December 2003 - cypherpunks-legacy

Re: ANNOUNCEMNT: February 1997 keysigning session
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <199702072349.PAA20677(a)peregrine.eng.sun.com>, on 02/07/97 at 05:49 PM, Ed.Falk(a)Eng.Sun.COM (Ed Falk) said: >We have enough people who want to have a PGP keysigning session at tommorrow's >meeting to make it worthwhile. We'll probably be doing it at 17:00 or >thereabouts. Unfortunatly I have too much work to make the 3,000 miles to get there. :( Would it be possiable at the next meeting to set up a CU-SEE-ME session for those of us who do not live in the Bay Area? Thanks, - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: I'm an OS/2 developer...I don't NEED a life! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Registered User E-Secure v1.1 0000000 iQCVAwUBMvv9D49Co1n+aLhhAQE1lgP/Sh0Mszii6dvSkssMI3rTHllz+EbFrtKk k3qOPFkBSRbsaSXBTopenUjNpbbHANgzzUJRnekaUJIyZbTGRY9PF+QAFcsF/vXI 2HIjnStiyXdgESPE0YFPRiTzrkR5/18Ga2s20AlWXgaQApSSmIAhwrFWjmi1kQws y0n+CZwqa0U= =A+nO -----END PGP SIGNATURE-----

1 0

Enlightened commentary on Netizen.
by Anil Das 17 Dec '03

17 Dec '03

First, Rebecca Vesely has a special report, the main thrust of which is that three firms being allowed to export 56 bit encryption indicates flexibility on the part of the government. http://www.netizen.com/netizen/97/05/special2a.html To top it off, here are two gems from the followup discussion. http://www.netizen.com/cgi-bin/interact/replies_all?msg.37387 2. 56 ONLY A SLIGHTLY SMALLER JOKE Ric Allan (ricrok) on Wed, 5 Feb 97 11:53 PST If it takes a college student four hours to break a 40bit code it should take him/her about six hours to do the same to 56bits. Then what excuses are the government and its butt-kissing companies going to give us for not allowing *real* coding? 4. 56bits will not take 6 hours to crack Piers Cawley (pdcawley) on Thu, 6 Feb 97 05:05 PST Rick seems to be missing the point about strong encryption -- the reason that DES/IDEA encryption is hard to crack is because the key system is based on the fact that factoring big numbers is a long, slow tedious process which gets exponentially harder as the length of the number increases. What this means is that it'll probably take the college student, ooh... 24 hours to crack a 56 bit key. However, the question has to be asked, why the fuck should we non US citizens go and buy cryptographic software that is deliberately coded to allow the US government to read our mail? -- Anil Das

2 1

Re: Dear Cypherpunks /from NHK Clew
by Dale Thorn 17 Dec '03

17 Dec '03

I'm sorry I can't drive the 500 miles to the meeting, but in Los Angeles, the USA's #2 city, there are NO meetings. Sad but true. People in Los Angeles just don't comply with censorship as well as those in the Bay Area, apparently. Anyway, please don't base the whole story on what goes on at the meeting, since the people who show up at the meeting are the ones who most agree with John and Sandy. Do you know what I mean? There's an assumption in the USA, which even the cypherpunks share, that the rogue elements of the government are to be considered "innocent until proven guilty", even after the fact when they are caught and never prosecuted. Someday, when we have enough research data on this current series of events, we will be able to expose the money trail which demonstrates the motivations of the "list" owners. In the meantime, I trust you'll not be taken in by the sweet-talk you'll get in San Francisco. Sh.Hanabusa wrote: > We are a film crew from NHK, Japanese Public Television (Japan's largest > TV network). As you may have all seen the announcement posting, we would > like to attend tomorrow's CP physical meeting for filming. > We consider the "Crypto War" you are all fighting, not only a U.S domestic > issue. It is a historic process which would effect the basic order/system > of the global network society for the 21st century. > In the midst of the ongoing changes of the idea of how a nation, a corporation > and an individual ought to be, we would like to portray your assertions and > proposals through the discussions of tomorrow's CP meeting, demonstrations, > speeches and booings(just kidding..). > We assure you all that we will do our best not be of your distractions. > (I know you won't, but) I hope you don't show up with a tie and a three > piece suit just because you'll be on TV... ;-) > We look forward to the usual (or perhaps more than ever) Cypherpunkish > meeting tomorrow!

