December 2003 - cypherpunks-legacy

InfoWar Epilogue 6 (Part III of 'The True Story of the InterNet')
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

[news] Pentagon computers broken into over 250 times
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Pentagon computers broken into over 250 times More than 250 U.S. Defense Department computer systems were broken into last year and the number of attempted break-ins was projected to double this year, a U.S. intelligence official said. The comments that Air Force Lt. Gen. Kenneth Minihan, director of the National Security Agency (NSA), made Saturday at an intelligence convention were released Thursday. Urging stepped-up awareness of cyber security issues, Minihan said the United States built its information infrastructure on a "poor foundation -- and we will eventually pay for it." See http://www.infobeat.com/stories/cgi/story.cgi?id=5585016-7b1 -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

1 0

Re: spoofing as performance art
by John Young 17 Dec '03

17 Dec '03

Indeed, it is hard to tell the difference between spoofing and grave pronouncements on threats to one's own interests under guise of national secuirty and/or personal privacy, for the truthful lying that accompanies each performance are identical. Spoofing has the ethical and humorous edge, however, in that it gives clues to its origin as entertainment -- let's us in on the joke -- while the seriously dramatic performer aims at dominating us with profundity, wisdom, righteousness, conviction and disdain for disbelievers in the blind faith of the performer in the importance of her responsibility to hector and lecture us into craven servility. All leaders suffer over self-importance and thereby demand ridicule to save us from them. Here's a Bronx cheer to the non-spoofers, who don't get that the joke's on them. Thank Zeus and Juno, as far as I've read here, cypherpunks has no implacably non-spoofers posting, though a few of us are pretty good at behaving seriously briefly, spoofing seriousness. And PGP is doing a fine sanctimonious act worthy of high ridicule, it's just conforming to what businesses and governments do to survive the disloyalty of employees and citizens who don't believe once-trusted leaders inevitably corrupted by power, fame and chance to forever escape work (corrupt me, do). They become parodies of themselves. Anonymous got it right: Bosses and Government, no difference, same liars and snoopers and non-spoofers who just don't get what's wrong with putting their interests before ours, we gobbling voracious maggots.

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

>Mark, just remove the self signature on the user key. The message >recovery key packet goes away! That's all you have to do. Is that >so tough? This big threat, the dangerous CMR key, turns out to take >two seconds of user actions to be destroyed. Something this easy to >turn off will never be good enough for GAK. Gosh, so I can just remove that packet and all my mail will bounce. What fun. This seems to be one of the mantras which pro-PGP folks are chanting: 'But there are easy ways to work around it, just modify your copy of PGP and it will all work fine'. Indeed there are; I have no doubt that there is no way that anyone could entirely prevent me from communicating privately with a few people. But what happens when I want to check whether the local Blockbuster have a copy of 'Debbie does Fort Meade'; will they have modified their software so I can send mail to them without GMR? Of course not. So 99.9% of my mail will still be visible to the government. >People say, "Oh, but then the government will make everybody run the >policy enforcer and reject any mail not encryped to the government." >First, if they were going to do this, they could do it with old versions >of PGP too. Multiple recipients have been around practically forever. *IT'S NOT THE MULTIPLE RECIPIENTS THAT ARE THE PROBLEM, IT'S BUILDING THE 'MANDATORY VOLUNTARY' MULTIPLE ENCRYPTION INTO EVERY COPY OF PGP WHICH IS THE PROBLEM* This is the other mantra that PGP supporters chant 'Oh, but it could all be done with PGP 2.6.2 and a few scripts'. Of course it could, but only a few people would choose to use those filters. If the government were to set up SMTP enforcers in various choke-points around the Net (and I'm aware of the performance issues) then anyone using PGP would have to encrypt to the 'voluntary' FBI key or lose their mail. The Feds aren't going to issue every PGP user with scripts to do it, but if you build this facility into the software they can use it. >Second, it's a ridiculous idea which ignores how email works. More and >more people are running systems at home which could send and receive >SMTP mail. The trend is towards home servers which support the multiple >home computers people will have in the next decade. There's no way to >make those people run filters! Duh, of course they won't. But that email will go out over a TCP link to the SMTP port, where it can be checked on route by sniffers or proxies. How did the Chinese and Singaporeans restrict Net access? By blocking connections in the routers and Web proxies. This is the way to do it, not to force everyone to run an SMTP enforcer on their personal machine. >It has to be suggested, because it's the only >way this incredibly stupid scenario could be made to work. I can only >assume that people are blinded by emotions or they wouldn't suggest such >a bizarre idea. Yes, I must be, mustn't I. I mean, the Feds would never pass a law mandating that all Internet providers must provide SMTP proxies which enforce the GMR and block other SMTP connections; after all, they never passed a law mandating that telephone companies must provide wiretap access. Oh, they did, didn't they? >If the only >way the government can enforce GAK is by making it illegal for people to >receive email through paths which don't pass through government filters >we can all rest easy, because it will never happen. Yes, which is why they won't do it that way. In my last job, any SMTP access from my machine to any other on the Net was automatically routed to our local SMTP server which acted as a proxy. Why can't the Feds do this on the US Internet? >Or superencrypt to the real end user, like you suggested in your scheme. >Why is this OK as a privacy workaround for your idea but it doesn't >count for PGP? Firstly, that's not a "privacy workaround" in my system, it's to prevent traffic analysis. Secondly, again it's a workaround which will only be available to a small number of people. >Ignoring all the considerations above about what a stupid idea this is, >the fact is that a simple filter like this is incredibly easy to write. As I said before, the SMTP filter is not the evil aspect of your design, it's the enforced encryption to multiple recipients. >The fact is, nobody has come up with a scenario where PGP's CMR feature >can be turned into GAK in any practical way. I just have. Now try to explain it away. Mark

