December 2003 - cypherpunks-legacy

fwd: The Swedes discover Lotus Notes has key escrow! (Win Treese)
by Ray Arachelian 17 Dec '03

17 Dec '03

(From the SpyKing Security Mailing list) 2)From: Mike G <mgevaert(a)bfree.on.ca> Subject: Lotus Privacy Problems This was taken from the Computer Privacy Digest 1/4/98 V12#00 Very interesting. The Swedes discover Lotus Notes has key escrow! (Win Treese) The article describes the reaction when various people in the Swedish government learned that the Lotus Notes system they were using includes key escrow. They were apparently unaware of this until Notes was in use by thousands of people in government and industry. Besides being an interesting reaction to key escrow systems, this incident reminds us that one should understand the real security of a system.... Secret Swedish E-Mail Can Be Read by the U.S.A. Fredrik Laurin, Calle Froste, *Svenska Dagbladet*, 18 Nov 1997 One of the world's most widely used e-mail programs, the American Lotus Notes, is not so secure as most of its 400,000 to 500,000 Swedish users believe. To be sure, it includes advanced cryptography in its e-mail function, but the codes that protect the encryption have been surrendered to American authorities. With them, the U.S. government can decode encrypted information. Among Swedish users are 349 parliament members, 15,000 tax agency employees, as well as employees in large businesses and the defense department. ``I didn't know that our Notes keys were deposited (with the U.S.). It was interesting to learn this,'' says Data Security Chief Jan Karlsson at the [Swedish] our Notes keys were deposited (with the U.S.). It was interesting to learn this,'' says Data Security Chief Jan Karlsson at the [Swedish] defense department. Gunnar Grenfors, Parliament director and daily e-mail user, says, ``I didn't know about this--here we handle sensitive information concerning Sweden's interests, and we should not leave the keys to this information to the U.S. government or anyone else. This must be a basic requirement.'' Sending information over the Internet is like sending a postcard--it's that simple to read these communications. When e-mail is encrypted, it becomes unintelligible for anyone who captures it during transport. Only those who have the right codes or raw computer power to break the encryption can read it. For crime prevention and national security reasons, the United States has tough regulations concerning the level of crytography that may be exported. Both large companies and intelligence agencies can already--in a fractions of a second--break the simpler cryptographic protections. For the world-leading American computer industry, cryptographic export controls are therefore an ever greater obstacle. This slows down utilization of the Internet by businesses because companies outside the U.S.A. do not dare to send important information over the Internet. On the other hand, the encryption that may be used freely within the U.S.A. is substantially more secure. Lotus, a subsidiary of the American computer giant IBM, has negotiated a special solution to the problem. Lotus gets to export strong cryptography with the requirement that vital parts of the secret keys are deposited with the U.S. government. ``The difference between the American Notes version and the export version lies in degrees of encryption. We deliver 64 bit keys to all customers, but 24 bits of those in the version that we deliver outside of the United States are deposited with the American government. That's how it works today,'' says Eileen Rudden, vice president at Lotus. Those 24 bits are critical for security in the system. 40-bit encryption is broken by a fast computer in several seconds, while 64 bits is much more time-consuming to break if one does not have the 24 bits [table omitted]. Lotus cannot answer as to which authorities have received the keys and what rules apply for giving them out. The company has confidence that the American authorities responsible for this have full control over the keys and can ensure that they will not be misused. On the other hand, this (assurance) does not matter to Swedish companies. On the contrary, there is a growing understanding that it would be an unacceptable security risk to place the corporation's own ``master key'' in the hands of foreign authorities. Secret information can leak or be spread through, for example, court decisions in other countries. These concerns are demonstrated clearly in a survey by the SAF Trade and Industry security delegation. Some 60 companies answered the survey. They absolutely do not want keys deposited in the U.S.A. It is business secrets they are protecting. These corporations fear that anyone can get a hold of this information, states Claes Blomqvist at SAF. Swedish businesses are also afraid of leaks within the American authorities. The security chief at SKF, Lars Lungren, states: ``If one has a lawful purpose for having control over encryption, it isn't a problem. But the precept is flawed: They ought to monitor (internally), but the Americans now act as if there are no crooks working within their authorities.'' In some countries, intelligence agencies clearly have taken a position on their country's trade and industry. Such is the case in France. One example, which French authorities chose to publicize, was in 1995 when five CIA agents were deported after having spied on a French telecommunications company. Win Treese <treese(a)openmarket.com> [The Lotus Notes crypto scheme is one that I have familiarly been calling ``64 40 or fight!'' (in a reference to a slogan for an early U.S. election campaign border-dispute issue many years ago. PGN]

