December 2003 - cypherpunks-legacy

Re: Security flaws introduced by "other readers" in CMR
by Anonymous 17 Dec '03

17 Dec '03

Let's look a little closer at the kinds of access and notice available in the PGP system compared to alternatives. As several people have pointed out, no encryption system can provide protection against what is done with the message after it is decrypted. The receiver could share it with whoever he wants to, or whoever he is forced to. Consider the following scenarios: - An encrypted message is sent to someone at his workplace using current systems like PGP 2.6. - An encrypted message is sent to someone at his workplace, who is using the message access features of PGP 5.5. The corporation key is marked as "optional", and the message is not encrypted to that extra key. - An encrypted message is sent as before, but this time the message is encrypted to the corporate key. - An encrypted message is sent to someone at his workplace, who is using a different form of corporate access which relies on key escrow or automatic acquisition of cleartext. We agree that none of these systems can provide complete protection against third party access. In any of them, the receiver could be forced to turn over the encrypted message. But there is still a difference. In the first two scenarios, the expectation of privacy is the same. You are encrypting to a personal key at a business address, but you expect that you would know about it if the data were being provided to a third party. There is no widespread installed base of software which provides secret access after the message is decrypted. In fact, the second scenario arguably provides slightly more privacy than the first, which is what we have now. The reason is that in the second scenario, the company provides an optional mechanism for business mail to be recoverable, but also provides an explicit, sender-controlled escape clause. The company is granting an explicit expectation of privacy by allowing the corporate key recipient to be removed. With usage of older versions of PGP, there was really no way for the company to even inform the sender about whether it was going to be reading the mail. In the third scenario, where you encrypt to the corporate key, there is no expectation of privacy. All parties, the sender, the receiver, and the company, know that the data is being made available to the business. There is not much privacy here; what you have is business security. This mode would be used for business documents and business communications. In the fourth scenario, which some people are offering as a superior approach, the expectation of privacy is much less clear. Unlike in the current PGP approach, where the design of the corporate access system is oriented around notifying the sender and receiver, a key escrow or plaintext recovery system inherently provides no such notice. This is different from the status quo. We are talking about a commercial product which provides automatic corporate access to communications. Widespread installation and use of this alternate version of PGP inherently changes the assumptions and expectations that you will have when you encrypt to someone at work. Given the company's desire for message access, this approach implies that you must conservatively assume that most encryption to a business address will be read. The PGP system is designed to avoid this. It provides another method for corporate access, a visible and explicit method. It is intended as an alternative to key escrow and other systems which recovery data after the recipient gets it. PGP's third party recipient feature is designed to prevent the creation of an installed base of escrowed keys and after the fact third party access software. Even if the encryption system provides a way for the user to mark his keys as being escrowed or otherwise providing third party access, the system is not self-correcting in the way the PGP system is. It would be much easier for a business owner to pervert a secretive access system than one like PGP. The company could install the access features but not tell its employees that their keys were being escrowed, or that their mail client was secretly storing a copy of all plaintexts. This kind of change would be easy to make with the after-the-fact access systems some people are proposing. Yes, theoretically this can be done with any encryption system (as all agree) but the point is to avoid the widespread distribution of software which invites this kind of abuse. The PGP system is designed to satisfy business needs without leading us into this dangerous situation. A world in which third party encryption by the sender is the normal and widespread method for corporate access is one with increased privacy and more visibility of access. The alternatives which have been proposed are prone to abuse and provide less visibility. They lead us towards a world in which there is no expectation of privacy even for encrypted messages, by providing an installed base of snooping software. The PGP approach is explicitly designed to keep us out of that world, by removing the need for that kind of software.

