifantly more genetics than social environment. -attila == I'll get a life when it is proven and substantiated to be better than what I am currently experiencing. --attila ************** forwarded article **************** LICENSING PARENTS REVISITED The December 1996 edition of the journal Society contains a symposium on the subject of "Licensing Parents" -- a totalitarian proposal with which regular readers of The New American may be familiar. (See "Whose Child Is This?" in our November 28, 1994 issue and "Are You Fit to Be a Parent? in our January 23, 1995 issue.) Included in the symposium were Dr. Jack C. Westman of the University of Wisconsin-Madison, author of Licensing Parents: Can We Prevent Child Abuse and Neglect? and Professor David T. Lykken of the University of Minnesota, author of The Antisocial Personalities. Westman and Lykken are the most prominent advocates of a system of parental licensure in which parents would have to be certified "competent" by the government before being permitted to raise a child. In his Society essay, Lykken writes, "I will testify in support of a parental licensure bill to be introduced at the next session of the Minnesota State Legislature. The only sanction proposed in this bill for unlicensed parents who produce a child is periodic visits by child- protection caseworkers who will do an annual audit of each child's physical, social, and educational progress." However, Lykken asserts, "Minnesotans and their legislative representatives will [eventually] recognize the need to take one further step. That step, I suggest, should be to take custody of babies born to unlicensed mothers, before bonding occurs, and to place them for adoption or perma- nent care by professionally trained and supervised foster parents." Nor is this the last step that Lykken would take toward the abolition of parental authority by the state. The December 17, 1994 Minneapolis Star-Tribune reported, "Under Lykken's system, if children were born to un- licensed parents, the state would intervene immediately. Licenses would be checked in hospital maternity wards. Unlicensed parents would lose their children permanently. Adoptions would be final and irreversible." Furthermore, according to Lykken, "Repeat offenders might be required to submit to an implant of Norplant [a surgical contra- ceptive] as a way to keep them from having another baby for five years." Source: Insider Report, p.12 The New American December 23, 1996

1 0

Re: KRA_gak
by jim bell 17 Dec '03

17 Dec '03

At 07:50 AM 12/13/96 -0500, John Young wrote: > 12-12-96 > "High-Tech Leaders to Facilitate Recovery of Encrypted > Information Globally. Key Recovery Alliance Welcomes 29 > New Members" > The key recovery alliance has more than tripled its membership > and identified its charter objectives. > + expediting the widespread, global use of strong encryption > + evaluating technologies that are flexible and scaleable to meet > various changing commercial needs and policies > + promoting interoperability between different key recovery and > non-key recovery solutions > + defining a commercial infrastructure for worldwide development > of strong encryption > + maximizing security for business While this will, of course, be obvious to those frequenting CP, notice a curious fact here: The commentary above refers to the organization as a "Key Recovery Alliance." Well, one might normally expect that organizations are usually named based on their primary raison d'etre. Yet, the objectives listed above clearly do not require, or even desire, "Key Recovery." Quite the opposite, in fact. If there was any need to demonstrate the illegitimacy of this arrangement to the press or public, you need merely show that the people and organizations participating in it don't even consider the goal implicit in the name to be a desireable outcome. Jim Bell jimbell(a)pacifier.com

1 0

Re: ITARs effects
by jim bell 17 Dec '03

17 Dec '03

At 08:23 PM 12/14/96 -0500, Robert Hettinga wrote: >At 7:09 pm -0500 12/14/96, Adam Shostack wrote: >> My understanding is that they choose not to continue >>per^H^Hrosecuting Phil for putting the code up for FTP. Thus, this is >>a change. Or did Phil not put the code up for FTP? > >Actually, it's my understanding that PRZ didn't do it personally. Someone >else got the code from Phil and put it on the net. Phil had nothing to do >with it. Except for writing PGP, of course. :-). I suppose one of the myriad reasons it would have been difficult/impossible to prosecute Zimmermann is that, because the "crime" was approaching the end of the statute of limitations, the prospect existed that sometime during the trial, we could have had a "Perry Mason"-type ending, with somebody else standing up and claiming credit for the (then past the limit) act of uploading PGP. If the standard used for conviction was "beyond a reasonable doubt," it would be just about impossible to convict unless the gov't had some sort of person-specific evidence, rather than merely evidence that PGP got onto the web. Jim Bell jimbell(a)pacifier.com