2 1

Re: cypherpunks and guns
by David Honig 17 Dec '03

17 Dec '03

At 05:28 AM 1/6/98 -0500, Ryan Lackey wrote: > >I am fairly certain that as an irregular army soldier I could inflict >a substantial amount of damage upon an occupying military. With maybe >$20k in equipment and several hundred hours of training, you could make >life very difficult for any luckless squad that happens your way. Multiply >that by 100 million armed citizens and you see that armed civilian >resistance *can* defeat an occupying army. A distributed decentralized terrorist group can trash almost any country's infrastructure as well. The gov't knows this, but if it were to start happening (or their intelligence indicated it might) guards would be sent to the power stations, transformers, water works, radio relays, NAPs, refineries, etc. These guards would be physical, guarding physical resources against physical threats. They would be able to resist smaller threats. As you say, if outnumbered, they're eventually hosed. The recent gov't interest in 'cyber' threats against infrastructure reflects the fact that the government doesn't dominate the digital domain, and can't protect it with troops, and needs it to run civilization and its armies. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu "How do you know you are not being deceived?" ---A Compendium of Analytic TradeCraft Notes, Directorate of Intelligence, CIA

1 0

RE: Location Escrow anyone ?
by Pearson Shane 17 Dec '03

17 Dec '03

Hello all, >> "Swisscom has stored data on the movements of more than a million mobile >> phone users. It can call up the location of all its mobile subscribers down >> to a few hundred meters and going back at least half a year," the paper >> reported. > >They probably say a few hundred meters so the people don't feel >their privacy is too ridiculously invaded / soften the blow. > >If this is a GSM network then I think they can probably pinpoint >your location down to 2 possible locations within a few meters >due to the digital timing involved with the very precise spread >spectrum radio. Or maybe your actual location within a meter or 2. > >I have heard of digital mobile phones that have a feature in their test/diag >mode that displays the distance to the current base station in meters, >and also displays info of a second base station that it would most likely >switch to when moving out of the current cell. >Even if the telco only had the distance info to your phone within a meter >from 2 of their base stations, they could calculate where you are if need >be to 2 possible locations within meters. >Surely though they would have the capability of recording distance info >from 3 base stations, pin pointing you exactly during a call or the exact >spot your phone requested a cell change. > >And during a call, if need be, they could probably plot your position at >around 10,000 samples per second. :) Though for them to be keeping >this much info on you, you are obviously being investigated. > >Isn't it ironic that people who use GSM for it's "security" can have this >much info of their whereabouts known to big brother/whoever? >Not to mention their actual conversation. > >Imagine Mr.Drug Dealer turns up to court and watches as the jury is >presented with a floorplan on screen and an animated pinpoint of his >phones position while a recording of his conversation is played in sync? > >The world just about, has no idea! >To say big brother is watching is a gross understatement. :) > >He's gunna find out who's naughty and nice. > >Bye for now.