3 2

InfoWar Epilogue 3 (Part III of 'The True Story of the InterNet')
by I Am Not A Crook Remailer 17 Dec '03

17 Dec '03

1 0

InfoWar Epilogue 3 / TEXT
by I Am Not A Crook Remailer 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger <tm(a)dev.null> Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * Gomez ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- Subject: Nun Other From: John Young <jya(a)pipeline.com> To: cypherpunks(a)toad.com On terrorists, one of the Four Horsemen. IS THE ASSAULT ON NATIVE INTELLIGENCE & GOOD WILL WE CALL THE EVENING NEWS ANYTHING OTHER THAN AN ACT OF TERRIORISM? What was the Gulf War but terrorism wearing the death mask of order?-- One big car bomb it was the guys who drove it are dying now one by one--ignored! Is acid rain a form of terrorism? (Think for yourself.) Is GATT or NAFTA anything but a pact among brigands--the World Bank, the IMP their backup men? How long before they fight over the spoils? Who'll do the fighting for them?" ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- Gomez Damn! Will these contemptuous, plebeian subalterns never learn? I will allow them to fight over the spoils! They will do the fighting for ME! It is I who am at the right hand of the Evil One. It is I who will bring the earth to submission under HIS dominion, with the Dark Allies by my side. The future is written! It is written! These foolish ants continue to struggle in vain, though the battle they persist in fighting was lost centuries ago. They can do no more than postpone the inevitable, at best ---------------------------------------------------------------------------- The stage is set. My minions have their exits and their entrances, and I have, in my time, played many parts. The book-learners rail against sheep in wolves clothing, while I weave them all into patterns of my own design, like a weaver spinning her wool and intertwining it according to an already foreseen pattern. Like the Big Bad Wolf in Grandmother's bed, I sit at the head of the table from which they sup, laughing at the ragamuffin progeny of the human race as they tell me, "My, Big Brother, what big eyes you have." And what big teeth I havebut this Big Bad Wolf has already taken the axes out of the hands of most of the woodcutters, and the rest of their weapons shall be in my hands by the end of 1999. The mortal fools who live in the InfoWar weald of my Grand Scheme cannot see the forest for the trees as they fight their 'winning' battles one retreat at a time. I have turned their words on their head with NewSpeak, DoubleSpeak and SpinSpeak-I have turned their minds upside down by making all forms of disagreement with my Puppet Masters CrimeThink and CrimeSpeak. I have turned their world and their reality on its head, yet the simpletons are not capable of turning 1999 on its head and realizing that at the end of the millennial forest stands the Subtle Serpent which convinced Eve and Adam to eat the fruit from the Tree of the Knowledge of Good and Evil-the serpentine, autarchic Evil-1and Armageddon. ---------------------------------------------------------------------------- "Please allow me to introduce myself" "I am An Evil FUD Disseminator To Be Named Later. "I will be your host for the rest of this chapter of 'InfoWar,' because I have the brass balls needed to tell you blatant lies about your future, and the future of humanity, because I know that it is now too late for human kind to save themselves, and that you desperately desire to hear, and believe, the lies I am about to tell you. "Nowback to our 'story.'" It is becoming increasingly obvious, to even the deaf, dumb and blind, that the Y2K (Year 2000) programming 'problem' has the potential to become a worldwide disaster. Is this an 'accident?' Is it the result of the laws of inertia, vis a vis human nature? Yesnow turn on the TV and go back to sleep. That's rightthe Y2K 'problem' has been known about for years, yet the finest minds in the arena of computer finance have not understood the true import of the problem until just recently. The major players of huge financial empires have been sitting on their butts, completely unaware of the possible scope of disaster that lies in wait at the turn of the century. And all because they are so terribly, terribly stupid. Yes, they are just now beginning to wake up and realize that their whole world may come crashing down around them if the Y2K problem is not properly dealt with. Bill Gates has been sitting back, thinking, "Damn. I may be out a hundred billion dollars before the fallout from this problem stops. Oh well, easy come, easy go." Financial institutions holding billions of dollars in hard assets have not even remotely considered the possibility that, if computers worldwide lose the ability to easily prove whom those assets truly belong to, well"We'll have this all sorted out soon, sir. If you will just take a place at the back of the line, behind the other one hundred million people, our company directors will be taking a look at everyone's claims just as soon as they get back from their extended vacation on the French Riviera." "After an intensive inquiry, we have come to the conclusion that we are an honest, reputable financial institution which would never take advantage of the Holocaust by profiting outrageously from the slaughter of millions of our valued customers. "There is just no way we can possibly trace who these assets should properly belong to as a result of being slaughtered by some of our other valued customers. "On your way out, would you mind throwing these bookkeeping records in the trash for me?" The truth of the matter is, human nature is such that the operators of funeral parlors in Asia have been found to be paying hospital employees to surreptitiously murder patients whose family members are likely to use the operators services when their relatives die. However, people who can rule empires, perhaps even the world, by virtue of being a Sumo Dog in a world of kittens, would never dream of using their money, power and position to do so. The three-letter agencies that regularly violate all manner of their own country's laws, as well as the laws of other countries, and international law-the secret agents who trade in weapons and drugs to support their objectives, while imprisoning others who do so-the spooks who openly admit that they use their secret access to worldwide financial systems to manipulate and steal the Bad Guys money and bring them to ruin Well, lets just say that they are people with high moral values, and would never consider secretly preparing to take full advantage of the Y2K issue, while assuring those outside the loop that it is bit of a 'problem' that 'someone' will get around to taking care of, sooner or later. You can turn on the TV and see major financial institutions actively seeking the business of deadbeats or fools with hard assets. You can see a smiling man explaining that the company he represents loves you so gosh-darned much that their standard contract contains two 'gimmes'-that they will give you coupons which allow you to 'miss' two payments at your own convenience. "Yes folks, we are trying to help people who are likely to default on their loans because they believe the problems resulting from their bad financial habits will be solved by planning ahead for getting in above their heads." You can see ads telling you that Company B loves you so gosh-darned much that they will loan you up to 125% of your equity in your home. "We will even kiss you on the lips, to show our sincerity. " When we call in your loan, you will be advised of where you can kiss us." Trust methese people are not involved in a mad scramble to gain possession of as many hard assets as possible because they know something that you don't know The IRS, the Rockerfellers, the shadowy world figures who own and operate munitions factories in both, or all, countries involved in armed conflict, the patriots who sell ball-bearings to keep the war machines that are shooting at their sons and daughters operating Well, if there is great upheaval and disaster in the financial community, as well as in society itself, then these people will probably come to ruin, while your life just keeps getting better and better. In conclusion, I would like to assure you that if worldwide disaster suddenly looms as a result of a crisis caused by the Y2K 'problem,' that it will undoubtedly be a result of the evil conspiracies of drug dealers, pedophiles, terrorists, Saddam Hussein, and a Horseman to be named later. The 'good' news is that our saviors are waiting in the wings to rush to our rescue and save us from the Great Evilas long as your name is not on 'The List,' of course. {Hang on a second, I'll check} Gee pal, I'm afraid I have some rather bad news for you ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ----------------------------------------------------------------------------