2 1

Save Money...Own your own Cable Descrambler!
by CableUs 17 Dec '03

17 Dec '03

Don't let your cable company force you to pay OUTRAGEOUS equipment costs to receive basic/premium channels. We are Midwest Electronics, Inc. America's LARGEST PROVIDER of cable converters and descramblers and we feel you shouldn't have to pay TOO MUCH any more! The Communications Act of 1996 approved by Congress and signed by President Clinton in February 1996 now allows cable subscribers to purchase cable converters and descramblers from independent vendors. We have 18 years experience in the cable industry. We carry most makes and models of cable converters and descramblers including Jerrold, Scientific Atlanta, Tocom, Zenith, Pioneer, Panasonic, Novavision and More. Our prices start at just $150.00. *** SPECIAL INTERNET OFFER *** Call us today at (800) 648-3030 M-F 8:00-5:00 C.S.T. with the model number of your cable company's converter/descrambler, usually found on top of your television, and receive a FREE Battery Charger with any combination unit purchase. *** ONLY THOSE NOTIFIED BY ELECTRONIC MAIL ARE ELIGIBLE *** Our SPECIAL Internet Promotion ends November 15, 1997. When calling please provide us with your e-mail address in order to receive your FREE BATTERY CHARGER!!! If are unable to take advantage of our offer at this time, but would like to receive our FREE CATALOG reply to us via e-mail at cableus(a)internetmedia.com with your mailing name or visit our WEBSITE at: http://www.midwestcable.com http://www.midwestcable.com More about us: * 30-Day Money Back Guarantee! * We Service What We Sell! * Personal Assistance Hotline! Note: No sales to TIME-WARNER or PARAGON cable franchise areas. ------------------------------------------------------------------------- If you would like to continue receiving updates on prices and other information from Midwest Electronics you may REPLY and type SUBSCRIBE in the SUBJECT line (Please be sure to include name, address and phone for your FREE CATALOG!). Otherwise, your address will be promptly removed from our lists and no further attempts will be made to contact you. -------------------------------------------------------------------------

1 0

Re: ADMIN: lost messages (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Attila T. Hun" <attila(a)hun.org> > Date: Fri, 24 Oct 97 04:43:22 +0000 > Subject: Re: ADMIN: lost messages > Jim Choate <ravage(a)ssz.com> was purported to have > expostulated to perpetuate an opinion: > a:> Any clues? > > a:Things get lost on occassion? > pure bullshit and ego gratification. [much deleted] Put up or shut up junior. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

