December 2003 - cypherpunks-legacy

Re: Key Security Question
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM wrote: > Bill Stewart <stewarts(a)ix.netcom.com> writes: > > On the other hand, if the "repairman" replaced your pgp executable > > with version 2.6.3kgb, which uses your hashed passphrase as the > > session key, you're hosed. Or if he installed a keystroke sniffer, > > or added a small radio transmitter to your keyboard, or whatever. > > Depends on your threat model. If you need to be paranoid, > > they've already gotten you.... > > If you're really paranoid, you can boot from a clean floppy and > reinstall everything from your backup tapes. You do have a > contingency plan in case your hard disk goes bad, or gets a > virus, don't you? Well, if you're in doubt, exercise it. And what if the repairman replaces BIOS ROM chips with KGBios? - Igor.

1 0

RE: Cyphernomicon by Tim May
by blanc 17 Dec '03

17 Dec '03

From: Toto I am not speaking of the sheep-mentality in regard to moderation or any other single issue on the list. I am speaking of the tendency of many list-members to fall into common ruts of thought wherein the comments and opinions of others are auto-files as this-or-that, and interpreted in that light, no matter what the actual content of their messages. ................................................ Hm, well, what's an anarchist to do about other people's psychological makeup? = I regard Igor and yourself, and a number of others, in the same light. I'm reluctant to bend over and drop my pants, waiting for you to kiss my butt, because I realize that I am just as likely to feel the sting of your toe-nailed boots instead of soft lips. .......................................... Hm, well, I'm not in the custom of doing either of those things, but thanks for the compliment! = But, under the New List Order, any strong opinion risks being thrown in the crapper as a 'flame'. ............................................... Not that I'm condoning centralized management, but I bet I could flame anyone pretty good yet by-pass the moderator. It's all in the style, you know. Some people are very delicate about what offends them - I know I could get on some particular people's nerves any day without trying. An opportunist can take advantage of another's infirmity by being perfectly polite while yet excruciatingly annoying. = Yes, but there are always members to whom these treatises and orientation of thought are 'new', and people only notice the repetiveness when they are, indeed, following these posts, which means that they must be getting some value out of them. ............................................ Oh, I wasn't condemning Tim's posts as being repetitive and boring - it's commendable that he would write about the same ideas in fresh new ways, for the benefit of the newbies and the entertainment of the oldies. But not everyone is as interested & willing (or have the time) to re-iterate this way, and with only one or a few "holding up the ship", so to speak, it leaves a lot of room for wayless bickering degenerating into unproductive ad hominems - ad absurdum, ad nauseam. You, know, Toto, I heard that there's a vacancy in the Cypherpunk Division of History & Philosophy .... .. Blanc

2 1

Re: Key Security Question
by Bill Stewart 17 Dec '03

17 Dec '03

>> My computer went into the shop a few days ago, and I was unable to take >> my PGP keys off it before it went in. What are the security risks here? >> If the repairman chooses to snoop through the files, what would he be >> able to do with my key pair? Will I need to revoke the key and make a >> new one, or will I be relatively safe since he doesn't have my >> passphrase? Passphrases are MD5-hashed into 128-bit IDEA keys and used to encrypt the secret key; there's a "pgpcrack" program out there that does dictionary-style searches to find if you've got wimpy passphrases. So if your passphrases is "secret", you lose, but if it's "fjhw;doifvjuc-[09efiu v` 2 4rnhc;ljoipcvjpoiewujfgv;loik" you're probably pretty safe, unless that's written on the yellow sticky you left on the side of the PC. On the other hand, if the "repairman" replaced your pgp executable with version 2.6.3kgb, which uses your hashed passphrase as the session key, you're hosed. Or if he installed a keystroke sniffer, or added a small radio transmitter to your keyboard, or whatever. Depends on your threat model. If you need to be paranoid, they've already gotten you.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

3 3

Re: Cyphernomicon by Tim May
by Declan McCullagh 17 Dec '03

17 Dec '03

That question is one for Tim to answer, but I should point out that philosophical anarchists are not necessarily opposed to rules, just government rules -- which this moderation policy clearly is not. -Declan On Sat, 1 Feb 1997, Dale Thorn wrote: > Toto wrote: > > 3.5.1 Contrary to what people sometimes claim, there is no ruling > > clique of Cypherpunks. Anybody is free to do nearly anything, > > just not free to commit others to course of action, or claim > > to speak for the "Cypherpunks" as a group (and this last > > point is unenforceable except through reputation and social > > repercussions). > > 3.6.3 "Why isn't the list moderated?" > > ...hardly consistent with many of our anarchist leanings, is it? > > - "No, please, let's not become a 'moderated' newsgroup. This > > would be the end of freedom! > > Is this why T.C. May hasn't posted in quite a while? > > >