1 0

What else do I need for an Internet Server
by Otto Matic 17 Dec '03

17 Dec '03

What else do I need for an internet server? HP Vectra Towers 2 each 486 cyrex chips 50 meg processor Need high speed hard drives. These are the Tall Towers that have multiple drives, these are server towers. I think I have a router Hub. And a couple LAN cards. That's all I have. But I just got them, and I want to use them. I assume I will be using some kind of UNIX software. Thanks: otto =-=-=-=-=- Otto Matic "Fuckin' A, Miller!" Bud, Repo Man --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

2 1

The Frightening Dangers of Moderation
by Against Moderation 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well, folks, tonight I have witnessed the frightening dangers of moderation and censorship first-hand, and would like to tell you what has happened. I think there is an important lesson to be learned from these incidents. Before I explain what has happened, I want to make one thing absolutely clear. Though I've thought the moderation of cypherpunks was a terrible idea from the start and am even more convinced of it now, I don't assign any blame to Sandy. I believe he offered to moderate the list with the best of intentions, and I sincerely appreciate his efforts to try to revive what was once a fantastic mailing list, even if in my opinion those efforts have backfired. Sandy has been a valuable advocate of cypherpunk beliefs and a lively contributor to cypherpunks list for a long time. Though the moderation experiment has resulted in some terrible consequences, we can't blame him for what has happened. If the events I have witnessed tonight occured with such a high-standing member of the cypherpunks community in charge, the cause of them can only be the very nature of moderation and censorship. I don't think any of us could have done much better in Sandy's shoes. Now, what happened tonight? As some of you may recall, a month or so ago I vehemently argued against the elimination of the cypherpunks-unedited mailingt list. Some people (though no one associated with toad.com) were claiming that 3 mailing lists might be too much load, and that having cypherpunks and cypherpunks-flames would be enough. I argued that not only would the delay of waiting for a decision put alternate cypherpunks moderators at a disadvantage, it would make it farm more difficult to convince people of the moderator's honesty as there would be no guarantee that messages made it to either list. Fortunately, cypherpunks-unedited did get created (it seems no one "in charge" ever intended not to create it). Well, as it turns out, a number of messages have made it neither to cypherpunks nor to cypherpunks-flames. Making matters worse, however, not only are certain messages being suppressed from both lists, but even messages mentioning that fact get suppressed from both the cypherpunks and the cypherpunks-flames lists! Here's exactly what happened. I was beginning to believe that Dmitri Vulis had sent an (admitedly objectionable) message to the cypherpunks mailing list, but that the message had gone to neither the cypherpunks nor the cypherpunks-flames lists. Since I was under the impression that every article was supposed to go to one list or the other, and many people probably still believe that, I mentioned this somewhat startling fact on the cypherpunks mailing list, I believe in response to a post by Tim May on the same subject. Tim replied (in a message Cc'ed to cypherpunks--though I don't think it went anywhere but to -unedited), asking me in the message, "Can you send to the list, with a copy to me, the articles CENSOREDCENSOREDCENS OREDCENSOREDCENSORE?" I therefore went back through my mail archives and found a copy of the message that I believed had gone to neither mailing list. I sent it to Tim and to cypherpunks. I prepended a few paragraphs in which I asked people to confirm that the message had gone to neither mailing list. Among other things in those paragraphs, I stated that Vulis's message was "verifiably false". It was clear from the context that I was forwarding this message to ask people which lists it had gone to, not because I believed the content to be correct or even at all convincing or interesting. That message I sent, quoting Vulis's, immediately follows this message, after the line '========'. Then, tonight, I received a message from Sandy, which I include below a second '========' marker. In that letter, Sandy had explicitly aknowledged not only that he had sent Vulis's letter to neither mailing list, but that he wouldn't send my letter to either mailing list, either! He claimed that he couldn't forward Vulis's message because it was libel, and accused me of committing libel simply by quoting Vulis's message, even though I explicitly stated that Vulis's message was verifiably false. Well, this travesty must exposed, even if I can't make known all the details for fear of libel charges. I am therefore forwarding everything I can to the cypherpunks mailing list, for all to see. As you can see, Vulis made unfounded and incorrect charges that a particular system contained a security hole. Believe me, if I could get into the details of the case I could convince you easily that his claim is not true. However, since even quoting that claim apparently opens me up to charges of libel, I can't give you the details. Thus, I have censored (by overriting original text with the letters CENSORED) any portion of quoted messages that might give you an indication of what system Vulis actually claimed had a security hole. This censorship should not, however, affect my main point, and the lesson that I hope we can all take away from this. When it comes down to it, the details of this case do not matter. What