December 2003 - cypherpunks-legacy

PGP key fingerprint spoofing
by Adam Back 17 Dec '03

17 Dec '03

Well we're all aware of the 0xDEADBEEF attack, right? (PGP keyids, are the 8 hex digit number which PGP recognizes a key by. The 0xDEADBEEF attack (so christened by Greg Rose one of the people who independently rediscovered this attack) is where you generate a PGP key which has the same key id as someone else's key. This could confuse a keyserver, or a user into using the wrong key. This attack is fairly easy to do, just choose p ending in 0xDEADBEEF (or whatever the desired key id is), then start with q ending in 0x00000001, and add some value larger than 0xFFFFFFFF at each iteration doing your primality test, the p and q will then multiply to have the desired least significant bits of n). You may also have noticed that Gary Howland has a keyid of 0xc001d00d ("cool dude", get it). Anyway it seems that you can spoof the finger print also indirectly, which is much less obvious, as the fingerprint is the MD5 hash of the RSA modulus concatenated with the RSA public exponent. This was described recently on coderpunks. (I was forced to eat my words on coderpunks after declaring this was impossible without an exploitable flaw in MD5 or brute force of 2**128 bit search space, when someone explained the concatenation weakness). I'm not sure who it was that discovered this attack, or which list/newsgroup this was announced on, but this was the first I had seen it discussed. The concatenation is the weakness, as if you have an RSA key of: n = 0x1234567 e = 0x11 Then you can try n = 0x12345, and e = 0x6711. So you try factoring each n of this form, and if it has two factors p and q, then you can construct a key with the same fingerprint, but with different key. Anyone who bothers to would be able to factor 0x1234567 also, so it is not secure, but if you can fool someone into using this key in place of the real one, you can get their communications. It will be much easier to fool someone to use this key as the fingerprint is the same! Here's an example... Say we have a 1024 bit key, say e is small ( < 256). That means n || e is 129 bytes long. The e value must be represented by a whole byte. n can't be smaller than 384 bits (or PGP will reject it as too small to hold the required idea message key and padding), so that will give us 80 possible values for e and n. Lets use my 1024 bit key for an example. n = 0x99d61071378ee2c0c8c9c4b7786b203dedf2d6e526f24f7e83f3e0f960fb66b9 cb81c04e89d70689a4866f21ad1bb5ba6aee51469e5b59b121ba6f3f8d776b62 7253ba5dc9fca8155a565b9893f695d83a0496eb977ee4659ee20e0f2eb49b25 93c11487b377cc5d767c79fb985b464d4ae94a5f45e42e3b29c8b89d556a4a67 e = 0x13 So we could try: e = 0x6713 e = 0x4a6713 e = 0x6a4a6713 ... n = 0x99d61071378ee2c0c8c9c4b7786b203dedf2d6e526f24f7e83f3e0f960fb66b9 cb81c04e89d70689a4866f21ad1bb5ba e = 0x6aee51469e5b59b121ba6f3f8d776b627253ba5dc9fca8155a565b9893f695d8 3a0496eb977ee4659ee20e0f2eb49b2593c11487b377cc5d767c79fb985b464d 4ae94a5f45e42e3b29c8b89d556a4a6713 Here's the first candidate I found with only two factors starting from the smallest n value (384 bit n) so that it would be quicker to factorize (anything that took a long time to factor I moved on to next value). n = 0x99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9 CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B62 7253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 e = 0x9EE20E0F2EB49B2593C11487B377CC5D767C79FB985B464D4AE94A5F45E42E3B 29C8B89D556A4A6713 p = 0x6D q = 0x1694DA7CA7DC9B69CD9ECAAC8BCDF6A41988A31132573CFD6EF72CC44FFF5330 69074D8CB3F0974586892A25D2F3A08C19173D406266A82CCA3C3F4D705CAF78 23922972C20D99D8DBF07E2DE20CB5B3B3F747797B3A8D9 n = 0x99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9 CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B62 7253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 d = 0x0455419C3B8CCE54710EC04F9FA61F83A5E2363BE0D2E361886080716E7B8886 EA62B748F20B9E9E7F93F768616D3AF5F8785D514A82EE41CB1FF251FFB053FA 173D0B239D7BD1995B4F7DE3B2B112F911BE1304453EAC53 u = 0x0162AC862E1D88F2ACC3230A4AED13AEC3EA4A978387684ADA099644FF9FAA3D D51F6BA831347C5D12AD1CDC72F5FE40F66228E54573373C4A0F255A091879BC F2EA9509D46B673CB7C4EB8EDA0D6754DC373EA911653504 (Factorization courtesy of pollard rho / trial division code in the factorization code which comes in ssh-1.2.20, which includes a modified gmp-2.0.2 which has the code in the demos directory.) I checked RSA operation (with my .sig rsa program which works with hex numbers rather than formatted pgp keys) -- it works!! % echo hello world | rsa -k=9EE20E0F2EB49B2593C11487B377CC5D767C79FB985B464D4AE94A5F45E42E3B29C8B89D556A4A6713 -n=99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B627253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 > out % % rsa -k=0455419C3B8CCE54710EC04F9FA61F83A5E2363BE0D2E361886080716E7B8886EA62B748F20B9E9E7F93F768616D3AF5F8785D514A82EE41CB1FF251FFB053FA173D0B239D7BD1995B4F7DE3B2B112F911BE1304453EAC53 -n=99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B627253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 < out hello world % I'm