2 1

Keystroke sniffer question
by Scott 17 Dec '03

17 Dec '03

How can you detect if there is a keystroke sniffer on your computer. Is there a file name to look for? Where do people get them? ======================================= Scott Bellavance scott-b(a)ix.netcom.com http://www.netcom.com/~scott-b/homepage.html ======================================= -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzAu56UAAAEEAL8pOdPu2pw5E91f99ByJWT+O1smtcOlIr6GL9TdCbdZ6I2U UPLl7RL5cV4e3Wv4nIIZiOIePMAUouM5fQZib4vnGpCKM/WxfGQBRGafsq2mlzvE IKLBrdYhQ5STl/qZIaCKI2+V4hdsvTPaI0PCqGzGoiDv9gbbZ40Gi3F38KqtAAUR tCtTY290dCBSLiBCZWxsYXZhbmNlIDxzY290dC1iQGl4Lm5ldGNvbS5jb20+ =Hfbk -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: "Secret" Postal Device stolen
by Toto 17 Dec '03

17 Dec '03

Bill Stewart wrote: > >>>Postal Service offers $25,000 reward for stolen . . . something > I was also guessing keys - truck keys are a less subtle target than > box storage keys, and telling every thug in the country that > mail trucks are an easy target, just take the keys from the carrier, > seems almost worth sounding really stupid in public to avoid. > They did say that it wasn't something they carried in their pockets, > but do mail carriers hang their keys on their belts? Mail carriers in some areas carry keys for buildings with security doors (sometimes Master keys). Or perhaps they've taken over the CIA's crack distribution route. Is anyone on the list willing to 'knock off' a couple of mail carriers and get back to us with a definitive answer on this? (Doesn't this kind of thing fall under the moderator's job description?) Toto

3 2

Re: Free & Open Society & toleration (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Nobody has a problem with your ideals, it's just that Jim Bell is > trying to say (correct me and forgive me if I'm wrong) that: > > 1. Society will never subscribe to your ideals. But other than two points they already do. The two points being, 1. Libel is a recognized legal concept now, the difference is one of degree. That degree of difference being how much money there is available for the lawyer and their willingness to enforce the concepts of justice in the society based upon their perceived ability to profit by it. 2. The extension of acceptance of reasonable legal representation by lot from not only the defence but also the prosecution. My solutions to these two issues are: 1. Removal of the lawyer from the ultimate choice of whether the case should be pursued. 2. The minimalization of the defendants and plaintiffs monetary resources by removing them from the legal system by choosing the legal representation of both parties by lot. 3. By moving the responsibility of police to provide evidence from the prosecution to the court we equalize the impact of irregularities in evidence selection as well as minimizing the sorts of evidence disputes which so impact some trials (ie OJ Simpson). 4. By the implimentation of a bond proviso on the part of the plaintiff the system provides a check and balance reducing nuisance cases as well as reducing the taxation load on the citizenry. > 2. Society is not static, i.e., instead of remaining at a constant > level of corruption, the officials will keep demanding more, > until there's a sudden, catastrophic break. Absolutely, that is one of the reasons I refuse to seperate those who represent the social contract (eg the Constitution) and those who are impacted by it, which includes even those who represent it and enforce its various responsibilities. AP relies on this distinction as axiomatic. This axiomatic view is ultimately based in a jealous greed for what others have (ie power, percieved or real) and the implicit belief that all people are NOT created equal. > 3. The AP solution has the potential to stabilize the level of > corruption, which should make violent revolutions and genocide > unnecessary. But it doesn't. What it does is provide a mechanism for de-stabalization. Just look at the Middle East and the history of assassination. Assassinations have never stabalized that region or any other. There is nothging in our current understanding of human psychology and social interactions that leads to the conclusion that threats of violence will necessarily force people to comply. If it did the government (as perceived by AP) would not have to deal with real opposition. Simply threaten the opposition and it melts away for the same reason that supposedly the government would cease to oppose radicalism (ie changes in the status quo forced by small groups upon the masses). If anything every real world example of AP demonstrates an increase in corruption (eg. Beirut). The closest analog in history to AP is the "Flowery Wars" as practiced by the Aztecs. However, these were motivated by a belief in religous homogeneity and not one of politics. Also, implicit in this was the axiomatic acceptance of a real class seperation between those who ruled and those who were ruled. By no means could one accept the premise that this caused the Aztec rulers to be more sensitive to corruption or the continued existance of their system. Another good example is assassination in ancient Rome, it is clear that such activities in no way reduced corruption. If anything AP provides a rationale (ie self-defence) to impose even harsher a priori conditions on sections of a society by another part of that society. Hardly what I would consider a stabalizing condition let alone democratic. What is required for stability is for each group to feel unthreatened and secure in expressing their beliefs without fear of reprisals and at the same time recognizing they must provide room for others beliefs. There must also be the realization that refusal to abide by these precepts will be met with immediate consequences. Something AP can't do, as it explicitly promotes threats and the carrying out thereof. On another issue, it was asked what purpose there is in suing a poor person. Simple lack of monetary wealth should be no more reason to exempt a party from justice than having large quantities. A citizen should face the consequences of their actions, how rich or poor they are is an irrelevant issue. Concepts required for a true working democracy: Liberty Justice Equality Fraternity Jim Choate CyberTects ravage(a)ssz.com

