December 2003 - cypherpunks-legacy

Re: Open Letter from ClickZ Publisher
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:00 AM 11/25/1997 -0000, some flamer using lcs Mixmaster Remailer wrote: > For further info on Gary's arrest, visit: > http://www.e-media.com/cm/sac.html >First off, it eventually became "a ticket actually" because it was plea >bargained down to that. That's one of the advantages of committing a >"politically correct" offense in a city like Frisco. The San Francisco >Police Department presumably doesn't take people into custody and impound >their vehicles for mere traffic tickets. The SFPD _was_ arresting several hundred people that night and impounding their bicycles for what might normally have been traffic tickets, though many of the arrests were for "failure to disperse" -- Mayor Willie Brown had been taking enough PR heat for the Critical Mass bicycle rides, and decided he had to "do something". All but a few of the arrestees were out in a few hours, with at most traffic tickets, and got their bikes back the next day (the city DA had to keep reminding Da Mayor that he couldn't legally just confiscate them.) I wasn't on the same block as Burnore, so I don't know if he was being personally obnoxious when he got busted, or was one of the many who were just in the wrong place at the wrong time. (Not that Critical Mass isn't somewhat confrontational :-) Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

The Databasix gang (Paul Pomes @ Qualcomm) is now harrassing the bureau42 remailer
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Paul Pomes is one of the least intelligent members of the Databasix gang. He's been harrassing Jeff B.'s upstreams and employers with false complaints at the same time Gary Burnore, Belinda Bryant, and the rest of the Databasix gang did, eventually killing the huge cajones remailer. Now they're after on bureau42. For some reason Pomes slipped and cc'd me one his false complaints (even though he was ordered not to send me any more e-mail). I ask everyone to a) complain about Paul Pomes to Qualcomm, his employer b) discuss what we can do to protect bureau42 from Databasix harrassment Received: from localhost (localhost [127.0.0.1]) by zelkova.qualcomm.com (8.8.5/8.8.5) with ESMTP id SAA10389; Tue, 25 Nov 1997 18:52:26 -0800 (PST) From: Paul Pomes <ppomes(a)Qualcomm.com> Organization: Qualcomm, Inc. Subject: More spam from vulis Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Id: <10385.880512741.1(a)zelkova.qualcomm.com> To: dlv(a)bwalk.dm.com, remailer-admin(a)bureau42.ml.org Date: Tue, 25 Nov 1997 18:52:25 -0800 Message-Id: <10387.880512745(a)zelkova.qualcomm.com> Sender: ppomes(a)Qualcomm.com A mis-edit of my killfile let the following gem from Dimi Vulis through. FYI /pbp ------- Forwarded Message