off to pack this up as a PGP key, to see if PGP likes it! Well here's that key as a pgp key. Under no circumstances use it to encrypt a message you care about. Here's the public key. Type Bits/KeyID Date User ID pub 704/977EE465 1997/06/08 Adam Back <spoofed fingerprint DO NOT USE> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzObE60AAAECwJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GUBSJ7iDg8utJslk8EUh7N3zF12fHn7mFtGTUrpSl9F5C47Kci4nVVqSmcT tCpBZGFtIEJhY2sgPHNwb29mZWQgZmluZ2VycHJpbnQgRE8gTk9UIFVTRT6JAG0D BRAzmxOtOgSW65d+5GUBAQ27ArwOTveQTs0kjzBEMa09yWFs5+jNjv5tzSCngzXO bRzvwhTwWz4voR3ov2o0bGTYZF1biKRKeKqZzHb4Oq4XhD4TADdlmsxA5gQgbYFN 5K+tbgWEDQD53KFv =rlth -----END PGP PUBLIC KEY BLOCK----- Here's the secret half: -----BEGIN PGP SECRET KEY BLOCK----- Version: 2.6.3i lQGhAzObE60AAAECwJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GUBSJ7iDg8utJslk8EUh7N3zF12fHn7mFtGTUrpSl9F5C47Kci4nVVqSmcT AAK7BFVBnDuMzlRxDsBPn6Yfg6XiNjvg0uNhiGCAcW57iIbqYrdI8guenn+T92hh bTr1+HhdUUqC7kHLH/JR/7BT+hc9CyOde9GZW09947KxEvkRvhMERT6sUwAHbQK5 AWlNp8p9ybac2eyqyLzfakGYijETJXPP1u9yzET/9TMGkHTYyz8JdFhokqJdLzoI wZFz1AYmaoLMo8P01wXK94I5IpcsINmdjb8H4t4gy1s7P3R3l7Oo2QK5AWKshi4d iPKswyMKSu0TrsPqSpeDh2hK2gmWRP+fqj3VH2uoMTR8XRKtHNxy9f5A9mIo5UVz NzxKDyVaCRh5vPLqlQnUa2c8t8TrjtoNZ1TcNz6pEWU1BIRbtCpBZGFtIEJhY2sg PHNwb29mZWQgZmluZ2VycHJpbnQgRE8gTk9UIFVTRT4= =lE9S -----END PGP SECRET KEY BLOCK----- Here are the fingerprints of spoofed key as compared to real key. Type Bits/KeyID Date User ID pub 704/977EE465 1997/06/08 Adam Back <spoofed fingerprint DO NOT USE> Key fingerprint = 18 B8 A0 65 9D 38 14 83 61 5A E6 AC 91 8B 9E 57 pub 1024/556A4A67 1993/06/08 Adam Back <aba(a)dcs.ex.ac.uk> Key fingerprint = 18 B8 A0 65 9D 38 14 83 61 5A E6 AC 91 8B 9E 57 Note the identical fingerprints! (Awesome). Key id of course is different. Also note that you can't decrypt directly with PGP, as I suspected, because the chinese remainder theorem used in decrypt to speed up the works barfs on small p. You can hack around that if you're bothered. It might be possible to find a spoofed fingerprint key with large p and q, so that this was not a problem. Below this post is my real key. This is a major security flaw, and I take my hat off to the guy who discovered it. As others noted (who were aware of this flaw) the solution is to consider the keyid as part of the fingerprint. That reduces by a factor of 2^32 the likelihood of the attack succeeding. I suspect that rules out the attack working for most keys. Also be suspicous of odd sized keys. Now if someones 2048 bit key has a 1024 bit spoof, you're in trouble. I'd be interested in estimates of the likelihood of this being possible for a randomly selected key. You could construct a key where the keyid matched, and the fingerprint matched for two different keys, using a combination of dead beef attack, and brute force to find a key with the keyid appearing two places in the key, and then trying to factor the n value at that point. Shouldn't take long. As far as PGP format goes, adding the length field into the digest would go along way towards fixing it. (Length fields for pgp big int representation is big endian 16 bit word representing length of following big int in bits). There might still be a small chance of doing the fingerprint spoof where the length fields both happened to be right. As you require a specific length field it would seem this attack would be 2^32 times less likely to succeed. This would make most keys safe. I wonder if there exists a key out there which would fall to this attack. (btw for people playing with this stuff, a useful program is pgpacket.pl by Mark Shoulsen, which displays pgp packets as hex numbers, see ftp.ox.ac.uk/pgp somewhere under utils). Adam My real key, so you can compare fingerprints. Type Bits/KeyID Date User ID pub 1024/556A4A67 1993/06/08 Adam Back <aba(a)dcs.ex.ac.uk> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAiwUXUEAAAEEAJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GWe4g4PLrSbJZPBFIezd8xddnx5+5hbRk1K6UpfReQuOynIuJ1VakpnAAUT tBxBZGFtIEJhY2sgPGFiYUBkY3MuZXguYWMudWs+iQCVAwUQMiDfwUZRiTErSPb1 AQF/yAP8D1X2eAhXSc0P/X7lCHyBhWCl3pxa6oyGxFBOmUeOGfYna8CpJeMiTmZm akRWDYmJUiXscQUfd9qRv8eAeOtbvM87olSjm56Dlh4gYJFZRxZ6IhHlFJx3mPmp q9PnL+pSC41IIheRBJFzpKGD3LW9+VQwRAx9bXFJYyOFpx7vGJqJAJUCBRAwLhaV fjuD7tLfgD0BAYnfA/0XByiiqDX/cxgWt9syiobJ0TrTKloJcEgzxnKmqHH7rhqn wWGQA2pbWPGW1AwLtkeE+JYyk21YQZZxYWerK3JUi8a/ye4EaaJSs8mcw9YCwdPC Xa0nlalh09/FBEt83l5auNbw+zl9AcrOIGsTQcAr0Vy5nnV9IEfi6WZ3/aQ734kB FQMFEC/gRoaxVzBJFqEkZQEBEXcIAI6z9nUinIomouzB/3v1Fu9+kLOLiva+7Mp1 8UT40FXvHSabXe/cSV1//lnlYHJnfpJCPFSEjGox1pVBp9pLmiJBmubLfUrojIAn FDB081n6kB0B4BKb2rUiNghvT4CzpBZ149g/2NGscRIeQOCYkA2cBxT44v2luuqN 3Ahg9bWu+kjnxUKIK9Da/8D0ur5HiinBDevPiVf3/uoOdZ8F7alxqitBcC5ctIYR tr8fgdQq8is6dbeNxDMraV5vEpEN27AU4xOetymdFUufbU1K6Riw5TVZni9qXAgU ZS3zyFw7wqJ/SWILMWp+99ss921b+GpL+/m6S4j7LTXvFvcfy9aJAJUDBRAv2A0p Kci4nVVqSmcBAcfoA/9Pt3BeJ3TdTtQzb9DNT7LoXiQesYG68lzIl7BZsRvXoi2Q yeCPNc/juTGBnKBHgxZezJCW8TaKdJjNEncv7p+1o+9fwmy9UKWXskh6N+Y0ZlhJ bD0T+8+L+Wxpr6k3dao/GfOnCvw8vpvzDV9lnjtqe2B1mU5eAY76FFtZXvM9xw== =xN9o -----END PGP PUBLIC KEY BLOCK-----

