December 2003 - cypherpunks-legacy

Re: Security of Encrypted Magic Folders
by geeman＠best.com 17 Dec '03

17 Dec '03

Sounds like a crock. See the Snake-Oil FAQ. This (mis)information is so full of nonsense I wouldn't touch the product with rubber gloves. At 07:51 PM 12/4/97 -0800, Alex Woolfson wrote: > >Hello, all! Back reading the list after a long hiatus. Glad it's still as >good as ever. Anyway, thought I'd appeal to the collective brain trust as >this question is over my head. Please "cc" me directly since I'm on the >filtered cypherpunk list. > >I just downloaded Encrypted Magic Folders--a program that hides Windows 95 >folders and then encrypts them to prevent a disk utility from revealing >their content. In their help file, they try to answer the question "How >Secure is it?"--and, of course, they say *very*, but I can't tell if this is >so or if they're just blowing smoke. Particularly, their claim that key >size doesn't matter. (My mom taught me size always matters... ) If >someone with a stronger cryptography background than me could take a look at >this and let me know, I would greatly appreciate it. > >Thanks! > >Alex > > >* How Secure is it? > > EMF's encryption offers good protection and excellent speed. It > hasn't been broken yet. It is, as far as we know, exportable. THERE > IS NO BACKDOOR. Should you forget your password there is nothing we > can do to decrypt your encrypted files. > > Quite a few people ask us how big EMF's key size is. They've learned > from other encryption programs that the bigger the key the stronger > the encryption. This really doesn't apply to EMF. > > We developed our own encryption instead of using a standard because > we wanted EMF to be able to decrypt at the byte level. In this way > we only need to decrypt/encrypt the data your programs require and > not the entire file. > > In theory, because we decrypt at the byte level, the biggest key we > could use would be 8 bits - which is a joke. So instead of > decrypting every hunk of data using the same key, as most other > encryption programs do, we developed an algorithm to vary the key > based on the data's location within the file. In this way we get > both high security and high speed. We are trying to patent EMF's > encryption method. > > Having said all that, truth is, most encryption isn't "cracked" by > breaking the algorithm, it's done by guessing the password. Brute > guessing of passwords tends to level the playing field tremendously. > We actually have an advantage because we aren't an established > standard. Because we're small and relatively obscure chances are no > one will take the effort to write a password guessing program (which > incidentally would violate copyright and intellectual property laws.) > Even if someone were to go thru all this effort we could easily > change the encryption method for the next update. > > If we used an established encryption method like DES or Blowfish then > your files would probably have to be fully decrypted when opened, > would exist on disk as unencrypted while you're using them, and then > would need to be encrypted when closed. This has multiple > disadvantages. First, if your computer shuts down while you have > "encrypted" files open, then those files would be unencrypted. This > doesn't happen with EMF as your encrypted files are always encrypted > as stored on disk. The second disadvantage is that it slows things > down tremendously. As an example, let's say you retrieve your email > and your email program needs to add today's message to the end of > your 3MB email file. If we used a standard encryption method > requiring the decryption of the file before use then the entire 3 MB > file would have to be decrypted, your 300 byte message added to the > end and then the entire file encrypted again. With EMF, no > decryption would need to take place, and the only data needing > encryption would be the 300 byte message. MUCH faster. Around > 20,000 times faster in this example! > > If you still think you'd like to see us use a standard encryption > method like DES or Blowfish, or have any other suggestions, let us > know and we will consider your input in future updates > > >

