December 2003 - cypherpunks-legacy

Free Stuff!!
by JC 17 Dec '03

17 Dec '03

Because your profile indicates you are a visionary, you have been selected to participate in a marketing study where you will receive FREE products at ABSOLUTELY NO COST TO YOU. If you do NOT want to receive FREE PRODUCT SAMPLES, discounts and other benefits only available to CLUB MAIL (tm) members, hit reply and put the word <REMOVE> anywhere in the response, and we will never email you again. BUT if you would like FREE PRODUCT SAMPLES, discounts, and other benefits, absolutely FREE with no strings attached, hit reply and include <MORE> anywhere in the response. Then, you will be enrolled in CLUB MAIL, "the place to get FREE STUFF and more" (SM) There is NO CHARGE and NO OBLIGATION, you just have to want to get the best stuff for less, even FREE. HOW IT WORKS: We have many manufactures of consumer merchandise ready and willing to send it to you just for the asking. CLUB MAIL is a new service connecting preferred consumers with top distributors and manufactures. These companies are willing to go all out to get your attention. Even, give away valuable products, with no strings attached!! These companies know that the best form of advertising is word -of- mouth. They are confident in their products and service. They know once you do business with them, you will want to tell your friends and neighbors. But, in order for any of this to happen, they need you! When you email us back a <MORE> anywhere in the reply, we will add your name to a select group. You will then get emails from us, about once per week, with information about FREE PRODUCTS and SERVICES, and SPECIAL DISCOUNTS available ONLY THROUGH CLUB MAIL!! SO WHY NOT EMAIL US BACK A "MORE" right now, and await the next great offer from CLUB MAIL! Sincerely, David Schulhof Head Coach, CLUB MAIL P.S. The more you respond, the more FREE products you will receive. We have many leading manufactures that would like to have you try their products, and are willing to give them to you, just to get your feedback. SIGN UP FOR "CLUB MAIL" now. EMAIL us back a "MORE" P.P.S. We have valuable products for FREE that we can send you information on right away. But we must first have your response with <MORE> as in MORE FREE STUFF on file. So don't miss out, email us back right away!!

1 0

File Systems
by JOlson 17 Dec '03

17 Dec '03

Are there any commercial/shareware/freeware versions of cryptographic file systems for any Windows environment?

2 1

HOT_sum
by John Young 17 Dec '03

17 Dec '03

3-03-97: "Congress Vs. President On Encryption" Last week a bill was reintroduced in the Senate to ease restrictions on the export of encryption technology. But the Clinton administration is preparing to back new legislation proposing additional controls over encryption software, according to sources familiar with the plans. The White House is preparing to back legislation that will deal with the liability issues surrounding trusted third parties. That legislation may seek to regulate the entities that will preside over digital signature and digital certificate authentication. "It's going to be a long, hot summer," Bidzos said. ---------- HOT_sum Return blank message with this key as subject for full article.

1 0

Microsoft Authenticode key security
by gbroiles-nospam＠netbox.com 17 Dec '03

17 Dec '03

Recent discussion on the cypherpunks list(s) talked about the feasibility of subverting Microsoft's security model by stealing their private key(s). The following snippet (originally sent to RISKS digest) might be of interest: >Date: Mon, 3 Mar 1997 19:23:15 -0800 >From: "Bob Atkinson (Exchange)" <bobatk(a)EXCHANGE.MICROSOFT.com> >Subject: Comments and corrections regarding Authenticode > >As the architect and primary implementor of the Authenticode code-signing >technology (boy, that'll get me mail :-) found in Internet Explorer 3 and in >Windows NT 4, I think my perhaps somewhat lengthy and clearly very biased >perspective on some recent articles might be of interest to others. >Bob Atkinson >[...] >For those curious: at the present time, the private keys with which >Microsoft signs code that it publishes are managed inside BBN SafeKeyper >boxes housed in a guarded steel and concrete bunker. Even were a SafeKeyper >to somehow be physically stolen, these cool little boxes have several >elaborate internal defenses designed to have the box destroy itself rather >than compromise its keys. As I understand things, a military variation on >the SafeKeyper technology is used as an integral part of launch control of >nuclear missiles on submarines in the US Navy. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: The Pro-CODE Bill could make things worse!
by Greg Broiles 17 Dec '03