5 4

Question about anonymizing proxies
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Sorry if this has been beaten to death before (if it has, a pointer to where it is in the archives would be appreciated), but is it possible to chain anonymizing proxy servers in a way similar to remailers?

4 3

Re: Thoughtcrime (Re: My War)
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > Subject: How "child porn" laws ban pix of girls in leotards > > At 11:54 -0700 6/9/97, Vangelis wrote: > >None of this out-of-control angry mob shit, alright? THINK. If it's too > >hard a task to go after ONLY those genuinely responsible and you'd rather > >go after their friends, family, co-workers, customers, or anyone else > >you've rationalized as somehow indirectly encouraging the activity w/o > >actually participating, then you've got no business playing vigilante - > >you've become just another wreckless crusader *blinded* by his own > >self-righteous outrage. Christianity, the Nazi Party, and Prohibition, and > >McCarthyism (just to name a few) have already given us enough of those. It seems logical to deduce that a child pornographer would want to cover up their activity by loud protestations about child porno on the internet. The obvious solution to child pornography on the internet is to attack those who most loudly protest against it. > The main reason folks seem to be in a lather about the "threat" of child > porn is that it might ruin the Net for everyone. That is, it gives Congress > an excuse to censor it and bring it under ever-tightening controls. Perhaps the answer, as with alcohol and gambling, is to put child pornography under government regulatory control. Find a way to tax it. Then only those who were not decent, law-abiding child pornographers would have to fear imprisonment. > Also, I see a lot of uninformed rants on this list about "we must uphold > child porn laws." Few people seem to realize that the long-standing Federal > child porn law outlawed *pictures of dancing girls wearing leotards*. I'm > not making this up. No nudity. No breasts. Certainly no genitals. But the > Supreme Court upheld the conviction in the Knox case. Now the law is even > worse, since it criminalizes morphed images that *look* like kids in > leotards, even if the models were 25-year old adults. And William Geiger could be criminalized by the fact that his bad speling and the gramma make his posts *look* like crypto. TruthMonger

1 0

Re: Thoughtcrime (Re: My War)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Comrade Declan: Thank you for labeling se7en's thoughtcrime as such and blocking his subversive and enturbulating assertions from the fight-censorship mailing list. The counterrevolutionary sedition that there is such a thing as kiddie porn on the Holy Internet shall be suppressed forthwith. Verily, traitor to the Holy Cause se7en is naught but an NSA Shill, who belongs in the Pit of Despair with the other thought criminals. Operation Free Speech II is proceeding according to the Five-Year Plan. - -rich http://www.stanford.edu/~llurch/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBM50l2kFGBFr0lf2RAQGRsgfLB6Fqg6Cefsr5u0zI9DIE2JD1I3fB6q0l c+JEgnbpqpVWH9kqzY/tQxP78dh/pUUOIGzNuohIoad8f70BSp6PJUoQbaVrV5+p K3SsTDxTIwZ77ubJSkPtean1RJRY8Nerv42CGrkSWo/HsdHBE6GH0pmDzBDgCAoS BIXJvg4FM44wGAX+uWfiKd9JK/F3m9a/6m4sUOhmZEBIXF8GYa1TQQBlDOuuNqsM dfYNQnu74TyhQM4qHEC9fqr+t4yC2bnemcVWVk8ddkM/vNMqrGfbyimLV7vsl30s 31aDJ5VoWVrcxV2qLCDxAJPTlxHeGtFRWCfmswRZ/U1eMw== =M9iS -----END PGP SIGNATURE-----

1 0

Re: Thoughtcrime [Lisa Bonet Ramsey]
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > > Precisely. The laws are designed to go after the thoughts. Synthetic > images, images of little girls in leotards. images of teenagers of legal > age *in the countries of origin*...none of these involve acts of sexual > congress with a child in violation of the laws of the U.S. The only crime > is thoughtcrime. I couldn't help but notice from the TV reports that Lisa Bonet Ramsey was a pretty hot little number. Has Peter Jennings been arrested yet for his part in the national media helping to spread child pornography? Kookie Roberts? What if I send the FBI a picture of myself pulling my pud while watching young Lisa strutting her stuff on the ten o'clock news? Will the newscasters be imprisoned for conspiracy in my thought crime? > As for whether it is "sick" to be sexually attracted to an "underage" > person, I sure do recall being attracted to a lot of the girls in high > school, and they were certainly nearly all "underaged." Mother Nature was undoubtably a co-conspirator in your criminal thoughts. If you had been charged you probably could have eased your sentence by ratting her out. A. Perv