2 1

SynData/Schneier Attack Network Associates
by NoSpam 17 Dec '03

17 Dec '03

At 11:42 AM 12/5/97 -0500, you wrote: > Right to Privacy for Sale in Cyberspace; SynData Technologies Inc. > Speaks Out Against Key Recovery > > Cedar Grove, N.J. -- SynData Technologies Inc., a provider of encryption > software solutions, released a statement today condemning Network > Associates Inc. for supporting the government's key recovery program. > Network Associates recently purchased Pretty Good Privacy (PGP). > PGP had historically been opposed to key recovery. <snip> > "The government's key recovery program is a complete violation of the > individual's right to privacy and, in fact, compromises of the system are > already taking place. This shows that key escrow is an untenable policy," > said Bruce Schneier, one of the world's leading authorities on encryption > and author of the book "Applied Cryptography". "SynData is paving the > way for other software developers by taking a stand in opposition to the > government and companies like Network Associates." By "companies like Network Associates", do you mean "companies who are members of the Key Recovery Alliance" (http://www.kra.org)? If so, here are the "companies like Network Associates", in that regard: [Note RSA is a Charter Member] America Online, Inc. Apple Computer, Inc. * American Express Corp. Atalla * Baltimore Technologies Boeing Candle Corporation CertCo Certicom Compaq Computer Corp. Cryptomathic CygnaCom Sulutions, Inc. Cylink Corp. DASCOM, Inc. Data Securities International, Inc. Digital Equipment Corporation * Digital Secured Networks Technology, Inc. Digital Signature Trust Company Entrust Technologies First Data Corp. Fort Knox Escrow Services, Inc. Frontier Technologies Corp. Fujitsu, Ltd. GemPlus Gradient Technologies, Inc. Groupe Bull * Hewlett-Packard * Hitachi IBM * ICL IRE Intel Corporation McAfee Mitsubishi Corporation of Japan Mitsubishi Electric America Motorola Mykotronx Mytec Technologies, Inc. nCipher Corp. NCC Escrow NCR Corporation * NEC Network Systems Group of Storage Tek Novell, Inc. Open Horizon, Inc. Portland Software PSA Price Waterhouse Racal Data Group Rainbow Technologies RedCreek Communications RPK RSA * SafeNet Trusted Services, Corp. Secure Computing Corporation Siemens AG Silicon Graphics, Inc. SourceFile Spyrus Sterling Commerce Sun Microsystems * Tandem Technical Communications Corp. The Santa Cruz Operation, Inc. Toshiba Trusted Information Systems, Inc. * Unisys UPS * Utimaco Mergent VPNet Technologies ------------------- estone(a)synernet-robin.com remove "-birdname" spam avoider ------------------- ---------------------------- Ed Stone estone(a)synernet-robin.com delete "-birdname" spam avoider ----------------------------

5 4

encrypted home videos
by David Honig 17 Dec '03

17 Dec '03

Recently a hollywood pair's home sex video was stolen, duped, and sold. This makes the mass market aware. You could sell video cameras that required a passphrase to play. This would be easier with pure digital recording cameras, which are the next generation of consumer vidcams. A fast stream cipher is easy in hardware, and there *will* be a market for it. You have no privacy if your bits are not encrypted when your space is violated, by feds or other criminals, but you want the convenience of a videocamera. (forward this idea to other lists/newsgroups as appropriate) ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu Information is a dense, colorless, odorless material readily transmitted across empty space and arbitrary boundaries by shaking charged particles.

1 0

FYI
by DaveL＠classifiedcentral.com 17 Dec '03

17 Dec '03

Good afternoon, Just wanted to let you know about the Global Advertising Inter-Network. We are a classified ad network with over 650 member websites, each and every one of them promoting our site, promoting your ads! Check it out at: http://www.gainads.com Thanks!

1 0

launch memes
by goddesshera＠juno.com 17 Dec '03

17 Dec '03

Zooko Journeyman <zooko(a)xs4all.nl> propounded, >Terrorism and violent confrontation are the ultimate form of >politics. Uh, no. Terrorism and violent confrontation BY PROXY are examples of "politics." Terrorism and violent confrontation on one's own behalf is called "recreation." This message was automatically remailed. The sender is unknown, unlogged, and nonreplyable. Send complaints and blocking requests to <goddesshera(a)juno.com>.

1 0

Re: words have value, for good or ill
by Anonymous 17 Dec '03

17 Dec '03

Tim May writes: > To compound the debating style errors made by Anonymous and his > supporter(s), Anonymous also misrepresented my views about McVeigh and OKC. > In a series of posts a few months or so ago, I made my position clear: that > I could "understand" McVeigh's actions, in the same way one can understand > someone snapping under pressure. I also pooh-poohed the "human tragedy" > aspects of the OKC story in the same way any warrior must pooh-pooh > specific cases where innocents, alleged or real, die in battles. What Tim May actually wrote on May 9, 1997, was: > Every day that passes, I'm more convinced that McVeigh did the right thing. > Some innocents died, but, hey, war is hell. Broken eggs and all that. This is not a matter of "understanding" McVeigh's actions. This is a matter of agreeing with them, of becoming convinced that he did the right thing. It is a totally different position. Consider: anyone might legitimately say they could understand why the government opposes access to cryptography. It represents a threat to their monopoly power. But if someone said they were becoming convinced that restrictions on access to crypto were a good thing, we'd be attacking them in an instant. These are two completely different issues. One is a matter of understanding evil motivations, which we can all benefit by. The other is a matter of advocacy of evil. That must be opposed, and in fact this list has been a strong force for such opposition. When Tim May was explicitly offered an opportunity to repudiate his earlier statement, he refused. He wrote, in response to that offer: > I mean what I say and I say what I mean. Get used to it. Or leave, even better. So there it is in black and white. Tim May refuses to withdraw his earlier comments about becoming convinced that McVeigh did the right thing. He means what he says and he says what he means. Yet he attempts to characterize them in other messages as a matter of "understanding" McVeigh's actions. He is trying to have it both ways: powerful rhetoric followed by mealy-mouthed temporizing. Perhaps the answer is simply that May does not agree with his earlier comments, but is too much of a coward to admit that he was wrong. These mis-characterizations of his views are his attempt to amend and correct them without having to concede that he, the great Tim May, made a mistake. This would not reflect very well on him, but it may be consistent with his character. Has May ever admitted to a mistake on any non-trivial matter? Perhaps not. The problem this raises is that it is difficult to know where May stands on any issue. He makes contradictory statements, refuses to reconcile them, even refuses to admit that they are contradictory. Which is his true view? No doubt, whichever one turns out to be most convenient in the end. What a weak and childish individual this is, this man who is said to be the most respected of the cypherpunks.