1 0

Big Brother moves to Oregon
by Alan Olsen 17 Dec '03

17 Dec '03

Here is something you may not have heard about. The new drivers licences in the state of Oregon have a digital picture on them. You get one on your licence and the state keeps on on file. Any time the police need to pull up information on you, your picture comes up along with it. (The police are supposed to have this capability in their vehicles any day now, if not already.) This plan is being put into place as fast as they can and over 70+ million over budget. (They expect to have all of the Department of Motor Vehicles offices hooked up in a couple of months.) And the "Drivers Licence Number" has been replaced with a "Customer Number". (Had to have a bit of newspeak creep in there somewhere I guess...) Oregon used to be a nice place to live. Lately they have been the experementing ground for some of the most draconian laws in the country. "Welcome to the New Global Village. You are Customer Number 6." --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

RE: Securing ActiveX.
by John Fricker 17 Dec '03

17 Dec '03

>Ray Arachelian (sunder(a)brainlink.com) said something about Securing ActiveX. on or about 12/16/96 11:08 AM >On Sat, 14 Dec 1996 ichudov(a)algebra.com wrote: > >> Ray Arachelian wrote: >> > >> > Until Microsoft secures ActiveX in it's own sandbox and doesn't allow it >> > to access things it shouldn't, it's not cool. >> > >> >> I do not understand how one can secure ActiveX. > >Simple. Check out Windows NT, under NT you can write/run programs as >services which log in as an account. When you do this, that service >program is limited to the security restrictions of that account. Not exactly. Win32 API's include the ability for a program to impersonate any known user. Besides ActiveX (OLE really) has nothing to do with services. In order to make ActiveX secure there would need to be a virtual machine with access to a limitted API only. Sound familiar? > >If you're using the NTFS file system and give that account access only to >one directory, it can't access anything but that directory. (If you're >using FAT, this isn't true and the program can read/write/delete anything >it wants.) Works quite well. > >It can be done under 95 but Microsoft will have to write a Sandbox >Virtual Machine (a Virtual x86 session whose API's are filtered to >prevent access to certain things like the file system, and disables >direct I/O.) Not that easy under '95, but it already exists for NT. There is no such thing on WinNT. > >The problem is how to deal with DLL's. You don't know all >features/functions of all DLL's. It may be possible to write a DLL that >runs outside the sandbox and can act as a proxy to the file system, so >it's iffy unless you limit the DLL's and services that ActiveX apps talk >to, and make them all live inside the sandbox. > Why is that a problem? ActiveX components are shipped as discrete objects with a known DLL like interface. DLL's are unloaded when the load counter is zero so they don't hang around in memory after the ActiveX job is done. You also cannot write a "proxy to the file system" in a DLL. That's a special device driver called a filter. Of course there is this Mark Russinovich fellow that is showing how this is not exactly true. It is possible to identify all entry points in a DLL. --j -------------------------------------------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending | me email with subject "send pgp key". | www.Program.com is a good programmer web site. --------------------------------------------------------------------

2 1

IMPORTANT: Changes affecting anon.lcs.mit.edu privacy
by lcs Remailer Administrator 17 Dec '03

17 Dec '03

I'm looking into reconfiguring anon.lcs.mit.edu (a.k.a. nym.alias.net) in ways that will improve performance and reliability. This could involve several changes (either temporary during testing, or even permanent) that might affect the privacy of users. I hope these changes won't affect people who use anon.lcs.mit.edu and nym.alias.net according to the instructions, but given the sensitive nature of anonymous services, I want to alert people of these changes to avoid any surprises. * 'Received:' headers may suddenly appear. Currently, anon.lcs.mit.edu does not add 'Received:' headers to any mail it relays or delivers to nym.alias.net aliases. Since the anonymous remailers mix(a)anon.lcs.mit.edu and config/send(a)nym.alias.net already strip header information upon receiving messages, this shouldn't really affect people unless they are telnetting to the SMPT port and forging E-mail. Such forgeries are not condoned by the administrators, anyway, and have actually not been much of a problem. If, however, you were somehow relying on anon.lcs.mit.edu's sendmail for "light" anonymity, you should start using real remailers before it's too late. Though I don't really mind suppressing Received: headers, this looks somewhat difficult to do with MTA's other than sendmail, so if sendmail gets junked, we may end up with something that adds Received headers. * SMTP destination statistics may be kept. Recent versions of sendmail (and other MTA's) can keep statistics on delivery to remote machines, to prevent blocking multiple times when sending mail to unavailable remote hosts. The information kept appears to be the name of each remote machine to which mail has been sent, and the last time at which an attempt to send mail to that host was made. Such information would not be backed up, and could potentially be purged daily. I understand this may cause concern. I welcome any feedback or suggestions on how to deal with this, either in sendmail or also qmail (which I'm thinking of switching to). The worst case scenario seems to be the case where anon is seized or stolen and someone discovers that your machine received a piece of mail from it. No information will be available about whether or not you ever sent mail to anon.lcs.mit.edu. This seems acceptable because if someone really needed to prove you had received a piece of mail from nym.alias.net, that person could already do so by tapping your network and sending you a message through nym.alias.net. Despite these changes, anon.lcs.mit.edu does not currently and will never keep any message-by-message mail logs. Sendmail currently runs at log level 1, which the documentation describes as logging only "Serious system failures and potential security problems."