1 0

none
by kndpblsh＠mail4.c-flash.net 17 Dec '03

17 Dec '03

ARE YOU SICK OF ALL THE SCAMS?!! If you SERIOUSLY want to work at home, but you're sick of all the mlm "opportunities", then we have the PERFECT thing for you. You'll work 15 hours per week, and average $500-$900. NO selling, NO catches, and NO SCAMS!!! For Info: http://www4.c-flash.net/~kndpblsh If this message has reached you in error, please accept our most sincere apologies. Simply hit "reply", type "remove" in the subject area, and send. You'll be removed from our list, promptly. Thank you very much. =) Kim Skinner, K & D Publishing ********************************************************************* NO MLM, NO CATCHES, AND NO SCAMS!!! For FREE Info On Our LEGITIMATE HOME BASED BUSINESSES, Visit Our Website At http://www4.c-flash.net/~kndpblsh Or, Click Here, kndpblsh(a)mail4.c-flash.net">mailto:kndpblsh@mail4.c-flash.net And Send Us Your Snail Mail Address. ********************************************************************** To Have Our FREE Report On SUCCESSFUL INTERNET MARKETING Sent To You Immediately, Send A Blank E-Mail To Our Autoresponder At mailto:kndpublishing@mail4.c-flash.net **********************************************************************

