December 2003 - cypherpunks-legacy

OECD policy: constructive comments?
by Robin Whittle 17 Dec '03

17 Dec '03

The US, French and UK government policies on crypto control are stupid. The OECD has a group of so-called experts who are likely to reach the same conclusion about how governements "must" have access to the content of criminal communications. For a commented version of a leaked draft the OECD crypto guidelines, see my WWW site. Recently I got some email from someone at the OECD who is on the secretariat working on this. The didn't seem to mind me publishing the draft and they seemed to appreciate my comments. These people seem to be in their own government circle - but if you can get through to them, at least some of them will listen. They are likely to be intelligent, concerned people, but due to their lack of wide perspective (something they really should be working harder on, for sure) they may come up with some totally unrealistic policies. In fact, most of the draft seems to be really good - it is only the last bit on law-enforcement access which is crook and this seems to be at odds with the rest of the draft. It is no good complaining about them sitting in their bunker if we won't crawl out of ours. If you have some constructive comments on the draft, let me know and I will put you in touch with the OECD secretariat. - Robin > Date: Thu, 5 Dec 1996 08:00:32 -0500 > From: C Matthew Curtin <cmcurtin(a)research.megasoft.com> > To: cypherpunks(a)toad.com > Subject: Encryption policy challenged > http://www.news.com/News/Item/0,4,5909,00.html?dtn.head > > "The Business Software Alliance, a powerful Washington trade > organization, warned the White House that its encryption policy will > fail if the government does not turn to the industry for guidance." > > blah blah blah ... > > Interesting how these polite requests from the SBA, et al, are going > for such ridiculously low goals. Being able to export 56-bit symmetric > cipher products... Why in the world go for such a low number when that > is the absolute *best* that you can possibly get? And with such a > small difference between 56 and 40 bits, there isn't really any room > to haggle. > > Duh. > > -- > Matt Curtin cmcurtin(a)research.megasoft.com Megasoft, Inc Chief Scientist > http://www.research.megasoft.com/people/cmcurtin/ I speak only for myself. > Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

1 0

Re: Mondex
by David J. Phillips 17 Dec '03

17 Dec '03

At 11:02 AM 12/6/96 -0500, you wrote: >Can anyone briefly discuss the anonymity features (or lack thereof) for >Mondex? The following information is gleaned from Seth Grodin's "Presenting Digital Cash" (Sams.net Publishing 1995), the British Environmental Health and Trading Standards' response to Simon Davies' false advertising claim against Mondex, The FAQ page of Mondex's web site, and Tim Jones' testimony before the U.S. House of Representatives. Each card is uniquely identified, and the id of the card is linked at the issuing bank with the identity of the card holder. According to Grodin, each card has 3 logs, the transaction log (recording the recipient, date, and amount of the last ten transactions), a pending log of current transaction process, and an exception log recording "unsuccessful transactions". When the exception log is filled, card is disabled. Traders' tills retain the last 300 transactions as card number, value and date. (Presumably this log info can be offloaded to another devise after every 300 transactions, so the merchant's log can be limitless in size.) Tills record the card's identity, not the user's identity. However, banks have access (I'm not sure by what mechanism) to the till logs, and can then link transactions to card holders (or at least to the individual to whom they have issued the card - whether or not this is the person actually using the card.) Mondex touts their system's ability to monitor aggregate monetary flow, presumably through monitoring merchants' tills. (Jones to House of Reps: "Retailer's terminals and bank cashpoints provide many opportunities for Mondex to capture transaction data and patterns of behaviour which can be analysed to give warning of suspicious circumstances.") In addition to aggregate data, there is also some mechanism for isolating unusual activity on a particular card. (Jones to House of Reps: "In addition, Mondex transactions can be assessed automatically against threshold parameters, derived from past experience. Discovery that a transaction exceeded such thresholds can raise a warning, which can enable a member bank to disable or lock the card if desired.") I don't know how this is supposed to work, but I suppose it could be linked to the exception log on each card, which may record anomalous transactions as well as unsuccessful ones. Banks have the option of issuing cards which require on-line authorization for transactions (or, I imagine, for transactions above a certain threshold or meeting some other sort of criteria.) Much of the monitoring capacity seems to depend on communication between merchant tills and banks, or through auditing of individual deposits and withdrawals at the bank. (Jones to House of Reps: "Suspicions can be aroused, for instance, by regular or frequent value redemption from particular 'unexplained' sources, by a high average of redemptions relative to the card limit (for example, an individual's card behaving as if it was handling the amounts appropriate to a shopkeeper's card) or single large redemptions from an unusual location.") But apparently value can also be transferred between consumer wallets, and I don't know how that is monitored. I'm eager to learn anything more about this. djp