Return-Path: owner-cypherpunks(a)cyberpass.net Received: from warlock.qualcomm.com (warlock.qualcomm.com [129.46.52.129]) by zelkova.qualcomm.com (8.8.5/8.8.5) with ESMTP id SAA10273 for <ppomes(a)zelkova.qualcomm.com>; Tue, 25 Nov 1997 18:37:14 -0800 (PST) Received: from moria.qualcomm.com (qualcomm.com [192.35.156.11]) by warlock.qualcomm.com (8.8.5/1.4/8.7.2/1.13) with ESMTP id SAA19074 for <ppomes(a)Qualcomm.com>; Tue, 25 Nov 1997 18:35:25 -0800 (PST) Received: from sirius.infonex.com (sirius.infonex.com [206.170.114.2]) by moria.qualcomm.com with ESMTP id SAA19347 for <ppomes(a)Qualcomm.com>; Tue, 25 Nov 1997 18:36:21 -0800 (PST) Received: (from majordom@localhost) by sirius.infonex.com (8.8.8/8.7.3) id LAA07735 for cypherpunks-outgoing; Tue, 25 Nov 1997 11:56:04 -0800 (PST) Received: (from cpunks@localhost) by sirius.infonex.com (8.8.8/8.7.3) id LAA07459 for cypherpunks(a)infonex.com; Tue, 25 Nov 1997 11:54:18 -0800 (PST) Received: from rigel.cyberpass.net (root(a)rigel.infonex.com [206.170.114.3]) by sirius.infonex.com (8.8.8/8.7.3) with ESMTP id LAA07440 for <cpunks(a)sirius.infonex.com>; Tue, 25 Nov 1997 11:52:56 -0800 (PST) Received: from toad.com (toad.com [140.174.2.1]) by rigel.cyberpass.net (8.8.8/8.7.3) with ESMTP id LAA10626 for <cypherpunks(a)cyberpass.net>; Tue, 25 Nov 1997 11:48:59 -0800 (PST) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id LAA03665 for cypherpunks-unedited-outgoing; Tue, 25 Nov 1997 11:43:02 -0800 (PST) Received: from corsica.shorelink.com (mail(a)corsica.shorelink.com [207.155.180.7]) by toad.com (8.7.5/8.7.3) with SMTP id LAA03660 for <cypherpunks(a)toad.com>; Tue, 25 Nov 1997 11:43:00 -0800 (PST) Received: from uucp by corsica.shorelink.com with local-rmail (Exim 1.62 #1) id 0xaQss-0008Rq-00 (Debian); Tue, 25 Nov 1997 11:42:58 -0800 Received: (from remailer@localhost) by bureau42.ml.org (8.8.8/8.8.8) id OAA27483; Tue, 25 Nov 1997 14:47:01 GMT Date: Tue, 25 Nov 1997 14:47:01 GMT Message-ID: <EPtLawOnbaoGUl8PvUSglw==(a)bureau42.ml.org> From: bureau42 Anonymous Remailer <nobody(a)bureau42.ml.org> Comments: This message did not originate from the Sender address above. It was remailed automatically by anonymizing remailer software. Please report problems or inappropriate use to the remailer administrator at <remailer-admin(a)bureau42.ml.org>. To: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)cyberpass.net Precedence: bulk Reply-To: bureau42 Anonymous Remailer <nobody(a)bureau42.ml.org> X-List: cypherpunks(a)cyberpass.net X-Loop: cypherpunks(a)cyberpass.net Content-Type: text Content-Length: 206 May Timothy C[ocksucker] Maya's forgeries get stuck up his ass so he'll have to shit through his filthy mouth for the rest of its miserable life. /~~~\ {-O^O-} Timothy C[ocksucker] Maya \ o / (-) ------- End of Forwarded Message