1 0

PGP Inc apology deal
by Adam Back 17 Dec '03

17 Dec '03

To reply to Jon Callas request for an apology for my rudeness, I'll offer a deal: - If I am unable to show you how to improve the GR (GAK resistance) of a system with a similar set of recovery properties to the CMR system; which replacement design is vialble to use in a typical corporate environment I will publically apologize for being rude, and for wasting your time. - If I am able to show you how to improve the GR (GAK resistance) of a system with a similar set of recovery properties to the CMR system which replacement design is vialble to use in a typical corporate environment, I _don't_ want an apology. I want something much more interesting: I want PGP Inc to implement and deploy it. - The group which will judge this process is PGP Inc. Do we have a deal? Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

re: consensus on pgp? can we consolidate for action?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- after I mailed the rant, I thought maybe the paragraph below was incomplete: # of course, I may be presumptuous PGP would even want to hear # from us, let alone have any form of "Cypherpunks Inside" # (yuk) label on the box! particularly with the round robin # multi-teaming of the sleepless Jon Callas. # should have said ..."Cypherpunks Inside" label on the box: of course, they might it consider it preferable to being labeled: "Big Brother Inside" # # this has been an addendum to an attila rant... attila, out, again, one more time.... it aint over 'til the fat lady sings and vahalla is burning! "attila" sig: 1024/C20B6905/23D0 FA7F 6A8F 6066 BCAF AE56 98C0 D7B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNEZc+L04kQrCC2kFAQE1AwP/W+BJ+a2rGhTh90lnMqt8RZCTOtmpWYrl DMCQ+zojBnfRAkzZ/ethdnXYNgOlCRV/xWejMgOjLxlp3LDiAfzdgJM+u4ZCbZR3 Dvmkfs8uu8oK8E+3Ztb/H3XovXM6pxUtwoEaJKlOScBw2ypLFER3aZe1SVLnmDeb P9vIBbx5j+4= =NOox -----END PGP SIGNATURE-----

1 0

Re: CFV: comp.org.cauce moderated -- support privacy and anonymity
by Psycho Killer 17 Dec '03

17 Dec '03

Igor Chudov @ home wrote: > [This message has also been posted.] > [I am objecting to a proposal that seeks to ban one-way anonymous > remailers and other forms of unrepliable addresses such as spamblocked > addresses]. > Mozena>>But, what do you have against anonymity? > Mozena> > Mozena>Nothing. What right do you have, though, to force me and others to > Mozena>inconvenience ourselves so you can post anonymously or protect yourself > Mozena>from spam? I agree with Mozena. I like to hunt down and slaughter people who use the word 'reference' in their posts, and I'm getting damn tired of wasting my valuable time because some assholes want to remain anonymous. > The average American spends a total of six (6) months in prison. I always knew I was above average, and now I have *proof*. Psycho Killer "Qu'est que c'est?"

1 0

Re: Liberal lawyer joke from Cdn-Firearms Digest V2 #34
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

On 16 Oct 97 at 9:58,somebody wrote: > Research labs are increasingly replacing rats with lawyers. > > There are three reasons for this: > > 1. The lawyers are in abundant supply > 2. The lab workers do not develop any kind of emotional attachment to lawyers > 3. There are things you just can't get a rat to do.

1 0

FBI allowed to keep file on New York man's lawful activities
by Declan McCullagh 17 Dec '03