1 0

~ ~ SAVE YOUR LIFE - PROTECT YOUR PROPERTY !!!
by crime＠tarsey.com 17 Dec '03

17 Dec '03

~ ~ SAVE YOUR LIFE - PROTECT YOUR PROPERTY !!! *** 15 ANTI-CRIME REPORTS - You Should Know About ! Special Offer - Order All 15 Reports and you will also receive REPRINT RIGHTS... Yes - Reprint Rights $$$ !!! Dear Friend, Crime affects you, me, everyone - Young or Old - Rich or Poor. Crime is a problem for the entire community, not problems for the police alone. The police are charged to prevent and suppress crime and to solve crime once it occurs to the utmost of their ability. However, they are realistically aware that they can neither prevent all crime from occurring nor solve every crime that does occur. To attain the greatest possible degree of safety you, me and every other law abiding citizen needs to become aware of how the criminals traditionally do their "Dastardly" deeds and how you can "Minimize The Risk" of crime affecting you. Knowledge is power and the 15 reports below will give you the POWER YOU NEED to minimize crime that could someday affect YOU or a LOVED ONE! Please seriously consider purchasing the below reports. The price is so low that you really cannot afford not to be armed with the knowledge you will receive by reading and re-reading these reports! Report #1 - How To Protect Your Home From Intruders. Report #2 - How To Protect Yourself On City Streets. Report #3 - How To Protect Your Valuables From Theft. Report #4 - How To Protect Yourself When Traveling. Report #5 - How To Guard Against Purse Snatchers. Report #6 - How To Protect Yourself From Armed Robbery. Report #7 - How To Protect Your From Pickpockets. Report #8 - How To Safeguard Against Rape. Report #9 - How Shoplifting Affects You and Your Family. Report #10 - How To Protect Your Cars, Bicycles and Motorcycles. Report #11 - How To Protect Your Home While Away. Report #12 - How To Burglar-Proof Your Doors. Report #13 - How To Burglar-Proof Your Windows. Report #14 - How To Select a Burglar Alarm. Report #15 - How To Reduce Crime In Your Neighborhood. SPECIAL OFFER - Order All 15 Reports and you will also receive Reprint Rights. Reprint Rights, gives you the right (granted by us) to reproduce any and all of these reports. With Reprint Rights, you can photo copy and distribute these reports to your family, friends, co-workers, teachers, etc. When distributing these reports you may give them away for FREE or you may charge for them. Collect any amount of money you wish. It's your money and yours to keep! We will never ask for any of it !!! Two Ways You May Order The Above Reports: 1. You may order ALL 15 REPORTS with Unlimited Reproduction Rights for a total cost of only $12.00. 2. You may purchase reports individually for $4.00 each. Now IS THE TIME for you to "Minimize The Risk" of crime affecting YOU or a LOVED ONE! Money Back Guarantee: If unsatisfied for any reason, you get your money back, period! Upon receiving your order, the Anti-Crime reports will promptly be emailed to you. TO ORDER: Follow the instructions below: You may pay by Check, Money Order, Cash, Visa or Mastercard. FAX the form below to 1-405-330-5379 or MAIL this form to: Douglas C. Parcells 3126 S. Boulevard Suite 147 Edmond, OK 73013 USA - - - - - - - - - - - - - - - - - - - O R D E R F O R M -- - - - - - - - - - - - - - - - - - - - - PLEASE PRINT ALL INFORMATION LEGIBLY TO SPEED UP YOUR ORDER (1.) [ ] Visa [ ] Mastercard [ ] Check [ ] Money Order [ ] Cash (2.) Credit Card Number: (put one number on each line) CC# __ __ __ __ - __ __ __ __ - __ __ __ __ - __ __ __ __ (3.) Expiration Date: [ __ __ / __ __ ] Month/Year (anti-crime) Email Address:__________________ Name:_____________________________ Address:_____________________________ City__________ ST_____ Zip_______ Ph.# w/ areacode:__________________ Signature (Required)_____________ *** You may purchase ALL 15 REPORTS with unlimited reproduction rights for a total cost of only $12.00. *** You may purchase reports individually for $4.00 each. [ ] Check here if ordering ALL 15 reports for the $12.00 Special. [ ] Check here if ordering reports individually and list by # below. #__________ #__________ #_________ #_________ #_________ FAX the above form to 1-405-330-5379 or MAIL this form to: Douglas C. Parcells 3126 S. Boulevard Suite 147 Edmond, OK 73013 USA *** Pay all orders in U.S. FUNDS or outside the U.S. send the currency equivalent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Be sure to INCLUDE YOUR EMAIL ADDRESS so we may fill your order A.S.A.P. !!! Best of Luck... we'll visit again. Kindest Personal Regards, Douglas C. Parcells Report Fulfillment Coordinator P.S. Now IS THE TIME for you to "Minimize The Risk" of crime affecting YOU or a LOVED ONE! The best way to minimize the risk of crime affecting you is by taking sensible precautions 02

1 0

~ ~ SAVE YOUR LIFE - PROTECT YOUR PROPERTY !!!
by crime＠tarsey.com 17 Dec '03

17 Dec '03

~ ~ SAVE YOUR LIFE - PROTECT YOUR PROPERTY !!! *** 15 ANTI-CRIME REPORTS - You Should Know About ! Special Offer - Order All 15 Reports and you will also receive REPRINT RIGHTS... Yes - Reprint Rights $$$ !!! Dear Friend, Crime affects you, me, everyone - Young or Old - Rich or Poor. Crime is a problem for the entire community, not problems for the police alone. The police are charged to prevent and suppress crime and to solve crime once it occurs to the utmost of their ability. However, they are realistically aware that they can neither prevent all crime from occurring nor solve every crime that does occur. To attain the greatest possible degree of safety you, me and every other law abiding citizen needs to become aware of how the criminals traditionally do their "Dastardly" deeds and how you can "Minimize The Risk" of crime affecting you. Knowledge is power and the 15 reports below will give you the POWER YOU NEED to minimize crime that could someday affect YOU or a LOVED ONE! Please seriously consider purchasing the below reports. The price is so low that you really cannot afford not to be armed with the knowledge you will receive by reading and re-reading these reports! Report #1 - How To Protect Your Home From Intruders. Report #2 - How To Protect Yourself On City Streets. Report #3 - How To Protect Your Valuables From Theft. Report #4 - How To Protect Yourself When Traveling. Report #5 - How To Guard Against Purse Snatchers. Report #6 - How To Protect Yourself From Armed Robbery. Report #7 - How To Protect Your From Pickpockets. Report #8 - How To Safeguard Against Rape. Report #9 - How Shoplifting Affects You and Your Family. Report #10 - How To Protect Your Cars, Bicycles and Motorcycles. Report #11 - How To Protect Your Home While Away. Report #12 - How To Burglar-Proof Your Doors. Report #13 - How To Burglar-Proof Your Windows. Report #14 - How To Select a Burglar Alarm. Report #15 - How To Reduce Crime In Your Neighborhood. SPECIAL OFFER - Order All 15 Reports and you will also receive Reprint Rights. Reprint Rights, gives you the right (granted by us) to reproduce any and all of these reports. With Reprint Rights, you can photo copy and distribute these reports to your family, friends, co-workers, teachers, etc. When distributing these reports you may give them away for FREE or you may charge for them. Collect any amount of money you wish. It's your money and yours to keep! We will never ask for any of it !!! Two Ways You May Order The Above Reports: 1. You may order ALL 15 REPORTS with Unlimited Reproduction Rights for a total cost of only $12.00. 2. You may purchase reports individually for $4.00 each. Now IS THE TIME for you to "Minimize The Risk" of crime affecting YOU or a LOVED ONE! Money Back Guarantee: If unsatisfied for any reason, you get your money back, period! Upon receiving your order, the Anti-Crime reports will promptly be emailed to you. TO ORDER: Follow the instructions below: You may pay by Check, Money Order, Cash, Visa or Mastercard. FAX the form below to 1-405-330-5379 or MAIL this form to: Douglas C. Parcells 3126 S. Boulevard Suite 147 Edmond, OK 73013 USA - - - - - - - - - - - - - - - - - - - O R D E R F O R M -- - - - - - - - - - - - - - - - - - - - - PLEASE PRINT ALL INFORMATION LEGIBLY TO SPEED UP YOUR ORDER (1.) [ ] Visa [ ] Mastercard [ ] Check [ ] Money Order [ ] Cash (2.) Credit Card Number: (put one number on each line) CC# __ __ __ __ - __ __ __ __ - __ __ __ __ - __ __ __ __ (3.) Expiration Date: [ __ __ / __ __ ] Month/Year (anti-crime) Email Address:__________________ Name:_____________________________ Address:_____________________________ City__________ ST_____ Zip_______ Ph.# w/ areacode:__________________ Signature (Required)_____________ *** You may purchase ALL 15 REPORTS with unlimited reproduction rights for a total cost of only $12.00. *** You may purchase reports individually for $4.00 each. [ ] Check here if ordering ALL 15 reports for the $12.00 Special. [ ] Check here if ordering reports individually and list by # below. #__________ #__________ #_________ #_________ #_________ FAX the above form to 1-405-330-5379 or MAIL this form to: Douglas C. Parcells 3126 S. Boulevard Suite 147 Edmond, OK 73013 USA *** Pay all orders in U.S. FUNDS or outside the U.S. send the currency equivalent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Be sure to INCLUDE YOUR EMAIL ADDRESS so we may fill your order A.S.A.P. !!! Best of Luck... we'll visit again. Kindest Personal Regards, Douglas C. Parcells Report Fulfillment Coordinator P.S. Now IS THE TIME for you to "Minimize The Risk" of crime affecting YOU or a LOVED ONE! The best way to minimize the risk of crime affecting you is by taking sensible precautions 02

