December 2003 - cypherpunks-legacy

Telecomm Act Reference (Was Re: Newt's phone calls)
by Sarah L. Green 17 Dec '03

17 Dec '03

>From Damien Thorn's 'A CELLULAR COMMUNICATIONS PRIMER' (at http://www.l0pht.com/~drwho/cell/texts/thorn1192.txt) To calm fears that cellular calls were not private, the cellular industry lobbied congress into passing legislation known today as the Electronic Communication Privacy Act (ECPA) of 1986 which makes it a crime to monitor cellular phone calls and a host of other transmissions like digital pagers. This law is used by cellular equipment dealers and service providers to reassure customers that their conversations will remain private. Sarah. ============================================================================== Sarah L. Green Hey, I never claimed to be >>osprey<< Madison, AL (USA) a genius nor a typist greens(a)hiwaay.net ==============================================================================

1 0

Re: Key Revokation Scheme
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:32 PM 1/14/97 -0500, harka(a)nycmetro.com wrote: >I started thinking about the issue, how to set up a system to have >somebody else revoke your key for you, if you don't have the means >to do so yourself. >The possible case I had in mind was, what if you're maybe a >dissident, you get arrested and your apartment (incl. disks/keys) >gets raided. You don't have any means to revoke the key yourself, >don't even have e-mail in general, and with the "one phone call", [.... method deleted .... lawyer, alice, bob, ... ] Too complex for what you're really doing. Give your lawyer a floppy with the key revocation certificate and a yellow sticky about how to call Alice or Bob for help if your lawyer's not computer-literate enough to follow the README file. If you're paranoid about the cops getting your unindicted co-conspirators' names, use PGP Inc. or some computer consultant instead of Alice and Bob and have your lawyer pay their per-hour rate. On your One Phone Call, tell him to get the floppy out of the sealed envelope in his safe and use it. Key revocation certificates don't leak your private keys, so the only risk if the Bad Guys get a copy is denial of service, including the pain of rebuilding all your connections, etc.; it doesn't leak your communications or allow them to forge mail. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: Forgery detection
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy C. May's reheated, refurbished, and regurgitated cud is completely inappropriate for the mailing lists into which it is cross-ruminated. |||~ (0 0) _ooO_(_)_Ooo__ Timmy C. May

1 0

Re: Newt's phone calls
by Sean Roach 17 Dec '03

17 Dec '03

At 10:45 PM 1/15/97 -0500, Rabid Wombat wrote: > > >On Mon, 13 Jan 1997, Declan McCullagh wrote: > >> Don't be too sure that crypto is that far beneath the radar. I spent >> Thursday through Saturday at an annual privacy conference for activists >> from around the country, and they understood the principles. Their >> voicemails were filling up with calls from reporters last Friday about the >> Gingrich incident, and I know they were talking crypto. > ... > >"Call Privacy and Security" are listed in bold, with "Say goodbye to >eavesdropping" right below. Don't sell the public short; even me mum >knows her cordless phone is insecure. ;) > I had to tell my sister not to use the cordless phone to use the automated banking services that our bank has available on grounds that transfers are also available through the same service. Our father is a math teacher, computer hobbyists since 1979. Both of my parents have college educations. My sister pegged the scales on the state distributed proficiency tests. Yet she knows practically nothing outside of her field. I will probably have to show her the values of cryptography before she actually has any patient records to deal with, (she's a pharmacy major.)

3 2

Re: UNSUBSCRIBE
by ed.falk＠Eng.Sun.COM 17 Dec '03

17 Dec '03

Could someone help this luser? Is he responding like this to every post on the list? ----- Begin Included Message ----- >From spooke(a)ita.flashnet.it Fri Jan 17 12:44:24 1997 X-Sender: rm02129(a)ita.flashnet.it Mime-Version: 1.0 Date: Fri, 17 Jan 1997 21:45:00 +0100 To: ed.falk@Eng (Ed Falk) From: Spooke <spooke(a)ita.flashnet.it> Subject: UNSUBSCRIBE globalkos.org >> >> Hi, my name is Tod, and I really want to be a cool hacker, ... > >This has *got* to be a troll. Nobody could be this clueless. > > >Well, actually, they could. > > ----- End Included Message -----