1 0

What has 4 legs and your childs name?
by woodshed＠stopgocal.com 17 Dec '03

17 Dec '03

////////////////////////////////////////////////////////// Due to the Postal Strike we are trying direct email. If you would like to be removed from our mailing list, please reply to this message with "remove" as the subject and you will not receive any more email from our server. ///////////////////////////////////////////////////////// Beautifully handcrafted coat rack and stool with your childs name, please visit our web ad at: http://www.stopgocal.com/woodshed/index.html 12/5/97

1 0

McAfee on KRAP
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Old press release from McAfee boasting Key Recovery Alliance membership: MCAFEE JOINS KEY RECOVERY ALLIANCE; MULTI-VENDOR GROUP TO CREATE INTERNATIONAL STANDARD FOR RECOVERY OF ENCRYPTION KEYS Key Recovery Alliance to Develop Solutions Which Balance the Needs of End- Users, Employers, and International Governments SANTA CLARA, CALIF. (December 12, 1996) -- McAfee (Nasdaq: MCAF), a leading vendor of network security and management software, today announced that it has joined the Key Recovery Alliance, a coalition of encryption software vendors who have joined together to promote international specifications for encrypted information. "As a member of the Alliance, McAfee will work to create an internationally recognized and widely available standard for trusted key recovery," said Dan Freedman, vice president of security products at McAfee. "Trusted key recovery enables the responsible deployment of encryption technologies worldwide, while addressing the valid interests and security requirements of end-users, employers, and government." McAfee recently extended its family of network security products with the introduction of three new encryption solutions. These solutions include PCCrypto for encryption of desktop computer files and electronic mail; WebCrypto for the encryption of Internet email; and NetCrypto for transparent encryption of all communications over TCP/IP networks such as corporate intranets and the Internet. The Key Recovery Alliance was formed in October, and is composed of approximately 40 different network security vendors who have joined to cooperate on the development and promotion of internationally-accepted standards for encryption key recovery. Encryption keys are the codes that unlock encrypted information. Encryption key recovery refers to the necessary ability to recover lost or damaged encryption keys. Common situations in which encryption key recovery would be needed include when the death or departure of an employee who maintained mission-critical encrypted information causes the encryption key to be lost; when an encryption key becomes damaged due to a hard disk crash; or when a court order warrants the decryption of computer-based evidence. Company Background Founded in 1989, McAfee is a leading worldwide vendor of Network Security and Management products for enterprise networks. The Company is also a leader in Internet and Web-based electronic software distribution. McAfee is adquartered in Santa Clara, California and can be reached by phone at (408) 988-3832 or by fax at (408) 970-9727. McAfee's Web address is http://www.mcafee.com.