1 0

SPECIAL ISSUE Surveillance List Forum Vol 2 Issue#133 June 10,1997 (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

Vewy vewy intwestwing stuff.... (forwarded from the security list.) Note the "major threat to LEA's" in particular... =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer, |./|\. ..\|/..|sunder(a)sundernet.com| Boy gets another beer!" |/\|/\ <--*-->| ------------------ | |\/|\/ ../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/. .+.v.+.|God of screwdrivers"| strange aeons, even death may die. |..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Tue, 10 Jun 1997 10:16:51 -0400 From: SpyKing <SpyKing(a)thecodex.com> Subject: SPECIAL ISSUE Surveillance List Forum Vol 2 Issue#133 June 10,1997 ****************************************************************************** Vol.Two Issue #133 The Surveillance List June 10,1997 Over 2100+ Members Worldwide Representing 46 different countries List Chat at: http://www.thecodex.com/chat.html ***SPECIAL ISSUE*** ****************************************************************************** IN THIS ISSUE... ****************************************************************************** 01) Important Issue Concerning ALL in the Surveillance Business... ****************************************************************************** DON'T BE A LURKER.... GET INVOLVED... YOU ARE A MEMBER... MAKE THE MOST OF IT ****************************************************************************** 1)From: SpyKing(a)thecodex.com Subject: Important Issue Concerning ALL in the Surveillance Business... I received this post from Gilbert Walz and thought it of immense importance to the list. He's asked me to post and I am complying... Read this carefully as it could affect all... If you agree that something needs to be done I urge you to contact you congressman and let them know about this situation... >>>> From: GilbertWa(a)aol.com Date: Sun, 18 May 1997 01:56:48 -0400 (EDT) To: SpyKing(a)thecodex.com Subject: US CUSTOMS BUST Greetings, My partner Jude Daggett was recently arrested by US Customs in a sting set up by Bill Fischer of E.C.I. Calgary Canada,for allegedly selling a chip that enabled a panasonic cell phone to receive 800-900 mhz.Mr. Fischer was apparently set up as well by Cellular Tecnology , a company that sell's the CT-1000 a Hand Held cell test piece. There is much more to the story,including an upcoming trial in San Jose Ca, for violations of section 2512, I am the defendant in this case. If you are interested in more detail please page me@ 415-979-7353. Regards, Gilbert Walz <<<< From: GilbertWa(a)aol.com Subject: Section 2512 FYI MAJOR THREAT TO STATE AND LOCAL LAW ENFORCEMENT CAPABILITIES State and local law enforcement bodies have begun to find it difficult to procure the latest in Title III equipment, i.e. equipment "...primarily useful for the surreptitious interception of ... communication". Unless action is taken at the highest levels of the federal government, there is no question that serious harm will be done to the abilities of state and local law enforcement to properly perform technical surveillance. This is an extremely serious matter, and I urge you to take the time to study this information. Law enforcement's ability to properly perform its duties faces a serious and a real threat, and correcting the situation will not be easy, but it is something that MUST be done. We're in this sorry state for two real reasons and one possible reason, viz: Real Reason #1. The federal law that deals with monitoring that which has been transmitted by radio is irrational, poorly written, unthinkably stupid, incomplete, technically impossible to enforce, vague where it should be specific, specific where it covers unenforceable prohibitions, and primarily of value to vendors of cordless and cellular telephones (because they can lie to their potential customers telling them: "nobody can listen to you; it's against the law). Real Reason #2. Some federal government entities have chosen to reinterpret elements of a law enacted almost thirty years ago (and amended many times since then). Possible Reason. There is great suspicion that some privileged companies are steering some of the federal government's minions toward small companies in order to remove possible competition from the marketplace -- in other words it is possible that the law is being selectively enforced for the benefit of some firms. Professionals who know their way around in this arena are aware of some targeting that had been orchestrated by entities that, although they deal in a big way with Title III equipment, have remained unaffected by the federal government elements that have suddenly developed real zeal to punish those who they say sell Title III equipment. Background. During the past TWENTY-NINE YEARS (since passage of Public Law 90-351, "The Safe Streets Act of 1968"), law enforcement at all levels in this country has benefited because of a reasonable interpretation of the elements of that law. That has now all changed. To allow you to understand the situation we must first cover the specifics of the law, and the way it has been interpreted over the years. First, the prohibitions. The law proscribes the use, possession and even advertising of equipment "knowing or having reason to know that the design of such device renders it primarily useful for the surreptitious interception of ... communication". Obviously there are categories of people who are exempted from these prohibitions - such as the very law enforcement people who would use it in investigations. However, one of those exemptions is now being reinterpreted. I refer specifically to the interpretation of the exception relating to "...an officer, agent, or employee of, or a person under contract with, the United States, a State, or a political subdivision thereof..." For almost thirty years that phrase has been interpreted that honest businessmen (manufacturers or dealers) who sold Title III equipment only to law enforcement agencies were "agents under contract to...". Small business entrepreneurs and their dealers have, since passage of the PL 90-351, operated under the belief that, if their customers were federal, state or local law enforcement organizations, they were operating legally when they designed, built and sold such equipment (or marketed it as agents of the builder). Never having had any notice by any government body that a specific item could be considered "Title III", sellers felt no compunction to refrain from advertising and no concern about selling to non-law enforcement (except for obvious Title III items such as body wires). This dogma has been reinforced and solidified by almost thirty years of practice. Before covering the 1996/7 reinterpretation of this law, let's review some recent events. Enforcement History. In 1991 or 1992 several businesses received a certified letter from the FCC that began "It has come to our attention that you are marketing..." and went on to accuse all of us of various felonies. My written request to be told the specific product and the specific accuser is to this day still unanswered. However, one man, whose letter was ignored and whose FOIA inquiry was ignored, finally inquired through his congressman. He was then informed that his FOIA action was sent to the wrong address (!), and that the FCC accusations were based on "anonymous telephone tips". Yeah, Right. (Those of us who are knowledgeable of the players have a good idea of how those "anonymous" tips were received; we remember seeing the guy who was siccing his FCC toady on various exhibitors at more than one trade show. Ah well.) Then about two years ago a bunch of stores with "spy" in their names were raided by the Customs Department for importing and selling forbidden radio transmitting equipment. (Personal comment: Good riddance; they were mostly rip-off artists preying on people who wanted to spy on others.) However, the serious reinterpretation that is tying up resources started last year. In 1996 and 1997 there has been a lot of activity based on 1) lawyers pretending to be all-knowing technical experts and 2) a reinterpretation of the exception clause quoted above. Current