does matter is that even when the "good guys" attempt benign censorship, it can have frighteningly far-reaching effects on people's ability to discuss otherwise reasonable topics such as the mechanics of the cypherpunks list. I generally dislike censorship and moderation, but the consequences of the cypherpunks experiment have gone far beyond anything I could have imagined. In closing, let me reiterate that I don't think most of this is Sandy's, John's, or anyone else's fault. Given the knowledge I have of this case, I believe Sandy has unwittingly found himself ensnarled in a nasty legal situation where, for fear of legal reprisal he must block articles that he has a moral obligation to send to cypherpunks-flames. I certainly don't envy his position. [To moderator Sandy: I believe we must get the content of this message to the main cypherpunks mailing list. I have done everything I can to ensure that the message contains no libel. If, for some reason, you still can't send it on to the main cypherpunks mailing list, can you please tell me specifically which parts cause problems. I will the CENSOR them out and try again. This message contains important, highly relevant information for the cypherpunks community. Please help me do what it takes to get it accepted by the moderation process. Thanks.] ======== To: tcmay(a)got.net CC: cypherpunks(a)toad.com Chain: nym=antimod In-reply-to: <v03007802af21505d61f5(a)[207.167.93.63]> (tcmay(a)got.net) Subject: Re: Is Sandy really censoring criticisms of CENSORCENSOREDCENSOREDC? Okay, I went through my old mail, and I'm fairly sure this is the message. I'm convinced it never went to the flames list, and now that I've found out I'm on the -unedited list after all, I think it probably didn't go to the regular cypherpunks list either. Can people on the various lists confirm this for me? Given the total lack of technical content, the flamey nature of the article, and the fact that it is verifiably false (CENSOREDCENSOREDC ENSOREDCENSOREDCE), I can see people arguing it should have gone to - -flames (though I would probably disagree). However, I don't want to debate that. What I object to more strongly and think is wrong is the fact that it went to *neither* list. A lot of people out there are subscribing to the cypherpunks-flames and cypherpunks lists thinking that they will see everything that gets rejected (albeit with a substantial delay). If this is not the case, it should be made clear. Otherwise, it's not moderation, but dishonesty. - -- >From cypherpunks-errors(a)toad.com Thu Jan 30 17:26:50 1997 From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) Subject: Security alert!!! To: cypherpunks(a)toad.com Date: Thu, 30 Jan 97 16:15:21 EST Organization: Brighton Beach Boardwalk BBS, Forest Hills, N.Y. Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id OAA18833; Thu, 30 Jan 1997 14:17:05 -0800 (PST) Received: from uu.psi.com (uu.psi.com [38.9.86.2]) by toad.com (8.7.5/8.7.3) with SMTP id OAA18824; Thu, 30 Jan 1997 14:16:39 -0800 (PST) Received: by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via UUCP; id AA02017 for ; Thu, 30 Jan 97 16:57:10 -0500 Received: by bwalk.dm.com (1.65/waf) via UUCP; Thu, 30 Jan 97 16:19:19 EST for cypherpunks(a)toad.com Comments: All power to the ZOG! Message-Id: <aw5c2D4w165w(a)bwalk.dm.com> Sender: owner-cypherpunks(a)toad.com Precedence: bulk Lines: 19 WARNING: There's a rogue trojan horse out there on the internet CENSOREDCENS OREDCENSOREDCENSOREDCEN. It's actually a hacked-up version of CENSOR with a backdoor, which allows hackers (or whoever knows the backdoor) to steal credit card numbers and other confidentil information on the Internet. Be careful! Always use encryption. Do not send confidential information 9such as passwords and credit card numbers) to any site running the trojan horse CENSOREDCENS. In general, beware of "snake oil" security products and hacked-up versions of free software. Please repost this warning to all relevant computer security forums. - --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps ======== X-From: sandfort(a)crl.com Sat Feb 08 00:56:23 1997 Date: Fri, 7 Feb 1997 16:45:31 -0800 (PST) From: Sandy Sandfort <sandfort(a)crl.com> To: Against Moderation <antimod(a)nym.alias.net> Subject: Re: Is Sandy really censoring criticisms of CENSOREDCENSOREDCENSORE? In-Reply-To: <19970207220720.15530.qmail(a)anon.lcs.mit.edu> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hi, On 7 Feb 1997, Against Moderation wrote: > What I object to more strongly and think is wrong is the > fact that it went to *neither* list. Unfortunately, it's not as simple as that. As soon as I can arrange it with John, I am going to stop moderating the list. In the interim, I *will not* be sending your post onto either the Flames or the Moderated lists. This is done for legal reason. As it is, you have already published a libel on the unedited list by repeating Dimitri's libel. This exposes you to legal liability, but as an anonymous poster, you are somewhat insulated from the consequences of your act. If you would like to PRIVATELY discuss this matter with me, I would not mind going into more detail with you. Suffice it to say, I any re-publication by me of Dimitri's libel would expose John and myself to legal liability and could also act to insulate Dimitri from liability as a result of CENSOREDCENSOREDCE NSOREDCENDOREDCENDOREDC. Take care, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ======== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMvwBkICHQnqYPZ9VAQGf+gP/cCw3gs23pL36RIi7OTRpZaM8E7D55hVE I7H8VX4u9TdWpPJPw0Q+ZqftRxn2Ancf/6RzqZA03jSnNCqUqkEhrPSTnq4qmZmx M+BGMI/3Y3Gl3Aj7YQhpcQLEaCLMMkQ4ddG5VVujeFwMs8gWt8Zi80aytD5dLenF ykV0cj2DsWs= =ezEz -----END PGP SIGNATURE-----