update.342 (fwd) [AIP]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 22 Oct 97 10:14:42 EDT > From: physnews(a)aip.org (AIP listserver) > Subject: update.342 > > PHYSICS NEWS UPDATE > The American Institute of Physics Bulletin of Physics News > Number 342 October 22, 1997 by Phillip F. Schewe and Ben > Stein > > ONE OF THE MOST CONVECTIVE FLUIDS EVER > OBSERVED IN THE LABORATORY has been created by [body deleted] > HIGH-PRECISION COSMOLOGY [body deleted] > SEVEN YEARS OF PHYSICS---the entire run of Physics News > Updates---is now available in searchable form on the AIP Website > at this address: www.aip.org/physnews/update. Just type in a term > or expression and up come references to items in past Updates. For > example: searching for "leptoquark" hauls up 2 items; "steven chu" > finds 3 hits; "DNA" results in 13. All past Updates can be viewed > by going to the archives. See also Physics News Graphics > (www.aip.org/physnews/graphics) our growing archive of physics > figures, most of which accompany Update items. Subscription > reminder: to add or delete your name from the distribution list, > follow these steps---send a message to listserv(a)aip.org, leave the > "subject" blank, and in the letter itself specify either the expression > add physnews or delete physnews. >

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

whgiii(a)invweb.net wrote: > No their system does not. For what the FBI and NSA want much more needs to > be done. Really? Read the message I sent after that one. Let's suppose it's 2007, PGP have 99% of the crypto market. CMR compatibility is incorporated into all their products. The FBI announce that from today all Internet providers must support PGP SMTP enforcers on all mail passing across their links, and block all other SMTP connections. Regardless of whether your mail is spooled on your ISP's hard disk, it will always pass through their link. All encrypted mail must now be encrypted to the FBI's key as well as the end user's key or it will bounce. So, tell me why "much more needs to be done". Tell me again why this can't be implemented. The only reason it *can* be implemented is that PGP build the feature into their software. > Not to mention that *ANY* crypto system can be turned into GAK if > the FBI & NSA get congress to pass the laws that they want. Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't care that any Perl hacker can write a script which builds CMR into PGP 2.6.2, because those scripts are restricted to those who wish to use them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!! How hard is this to grasp? > What PGP Inc. did was provide what their *customers* , you know the ones > that pay their bills and keep them in business, wanted in a timely fashion > with little modification to their current code while circumventing some of > the more draconian requests. Really? Did their customers ask specifically for PGP's flawed CMR implementation, or did they actually say things like 'Well, we want to be able to recover mail if someone dies or leaves the company'? If it's the latter, don't you think that PGP should take responsibility for implementing it in such a GAK-friendly way? You seem be repeating the other pro-PGP mantra 'oh, you're not thinking of the company's point of view'. I certainly am, which is why I want to see that they get the best, most secure system without any GAK-friendly features. Here's a quick example of how cool CMR is... let's suppose that loser(a)foo-bah.com upsets a customer and is working for a CMR corporation. Mr Irate Customer downloads some of that kiddie porn that we're told is all over the Net, and encrypts it to loser(a)foo-bah.com, but doesn't encrypt it to the company key. Mr Irate Customer mails hundreds of these images to loser(a)foo-bah.com. Their system bounces them. The security personnel at foo-bah.com notice all these bounces and snarf some of the messages. The security personell take these messages to Mr Loser, and force him to decrypt them. Shock, horror, what a hideous, insane pervert Mr Loser must be to be receiving all these messages. Mr Loser is handed over to the cops and taken away. He might not go to jail, but he'll lose his job. With a more rational implementation Mr Loser would receive the messages and see that they're obscene, and immediately report them to the security personnel who could track down the sender. But when the security personnel find them first, they immediately assume that Mr Loser asked for them. Now, if you want to be able to get people sacked, this is cool. If you work for a company with CMR, this is really bad. It is also unneccesary. > >These are the important questions we should be asking and noone on the > >pro-PGP side seems interested in answering them. Why? > > They have been answered time and time again, you just have not been > interested in listening. They have not. All we've heard are 'oh, don't worry, it can't happen, be happy' assurances with no basis in fact. Is it any wonder we aren't listening? > If this is such a life and death issue why don't you and some of the other > Cypherpunks Philosopher Kings get off your armchair quarterbacking write, > test, debug, and *market* your superior system?? Duh, because PGP has name recognition, and because by the time it was finished they'd already have a large part of the market. But note: I'll be very surprised if PGP CMR gets into the OpenPGP spec. Which means that any other compliant implementation of PGP will not be compatible with CMR. > Perhaps because the majority of the "PGP Inc is evil" crowd > here couldn't make a buck in the business world if their lives depended on > it. Oh sure, ad hominem, ad hominem. What the hell do you think I do all day? Why the hell do you think I'm spending so much time trying to show people what CMR's problems are when I could be making money? > I also find it interesting how there is "much weeping gnashing of teeth" > over PGP 5.5 , which does nothing that couldn't be done with 2.6, while > Netscape, RSA and the S/MIME crowd put weak crypto on every desktop?? Better weak crypto than GAK. Key-lengths can be increased, government surveillance infrastructure cannot easily be removed. Mark

