December 2003 - cypherpunks-legacy

Personal use crypto export
by Jim Gillogly 17 Dec '03

17 Dec '03

I'm moved to repeat Matt Blaze's exercise of a couple of years ago, where he went through the rigamarole to get an Official Paper from Customs or State or whoever was in charge to take his laptop out of the country with crypto on it for his personal use overseas. His experiences finding the right person to talk to to get a form, then his inability to find a Customs official to look at it on the way back, were semi-hilarious. However, now that crypto exports in general have moved from ITAR to EAR and BXA is in charge of general crypto exports, I can't find out how to get the right form to take out a laptop with PGP (or anything else) on it. Can anybody give me a pointer to whoever thinks they're in charge of this stuff? Or have they given up on this phase? Thanks... -- Jim Gillogly 24 Winterfilth S.R. 1997, 18:38 12.19.4.10.12, 7 Eb 10 Yax, Fifth Lord of Night

6 5

Security flaws introduced by "other readers" in CMR
by Tim May 17 Dec '03

17 Dec '03

At 11:10 AM -0700 10/15/97, Eli Brandt wrote: >Non-technical point: the NSA (reportedly) has no intention of using >GAK for classified information. They know that it weakens security. > >Do the privacy of the nation's data and the security of its >information infrastructure deserve the same consideration as the >Pentagon's "Confidential" memos? When you're planning to build in a >single point of failure, this is a question you have to ask. This also applies to CMR as well. Whatever the perceived business reasons for CMR, the fact is that it introduces additional failure points. No longer will Alice and Bob be secure that at least there are no "other readers" in the channel between them (what they do with the plaintext after decryption is of course solvable by no technology). And, contrary to some of what we've been hearing, even corporations have continuing needs to know that a communication between Alice and Bob, within a corporation or crossing the corporate boundary, is not being listened to by any other person. Merger negotiations are one obvious example. (There are workarounds, I suppose. CMR could have a "override" switch to turn off the CMR to a second key. But who decides on this? Maybe a signed message from a suitable higher-up? Ah, the complexity. And executives wanting to bypass CMR can and will use other channels. So many of the goals of CMR are out of reach....) Instead of choosing an example where CMR apparently "works," such as Crispin's example of a corporation using CMR to detect (as if it weren't detectable in other ways!) that an employee is operating a porn ftp site from company computers, let me throw out some examples where CMR introduces flaws into a security system. * Andy Grove sends a PGP 5.5-encrypted message to T.J. Rodgers, CEO of Cypress Semiconductor, outlining the plans for Cypress to be acquired by Intel. However, Cypress has implemented CMR, and one of the "second readers" of Andy's message is the cryptically-named (no pun intended) "CCCP" (Corporate Crypto Compliance Police), staffed by security guards and personnel management droids. Major security flaw. (Sure, one can imagine various levels of "second readers." But I rather doubt that most of them will be _offices_, with changing staffs. While one could, for example, designate "Gordon Moore" to be the second reader of all files encrypted to Andy Grove's key, I rather doubt this is the way CMR will play out.) * Craig Livingstone, at whitehouse.gov, is the Key Compliance Officer for all communications entering or leaving the White House. Enough said? * Sheep-dipped cutouts in defense companies await their orders from DoD, but find that other readers in their companies are monitoring them. And so on. "Three can keep a secret if two of them are dead." (Ben Franklin) What will of course happen is that these "security flaws" will be plugged by subterfuge. People will stop using the corporate mail for many such tasks, and will use nonwork accounts. With some loss of efficiency, and even more opportunities for leaks. (If firewalls are in place, on outside net connections, employees can just dial out. Or use Metricom Ricochet modems, if conditions are favorable for reception. Or wait until they go home.) In fact, CMR will mostly just mean bland, interdepartmental messages get "recovered." As I said before, this is a pretty crude way to implement a kind of corporate archiving of information. Truly sensitive stuff--stuff about takeovers, foreign production plans, new products, etc.--will be encrypted with channels having no nosy security guards or Corporate Crypto Compliance Police silently listening in. Which means we're back to square one. So why does PGP, Inc. bother? And why should OpenPGP squander efforts worrying about this? --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 5