2 1

official CyberCash response
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: cme(a)cybercash.com Date: Tue, 25 Nov 1997 15:37:14 -0500 To: rah(a)shipwright.com From: Carl Ellison <cme(a)cybercash.com> Subject: official CyberCash response Cc: cme(a)cybercash.com Mime-Version: 1.0 If you know of any lists where the message appeared but the official response didn't, you're welcome to post the following. - Carl -------------------------------------------- [The following should appear in its entirety if it's printed at all.] The following message appeared on the net. From: Anonymous <anon(a)ANON.EFGA.ORG> Subject: Major security flaw in Cybercash 2.1.2 To: BUGTRAQ(a)NETSPACE.ORG CyberCash v. 2.1.2 has a major security flaw that causes all credit card information processed by the server to be logged in a file with world-readable permissions. This security flaw exists in the default CyberCash installation and configuration. The flaw is a result of not being able to turn off debugging. Setting the "DEBUG" flag to "0" in the configuration files simply has no effect on the operation of the server. In CyberCash's server, when the "DEBUG" flag is on, the contents of all credit card transactions are written to a log file (named "Debug.log" by default). The easiest workaround I've found is to simply delete the existing Debug.log file. In my experience with the Solaris release, the CyberCash software does not create this file at start time when the DEBUG flag is set to 0. The inability to turn off debugging is noted on CyberCash's web site under "Known Limitations". The fact that credit card numbers are stored in the clear, in a world readable file, is not. We have taken this quite seriously and have put through a full release of our software which will be available Monday 11/24 for three platforms and others shortly thereafter. The flaw was in the debug logging function, not in the protocols or core implementation. Nonetheless, the effect was an unnecessary exposure of potentially sensitive information, and it shouldn't have gone out the door that way. We're tightening our internal processes to avoid this in the future. That said, here's the actual exposure. The credit card information that's in the clear in the log comes from "merchant-initiated" transactions, which means the merchant obtains the credit card number from somewhere -- phone, mail, fax, SSL-protected Internet interaction, or unprotected Internet interaction. The merchant thus has the same info in the clear already. If the card number was provided via a wallet, then the card number is blinded at the consumer's end. It is therefore not in the clear as it passes through the merchant's machine and the reported exposure does not apply.. In order for the unprotected log to pose a risk of exposure, someone has to be able to gain access to the merchant's machine. If the machine is well protected, viz behind a firewall and/or carefully configured, presumably an outsider won't be able to gain access. And in terms of the *additional* exposure the open log represents over existing risks, if the same information is accessible in the clear elsewhere on the machine, eliminating from the log or encrypting the log provides little or no real protection. We continue to advise merchants to take strong steps to protect their machines. To our knowledge, the exposure documented above has not resulted in the actual loss of any customer data or other security incident. ---------------------------------- Steve Crocker Desk: +1 703 716 5214 CyberCash, Inc. Main: +1 703 620 4200 2100 Reston Parkway Fax: +1 703 620 4215 Reston, VA 20191 crocker(a)cybercash.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Leviathan Dying
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 25 Nov 1997 10:21:05 -0800 to: misesmail(a)colossus.net from: news(a)mises.org subject: Leviathan Dying Sender: owner-misesmail(a)colossus.net Precedence: Bulk "The Future of Liberty" is the title of a feature piece in VITAL SPEECHES OF THE DAY (November 15, 1997) by Llewellyn H. Rockwell, Jr. "The leviathan state, that monster devouring civilization in this century, is in the throes of death," says Rockwell. "This is not a wish or a prediction, but a conclusion drawn from a broad look at the trends of the last decade and a half, which, if we take the right steps, can continue on into the next century. What has happened around the world--nation states collapsing, markets outwitting planners, citizens rising up against government masters--can and is happening here at home." The speech is from the 15th anniversary conference of the Ludwig von Mises Institute. Rockwell--head of the Institute--explains that in our times, we are witnessing the development of something more radical and far reaching than mere "limitation of government"; the very idea of institutionalized and centralized state power is under fire. The primary catalysts for this trend are the end of the Cold War, the increasing global resentment of the U.S. imperium, and the rise of new information technologies. All that's left in their wake is the reality of Washington as a parasite, which is how government is increasingly regarded in the late nineties. Rockwell spells out the implications of this and foresees a future of liberty, conditioned on intellectuals being willing, in the tradition of Mises and Rothbard, to take the right steps in leading the way. VITAL SPEECHES is widely indexed. Also in this issue are speeches by Bill Clinton and Madeleine Albright. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Suggested Reading...
by Jim Choate 17 Dec '03

17 Dec '03

The Case Against The Global Economy: and for a turn toward the local ed. J. Mander, E. Goldsmith ISBN 0-87156-865-9 $16.00 A collection of 43 essays discussing the consequences and alternatives to unitary global economy. The homogoneity of such a system is seen as counter-productive to the long-term human condition. ____________________________________________________________________ | | | | | We built your fort. We will not have it used against us. | | | | John Wayne - Allegheny Uprising | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Freedom Forum First Amendment conference (12/16/97)
by Declan McCullagh 17 Dec '03

17 Dec '03

----------- Date: Wed, 26 Nov 1997 10:33:05 -0500 From: Paul McMasters <pmcmasters(a)freedomforum.org> Subject: First Amendment Conference The Freedom Forum is sponsoring a major conference on the First Amendment on December 16 in Arlington, Va. We will be releasing Donna Demac's "State of the First Amendment" report and a landmark public opinion survey on the First Amendment. In addition, there will be presentations by leading authorities on violence in the media, hate speech, pornography, flag desecration, television, the Internet, videos, the press, art, and religion. If you would like more details and directions for signing up (there is no charge), please go to my web page at: http://www.freedomforum.org/first/1997/11/20famdcon.asp Here it is in a nutshell: Who: Everyone concerned about the First Amendment What: State of the First Amendment conference Where: The Freedom Forum World Center, Arlington, Va. When: Tuesday, December 16, from 8:30 a.m. until 5:30 p.m. Why: Release of a major report, "State of the First Amendment," and a landmark national survey of public attitudes toward the First Amendment How: Just check our web site for details and directions The catch: There is none. No charge. Good food. Good conversation. First-rate speakers. Dynamite program. Contact: Paul McMasters, 703-284-3511, or: pmcmasters(a)freedomforum.org