2 1

Enough is Never Enough -- pro-CDA alliances, from TNNN
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 17 Jan 1997 18:04:35 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Enough is Never Enough -- pro-CDA alliances, from TNNN [Attached are two excerpts from the article. For the rest, check out: http://cgi.pathfinder.com/netly/textonly/1,1035,549,00.html --Declan] ******** The Netly News Network http://netlynews.com/ Enough Is Never Enough By Declan McCullagh (declan(a)well.com) January 17, 1997 A broad coalition of conservative and anti-pornography groups and individuals will file legal briefs next Tuesday in the Supreme Court supporting the government's defense of the Communications Decency Act, The Netly News has learned. The alliance includes longtime supporters of the act, such as Enough is Enough, Focus on the Family, and the National Association of Evangelicals. Members of Congress will join a separate brief that the National Law Center for Children and Families is preparing. But a letter from the attorney representing the coalition asked the ACLU for permission to file a brief "on behalf of" 59 plaintiffs, including such unlikely participants as the National Association for the Advancement of Colored People, PBS, SafeSurf... and Netscape. Netscape? The company that lobbied against the CDA? A firm with a reputation of putting their balls on the chopping block when fighting for Net-issues on Capitol Hill? Netscape was as shocked as I was to learn about their participation. "It wasn't authorized by me or my office. This is flabbergasting," Peter Harter, public policy counsel for Netscape, said. "I'd be crucified if this happened." [...] In their brief, which argues sociological rather than legal points, the groups hope to highlight the "dangers" of pornography online. They plan to supply the court with "legislative facts" to support the position Congress took when crafting the bill. The document also will include statistics discussing the effects of the Internet on children and the availability of material covered by the law. (Marty Rimm, where are you now?) Donna Rice-Hughes from Enough is Enough says: "It discusses three primary areas of our concern: letting the court know the problems on the Internet. Adult pornography, indecency, and child porn as well. A section on the harms of pornography. And a section dealing with the compliance issues: Is it feasible technically to comply with the CDA?" [...] Chris Stamper and Noah Robischon contributed to this report.

1 0

cash machine PINheads (fwd)
by Petro 17 Dec '03

17 Dec '03

------- start of forwarded message ------- Path: news.suba.com!feeder.chicago.cic.net!wolverine.hq.cic.net!news.neca.com!news.shkoo.com!news1.mpcs.com!hammer.uoregon.edu!arclight.uoregon.edu!news.bbnplanet.com!su-news-hub1.bbnplanet.com!csn!nntp-xfer-1.csn.net!news.hemi.com!news From: Tkil <tkil(a)scrye.com> Newsgroups: alt.sysadmin.recovery Subject: cash machine PINheads Date: 16 Jan 1997 11:27:04 -0700 Organization: Scrye.com Lines: 59 Sender: tkil(a)creepy.scrye.com Approved: yup. Message-ID: <m3680xfpc7.fsf_-_(a)creepy.scrye.com> References: <E3KH0p.55F(a)xcski.com> <5bh6ke$5rr(a)illuin.demon.co.uk> <5bhhd5$dfv$1(a)comet3.magicnet.net> <spberry.853431573(a)endeavor.ansci.iastate.edu> NNTP-Posting-Host: ppp2.hemi.com X-Attribution: Tkil X-Newsreader: Red Gnus v0.80/Emacs 19.34 found in <URL: http://axion.physics.ubc.ca/atm.html>: A number of security systems were developed, of which two captured most of the market. These were the IBM system, launched in 1979; and the VISA system, which extended it and was introduced shortly afterwards. These systems relate the PIN to the account number in a secret way. The idea is to avoid having a file of PINs, which might be stolen or copied. and to make it possible to check PINs in the ATM itself so as to allow transactions when it is not online to the bank's central computer site. The definitive reference is Meyer and Matyas' huge book Cryptography: a new dimension in computer data security; there is a shorter account in Davies and Price Security for Computer Networks. PINs are calculated as follows. Take the last five significant digits of the account number, and prefix them by eleven digits of validation data. These are often the first eleven digits of the account number; they could also be a function of the card issue date. In any case, the resulting sixteen digit value is input to an encryption algorithm (which for IBM and VISA systems is DES, the US Data Encryption Standard algorithm), and encrypted using a sixteen digit key called the PIN key. The first four digits of the result are decimalised, and the result is called the `Natural PIN'. Many banks just issued the natural PIN to their customers. However, some of them decided that they wished to let their customers choose their own PINs, or to change a PIN if it became known to somebody else. There is therefore a four digit number, called the offset, which is added to the natural PIN to give the PIN which the cusomer must enter at the ATM keyboard. and from <URL: http://catless.ncl.ac.uk/Risks/14.76.html>: *The Risks Digest Volume 14: Issue 76* [...] How is it possible to use an EXPIRED card to make $8000 in cash advances? It's possible because the ATM's verification center ONLY checks if the card number is on a list of STOLEN/LOST cards. If the card is not stolen/lost, the verification center then performs a verification check of the information FROM THE CARD ITSELF, not from some other database. So the perpetrators just wrote a new expiration date on the magnetic stripe of their fake card; the ATM verification center verified that the date hadn't yet passed and that was that. my apologies for the useful info, but the "yes it is" "no it isn't" bit was getting even more irritating. both of these items have quite a bit more text to them that makes for interesting reading -- i just excerpted the bits that dealt with where the PIN was verified. t. -- Tkil <tkil(a)scrye.com> emacs evangelist, hopelessly hopeless romantic "Like brittle things that break before they bend" -- The Sisters Of Mercy, _Floodland_, "Driven Like The Snow" [1987] ------- end of forwarded message ------- -- ***************** PLEASE TAKE NOTE: In an effort to reduce the amount of junk mail that I receive, I am no longer reading email sent to petro(a)suba.com. send email to login(a)encodex.com where login = petro. You send unsoliciated commercial email, and I will kill you.