6 5

Re: CMR versus GAK? (fwd) > Right to monitor
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: lutz(a)taranis.iks-jena.de (Lutz Donnerhacke) > Subject: Re: CMR versus GAK? > Date: 24 Oct 1997 13:01:12 GMT > * William H. Geiger III wrote: > >documents. This is the distinction between corporate access to plain text > >and GAK. The company *owns* the documents. They have a right to read them > >any time they want. If you don't want your *private* corrospondance to be > > The company *owns* all telephon calls mad from an to there office. So they > have a right to wiretrap and record all phone calls you does from the > company. If you don't want your *private* corrospondance be wiretraped and > recorded, prevent every phone call in private issues from the company. > Forbit your insurance agency to call you in the company, deny the school > attended by your children to phone you at work, if your childen is ill, ... It occurs to me that this entire question is really of much larger social import: - do babysitters in your home have an inherent right to not be monitored in case they harm the child? - do operators of vehicles on public roads have an inherent right to privacy about the vehicle? - do businesses have the right to monitor the uses that their systems are put to? - do public officials have an inherent right to privacy about their actions related to their office? etc. ad nausium... These various issues can be broken down into two simple questions that once answered genericaly can be applied to the specific cases. The bottem line is: Does the owner of a resource have an inherent right to control that resource and if so what are the boundaries? Does the user of a resource have rights outside the purvue of the owner of that resource and if so what are the boundaries? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Internet Child Pornographers Convicted [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > CNN logo > Navigation > > Infoseek/Big Yellow > > > Pathfinder/Warner Bros > > > > > Main banner AST. Working For Your Business. rule > > INTERNET CHILD PORNOGRAPHERS GET LONG JAIL TERMS > > October 23, 1997 > Web posted at: 3:24 p.m. EDT (1924 GMT) > > SAN JOSE, California (Reuters) -- Three members of an international > child pornography ring that used the Internet to transmit pictures > of children were sentenced to jail. > > The men were jailed for their part in a wide-ranging, Internet-based > conspiracy in which several children, aged 10 or younger, were used > in sexually explicit acts to produce pornographic pictures and > videotapes, the U.S. Attorney's office said. > > U.S. District Judge James Ware on Wednesday sentenced the three > members of the "Orchid Club" in a San Jose courtroom after a long > hearing that included poignant personal statements by the victims. > > The U.S. Attorney's office in San Jose said Ronald Riva, 38, of > Greenfield, California, was sentenced to 30 years in prison; David > Tank, 35, of Cheney, Washington, to 19 years and 7 months; and > Christopher Saemisch, 38, of Lawrence, Kansas, to 11 years. > > Copyright 1997 Reuters Limited. All rights reserved. > > > rule > > Related stories: > * Officials focus on Internet use in sex crimes - October 8, 1997 > * FBI: Internet pedophiles a growing threat - April 8, 1997 > * FBI cracks down on child pornography on the Internet - April 7, > 1997 > * 12 arrested in computer pornography sweep - September 14, 1995 > > Related sites: > > Note: Pages will open in a new browser window > * Crime on the Superhighway > * Child Safety on the Information Highway > > > > External sites are not endorsed by CNN Interactive. > > > _________________________________________________________________ > > Infoseek search ____________________ ____ ____ > > _________________________________________________________________ > > > rule Message Boards Sound off on our > message boards > > You said it... [INLINE] AST. Working For Your Business. rule > To the top > > © 1997 Cable News Network, Inc. > All Rights Reserved. > > Terms under which this service is provided to you. >

1 0