1 0

Cato Institute request for policy papers on encryption
by Declan McCullagh 17 Dec '03

17 Dec '03

---- Date: Tue, 25 Nov 1997 10:18:33 -0500 From: Solveig Singleton <solveig(a)cato.org> Subject: Request for short policy papers Cato Institute's progam for information studies (that is, privacy and crypto) is interested in receiving proposals for **short** policy papers (five to thirty pages) on different aspects of the encryption debate. In particular, I am interested in detailed, well-argued but concise papers addressing the following: * The costs (narrowly conceived) of mandatory key recovery: OMB has one estimate with no particular empirical support beyond the assertions of national security folks. We are interested in cost estimates that move the debate forward in being based on something more concrete and reliable than what has been offered thus far--so, we won't need years of carefully calibrated econometric data (which just isn't there)--but we do want something more than speculation. * Also needed, a short paper illustrating the impact of the export control regime on experimental software or hardware ventures. What are the costs of the regulatory process in time and money, from the standpoint of the developer? Anecdotes welcome. * I would also like to do a paper on the uses of encryption in combatting human rights violations worldwide, again replete with examples and anecdotes... * and A short paper on the ease of evading export controls--detailing the ease with which encryption programs can be homemade, purchased from foreign sources, etc.; * and a short paper on the strength of U.S. assertions that other countries are likely to go along with U.S. attempts to foist mandatory key escrow upon everyone by international agreement. Please contact me if you are interested. Solveig Singleton (202) 789-5274 (202) 842-3490 (fax) Director of Information Studies Cato Institute 1000 Mass. Ave. NW Washington, DC 20001

2 1

Newsletter Internetwk: InternetWeek Newsletter - Nov. 25
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text To: dcsb(a)ai.mit.edu Subject: Newsletter Internetwk: InternetWeek Newsletter - Nov. 25 Date: Tue, 25 Nov 1997 08:01:13 -0500 From: "Eric S. Johansson" <esj(a)harvee.billerica.ma.us> Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Eric S. Johansson" <esj(a)harvee.billerica.ma.us> ------- Forwarded Message That Ain't No Standard Spec It looks like SET may have run out of breath before even leaving the starting gate. Despite a dogged insistence by its sponsors that the 6-month-old Secure Electronic Transactions specification is essential to the growth of Internet commerce, the technology's creators cannot point to one operational deployment. And with good reason, apparently. The two main beneficiaries of the technology--merchants and banks--say the technology is severely flawed. They say compliance with the spec does not guarantee compatibility across vendor implementations. They further charge that SET is too complex to integrate cleanly with legacy transaction systems. In short, they say, the standard is not a standard at all. "It's an enormously complex technology that's flawed from the bottom up," according to Aberdeen Group analyst Chris Stevens. "The only people who are interested in it are the credit card associations, analysts, the press, Hewlett- Packard and IBM." Two of SET's inventors, Hewlett-Packard's VeriFone division and IBM, all but admitted SET's shortcomings earlier this month when they announced a program to ensure that their SET 1.0-enabled products are interoperable. The results will be published in a reference guide for developers. But SET products are supposed to be interoperable by definition, according to the published spec. Other features of the spec are confidentiality of information, integrity of data, card holder account authentication and merchant authentication. The preliminary 0.0 version of the spec has been extended to February of next year so retailers can work with a more tested version through the Christmas season. Version 2.0 is already in the works for release late next year. As a result of the glitches, the sponsors of the initiative, mainly the credit card issuers and E-commerce software vendors, are loosening their definition of a standard. "In the SET 1.0 specification, we tried to be as precise as possible, but any specification is open to interpretation," said Steve Mott, MasterCard's senior vice president for E-commerce. "The marketplace will determine if it's a standard." Mott acknowledged that the root of SET's troubles is its complexity. SET relies on a three-tier architecture-the client wallet, the merchant server and the gateway to processing banks. Not only does each tier have to exchange transaction data, but it must be able to do so with software developed by different vendors. Moreover, as a certificate-based system, SET requires the management of digital certificates for millions of merchants and consumers. All of this has left the banking industry holding the ball. "There are a lot of operational issues left unresolved, like the problem of integrating SET and a new level of certificate information with the banks' legacy systems," said Stephanie Denny, until recently the vice president and director of marketing for Bank of America's credit card unit. By Matthew Friedman http://techweb.cmp.com/internetwk/news/news1124-1.htm ************************* - ------------------------------------------------------- Copyright 1997 CMP Media Inc. a service of InternetWeek. - ------------------------------------------------------- Distributed by Email Publishing Inc. - http://www.emailpub.com ------- End of Forwarded Message For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