2 1

Re: 40-bit RC5 crack meaningless??
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:37 AM 2/7/97 -0500, Vin McLellan wrote: > Now, an international institution which buys and bets the bank upon >US-exportable (40-bit) cryptography probably deserves what it has bought: > [...] even 56-bit keys -- whatever the algorithm! -- offer only "minimal" security. >(What Goldberg did in hours, many could do in a days or weeks with much >less equipment. You don't bet the bank on 40-bit crypto, unless you're, ummm, accepting credit cards over wimp-configured sessions of SSL. (You, as merchant, may not lose if there's a forgery, and your customer's loss may be limited to $50, but the bank's loss isn't limited except by how fast they can block thieves.) While banks get Extra Slack on crypto exports, and can use 56-bit DES, they've got more serious adversaries - building a $1M machine to win a $1000 contest is a bit expensive for the average grad student, but it's a perfectly reasonable investment if you're planning to rob banks of millions of dollars with it, especially if you think you can either siphon the money off slowly while hitting a lot of banks or else make a really big haul all at once. Banks aren't the only kind of company with big money floating around; stockbrokers, commodities traders, purchasing departments of big companies that might not notice that they're buying a few percent more parts, and all sorts of other large companies are targets for crypto-cracking thieves. Because well-funded thieves can do this kind of financial damage, we have a legitimate-sounding spin on "Federal law enforcement's job includes preventing large-scale theft, and they're letting their political agenda get in the way of doing their job. Sure, 56-bit keys are harder to crack than 40, but well-funded crackers could use the same techniques Ian did." Either method of theft requires being non-stupid enough not to get caught afterwards (like the $(24?)M computerized bank job last year), and having your "partners" not rip you off; a big heist also risks detection by tracking chip purchases, and provoking the Feds into banning "ASIC Laundering" and criminalizing illegal possesion of field-programmable gate arrays and such paranoid silliness. ..>> the same Strassmann Yeah, him :-) > (It was a usefully overheated hook for some article on compsec, but >I don't think I ever used it. Reminded me too much of warnings that >someone was bound to someday taint the city water reservoir with LSD;-) But we _were_ planning to enhance the water that way, back in the 60s! :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