1 0

[STEGO] Firewalls
by nobody＠replay.com 17 Dec '03

17 Dec '03

Tim C[retin] Mayflower's wee-wee is so tiny that only his mommy is allowed to touch it. |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Tim C[retin] Mayflower | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

1 0

Re: Please post Eudora PGP plugin URL
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 04:57 PM 12/6/96 -0800, you wrote: :Or Email it to me : : :Thanks in advance : You're welcome ----------------------------------------------------- Eudora/PGP Plug-In Download version 0.20 from the Web: http://www.prism.gatech.edu/~gt6525c/eppi/epp16_02.zip (for 16-bit version of Eudora 3.0 for Windows 3.1) http://www.prism.gatech.edu/~gt6525c/eppi/epp32_02.zip (for 32-bit version of Eudora 3.0 for Windows NT/95) If you don't have Web access, but have FTP access, try the following sites. Note that if the version you are trying to get was released today or just a few days ago, it may not have shown up at the sites below yet, so give it a few days: papa.indstate.edu: /pub/winsock-l/mail/epp16_02.zip /pub/winsock-l/Windows95/mail/epp32_02.zip /pub/winsock-l/WindowsNT/mail/epp32_02.zip ftp.winsite.com: /pub/pc/win3/winsock/epp16_02.zip /pub/pc/win95/winsock/epp32_02.zip If you want to be automatically notified of new versions, send e-mail to gt6525c(a)prism.gatech.edu with the subject of "eppi news", and the following message body: join stop You will not be able to post to this list. It is merely a convenient way to receive notification of new updates to EPPI. Send comments to: gt6525c(a)prism.gatech.edu What is EPPI? EPPI is the acronym for Eudora/PGP Plug-In. It is a "Plug-In" module for Eudora for Windows. Eudora Plug-Ins are simply programs that utilize the new Extended Messaging Services API (EMSAPI) that were introduced with Eudora 3.0. EPPI makes it easier to use PGP (Pretty Good Privacy) with e-mail via Eudora. Note that EPPI does not contain any encryption/decryption routines, so it should not violate anybody's export/import restrictions. It simply calls the PGP executable with the appropriate command-line options in order to perform the requested functions. It's also 100% free! Get a copy, give it to your friends, spread it around...

1 0

Re: Laptops and TEMPEST
by Lucky Green 17 Dec '03

17 Dec '03

[Sorry, I don't have the attribution for the fist quote. The remainder of the post was authored by a friend of mine who retired from decades in military SIGINT. He allowed me to forward it to the list.] >>> don't emit enough radiation for Bad Guys to read it. CRTs are well known >>> as emitters of easily decoded signal, but people have occasionally >suggested >>> on this list that laptop LCD screens are much quieter. I now have a data >>> point on this one, and basically, it ain't so. Look - if it uses electricity; if there is an oscillator anywhere innit; if there is a ground loop in the circuit design, if there are make/break contacts anywhere - It will radiate, and the amount it radiates is directly proportional to the basic power source ... And circuit board traces are getting so damned close that engineers I know/knew were worried about friggin' arc-over at 3 volts. By now, may be even closer and voltage worries lower... So we have a problem. The only computer I know of that is (at this date) leak-proof is the biological one 'twixt one's ears. And soon, maybe not even that. Those who laugh at the paranoiacs who wear aluminum helmets and wear shoes with a static strap to the sidewalk may be laughing out the other side of their moufs too soon... As for any government directives requiring companies to make computers leak, I know of none, but CAVEAT: I've been retired from source info since '91, and most of my friends/fellow engrs who occasionally got together for a few brewskis and BS sessions over in Mt. View have either gone to better jobs (more $$$), transferred back east, or inconsiderately died. So, who knows? And of course, the ability to detect this RF/RFI/EMI leakage from your information processor is similarly dependent on the sensitivity of the equipment you're using for detection. I've seen absolute magic performed using a Wullenweber antenna, and that is NOT state-of-the-art equipment any more (ca. 1965-70), even tho the DoD keeps throwing money at it in upgrades (affectionately called 'the elephant's cage' by those who worked with it). If you really need to keep your information processing "private", then you can either isolate yourself inside a double-shielded room of solid copper; power everything with batteries; have no wires leading out of that room; make damned sure the door has the nice secure wiping strips to complete the shield when you close it -- or move your information processor into the middle of a whole bunch of the same or worse RF/RFI/EMI emitters, and just _maybe_ your data will get lost or become inaccessible because of the overload of the detection equipment by much larger interference fields. Or use paper, pencil, and one-time pads and burn everything that's done "in the clear" and really scrunch the ashes into dust. [Again, I am not the author of the above post.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://ourworld.compuserve.com/homepages/justforfun/prime.htm

4 3

[Fwd: Returned mail: User unknown]
by Rosario Family 17 Dec '03

17 Dec '03

1 0

wealth and property rights
by varange＠crl.com 17 Dec '03

17 Dec '03

If the free market is a good thing, that it's a democratic way of getting the best to the top of the economic ladder, then I see no reason why this should not also apply to politics. The people have every right to use democracy to establish a non-democratic system re: abolishment of the wealthy as a class and sentencing the entire Forbes 400 and their underlings to 25 years at forced labor, say 16 hour days at picking vegetables under the pain of the knouted whip. No Libertarian could oppose the use of the political free market of democracy for undemocratic ends; that would violate the spirit of liberty! -- Cheers!