17 Dec '03

At 12:36 AM 3/3/97 -0800, Tim May wrote: >(These items may not be banned for general export, given the language about >an "identfied individual or organization," but think of the new mischief >this will cause. For example, if remailers are used to evade taxes by some >individuals connecting to some sites, then exporters (like Eric Hughes, >Lance Cottrell, whomever is writing remailers these days) may have to jump >through large numbers of hoops to ensure that some specific site does not >get the software...this will effectively make export of remailers >impossible to legally do...as I read the language of the Bill.) I don't think that Pro-CODE can be used to control the dissemination of remailers. The bit of Pro-CODE at issue here (section 5(c)(3)(B) "The Secretary shall prohibit the export or reexport of particular computer software and hardware *described in this subsection* to an identified individual or organization . . if the Secretary determines that there is substantial evidence that such software and computer hardware will be . . (iv) intentionally used to evade enforcement of US law or taxation by the US or by any State or local government." (emphasis added) I read "described in this subsection" to refer to Section 5(c), and the best description I can find in 5(c) of computer hardware and software is "computer hardware, computer software, and technology with encryption capabilities, except computer hardware, computer software, and technology that is specifically designed or modified for military use, including command, control, and intelligence applications", in section 5(c)(1). So I don't think that this creates a new ability to control the dissemination of non-crypto hardware or software. (The Mixmaster remailer software, which does include crypto, would still be controlled.) The prohibitions on export to named individuals and organizations will be effectively useless with respect to those parties getting strong crypto - the only utility I can see in such a clause is to be used as a club against domestic sympathizers/allies of unpopular groups/people abroad. It also seems likely to lead to yet another round of worrying about whether the format of a particular distribution site on the Internet is sufficiently configured - if ProCODE passes, instead of asking "Are you a US citizen?", distribution sites will ask "Are you on the list of forbidden people?" Same difference. >And the other language--about how companies have to advise the government >about what they are doing, and the "review board"--are possibly ominous. Indeed. The "Findings/Purpose" text (Section 2), includes the following: "(16) The Federal Government has legitimate law enforcement and national security objectives which necessitate the disclosure to the Federal Government of general information that is neither proprietary nor confidential by experts in information security industries, including cryptographers, engineers, and others designated in the design and development of information security products. *By relaxing export controls on encryption products and programs, this Act creates an obligation on the part of representatives of companies involved in the export of information security products to share information about these products to designated representatives of the Federal Government.*" (emphasis added) and Section 5(c)(4)(A) reads: "Exports. The publisher or manufacturer of computer software or hardware with encryption capabilities shall disclose (for reporting purposes only) within 30 days after export to the Secretary such information regarding a program's or product's encryption capabilities as would be required for an individual license to export that program or product." The former has no real force, as "findings" aren't enforceable, but are intended for use by courts who are interpreting or construing a statute. But I don't see a technical reason why the latter wouldn't be enforceable. (Modulo the First Amendment, of course.) Another feature of Pro-CODE that I haven't seen discussed is that it restricts the *private* dissemination of code - e.g., a US programmer may make his/her code globally available (if it is "generally available, as is, and designed for installation by the user or purchaser", section 5(c)(2)(a)(i)), but a US programmer may not (assuming the current regulations, or similar regs, are in force) share code privately (say, pre-release) with foreign programmers. My hunch is that the drafters didn't intend this consequence, but I think it's a logical conclusion given that (a) Pro-CODE doesn't define "export", (b) current regulations define "export" as, roughly, providing software to non-US persons, and (c) Pro-CODE only allows "generally available, as is, and designed for installation by the user" software to be exported. So it still won't be legal for a US person to work collaboratively with a foreigner on development (even if the development took place in a public forum, like sci.crypt, the intermediate drafts probably wouldn't be "designed for installation by the user"), nor for a US person to write crypto for internal corporate use, or to share crypto code with friends overseas without making a public release. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Master of disinformation
by Casey Iverson 17 Dec '03

17 Dec '03

The rather large mass of Russian dung a.k.a. Dr.Dimitri Vulis KOTM wrote >> John Gilmore lied. Consider the irony of the Russian slime ball master of disinformation (probably trained by the KGB), calling someone *else* a liar.