5 5

Jim Bell article excerpt (Was: Letter on Jim Bell)
by Declan McCullagh 17 Dec '03

17 Dec '03

I wrote this last summer: [...] Then Assassination Politics sent the IRS into a tizzy. Jeffrey Gordon, an inspector in the IRS' Internal Security Division, widened the investigation immediately. He detailed in an 10-page affidavit how he traced Bell's use of allegedly fraudulent Social Security Numbers, how he learned that Bell had been arrested in 1989 for "manufacturing a controlled substance," how he found out that Bell possessed the home addresses of a handful of IRS agents. Gordon's conclusion? Bell planned "to overthrow the government." The IRS investigator said in his affidavit that Bell's "essay details an illegal scheme by Bell which involves plans to assassinate IRS and other government officials... I believe that Bell has begun taking steps to carry out his Assassination Politics plan." But for all Gordon's bluster in court documents, he had no proof that Bell broke the law. He didn't even have enough evidence to arrest the prolific essayist -- at least not yet. After the April 1 raid, Gordon and a team of IRS agents worked to assemble a case against Bell. They pored through the hard drives of the three computers they seized. They scrutinized documents from Bell's house. They interrogated his friends. They listened to tape recordings of the "Multnomah County Common Law Court." They scoured the Net for mentions of Assassination Politics. Six weeks later they felt their case was complete. --- IRS agents arrested Bell on May 16 and charged him with obstructing government employees and using false Social Security numbers. Now, this is hardly attempting "to overthrow the government." But government agents insist Bell is far more dangerous than the charges suggest. (The judge seemed to agree: at the time of this writing, Bell is being held without bail.) The latest IRS documents filed with the court label Bell a terrorist. They claim he talked about sabotaging the computers in Portland, Oregon's 911 center, contaminating a local water supply with a botulism toxin, extracting a poison called Ricin from castor beans, and manufacturing Sarin nerve gas. He allegedly bought and tested some of the chemicals. "Bell has taken overt steps to implement his overall plan by devising, obtaining, and testing the materials needed to carry out attacks against the United States, including chemicals, nerve agents, destructive carbon fibers, firearms, and explosives," the complaint says. But what really got the IRS in a stink was what happened a month after they seized Bell's car. The complaint says: "On March 16, 1997, a Sunday, an IRS employee noted a strong odor in the Federal building. On March 17, 1997, several IRS employees had to be placed on leave due to the odor, and another employee reported other ill effects. The odor was traced to a mat and carpeting... just outside the IRS office entrance." The chemical proved to be "mercaptan," with which Bell's friends say he doused an adversary's law office in the early 1980s. Yet if Bell was a crypto-terrorist, he was a singularly idle one. This is a problem with the IRS' accusations: if true, they prove too much. If Bell was bent on toppling the government, and his exploits date back from the early 1980s, why are they such laughably juvenile and ineffectual ones? Stink-bombing offices isn't a Federal felony, nor should it be. "I would've thought this would be 'malicious mischief,' at most," Tim May, one of the founders of the cypherpunks, writes. "People who've done far, far, far worse are left unprosecuted in every major jurisdiction in this country. The meat thrown to the media -- the usual AP stuff, mixed in with 'radical libertarian' descriptions -- is just to make the case more media-interesting... It sure looks like they're trying to throw a bunch of charges against the wall and hope that some of them stick -- or scare Bell into pleading to a lesser charge." Since his arrest, the denizens of the cypherpunks list, where Bell introduced and refined his ideas, have become generally sympathetic. Gone is the snarling derision, the attacks on his ideas as too extreme. Now a sense of solidarity has emerged. One 'punk wrote: "I have decided that I cannot in good conscience allow Jim Bell's persecution for exercising his basic human right to free speech to pass by without taking personal action to support him." --- When I talked to Bell a few days before his arrest, he spoke calmly and with little rancor about the pending investigation. I couldn't tell how he felt after being raided and interrogated by his arch-enemy, the IRS. But imagine continuously railing on the Net against jackbooted thugs, then having real ones bash down your front door. Bell was most interested in talking up Assassination Politics and predicting how it would eventually blossom. He had just published an op-ed in a local newspaper saying "the whole corrupt system" could be stopped. "Whatever my idea is, it's not silly. There are a lot of adjectives you can use, but not silly," he told me. "I feel that the mere fact of having such a debate will cause people to realize that they no longer have to tolerate the governments they previously had to tolerate. At that point I think politicians will slink away like they did in eastern Europe in 1989. They'll have lost the war." He told me why he became convinced that the government needed to be lopped off at the knees. Bell's epiphany came after he ordered a chemical from a supply firm and was arrested when he failed to follow EPA regulations. "That radicalized me," he said. "That pissed me off. I figured I'd get back at them by taking down their entire system. That's how I'd do it."' Moral issues aside, one of the problems plaguing Bell's scheme is that it's not limited to eliminating "government thugs who violate your rights," as he likes to describe it. If it existed, anyone with some spare change could wipe out a nosy neighbor or even an irritating grocery store clerk. After I pointed this out to Bell on the phone, he fired email back a few days later saying, "Assuming a functioning Assassination Politics system, nothing stops you from contributing to my death." He suggested that maybe assassins would develop scruples: "You'd be able to purchase deaths of unworthy people, but it might be only at a dramatically higher price. Doable but not particularly economical." [...] -Declan