Re: FCPUNX:PGP Key Escrow and Congress
by goddesshera＠juno.com 17 Dec '03

17 Dec '03

On Wed, Oct 15, 1997 at 02:10:54PM -0400, Eli Brandt wrote: > Bruce Schneier wrote: > > From: "Barbara Simons" <simons(a)VNET.IBM.COM> > > > > Some of these are old arguments that we've been hearing for a while, > > but some are newer. In particular, points 4 and 6 are difficult to > > refute without getting into some technical details. Both points also > > undercut the argument that a key recovery infrastructure potentially > > weakens security. After all, the NSA thinks it's secure enough that it > > can be used by the government. > > Non-technical point: the NSA (reportedly) has no intention of using > GAK for classified information. They know that it weakens security. You have this wrong. In fact, NSA *supplies* keys for classified encryption equipment. They never told me whether they "escrowed" copies of the keys they supply -- what do you think? > Do the privacy of the nation's data and the security of its > information infrastructure deserve the same consideration as the > Pentagon's "Confidential" memos? When you're planning to build in a > single point of failure, this is a question you have to ask. In fact, it's much more complex. People with real classified data don't trust encryption at all, and they only use it if they absolutely have to. They, unlike many cypherpunks, remember well that there are other ways to get information besides running big computers, and if you have protections against those in place already, crypto doesn't buy much. But classified data isn't really interesting. Though by any measure there are huge amounts of it, it is dwarfed by the amount of government data that is not classified. To protect that data government agencies will use comercial crypto, and "key recovery" *will* be required in any commercial product purchased by a government agency. As use of crypto becomes commonplace business practice, the government market will be huge, and consequently, commercial products with key recovery *will* be prevelant. Any company that doesn't supply it will be relegated to niche markets, and, if legal winds blow the wrong way, eliminated. Crow This message was automatically remailed. The sender is unknown, unlogged, and nonreplyable. Send complaints and blocking requests to <goddesshera(a)juno.com>.

1 0

Hello!
by Hangman37＠aol.com 17 Dec '03

17 Dec '03

Have you ever wanted to contact a celebrity? Ever wanted your favorite celebrity to send you a personalized autographed picture? If you have, then you will need this list. It is a list of over 5,000 celebrity addresses. And it is guaranteed that the celebrity you are looking for is on the list, or you will get your money back! You can get this complete list of over 5,000 celebrity addresses for only $10.00. My list has been used for: Autograph Collecting Fund raising Real estate sales Security system sales Fan mail/appreciation letters Birthday cards Get-well cards Speaking invitations Included is a document that explains the easiest and fastest ways to get replies from the celebrity. A list like this cannot be found for less! For $10, you can get this list sent to your email address the next day after receiving your order. For an extra $2, you can get the list mailed to your residence on a 3.5" disk. Here's how to order: If you want the list emailed to you................ Total = $10.00 If you want the list sent on a 3.5" disk.......... Total = $12.00 Please include your name, address, and be sure to include your email address. Send checks or money orders to: Jared Thorp 2829 N. Glenoaks Blvd. Suite 106-179 Burbank, CA 91504-2660

1 0

New Mac68k snapshot available
by Hans Guenter Weigand 17 Dec '03

17 Dec '03

The second snapshot for mac68k is available at the usual locations. This time the newest installation tools are included. The errata of the first snapshot have been fixed. Please report all errors, problems, failure, and (of course:) success to Theo de Raadt or at least to the appropriate mailing list. Thanks to Allen, Rodney and Thomas for the last-minute-help! hgw

1 0

Re: FCPUNX:PGP Key Escrow and Congress
by goddesshera＠juno.com 17 Dec '03

17 Dec '03

On Wed, Oct 15, 1997 at 02:10:54PM -0400, Eli Brandt wrote: > Bruce Schneier wrote: > > From: "Barbara Simons" <simons(a)VNET.IBM.COM> > > > > Some of these are old arguments that we've been hearing for a while, > > but some are newer. In particular, points 4 and 6 are difficult to > > refute without getting into some technical details. Both points also > > undercut the argument that a key recovery infrastructure potentially > > weakens security. After all, the NSA thinks it's secure enough that it > > can be used by the government. > > Non-technical point: the NSA (reportedly) has no intention of using > GAK for classified information. They know that it weakens security. You have this wrong. In fact, NSA *supplies* keys for classified encryption equipment. They never told me whether they "escrowed" copies of the keys they supply -- what do you think? > Do the privacy of the nation's data and the security of its > information infrastructure deserve the same consideration as the > Pentagon's "Confidential" memos? When you're planning to build in a > single point of failure, this is a question you have to ask. In fact, it's much more complex. People with real classified data don't trust encryption at all, and they only use it if they absolutely have to. They, unlike many cypherpunks, remember well that there are other ways to get information besides running big computers, and if you have protections against those in place already, crypto doesn't buy much. But classified data isn't really interesting. Though by any measure there are huge amounts of it, it is dwarfed by the amount of government data that is not classified. To protect that data government agencies will use comercial crypto, and "key recovery" *will* be required in any commercial product purchased by a government agency. As use of crypto becomes commonplace business practice, the government market will be huge, and consequently, commercial products with key recovery *will* be prevelant. Any company that doesn't supply it will be relegated to niche markets, and, if legal winds blow the wrong way, eliminated. Crow This message was automatically remailed. The sender is unknown, unlogged, and nonreplyable. Send complaints and blocking requests to <goddesshera(a)juno.com>.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> writes: > This also applies to CMR as well. Whatever the perceived business reasons > for CMR, the fact is that it introduces additional failure points. No > longer will Alice and Bob be secure that at least there are no "other > readers" in the channel between them (what they do with the plaintext after > decryption is of course solvable by no technology). I thought that was the whole point of the PGP design. It makes the presence of third parties clear and visible to all participants. This seems to be the fundamental principle. PGP is designed to allow Alice and Bob to be informed if third party access is built in. Key escrow and re-encryption are inherently less visible forms of message access.