1 0

Re: cypher-PUNKS...
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: dlv(a)bwalk.dm.com, cypherpunks(a)toad.com Date: Sun Dec 08 12:22:55 1996 > Timmy posted a series of message via anonymous remailers > praising himself and calling himself "a genius among geniuses" or some > such. That charge is every bit as foundless as the charges that you are responsible for the "A Daily Warning Regarding Tim May" posts of a while back, or the current round of remailed messages featuring the sickeningly cutesy ASCII graphics at the bottom. OTOH, if you've discovered a way to gain access to the remailers in such a fashion as to prove those messages originated from Tim May, please share. (It just might be crypto-relevant, which would be a small miracle on the cypherpunks list these days :) > What a moron. I'm not even touching that sentence. It's just too tempting. - ----- David Smith, Thinker of Deep Thoughts :) http://www.prairienet.org/bureau42/library.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqsHlnEZTZHwCEpFAQF7iwf9Ers31ZMzVyKglW2DON71s/x9w9iqPlzV ISWZLyJPNjzUkrhg67XGAuumaJB+gmSYmnnn4xVfW1bmBHD2r3p+d0zG7sE0vc/e M2YlMq7b3oUv7XcRRRwAycasboqidpsNoQUq3eiwcraHessYIKSm6PezOgjB+DOG rC9u+zirILrjmS7F6wizHB5Eex/VnK9kwbBmpOmGVPuS+muxeEF1GONeuRI+cibD Q0M8PqTyPuSA/T2AD6IIH51hAf0+nTxrxUzfioK8/OAMYnk3gdhJzsi7SfK8fzdJ SjqdqI5fJ4RGVy7p3GHthnS8d70VMcoTwaWAeETQvsuugd24bLowYg== =yaDS -----END PGP SIGNATURE-----

2 1

cause for alarm
by Rich Burroughs 17 Dec '03

17 Dec '03

The dec96 issue of _cause for alarm_ has hit the web. You can get to it via the home page, at: http://www.teleport.com/~richieb/cause/ _cause for alarm_ is a zine which explores threats to freedom of speech, as well as other online freedoms. This month's features focus on the persecution of Bernie S, and the landmark Bernstein v US Department of State crypto case. Past topics have included a primer on starting local activist groups, Intel's hosing of Perl wizard Randal Schwartz, and the Church of Scientology. Also, interviews with prominent Net activists. I'm seeking contributions for future issues. If you'd like more info, point your web browser at: http://www.teleport.com/~richieb/cause/submit.html Or send email to richieb(a)teleport.com with the words "submission guidelines" (without the quotes) in the subject line of your message. Rich Burroughs Editor and Publisher, cause for alarm http://www.teleport.com/~richieb/cause/

1 0

Re: PICS is not censorship
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:02 PM 12/7/96 -0800, Timothy C. May wrote: >So, as long as PICS is fully voluntary, and I mean _fully_ voluntary, civil >libertarians will likely not object. After all, it's just a system _some_ >other people (maybe even most) are voluntarily adhering to. However, the >pressure to stop "rogues" from "subverting" the PICS system by either not >using it, or by deliberately monkeywrenching it, will be enormous. The last time I looked at PICS, there was a mode where sites were checked against a third party "PICS server", and a mode which used signed ratings. Now I am not saying these modes can't be hacked. I don't remember the details well enough. But they should be somewhat resistant to problems with false self-rating. (How these "PICS servers" and "Rating signers" keep up with the number of sites and the growth of web page publishing is not at all clear. It would seem to me that it would require many people. Perhaps the Christian Coalition can put together a cooperative effort among their members.) Note that the "PICS server" approach has major privacy problems. However, I don't think that many censors are interested in privacy, so they may not be a barrier to censorious parents. ------------------------------------------------------------------------- Bill Frantz | I still read when I should | Periwinkle -- Consulting (408)356-8506 | be doing something else. | 16345 Englewood Ave. frantz(a)netcom.com | It's a vice. - R. Heinlein | Los Gatos, CA 95032, USA

1 0