December 2003 - cypherpunks-legacy

Slow Cypherpunk Day
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Is cypherpunks-outgoing-ksiuw(a)toad.com where articles should be sent to bypass the censors? Testing 1 2 3... Cocksucker Armenian Mayonaise Gilmore Faggot Crypto Testing 1 2 3... We now return you to your regular programming... -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

4 3

Re: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Sean Roach <roach_s(a)alph.swosu.edu> wrote in article <5bv7g8$fhl(a)life.ai.mit.edu>... > At 03:44 PM 1/17/97 -0600, Igor Chudov wrote: > > It is limited, both accounts have to have the same password, (four > character, numeric.) If I want to transfer funds from another persons > account to one that I control, all I have to do is change the password on > one of them to that of the other, transfer funds, and change the password > back. By the time that my victim found out, (via the little letter "per > your request, $xxx was transferred to accnt#123456 from accnt#7890"), I > would be long gone. Depending on the country and bank you can probably perform almost any transfer you like by fax. I moved my pension from one bank to another simply by sending a fax. I have done similar transactions with Swiss, German and UK banks. For some reason the fax is considered to be a practically infallible authentication device. Quite why is beyond me since it should be obvious to anyone that all one needs to fake a fax is a photocopier, document signed by account holder, paste and scissors. You get everything needed on a signed cheque. Phill.

1 0

Using the political opportunity Was: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Sarah L. Green <greens(a)hiwaay.net> wrote in article <5bo2df$7ui(a)life.ai.mit.edu>... > On Thu, 16 Jan 1997, Phillip M. Hallam-Baker wrote: > > > > It was a conference call but over a cellular phone. Martin had hacked his > > Radio Shack Scanner using a well known technique. He had a radio ham > > license. > > > Phill > Actually I'd love to see this go to court & have the law itself > tossed out. How many years have the airwaves been free? Now it is > illegal to listen on the cellular frequencies. Well I would love to see the case go to court but I prefer to see someone else being harassed. I don't imagine for a minute that anyone will want to take it to court though. Newt can hardly want his crookery to continue to be before the public eye. He wants it buried as soon as possible so he can make similarly "arcane" charges "nobody understands" against Clinton. Interestingly the tax law that Newt broke was the use of non profit funds for political purposes. Newt should know all about these since the Republicans used these laws to shut down political comment by the likes of the Sierra club etc under Reagan. I know several people who used to be involved in non-profits who either resigned or changed the status of the group because the cost of administration and risk of politically motivated prosecution was not worth the tax advantages. Given the "butterfly under the wheel" nature of the Republican attack I would expect jury nullification in a big way. Meanwhile there would be several weeks of questions asking why Newt is not being prosecuted, only the Martins. Despite the fact that I don't think the Democrats are smart enough to mount such a conspiracy it would be a bloody good one if they had done. I think that the challenge the crypto lobby must take on is to use the event to raise public consciousness for crypto rights. What we probably need is a single issue lobby group that the media can call on for this and only this issue and nothing else. The energies of the CDT and EFF are inevitably spread between this and other issues such as the CDA. The problem is that a journalist does not immediately think EFF or CDT when a cellphone case comes up. A single issue crypto lobby could fill that purpose. Phill

1 0

RE: Take it to sci.math
by Blanc Weber 17 Dec '03

17 Dec '03

From: someone using WinSock Remailer Will all those people who are talking about set theory and the countability of various number systems take their discussion to sci.math, please? 'Cuz 1) All that stuff is irrelevant to crypto, its science or politics. .................................................. And as everyone on this list acutely knows, neither math, science, nor politics has anything to do with crypto. In fact, history bears out the fact cryptologists have neither cause nor reason for what they do. It is a useless by-product of excess mental activity for which only a few can find application, while fewer yet have any concern for its ramifications in a globally connected society of lightning communication. .. Blanc

2 1

Re: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Sean Roach <roach_s(a)alph.swosu.edu> wrote in article <5bv7g8$fhl(a)life.ai.mit.edu>... > At 03:44 PM 1/17/97 -0600, Igor Chudov wrote: > > It is limited, both accounts have to have the same password, (four > character, numeric.) If I want to transfer funds from another persons > account to one that I control, all I have to do is change the password on > one of them to that of the other, transfer funds, and change the password > back. By the time that my victim found out, (via the little letter "per > your request, $xxx was transferred to accnt#123456 from accnt#7890"), I > would be long gone. Depending on the country and bank you can probably perform almost any transfer you like by fax. I moved my pension from one bank to another simply by sending a fax. I have done similar transactions with Swiss, German and UK banks. For some reason the fax is considered to be a practically infallible authentication device. Quite why is beyond me since it should be obvious to anyone that all one needs to fake a fax is a photocopier, document signed by account holder, paste and scissors. You get everything needed on a signed cheque. Phill.