1 0

RE: Airport security [no such thing]
by Internaut 17 Dec '03

17 Dec '03

snow wrote: > I say we make people fly naked and ship their stuff via UPS ;). >>shudder<< No!. A clear case of the cure being worse than the disease... I was just kidding. We do have to take on risks, like people wearing clothes, carring packages, ect. As Igor Chudov @ home wrote recently in the Newt's phone calls thread: > I would not be worried about this issue at all. The world at large is > insecure in very many respects: it is easy to find out credit card > numbers, overhear conversations, install hidden microphones, hack > into computers, etc etc. It does not mean that we should stop all > activity simply because there is "some" risk of losses. We have two seemingly conflicting desires: the desire for security and the desire for privacy. I do not call being searched "privacy" yet I do not call not being searched "security". We need to find creative resolutions to these conflicts. Of course, it is debatable if there is even an expectation of privacy on an airplane. I don't mind terrably being searched in an airport by security because I don't expect the privacy. I expect security. I don't want to die. If I have things I don't want them to see, there are other ways to get it there. I would worry if they cataloged what I had in a database and sold it to others. The service is just that -a service. It is not a right. We can travel other ways, too. My late night ramblings cease, Internaut

1 0

1997 Mac Crypto Conf registration
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: mac-crypto(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Tue, 14 Jan 1997 11:33:11 -0800 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <mac-crypto(a)thumper.vmeng.com> Subject: 1997 Mac Crypto Conf registration -----BEGIN PGP SIGNED MESSAGE----- hey all; I have posted a registration webpage for the 1997 Mac Crypto Conf at http://www.vmeng.com/mc/conf.html If you plan to give a talk there, I am looking for abtracts by end of Jan thanks Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A - ------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: Pretty Safe Mail 1.0 iQCVAwUBMtvcsfMF2+rAU+UdAQFOogP/R1/WmmAi3oEgLsC1il1OKf+7jR9j4L5U tAvhZIB6nyYpuHdP1fZ+/KfyCi4fYDmHIO4wVJo1BfbUtYL0YkIqzw/00JM8zfHR Zm9pcjSo70EDZPuypYyH+t0RlXJZj1eU0KjhAtRGeeWxAhP686wWCvz8hW4f2VfX uiLObXiqXiw= =faEk -----END PGP SIGNATURE----- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://offshore.com.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0

Re: National Security State has different standards for 'them' and 'us'
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:48 PM 1/16/97 -0500, Brad Dolan wrote: >I was distracted a bit but I believe I heard on NPR news this morning that >Colorado Guv. Roy Roemer showed up at an airport sans id and had a moment >of difficulty getting on his flight. Roemer solved the problem by showing >the Federal Permission-To-Fly checker a picture of himself in a recent >newspaper. >I thought the ill-defined (or ill-described) rules required presentation >of a _government_ picture I.D. Since when is a newspaper photo a >government picture I.D.? No, they don't, though the airlines like you to think that since it simplifies their life and it's something they can tell $5/hour bag checkers as well as higher-paid gate agents. There is no national rule that applies to everybody requiring it; each airline apparently has to negotiate with the FAA to make sure they're doing a "reasonable" job of identifying their passengers. The airline is free to make whatever rules they want. On United, I normally use my employee ID and the credit card I use to buy the electronic-ticket, which verifies reasonably well that I'm the person the ticket was bought for (by the people who told the airline they're my employer's travel agents.) If the _government_ required _you_ to have government ID, there'd be serious Constitutional problems with it; regulating interstate commerce and air traffic safety by forcing the airlines to do something they'd kind of like to do anyway doesn't have the same problems, even though it's almost _more_ offensive to a free society. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0