Status. To the best of my knowledge, the first activity in this "reinterpreting" arena was the indictment of Gilbert Walz and Jude Daggett by US Attorney Michael J. Yamaguchi in the US District Court of Northern California. The indictment accuses them of selling devices "whose [sic] design renders them primarily useful for the purpose of the surreptitious interception of wire, oral and electronic communications". (The paper I have in front of me is called "SUPERSEDING INDICTMENT" and is dated May 2, 1996.) There is no reference in this indictment - or in any of the other government papers I have - to the expert on whose opinion these indictments are based. Therefore, I have the terrible suspicion that Michael J. Yamaguchi took it upon himself to make the kind of determination that can only be made by a technical expert with education and experience in the field. Both Walz and Daggett have been "out on bail" until the very recent past. Then, within the past few months, it appears that various players in this arena have been pressured to "set up" those gentlemen. Walz took a telephone order for a piece of equipment, ordered it shipped from Canada, and was arrested when it arrived in the hands of the man who ordered it. He never saw it, never touched it, never got paid one cent, but was arrested and jailed for about one month before bail was set at one hundred thousand dollars. (By the way the man who ordered the equipment and who received it, is still free as a bird.) Daggett also was arrested (after also apparently being set up) and jailed, but released after a week or two on personal recognizance. I think it is important to note that these men have been selling these items for years, and had asked one government official after another if there was any question as to their legality. The only answers they received were non-committal. Deleterious Results from These Actions. These (and possibly other) actions by various entities at the federal level have caused the "unarrested" members of this community to pull in their horns. They will no longer even admit to possessing equipment that might be capriciously classified as Title III. The net result, unless some sensible order is created from this miasmic mess, will be a set back for state and local LE bodies of five to ten years in procurement of Title III equipment. I say that because some of the federal people involved have stated that "only people under contract to the federal government" are covered by the exception noted above. Even if that is softened to the state and local governments as specified in the law, any law enforcement agency that needs Title III equipment will have to totally technically specify its needs in a request for proposal, distribute the RFP to a list (Where does it come from?) of competent firms, take proposals, evaluate proposals, award contracts, evaluate products delivered; and finally, years after the need was recognized, receive the product. MY PERSONAL INVOLVEMENT Last month, while Jude Daggett was locked up in jail, his partner Gilbert Walz called and asked for my help in getting him out. Jude called also, and I agreed to do what I could. The letter I sent to Jude's lawyer follows. Dear *******, I am writing this on behalf of Jude Daggett, an honest man and a good friend of more than ten years. However, the opinions I express are not generated by that friendship; they are based on my education and experience and are totally consistent with my stated positions, writings and testimony over the years. Let me introduce myself and briefly list my qualifications to comment on this case and the law under which it was brought. I am an electrical engineer with almost fifty years of professional experience in communications and electronics. (A short resume follows.) I have been called as an expert witness in federal and state courts in civil and criminal cases relating to electronic communication, eavesdropping, etc. The Office of Technology Assessment of the United States Congress contracted with me to study and report on the vulnerability of our telephone system to secret monitoring. I believe I am the only engineer ever to provide an expert opinion in federal court on the meaning of "...knowing or having reason to know the design of which renders it primarily useful for the surreptitious interception of ... communications" as it relates to a specific item of electronic equipment. The law that applies originated as the Safe Streets Act of 1968, PL 90-351. The specifics relating to "primarily useful for" were printed under the heading "Title III" in that law, and that equipment has come to be known as Title III equipment by those in this field. 90-351 and its later versions were attempts to codify questions relating to monitoring the communications of others, but all are flawed in many, many ways - primarily due to the influence of lobbyists for the cellular telephone industry and cordless telephone manufacturers. They wanted to be able to tell their customers "No one can listen; it's against the law." In truth, despite any laws that can be written, that which has been transmitted by radio, can and will, be listened to. That is as immutable as water running down hill. Common, ordinary and essential electronic parts and systems, useful for many other purposes, can be used to monitor radio transmissions; and no series of laws or regulations can change that verity. There will always be people who will listen, regardless of any laws on the books or lies told to potential customers. People who choose to broadcast their thoughts by radio should not be lied to; they should be cautioned that every word can be heard by others. In fact, the United States Supreme Court, in an eminently fair and reasonable ruling, said that the man who had been imprisoned based on material his neighbors heard him say over his cordless phone had "no reasonable expectation of privacy". The court ruled that no one invaded his privacy, but, rather, that the signal received by his neighbors' cordless phone had been transmitted by his deliberate act, and the content of his messages was in no way privileged. Radio transmissions are radio transmissions, and although cellular transmissions are on different frequencies and handled differently than cordless, they are still transmissions that can be received by anyone. I'll opine that, when the law regarding cellular is tested at the supreme court level, the ruling on the validity of the law will be the same as it was in the cordless phone case. So, I present the idea above as something that could be called a "global defense" of Mr. Daggett and anyone else caught in the net that has recently been cast. However, let's consider the specifics of Mr. Daggett's case. With regard to the specific case at hand I believe the most important consideration is the legislative history of the federal law in question. Although I do not have a copy in front of me as I write this, the essence of the legislative history that applies is: "...Because this is such a specialized field, it's obvious that the services of an expert will be required in considering whether the design of a device renders it primarily useful for surreptitious interception of communication." I have read the documentation on this case, and I am appalled at the fact that technical laymen with no education or experience in this specialized field have bluntly stated as a fact that the devices under consideration are primarily useful for surreptitious interception of communication. In my opinion such statements are a travesty. As a man with an education and a lifetime of experience in the field, if I were asked that question, my answer would be that I would have to: have possession of each device for some time so I could operate it and compare it with other, technical equipment with similar capabilities, evaluate the cost vs. benefit of each possible equipment for the many possible uses, (to explain, let's consider the monitoring equipment that could be used on fax transmissions: There is a two-channel fax monitoring system from Denmark that costs $60,000 and has the capability of recognizing the formats used by all fax manufacturers. Also, it is possible to use