1 0

Re: Locked Up and Barred From Net
by tcmay＠got.net 17 Dec '03

17 Dec '03

This article touches on several Cypherpunks themes and technologies, including: use of anonymous remailers, mandatory Web content filters, bans on encryption, and bomb-making instructions. True, the persons being affected here are prisoners and parolees, and prisoners obviously are lacking certain civil liberties. Parollees, too. (Whether those convicted of felonies or even lesser crimes should be denied civil liberties after their sentence has been completed is a troubling issue I won't get into right now.) But as more and more things are declared criminal, and as selective prosecution is becoming the norm, these increasing restrictions may affect a larger fraction of the population. And, I think, the attitude here toward paroled convicts gives us some hints about the application of the Four Horsemen arguments in general. --Tim May > From http://www.wired.com/news/news/culture/story/8854.html > > Twice Removed: Locked Up and Barred from Net > by Steve Silberman > 4:57am 3.Dec.97.PST > > When US District Court Judge Sam Sparks sent Chris Lamprecht to the > Federal Correctional Institution in Bastrop, Texas, in 1995, the > 24-year-old hacker sobbed before the bench. A stint in the federal pen > was terrifying enough, but the judge had tacked an unusual condition onto > his 70-month sentence. Though Lamprecht was being sent to Bastrop for > money laundering - not the hacking that earned him the handle "Minor > Threat" - Judge Sparks stipulated that Lamprecht was forbidden to access > the Internet until 2003. > > "I told the judge computers were my life," Lamprecht recalled. > > Any case that involves computers and a boyish, fair-skinned defendant is > bound to get press, but things have changed since Swing magazine > (http://www.paranoia.com/~mthreat/swing.html) billed Lamprecht as "the > first person to be officially exiled from cyberspace." If the young > hacker was the first to be exiled from the online world by law, he now has > plenty of company, following the circulation of an internal memo at the > Federal Bureau of Prisons last year, which set in stone a federal policy > of keeping prisoners - and even many parolees - offline. > > According to the federal view, logging on is simply incompatible with > incarceration. As chief bureau spokesman Todd Craig states, in > bureaucratese, "Access to the Internet is not a necessary tool for the > correctional process" - which means that with more than 1.6 million > people locked up in the United States alone, and thousands of parolees > subject to similar restrictions even as they attempt to rejoin modern > life, a significant population is being left behind by the network > revolution. > > What's at stake? As more and more jobs are wired into the Net and the > Web, the possibility that former offenders will be able to find > employment after incarceration becomes more and more remote - which > undermines the very bedrock of the correctional process, asserts Jenni > Gainsborough, spokeswoman for the American Civil Liberties Union's > National Prison Project (http://www.npp.org) > > "The aim of our prisons should be to release people who are able to > reintegrate themselves into society," she explains. "But no politician > wants to appear soft on crime. Nobody thinks about what's actually useful > to reduce the recidivism rate." > > A poster boy for keeping prisons unwired > > Mention the words prisoner and Internet in a sentence, and the same > object-lesson will come up over and over again: the case of George > Chamberlain, a sex offender incarcerated at Lino Lakes state prison in > Minnesota, who used his position as manager of computer services for a > venture called Insight Inc. to download child pornography from the Net > while sitting in jail. > > Chamberlain was a poster boy for keeping prisoners as far away from a > modem as possible. He not only siphoned 287 erotic images off the Net and > encrypted them on an optical drive behind the pass phrase "They cannot > commit me," he also compiled lists of thousands of children's' names, and > chitchatted with other pornographers through an anonymous remailer. > > "The idea that a prisoner had this kind of access to the Internet and was > able to collect explicit child pornography and communicate with others on > how to hide it," US Attorney David Lillehaug declared last March, "is > almost unbelievable." > > The Chamberlain case seemed all too believable, however, given a > statement issued by the US Parole Commission just three months earlier. > The commission, "responding to increased criminal use of the Internet," > approved "discretionary use of special conditions of parole that would > impose tight restrictions on the use of computers by certain high-risk > parolees." > > A spokesperson for the Parole Commission declined to answer questions > about the number of parolees currently subject to restrictions on > computer use, which include a ban on encryption, screening of online > activity by monitoring or blocking software, compulsory daily logging of > all Web sites visited, and unannounced searches of drives and disks by > parole officers. > > Federal Bureau of Prisons spokesman Craig equates the ban on computer use > by inmates to restrictions on use of the telephone. "They can make > 15-minute calls to pre-approved numbers, like family and clergy," Craig > says. It would be impossible, he says, to pre-approve forays into the > online world in the same way. > > In its press release, the commission said it acted "after noting the > surge of 'how-to' information available on the Internet and other > computer online services relating to such offenses as child molestation, > hate crimes, and the illegal use of explosives." > > "That's complete BS," charges Stanton McCandlish, program director for the > Electronic Frontier Foundation. "There was no alarming increase in that > kind of 'how-to' information on the Net. There was an increase in > publicity about politicians like Dianne Feinstein > (http://www.senate.gov/~feinstein/bombstmt.html) who used those fears as > justification to limit use of the Internet." > > McCandlish