2 1

Free & Open Society & toleration
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It has been asserted that I am claiming that a free and open society should not abide any and all actions in contrast to Jim Bell's assertion that a free and open society must tolerate any action. This is not my case at all. I hold that a DEMOCRATIC society with a HEALTHY ECONOMIC system must have some minimum standards on what is allowed. By no means do I hold that the ONLY means of a free and open society is a democracy. It is quite possible to have an anarchy which would also be a free and open society and by DEFINITION would tolerate any action by its members acting individualy or in concert. I hold that for a democratic society to retain concepts of freedom and equity under the law as well as be economicaly viable, especialy in an environment where 'reputation' is critical such as a network over which economic transactions can take place with nothing more than a email order and a EFT, must not provide ex post facto AND carte blanche protection of the speech of the citizens. For such a system to operate requires a 'reputation' system to be in place. For such a system to be viable it MUST protect those reputations otherwise the concept of a 'contract' is worthless. I DO hold that this system MUST provide a priori protection of all speech. I further hold that any distinction between the 'government' and the people of a nation is a false and misleading distinction which is not in the best interest of the society because it by DEFINITION promotes a class society which is by definition contrary to the goal of equity under a democracy. It further provides a mechanism by which the representatives of the 'state' may claim immunity from the very standards they are charged with enforcing. This is because the charter of such a society is itself simply a contract between any arbitrary individual of that society and the sum total of the remaining citizenry (ie the 'state'). I further hold that one of the current legal practices based on precidence which MUST be replaced is our system dealing with defamation. I further hold that our current system of legal representation is inherently flawed and prevents equal representation under the law. Jim Choate CyberTects ravage(a)ssz.com

4 3

Re: PCS Encryption?
by John Young 17 Dec '03

17 Dec '03

> I was under the impression that Fortezza was ok for classified >traffic. Did I miss the changeover, was it unannounced, or was I >simply misremembering? Fortezza now comes in several implementations for various, variable and multiple levels of classification and message handling. There is info on latest mani-dexterous products at NSA's armadillo and missi sites. If you don't want to be logged by NSA, see the Mykronyx bouquet at: http://jya.com/fortezza.htm To be sure, you might get logged anyway: jya.com may have been approved by the Administrative Office of the United States Courts for a snoop.

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by Patrick May 17 Dec '03

17 Dec '03

Sandy Sandfort writes: [ . . . ] > On Sun, 2 Feb 1997, Timothy C. May wrote: [ . . . ] > > Fourth, it sent a message to enemies of liberty that "Even the > > Cypherpunks have found it necessary to abandon their anarchic > > ways." > > That's one message that one could take from all this, I suppose. > I don't see it that way, nor do several list members who thanked > me in private e-mail for improving the list. Again, YMMV. This is the strongest point in Mr. May's essay, and it is not easily dismissed as a difference in perspective. I admit to looking forward to the moderation experiment when it was announce; the noise on the list was phenomenal even by cypherpunk standards. My procmail filters were approaching the level of complexity required for self-awareness and the ASCII art still slipped through. Plus, I generally agree with Mr. Sandfort's positions. The point above demonstrates that support of the current solution is not rationally justified. Banning people from the list, however ineffectually, and imposing moderation on the main list, rather than offering another filtering service, does indeed support the thesis that even a virtual anarchic society must resort to a central authority to solve some problems. The moderation mechanism is the message. > What didn't work was "local filtering" which has no feed-back > loop to engender comity. This is a strong rebuttal. The primary affect of local filtering is that posts which are filtered do not garner as many responses as those which are not. This feedback is swamped by the tendency of filtered messages to generate flames from those who do not filter them. Filtered sublists are a more effective technique, available to non-technical subscribers as well. Some of the more advanced tools discussed here, such as collaborative filtering, rating schemes, etc. have potential if the ease-of-use barriers can be overcome. A cryptoanarchic solution, however, should be technical and individual. Centralized human moderation does not have the cypherpunk nature. Regards, Patrick May

1 0