4 3

ECPA/1997: the other shoe?
by Greg Broiles 17 Dec '03

17 Dec '03

I've seen discussion on various lists and in the media about the reissue of Sen. Burns' Pro-CODE bill (S. 377); I was poking around thomas.loc.gov for information about S. 377 and ran across S. 376, introduced by Sen. Leahy, the "Encrypted Communications Privacy Act of 1997", which implements a lot of legislation that cypherpunks types have been speculating about for several years now. I couldn't find an easily-accessible version of the bill's text on thomas, so I cobbled one together from the online version of the Congressional Register. It's located at <http://www.io.com/~gbroiles/ecpa1997.html>. I HTML-ized it in a hurry, so please rely on the official version when one becomes available. I haven't had a chance to go over it in detail, but it purports to do these things: Makes the use of any cryptosystem in the US, or by US persons on foreign soil, legal; Prohibits the implementation of mandatory key escrow Establishes standards and procedures under which key escrow agents may release escrowed keys (including criminalizing wrongful release and wrongful failure to release pursuant to court order/other authorization) Criminalizes the willful use of encryption to obstruct justice Confirms that it is legal to sell any cryptosystem within the US Sets standards for the release of keys to foreign governments I'll post a more detailed summary later when I've had a chance to go over the bill more carefully. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Wassenaar Arrangement
by Greg Broiles 17 Dec '03

17 Dec '03

Has anyone had any luck finding the actual text of the Wassenaar Arrangement? The Arms Control & Disarmament Agency has a summary/factsheet available on its web site (mirrored, I believe, on JYA's web site) but I haven't been able to find a copy of the actual text. I spoke with someone this morning at the ACDA who said that the actual text "has not been released by our government" and that to his knowledge it had not been publicly released by any government. I'm faxing a FOIA request to their legal folks this morning (talked to someone in their general counsel's office who said he wasn't sure if it was available via FOIA or not) but I suspect I won't get it. Has anyone actually seen the text of the thing? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

5 5

Re: Having the smarts to retire early
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > I never reply to these 'bot-generated things, but this one really does > crack me up: > > At 9:48 PM +0100 3/4/97, Anonymous wrote: > >Timothy C[retin] May is another loser who pays for got.net > >because he lacks the mental capacity to gain net access as > >a perk of either employment or academic achievment. > > > > ,,, > > ($ $) > > -ooO-(_)-Ooo- Timothy C[retin] May > > > An alternate interpretation: that I had the smarts to make enough money to > retire at age 34 for the rest of my life. Being that I'm now into my 11th > year of said retirement, I'd say paying $20 a month to got.net for > unlimited usage is a lot better deal than either "employment" or "academic" > subsidy. I'd even pay $100 a month, if that was my only choice, to ensure > freedom from the constraints and disclaimers forced upon corporate and even > academic users. > > Oh, and my first "academic" Net connection, modulo the Net not being very > advanced or usable in those days, was in 1973. > > --Tim May I feel sorry for Tim May. He's so bored, he reads 'bot fodder. I suppose he studies the bounce messages from mailer deamons too. WARNING: COCKSUCKER JOHN GILMORE IS FORBIDDEN TO REDISTRIBUTE MY E-MAIL FROM ANY MAILING LIST ON HIS TOAD.COM COMPUTER. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 5

Re: ECPA/1997: the other shoe?
by John Young 17 Dec '03

17 Dec '03

Thanks for pointing this. We got a TXT version from GPO Access and put it at: http://jya.com/s376.txt With a link to your HTML. On Waasenaar, we've written a few folks about finding a full copy, but so far the word is the same as State's: none has been publically released. Hope you get it. When the pact was first discussed at State a recorder transcribed "Vasinor (phonetic)," so that term might turn up in searches. As you noted, for those interested, we've put a few Waasenaar docs at: http://jya.com/acda.htm Back to your FOIA to CIA, and the Agency's referral to FCC: I wonder if there might not be something to that lead. As you must know, the legislation covering national telecommunications security puts the FCC in the center of infowehr C4I. Excuse this cite to a pro citer, the NatSec Telecomm leg is at: http://jya.com/47cfr2.htm This might support the CIA's intel that FCC is the chokepoint for CPI for the IC.

1 0