points out that last June's Reno v. ACLU decision > (http://www.aclu.org/court/renovacludec.html) by the Supreme Court sent a > message that the court considers the Net as much subject to First > Amendment speech protections as the printed word. Comparing broad > prohibitions on the use of computers by prisoners and parolees to banning > the act of writing by those in prison, McCandlish predicts that "the issue > is going to heat up" in the coming year. The EFF is "waiting for a good, > solid legal challenge" to arise before getting involved in a case, > McCandlish says. > > The world's best-kept secrets > > A small California businessman named John Danes runs an outfit called > Inmate.com, charging prisoners US$70 to design and maintain a personal > homepage (http://inmate.com/inmates.htm) and an email address for three > months. Each week, Danes prints out the incoming mail, peruses it for > forbidden content like pornography or communication from minors, and > forwards it to the inmates via snail mail. At present, nearly 70 male > prisoners and three women have homepages at Inmate.com. The majority of > the inmates are black or Hispanic; several of the pages maintain the > author's innocence; many are an invitation to romance. > > Ironically, the ACLU's Gainsborough attributes some of the public's fear > about convicted criminals having a gateway to the Net to the publicity > given to Web sites like Inmate.com and Dead Man Talkin' > (http://monkey.hooked.net/moneky/m/hut/deadman/deadman.html) - sites that > are put up by friends of prisoners who do not themselves have access. > > "Serial-killer homepages and prisoner sites contribute to the public > perception that there's a huge use of the Net by these people to > advertise their evil ideas," Gainsborough says, while affirming her > support for the right of prisoners to express themselves. > > One page on the Inmate.com site asks, "Have you ever wondered what it's > like to live in another world right here on Earth? What would you do if > you suddenly fell from grace? Prisons hold some of the world's best-kept > secrets." Secrets are one thing, Gainsborough observes, that prisoners > are not allowed to keep. > > "In many prisons, even [typewriters with built-in memory] are forbidden," > she says. "There's always this fear of prisoners hiding this stuff away - > so the idea of computers where people could really keep stuff hidden is > very frightening." > > In July 1996, a promising computer-training program at the Washington > State Reformatory was terminated when it appeared that the prisoners were > learning too much about computers - that is, more than prison officials > knew. > > Mike Williams, associate superintendent at the reformatory, was head of > security for the program, which was a pilot for a statewide effort that > would have allowed prisoners to learn how to use business software like > Microsoft Excel, PowerPoint, and Word. > > "The inmates learned a lot of good stuff," Williams acknowledges. "They > were able to learn a trade while in prison, so that they might have been > actually able to get a job in that area when they got out. This was like > real-world vocational training." > > So why was the innovative program scrapped, rather than ported to every > jailhouse in the state? > > "Our superintendent thought it was a manageable pilot program," Williams > recalls, "but the key figures who needed to approve it up in Olympia > decided to put an end to it. We had inmates learning more about computers > than we had staff time to keep an eye on them. We couldn't keep up with > them." > > The fear that prisoners would use encryption or other electronic means to > cloak escape plans was a chief concern. "It was a cat-and-mouse game. We > had to load the software for them, and there was no money allocated to > hire more officers to do that kind of thing," Williams says. Though at > least one inmate claims that graduates of the program had landed good > jobs upon release, state deputy director of prisons Jim Blodgett - one of > the "key figures" in the state capital who decided to shut the gate on > the pilot effort - told a reporter, "We couldn't see the value in keeping > it. We had staff not knowing what was going on." > > If the object of incarceration is to ensure that prisoners remain at > least as ignorant of current technologies as untrained prison staff, the > federal policy will be deemed a success. But as the Net touches every > area of our experience - from our most intimate relationships to our > responsibilities as participants in a democratic society - more and more > of those on the outside of the bars are coming to feel, with Lamprecht, > that "computers are our lives," or are inextricably linked with our > lives. > > And those on the inside are destined to be released into a life for which > they are even more unprepared than former offenders were in the past. > > ------------------------------------------------------------------------- > Minor Threat's Web Site http://www.paranoia.com/~mthreat/ > Official Kevin Mitnick Web Site http://www.kevinmitnick.com -- The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

another mixmaster source branch
by Adam Back 17 Dec '03

17 Dec '03

Anyone with a export controlled web site in the US like to give home to Rich Salz's mixmaster re-write? Adam ------- Start of forwarded message ------- Date: Fri, 5 Dec 1997 13:28:32 -0500 (EST) From: Rich Salz <rsalz(a)opengroup.org> To: coderpunks(a)toad.com Subject: Take my mixmaster source Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-coderpunks(a)toad.com Precedence: bulk A long time ago, Lance graciously gave me a copy of his mixmaster source. I ended up doing a line-by-line rewrite, splitting it into different executables, FSF configure'ing it, etc. I'm not going to have time to finish it. There is one bug that I know of, an off-by-one error in decoding multi-hop messages. If you would like fame and fortune and a somewhat interesting debugging problem, and you're inside the US or Canada, please send me email. I would like to see this code get released, and used. Thanks. ------- End of forwarded message -------

2 1