4 3

Web Biz Universal Remove List Update
by postmaster＠thehitman.com 17 Dec '03

17 Dec '03

Dear Cypherpunks MAILING LIST, Thank you for adding your address to the Universal Remove list This email is simply a notification that you have been added to or updated in our Universal Remove list(s). As a reminder, you submitted the following details to: www.thehitman.com Cypherpunks MAILING LIST at cypherpunks(a)toad.com Responsible Direct Email DOES exist at Web Biz!

1 0

OUBAKAYAROU!!
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

>Tim May (tcmay(a)got.net) >Wed, 15 Oct 1997 22:11:09 -0700 > >At 9:18 PM -0700 10/15/97, Nobuki Nakatuji wrote: >Where are another cypherpunk mailinglist ? > > >Am another cypherpunks mailinglist at cyperpunk(a)dev.null. >You go there, chop chop. >You not talk about Misty here anymore, OK? We am tired hering about >Misty and your fees. > >--Tim-san > > > Shine Shine!! Bakayarou!! Aho!! Manuke!! Anpontan!! ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

3 2

Re: CFV: comp.org.cauce moderated -- support privacy and anonymity
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

[This message has also been posted.] [I am objecting to a proposal that seeks to ban one-way anonymous remailers and other forms of unrepliable addresses such as spamblocked addresses]. In news.groups, WD Baseley <wbaseley(a)mindspring.com> wrote: * [my apologies to the net at large for replying sans *snecks* - I don't * know which group is read by the person to whom I'm replying.] * In article <3447bfd7.22958863(a)128.2.84.191>, phelix(a)vallnet.com * >On 14 Oct 1997 11:57:07 -0400, moz(a)server2.mich.com (John C. Mozena) wrote: * >>Igor Chudov @ home <ichudov(a)algebra.com> wrote: * >>>Vote AGAINST comp.org.cauce which wants to outlaw anonymity and * >>>use of spamblocked addresses. Go to news.groups and find the * >>>CFV for comp.org.cauce, with the ballot enclosed. * >> * >>Vote for comp.org.cauce, which protects the utility of a newsgroup and the * >>freedom of postmasters to not run anonymous posting services should they * >>not so desire. * > * >Well, I just started reading this, and I didn't really know which way to * >vote. But such an anti-anonymnity stance makes the choice clear: * > * >vote *NO*. * * Since you just started reading this, I think you need more background * before coming to a decision. I'm not trying to influence it one way * or another; I'm just trying to give you more complete information. * I'm posting and emailing, and I'm sure that if I get it wrong I'll be * jumped upon thoroughly in the newsgroups - feel free to look there and * see if that happened. By all means, as one of the opponents of the proposal and supporter of anonymity, I ask you to do so and also get your privacy-concerned friends to take a close look at the debate. For example, here's what the proponent said: Mozena>>But, what do you have against anonymity? Mozena> Mozena>Nothing. What right do you have, though, to force me and others to Mozena>inconvenience ourselves so you can post anonymously or protect yourself Mozena>from spam? * The RFD requires posters to use addresses which receive, and reply to, * email; in other words, no munged, faked, spamblocked, or other * bouncing or redirecting addresses. There is nothing that says you * must use your real name, or any other identifier, that tells who you * really are. If "the-return-of-zorro(a)example.com" receives and replies * to email, it can be used to post to the proposed group. "Anonymity", * the ability to post without anyone knowing your true identity, is not * really the issue. Even anonymous remailers will work if they forward * email in both directions. But mungs and spamblocks will not work. These are not anonymous remailers, they offer a much lower security, they are not very reliable by their very design, and the only *true* anonymity can come from a one-way remailer. The proposal, as it stands, seeks to outlaw the one-way anonymous remailers. * John Mozena's comment on anonymous posting services stems, I'm pretty * sure, from an alternative offered by several folks. The idea was: * posters would add an 'X-Real-Address' line to their posts; the * moderation bot would use that line for correspondence, but remove it * before making the post public. John Mozena and others at CAUCE were * unwilling to do this because of possible legal ramifications; John * likened it to running an anonymous posting service, and wondered what * the consequences would be should someone use it to post copyrighted or * sensitive information. Well, this is NOT true. John objected to it with the argument that he does not like unrepliable addresses appearing in newsgroups. Anyway, all this talk about the X-Real_Address: field is NOT related to true anonymity, by the very definition of the latter. -- - Igor. The average American spends a total of six (6) months in prison.

1 0