a $30 tape recorder and $150 fax machine to reproduce faxes transmitted by a machine of the same make. With no other information to influence my opinion, I would conclude that the person trying to collect information illegally on someone else would opt for the inexpensive approach; and that the company that needs to monitor communication between the headquarters and divisions located in countries all over the world would use the expensive system so as to be sure it can decipher all messages from all machines.) discuss uses with others who have had experience with the equipment for various functions; and finally, spend time to allow my brain to reach a logical conclusion. >From my point of view it is unconscionable to have a man jailed based on the unsupported technical conclusions of laymen - laymen with no education or experience in even basic design of electronic communication equipment much less the kind of specialized electronic communication equipment referred to in this case. Based on what I have learned about this case, I believe this was a setup, designed to result in the arrest of Mr. Daggett. There was absolutely no intent or effort on his part to violate any law; in fact, material I have in hand indicates that he and his partner had frequently asked law enforcement people and even a US Attorney to tell them if any of their equipment fell into the Title III category (primarily useful for...), and were always answered ambiguously. Mr. Daggett was the target, and men who were being pressured to do so by law enforcement authorities arranged to meet him in a place that had been prewired so as to videotape the whole activity while they pressured him into assembling the equipment and turning it on - while not a word was spoken about any illegal use of the equipment. Perfectly legal equipment can be used illegally. An ordinary hammer can be used to kill someone, but that doesn't mean it is primarily useful for killing a person. The bayonet I was issued in WWII, on the other hand, is designed for just that purpose and no other. In this case, serious consideration should be given to the "primarily useful for" clause. Is someone interested in illegally eavesdropping on cellular conversations going to buy a $100 scanner or an instrument designed to fight cellular toll fraud that costs thousands of dollars? I have no idea whether the following thoughts are material, but I present them because, as a legal layman, I regularly wonder about the uneven application of some criminal laws. For instance, while Jude Daggett is in jail for possibly having sold a Title III piece of equipment: the Martins (who said they had monitored and recorded Newt's conference call that Rep Boehner was on with his cellular) were fined $500 each for the deliberate illegal recording and distribution of a cellular phone conversation. Where's the justice? Westinghouse (and a raft of other companies) advertise Title III equipment regularly and continuously. In that such advertising is also proscribed by 18 USC 2512, I wonder how they get away with it. Does our federal law enforcement shy away from the bigger companies because they have bigger budgets to defend themselves with? Where's the justice? Finally, let me go back to my original comments about this law. It is so ambiguous as to be farcical. Examples: It uses the word "intercept" incorrectly so it has to contain a special definition of it. It refers to "audio subcarrier" a complete nonsensical combination of words - audio is sound, a longitudinal wave and subcarrier must be RF, a transverse wave. It could even be interpreted in some circumstances to mean it is a federal crime to "intentionally" listen to Muzak while on an elevator or on hold on the telephone. POST SCRIPT Additional Considerations. Since writing the letter above, I have continued thinking about that silly law. Sure, the legislators will tell you they passed it to protect our privacy. That's hogwash. If they were honest, they would have listened to Bob Grove when he was invited to testify. Instead they pilloried him, accusing him of all kinds of nasty things. Had they listened to him, or to anyone with education and experience in this field, they would have heard that the law is unenforceable. That which has been broadcast by radio will be monitored by parties other than the intended receiver. Unless encryption or some modern modulation techniques are used, every broadcast can be monitored - despite the lies of the sellers. Two more possible lines for the defendants to take: #1. I am an expert and allowed, therefor, to offer an opinion in court testimony. However, when I have offered an opinion, I have buttressed it with arguments and even demonstrations. I doubt the lawyers who have expressed opinions as facts have done, or even can do, the same. There is nothing in their writings other than unsupported conclusions. 2. I think a careful evaluation of the words in the law and the legislative history might lead to the conclusion that the " communication" referred to by the law writers is solely communication between humans. If that's so, the operation of the specific item should be carefully examined. For instance, the cellular monitoring systems print out tons of communication between the CMTs and the MTSOs (cellular mobile telephones and mobile telephone switching offices). Line after line on the printout specifies the status of all active CMTs in its area, and the details of what number called what number, etc. etc. If these things primarily monitor machine communications, can they be called "primarily useful for surreptitious interception of {human} communications? TWO POSSIBLE SOLUTIONS #1. The congress could pass a new law - one based on inputs from people who know what they're talking about and have the interests of our citizens in mind. (The elements of this law that cover monitoring [the law calls it "intercepting"] of radio broadcasts is not necessary. 47 USC 705 has served us well for many years, and makes sense.) #2. As long as the stupid law stays on the books, the federal government should establish a qualified, non-government body of experts to rule on what is and what is not a Title III device or system. This would allow manufacturers and dealers to know who they can sell to. James A. Ross +++Moderator's Note+++ I agree with Ross. The law IS unclear and can result in select prosecution of anyone who manufactures Title III equipment OR ANY TYPE of communication equipment that could POSSIBLY be used for interception... Several years ago I asked a personal friend who was the BOSS of a "three Letter agency" (Federal) in New York City for clarification of TITLE III because I had developed a new surveillance device and wanted to manufacture and sell... My friend told me (after checking with Justice Department Legal Counsel) that there was "no license" which would "hold harmless" a "surveillance device" manufacturer or distributor. That they operated at the discretion of the government and could be indicted at any time... He advised me (as a friend) against developing the new device since I could be indicted for simply offering it for sale to "bona fide" law enforcement agencies... The fact of the matter is "certain" companies that are on the "in" thrive while circulating "false" data about competition and "dropping dimes" to the feds to cause competitors "problems"... Ma Bell should also be indicted as well as MANY other companies for "manufacturing" devices which allow the "interception" of communications... See how stupid this gets?... This type of case affects us ALL... I hope the list will support Daggett and Walz and let there Congressman know about this farce... ************************************************************************** [Security List info deleted. ] *************************************************************************** The Codex Surveillance & Privacy News - http://www.thecodex.com Moderator of "The Surveillance List"... http://www.thecodex.com/list.html The Nets FIRST & ONLY list dedicated to Surveillance Technology... "We don't spy on you... but we DO keep an eye on those that do..." ***************************************************************************