1 0

Re: One time pads and randomness?
by Bill Stewart 17 Dec '03

17 Dec '03

Welcome! You've asked a Frequently Asked Question, so you're obviously new here, but you're also thinking, so we'll cut you some slack :-) A good book on cryptography that you should read is Bruce Schneier's "Applied Cryptography", which talks about both math and practical issues. At 09:51 AM 1/18/97 -0500, AaronH4321(a)aol.com wrote: >I want to use a one time pad pased crypto system. I understand that the >randomness of the pad genorator is key to security (other than lossing >the keys). What I want to know is if I use a psuedo-RNG that .... Pseudo-Randomness isn't Real Randomness, and OTPs need Real Randomness. [Von Neumann said that anyone using mathematical methods to generate random numbers "is, of course, in a state of sin."] If you've got a Pseudo-RNG, your random number generator has some state at step 1 that totally determines the output at steps 2...infinity. This means that anybody who can determine the state of the PRNG at step n can decode all messages for steps n+1, n+2, ...., and often for steps 1....n-1 as well (depending on the particular PRNG.) If you're got Real Randomness*, even if you know the value of the pad at step n, it tells you entirely nothing about any other step. To make it worse, the popular PRNGs turn out to be annoyingly easy to crack, i.e. to determine the state from a small number of samples. >Say I create a 1 million character one time pad that passes all of the >randomness tests. It is "truely random". Unfortunately, passing randomness tests doesn't tell you a pad is "truly random" - it just eliminates the blatantly easy stuff. For instance, x[n+1] = Hash( x[n] ) or X[n+1] = Encrypt( x[n] ) for a cryptographically strong hash function or encryption like MD5 or SHA or 3-DES will pass randomness tests just fine, but it's still totally deterministic. Still not a OTP. However, say you create the pad from really random sources like flipping lots of coins or counting gamma rays, and haul it to your computers by well-armed guys with briefcases handcuffed to their wrists. >"A" grabs a chunk of the one time pad starting at a random point and >encrypts it....There "B" moves to the random point and begins decryption. If the pad is _really_ random, and you're sure nobody's seen any of it, then there's no difference between starting at a random point and starting at the beginning, and the bookkeeping is much cleaner. >During to process both computers mark that section of the OTP used so >that they don't retransmit with it. I realize this has a limited amount >of messages before it is used up. But would this be secure? Yeah, you've got it (once you remember to use a really random pad so there's entirely no relationship between bits n and n+1.) And you've also hit one of the basic difficulties with using OTPs, which is making sure you only use the once, and that this means that sometimes you run out AND YOU STILL CAN'T USE THE PAD AGAIN. [*Some philosophers will argue that there isn't any Real Randomness, that there's just a deterministic State Of The Universe that's more complex than you happen to know, and some will rant about Quantum Mechanics, and others who actually have some clue about Quantum will tell you that it doesn't get you off the hook; in any case, as long as the universe is messy enough it's be close enough for government work.] The NSA was able to crack a bunch of Russian OTP transmissions back in the 50s (the project name was Venona, and it was recently announced) because the Russians did two major things wrong: They used pads more than once when they were sloppy or out of new pads, and they didn't use very good randomness - clerks banging "randomly" on typewriters generate data with more correlation and less even distribution than they'd expect, and in nearly-pre-computer days they weren't able # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Eudora PGP
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:07 AM 1/18/97 -0800, Some Anonymous Remailer User wrote: >If somebody wants to play with the new Eudora PGP >but don't have Eudora Pro 3.0, it is available at >ftp://ftp.catalog.com/aussie/biscoe/Eudora30.zip Rather than ripping off a commercial product, from a company that's nice enough to give away free versions, you can get Eudora Lite 3.0.1 from www.eudora.com; I haven't yet installed PGPmail with it, but it should work, and meanwhile it's nicely junking the more common flamers. It is a beta version, but there should be another out soon. >Btw, is it legal for a moderator to let messages >like this one through to the list...? This list isn't currently moderated. The legality if it were is unclear. > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Keyword scanning/speech recognition
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:34 AM 1/19/97, pgut001(a)cs.auckland.ac.nz wrote: >I was talking to someone recently about the feasibilty of >keyword-scanning phone conversations. He thought it was probably still >beyond the reach of current technology, I thought it wasn't I'd guess it's in-between, and it depends a _lot_ on how error-tolerant you are - do you want to catch them _all_, or just reduce the set of tapes that you'll have humans listen to later, since you're trolling for leads but don't mind missing the occasional one? Speaker-dependent isolated-word recognition is pretty doable. Speaker-independent small-vocabulary isolated-word is also pretty good (though the AT&T calling-card bot does a better job when I read it numbers than when I rapidly tell it "calling card" early in its dialog.) Connected-word is a lot harder. But word-scanning isn't the only thing "They" would troll for - it's probably easier to look for possible matches for specific voices, since you don't have to be too accurate. You want to catch Big Joey's calls from Vinnie, but don't care about his wife's calls. Some of the problems are with modeling speech well enough to do good algorithms; some are just getting enough horsepower to do it in real time. Can "They" afford enough DSP chips to do the job? They certainly can't follow a significant fraction of domestic traffic, and probably not even of US-to-overseas international traffic, but they may be able to pick out calls to/from phones of usual suspects, at least if they're mainly trying to filter for what tapes to listen to. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Gilmore and Sandfart (spit) died of AIDS
by Bovine Remailer 17 Dec '03

17 Dec '03

that's why there is no traffic.

1 0

RE: Take it to sci.math
by Blanc Weber 17 Dec '03

17 Dec '03

From: someone using WinSock Remailer Will all those people who are talking about set theory and the countability of various number systems take their discussion to sci.math, please? 'Cuz 1) All that stuff is irrelevant to crypto, its science or politics. .................................................. And as everyone on this list acutely knows, neither math, science, nor politics has anything to do with crypto. In fact, history bears out the fact cryptologists have neither cause nor reason for what they do. It is a useless by-product of excess mental activity for which only a few can find application, while fewer yet have any concern for its ramifications in a globally connected society of lightning communication. .. Blanc

1 0