17 Dec '03

FBI allowed to keep file on New York man's lawful activities By LAURIE ASSEO Associated Press Writer WASHINGTON (AP) - The Supreme Court today refused to order the FBI to purge its file on lawful activities by the former head of a charitable foundation. The court, without comment, turned away arguments that said the FBI is violating a federal privacy law by keeping a file about the man's years-ago meetings with foreign leaders and political dissidents. Lance E. Lindblom of Larchmont, N.Y., was president of the Chicago-based J. Roderick MacArthur Foundation from 1984 to 1994. The foundation supports civil liberties activities, and Lindblom's duties included meeting with foreign leaders and political dissidents. After filing a request with the FBI, Lindblom learned in 1989 that the bureau kept records that described his meetings with such people. Lindblom and the foundation sued the FBI in federal court in the District of Columbia, saying the 1974 federal Privacy Act required the bureau to purge those files. The law limits federal agencies' authority to keep records describing how people exercise their rights under the Constitution's First Amendment, including rights of free speech and association. Under the Privacy Act, agencies can keep such records only if it is authorized by another law or "within the scope of an authorized law enforcement activity." A federal judge ruled for the FBI, saying the files were compiled for legitimate law enforcement purposes. The investigations were not aimed at Lindblom or the foundation, but were aimed at the people with whom they met, the judge said. A federal appeals court agreed last December. Federal agencies can keep records they lawfully collected, the appeals court said, adding that a requirement to purge old files would be too burdensome. In the appeal acted on today, Lindblom's lawyers said agencies must separately justify the need to keep old records, even if they originally were lawfully collected. Keeping Lindblom's file increases the risk that it will be used illegally, his lawyers said, noting the 1996 controversy after it was found that the FBI files of 700 former White House employees had been sent to the White House. Justice Department lawyers said a requirement to purge old files would cause problems if the information later was needed for a new or reopened investigation. The case is Lindblom vs. FBI, 97-82. APTV-10-14-97 1020EDT

1 0

Re: FCPUNX:proposal: commercial data recovery
by Eli Brandt 17 Dec '03

17 Dec '03

Will Price wrote: > In your model, the recipient automatically > decrypts and then re-encrypts to a data recovery key -- even though > end-user computers are likely to be insecure thus making this decrypt & > reencrypt step rather specious at best. The value of this security model escapes me -- if the receiver's machine is insecure, you lose, period. Please, let us assume that neither endpoint is controlled by an attacker. You are concerned that the recipient is re-encrypting with a key whose access characteristics are unknown to the sender. Now, for all the sender really knows, the recipient may be storing the message in the clear, or maybe putting it on a Times Square billboard. This is not a cryptographic failure. In your CMR system as well, the sender has no choice but to trust the recipient's integrity and data hygeine -- or to not send the message. The headers could contain a request as to the eventual disposition of the message, but there are never any guarantees. > As an actual data recovery system, it also fails fundamental tests. If I > encrypt critical data to a colleague wiping it from my system after > sending, then the colleague is incapacitated before receipt and processing > of the message, the data can never be retrieved. Forget bus-struck colleagues, think unreliable messaging -- if you do this and your e-mail is lost in transit, your "critical data" is lost. So don't do this. > A data recovery system > must solve this kind of issue -- data recovery here means that from > end-to-end the data is recoverable in case of emergency. One cannot ignore > message transit time in this -- it can take days for a message to travel > from AOL to the outside world. I'm not seeing how transit time figures in here. Are you proposing to bypass it by sending in an emergency team to acquire the in-transit message from the AOL machine room? If you find this practical, you can even retrieve an un-CMRed message by putting the recipient on this emergency team. But as I said, this situation should never be allowed to arise. Data recovery means you can get the data. It doesn't specify which copy you get decrypt. For reliable transmission over an unreliable medium, the sender must not destroy the original until receipt has been confirmed; for stored-data recovery, "receipt" involves appropriate re-encryption. (A reliable medium simply involves shoving all of this down into the messaging protocol.) So reliable transmission can support data recovery, from one end or the other, without message recovery. You might ask what happens if both endpoints are struck by meteorites. If the data is critically important, it will have been replicated off the sender's disk. The bottom line is that no such data can be trusted solely to an AOL mailserver (of all things). > If you don't need data recovery, don't use > it, but at least respect the people who do need it and need it to actually > work at all points. I'm no protocol designer, but I'd have more respect for this system if explanations for its necessity seemed to have been fully thought through. The issue of communications keys versus storage keys has been discussed before; I don't believe I'm raising any novel issues. Did PGP Inc. consider and reject stored-data recovery (if so, what were the good reasons?), or are we seeing a retroactive explanation here? -- Eli Brandt | eli+(a)cs.cmu.edu | http://www.cs.cmu.edu/~eli/ (on FCPUNX, cc'ed replies appreciated)

1 0