1 0

LPWA
by Michael Stutz 17 Dec '03

17 Dec '03

http://www.wired.com/news/technology/story/4375.html Covering Your Tracks via a Helping Hand by Michael Stutz 6:02pm 10.Jun.97.PDT Ironically, when it comes to privacy on the Net, you often have to turn to middlemen for help. In the latest in a long string of software and services that act as intermediaries for two parties when at least one of the parties wants anonymity, a technology demonstration was announced by Lucent Technologies on Tuesday. The Lucent Personalized Web Assistant enables users to maintain Web anonymity even on sites that require email registration. The LPWA acts as an anonymous proxy server, handling HTTP requests between a user and a Web site so that the user remains anonymous, said Alain Mayer, one of LPWA's developers. LPWA also filters the HTTP protocol so that no unwanted information goes out from the user, he said. Unlike the Anonymizer, a popular anonymous Web browsing service, it cannot perform temporary, nonproxy, anonymous Web sessions, but it does allow for anonymous accounts on Web sites that require it. "It computes on your behalf all kinds of username and passwords you'll need at different Web sites, in such a way that they will appear completely unrelated. On top of that, it will assign you a different email address" for each site that is visited. The problem, Mayer says, is that many commercial Web sites require online registration before you can access their information. Besides the fact that many people do not like this - and choose not to visit those sites - this poses a number of logistical problems. "One problem is that you have to remember all the username and passwords that you give out the next time you come back," said Mayer. "And if you always use the same set of username and passwords, these sites can potentially can get together and see wherever you're going and trace you down." The goal in designing LPWA was to address "where convenience and privacy can go hand-in-hand," Mayer said. "If you design privacy in software, it entails that you have to give on the convenience side. Our main goal was to combine these two possibly antagonistic goals." Currently, Lucent stores no information about LPWA users, since the anonymous usernames and passwords are generated by a cryptographic function. When a user connects to a site that requires a login, "\U" is entered for a username and "\P" for a password; LPWA then interprets this and supplies the cryptographically generated username and password to the site. Unlike some anonymous remailers, which store translations of users on hard disks, nothing would be retrieved from an LPWA should it be compromised by a government or other entity. But could commercial sites ban LPWA access by their own means? Mayer doesn't think so. "Potentially, a Web site can always refuse email from certain domains," he said, "but we can always find different domains, not just lpwa.com. What we hope is that commercial Web sites don't see us as an enemy but as a friend, because if users feel more secure in having certain things protected that they feel strongly about, then they also hopefully will feel better about giving certain other demographic information that the Web site can use. If this system gets popular, both sides will gain." While LPWA is now online, it should just be considered a demo; future versions may evolve into a commercial product that corporations could use with their firewalls, or ISPs could provide as an added benefit. LPWA is built on top of the popular Apache server software and runs on Unix - so it is plausible that in the future, individuals will run it on their own machines. "It's technically feasible to have this run on your laptop," said Mayer, "and if you're willing to live with the performance degradation you can even have it connect to another one and another one, so you don't have to trust anybody." Justin Boyan, author of the Anonymizer, imagines that schemes like chains of proxies are conceivable, but you'll always have to trust the community you are connected with. "It is a matter of trust. It's an issue of, 'Do you trust the people or the organization behind the middleman?' [LPWA] does require you to trust Lucent if you use it, and it requires you to trust anonymizer.com if you want to use us." But why trust Lucent? Mayer thinks that's a very good question. "You shouldn't," he said. "This is only a demonstration, and hopefully will generate enough interest that this will be put in places that are not in our hands. We don't even want to have this responsibility - it's not our business. Do you trust your ISP? That's a question you have to ask yourself anyway." Copyright © 1993-97 Wired Ventures, Inc. and affiliated companies. All rights reserved.

1 0

With friends like these...
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

I just read www.crypto.com/key_study. I was not impressed. In fact, one thing worries me a lot. I think the report basicly sells us out. The authors, Hal Abelson [1], Ross Anderson [2], Steven M. Bellovin [3], Josh Benaloh [4], Matt Blaze [5], Whitfield Diffie [6], John Censor Gilmore [7], Peter G. Neumann [8], Ronald L. Rivest [9], Jeffrey I. Schiller [10], Bruce Schneier [11], include many "respected" "experts". Some of them, like Blaze and Diffie and Schneier, are people who act like they're on our side. But... Benaloh works for microsoft and Rivest for Bidzos. Two from AT&T. One from HP. One from Sun. The influence of big money was clear. They want what's good for the big companies. The report endorses pro-code/safe, which effectively criminalizes the use of crypto and would outlaw remailers. It's true that they say key recovery is a bad idea (not that it's unacceptable, however, just a bad idea, not nearly as strong as it could be). The reason they give is that they think it may be too expensive for corporate America. What they don't say is Far more interesting: They don't say that key escrow is unacceptable, period. They don't mention the big brother problem. They don't talk about the long history of government abuse (FBI, CIA, NSA, etc). The conveniently leave out ALL the libertarian issues about how key escrow making the government bigger and more powerful. They just seem to care about what it costs. And these are our friends? Now lets look at who benefits from this point of view. Criminalize crypto, outlaw remailers, no expensive key escrow. It SOUNDS good, at least a small gain, but this gives them a real tool AGAINST us. They can come after crypto users for the first time. Who benefits? BIG companies. NOT CYPHERPUNK GOALS. By not mentioning it, I think these guys have sold out. They may not realize it themselves, but the effect is just as bad (maybe worse). CDT which brought us the CALEA and the CDA, funded the study. They no doubt were able to influence the content to get rid of the "unacceptable" stuff. We should be asking who our friends are here. I think if these guys really wanted to be effective, they could take more of a real stand, with some real risks. Have ANY of these guys ever written code to promote strong crypto? Schneier wrote a book, but, charges for his services. I don't think they have been "bought" or are working for the other side, I just think we should be realistic about who the "experts" are really working for - their own pockets and their big employers. KEY ESCROW IS UNACCEPTABLE, PERIOD. No matter what the cost. No matter how safe. No matter what. I think we should respectfully ask them to clarify where they stand. Mr experts, <hal(a)mit.edu> <ross.anderson(a)cl.cam.ac.uk> <smb(a)research.att.com> <benaloh(a)microsoft.com> <mab(a)research.att.com> <diffie(a)eng.sun.com> <gnu(a)toad.com> <neumann(a)sri.com> <rivest(a)lcs.mit.edu> <jis(a)mit.edu> <schneier(a)counterpane.com> Do you stand for the criminalization of crypto? Is there anything wrong with key escrow other than the cost? Why is your report so weak?

4 3