2 1

Re: PGPfone contact server
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

[From a discussion on pgp-fone(a)rivertown.net] >>> Is there any kind of server method people on this list use to meet up on >>>PGP fone??? >>IMHO... Because PGPfone's main goal is to provide security and maybe >>some anonymity, would it make [no?] sense to have a feature like this. I can think of a few useful variants on this kind of service 1) Incoming-Call-Notifier daemon - faster than email, smaller than pgpfone. (PGPfone may not have a problem with this, but Netscape CoolTalk has a watchdog daemon that hangs out waiting for calls. Don't know if it barks, but it's got to be smaller than NS+CT. Firewalls generally kill these, though... 2) Chat-line with switch to voice - an IRC channel would do fine, and be easy to set one up, for people who want to meet to play with the technology; for people who want to cut out to PGPfone from other IRC groups, you don't even need that, though distributing an IRC client with a "PGPfone" button might be a good marketing technique. Name the IRC channel "pgpfone"... CU-SeeMe uses this approach - reflectors are often busy or way slow, and the available public-access reflectors change pretty often, and it's much easier to find people or find interesting reflectors using the IRC channel than polling for busy-signals. CU-SeeMe supports conversations through reflectors as well as direct-connection, and doing a PGPfone-like DC mode might be fun as well. 3) Finding specific people who don't have predictable IP addresses - IRC can also do this, or email, but it wouldn't be hard to build a web form widget that lets you plug in your name/handle and scarfs up your current IP address or lets you enter it. A "specific person" could be an alias, of course. 4) A secure n-person conference bridge could be good also, though it's much more difficult to make something like that work, especially if you use a crypto mode that dislikes dropped packets. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

2 1

RE: 40 bit DES [Was:Re: !! Point 'n Crypt]
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Walt Armour <walt(a)blarg.net> wrote: > If I encrypt a $10 million dollar proposal and then get 86'd in > a car accident I would like to go to my grave knowing that the > company could get the proposal back. .... Anyone who stores a $10m proposal on only one machine, without making backups on somebody else's machine, preferably out of the building, is asking for the Clue Fairy to send him disk drive gremlins and software from Bill Gates to scribble on his disk, and his company should probably consider 86ing him before he strikes again :-) Slightly more seriously, there are certainly corporate reasons to store backups of keys for important data, such as backup tapes and communications. GAK-style technology is the wrong level approach for communications - GAK-style access to keys is useless unless you've also backed up the data, so if your corporate officers need the data, give it to them encrypted with their own keys. Similarly, if you want backup access to keys used to encrypt files, back up the keyrings, maybe using a secret-sharer if you want to require multiple people to access the backup, or just have the backups of the files encrypted with the keys for the backup server. > BUT in regards to the general populace, I do not advocate any form of > key escrow/recovery. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

RE: permanent invasion of privacy
by blanc 17 Dec '03

17 Dec '03

From: attila In his Society essay, Lykken writes, "I will testify in support of a parental licensure bill to be introduced at the next session of the Minnesota State Legislature. ........................................................... Someone needs to remind this Senator Lykken what happened in Romania, when the beleaguered citizen-units finally took their 'noble', social engineering leader Ceausescu, put him up against a wall and shot him. History could repeat itself. Ah well, but really the most that this proposed bill would accomplish would be a lot of discussion and a lot of attention being brought to the general awareness about where individuals stand relative to their *elected* government (in 4 years - out!). Can you imagine the usenet discussions . . .all over the world. You know, he could be doing everyone a favor by inciting fury in the savvy masses who would, in the process of complaining, educate the ignorant ones about the ethics of social engineering and the precautions against it, as well as about the character of people like this Senator. A problem can be an opportunity in disguise! .. Blanc

3 2