What else do I need for an Internet Server
by Otto Matic 17 Dec '03

17 Dec '03

What else do I need for an internet server? HP Vectra Towers 2 each 486 cyrex chips 50 meg processor Need high speed hard drives. These are the Tall Towers that have multiple drives, these are server towers. I think I have a router Hub. And a couple LAN cards. That's all I have. But I just got them, and I want to use them. I assume I will be using some kind of UNIX software. Thanks: otto =-=-=-=-=- Otto Matic "Fuckin' A, Miller!" Bud, Repo Man --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Re: Metzger, Denninger square off
by Roy M. Silvernail 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In list.cypherpunks, ericm(a)lne.com writes: > Damaged Justice writes: >> administration about this." Barring that, Denninger will lobby >> Internet service providers around the country, asking them not to >> recognize the new GTLDs. "There is no reason to support it. We will do >> everything in our power to convince ISPs not to go along," he says. > If I didn't already think that Karl was an idiot, I'd sure think so after > reading this. Concur. When I went after my domain name last year, I was effectively forced into taking a .com, which was the _last_ TLD I wanted. (first choice was .net, but that's supposedly now only given to ISPs) I'd happily accept scytale.nom, especially since it's doubly cryptic. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com, which works now -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMvvDqBvikii9febJAQE23AQAle+xfNgFCof8CjIDD1VxKv62TbHz5itj 7z2aAPaOD9IT812heFSKn+wYteETpWKWy6iGI/cKyR4siEtqJq2IiqaEs6bjSkIL 2C2ErK0FaKmnW14rUNX2XdSGHlqBGfh3rkjKM5UrHd+PBakNQKIIByPvTxn/Stsl /XzWZBZyAG0= =qAs2 -----END PGP SIGNATURE-----

1 0

Congressional cell phone security hearing
by Dan Veeneman 17 Dec '03

17 Dec '03

Hyperbole flew hot and heavy during a February 5 hearing on cellular telephone privacy chaired by Louisiana Republican Billy Tauzin. The House Commerce Subcommittee on Telecommunications, Trade, and Consumer Protection held a hearing titled "Is anybody listening? You betcha." Subcommittee members were shocked, just shocked to learn that, according to a hyper-animated Thomas Wheeler (president of the Cellular Telephone Industry Association), Americans are engaged in "electronic stalking" of cellular telephone users. Further details of CSPAN pandering and Ed Markey's (D-MA) Humpty Dumpty imitation ("words mean whatever I want them to mean") elided. Some notable moments: Representative Cliff Stearns (R-FL), during a discussion about encryption, called PGP "a darn good program." Jay Kitchen, head of the Personal Communications Industry Association, related an (apocryphal?) story about MI5 requiring 2 Crays to run for 3 days to break a single GSM. Jim Kallstrom, Assistant Director FBI and head of the New York field office, woodenly delivered his (IMHO unfocused) testimony and reported that on the first day of the TWA Flight 800 crash investigation he determined that the news media knew more than they should, so he confiscated the cell phones of the FBI agents and locked them away, under the (reasonable) presumption that reporters were listening to FBI cell phone calls. Jimmy also reiterated the FBI line that their new wiretap requirements were reasonable and necessary to protect American citizens from terrorists. Dan dan(a)decode.com -- cypherp(a)decode.com (Dan Veeneman) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

1 0

Re: Sandy suppresses truth about his moderation policy
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 7 Feb 1997, Igor Chudov @ home wrote: > Below are some interesting facts implying that: > > 1) Sandy uses a bot to reject articles of people he does not like I see no evidence to substantiate this claim. People who would be most likely to get auto-blocked have managed to get at least one post sent to the moderated list. > 2) When I exposed him with an article showing all Received: dates, > he > a) rejected the article exposing him The only thing your previous post proved is that toad.com has a very little delay between receiving and sending mail to cypherpunks-unedited. Notice that the post in question does not have an altered Message-Id and the sender is set to owner-cypherpunks, not owner-cypherpunks-unedited which appears in all messages sent to the flames list. > and > b) changed his moderation software so that Received: headers > for the cypherpunks-flames do not show the times when > messages came in The modification was made after there was the problem of the received headers exposing the supposedly secret outgoing destination address of the moderated list. This change was certainly made before February 6, the date the post in question was posted. Also, John would have made this modification; not Sandy. Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMvwF/CzIPc7jvyFpAQE0lwf8Dx8bY2WUKDZQ4piOc0XRgY0LpbCOcbXZ FGMOlR9o1Hk9Z3DlCtNReM1YF9WoeHkc4Z6wDtDu0XJunB5Rj4Hwa1qZmvY2a2S/ IkkBDp+RyA1QpTsEU1fQjNJR0LQBoIa/fVKyAzKJSD66tCHHneIvc4IrXAciobE1 9WX+h6r5wBjXkVEI9mgehrprqBRIRaNgURunyCavbXPbiEoS7bflBfKBLurj7OQf uAERvyX6YYv7ZaycV9Qjx33ozrSrMzARbahx+ryWrO5MUuoZ9fabyeS61xr141Cv QCPRyxq1Pl2TcJF2otpxpCuzoty4VzEONDib+O+BkNDPo9sGx8a/8w== =J1Sw -----END PGP SIGNATURE-----

1 0