RE:: [NTSEC] - cheap tempest solution (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== ---------- Forwarded message ---------- Date: Mon, 24 Nov 1997 20:50:10 -0500 From: "Stout, William" <StoutW(a)pios.com> To: "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: RE: OFF-TOPIC RE: [NTSEC] - cheap tempest solution > ----- Original Message ----- > From: Tim Lebrun [SMTP:tlebrun@internetmci.com] > > This may be a stupid question, but what is tempest monitoring? And > what kind of information can you get from doing it? Ooh, ooh, something I was trained in once. Tempest protection is the ability to prevent undesirable signals from escaping a computer system. In the old days, electro-mechanical teletypes were used by the military. Someone discovered that placing a signal analyzer on the power feed shows what character is represented by each signal spike. Automating the translation gives you a mirror output of each message someplace else. Electrical filters (not just transformers which can pass these signals) prevent this. Present day keyboards and mice also radiate signals, readable even though the device is within the FCC part 15 class A or B device signal emanation restrictions. Both tube-type and LCD displays are big transmitters, and can be read by receivers connected to similarly phased displays. The receivers can be in a nearby building, van, plane or satellite. Makes you think twice when typing PGP messages or 'accidentally' hitting a 'can be used against you' newsgroup. Search for 'Van Eck' for more data. Physical metallic shielding (and thorough testing) fixes this. Network wires and equipment are also major radio transmitters, metallic types are readable from a distance, and of course networks can be directly tapped, even glass fiber. (It's been found in military environments, a simple wire was surreptitiously stretched above a ceiling, and which would act as a retransmitter.) All cables are guilty of transmitting readable signals if not properly shielded and filtered. Van Eck/tempest exploiting devices are used in the military/spy/wire-fraud/'drug war' business and in both government sponsored and private corporate espionage. Don't confuse EMP (Electro-Magnetic Pulse) protection with Tempest, since EMP is a high-energy pulse (such as created by a nuclear burst) that generates a high-voltage electrical pulse in both plugged in and off-line electronic equipment, and typically frys all unshielded electronics. Same effect as a power surge, but affects all circuits, even parts sitting on shelves. HERF guns do the same thing. Damn. I'm also guilty of contributing to the noise and 'firewalls-list' demise of NTsecurity list. Bill Stout

1 0

Re: FCPUNX:Internet Casinos
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:49 PM 11/26/1997 -0500, Sal Denaro wrote: >If you can't see the tables, how do you know the games aren't rigged? There's a lot of cryptography work addressing this problem, with variants like "Mental poker". You can do things like have the participants each - pick a random number, - share the hash of their numbers with each other, - then share the random numbers with the casino - then XOR everybody's random numbers together to feed the casino's card shuffler - play the game, lose the money - casino reveals its random number - everybody compares hashes to verify that it was honest >And do they offer Wayne Newton over streaming Video? I'm sure that can be arranged :-) > What about free drinks? By Fedex. Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0