3 2

Re: cypherpunks and guns
by Ian Sparkes 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 05:28 06.01.98 -0500, Ryan Lackey wrote: ><daemon(a)ATHENA.MIT.EDU> (Wei Dai) writes: > >> I don't understand why there is so much talk about guns here lately. >> Unless someone comes up with a weapon that has some very unusual economic >> properties, individuals cannot hope to compete with governments in the >> domain of deadly force. If we have to resort to physical violence, we've >> already lost! >> >> Think about it: if we can defend ourselves with guns, why would we need >> crypto? > >I am fairly certain that as an irregular army soldier I could inflict >a substantial amount of damage upon an occupying military. With maybe >$20k in equipment and several hundred hours of training, you could make >life very difficult for any luckless squad that happens your way. Multiply >that by 100 million armed citizens and you see that armed civilian >resistance *can* defeat an occupying army. > I'm not sure I am convinced by this argument. The "enemy within" seems to be the main focus of the discussions in the CP list. When the 'luckless squad that happens your way' is manned by your countrymen at the command of their (and your) government, what then? As far as I can see, the result would be a *very* bloody civil war. The outcome may indeed be less obvious than in a 'conventional' (i.e. unarmed populace) civil war, but the cost much higher. This is from the standpoint of a 'sissy' European. I admit I am poorly equipped to comment on the American Zeitgeist. However, my experience of civil war victims (refugees from the E-bloc) suggests that we should be concentrating on social revolution before we tool up for military. There is more to be won, with a potentially much lower cost. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNLImc4n3W0ooQnZKEQL4VwCffzMNK1MfQ/1zMv+E/3dfoioc8e8AoL0d uZMzgq6LPu9nVe90kcA49cbG =yL/D -----END PGP SIGNATURE-----

2 1

Encrypted Telephony Products
by Jrbl Pookah 17 Dec '03

17 Dec '03

I've recently begun looking for internet telephony products that employ reasonably secure encryption on-the-fly. Now, I've found Nautilus, and PGPFone, but neither product appears to have been updated for quite a while now. I was just wondering if anybody could give me recommendations for more up-to-date products, and perhaps comparisons between those available. Thank you.

3 2

Re: Anonymous Remailers
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sun, 4 Jan 1998 23:14:19 -0800 From: Chuq Von Rospach <chuqui(a)plaidworks.com> Subject: Re: Anonymous Remailers To: "ListMom-Talk Discussion List" <ListMom-Talk(a)SkyList.Net> Mime-Version: 1.0 Precedence: Bulk Reply-To: "ListMom-Talk Discussion List" <ListMom-Talk(a)SkyList.Net> Sender: "ListMom-Talk Discussion List" <ListMom-Talk(a)SkyList.Net> X-URL: <http://www.SkyList.Net/ListMom-Talk.Home> At 8:10 PM -0800 1/4/98, Eric Mings wrote: > I noticed on Apple's info about acceptable behavior on their lists, that > they ban postings which originate from anonymous remailers (of which they > include juno). I was wondering what experience people have had regarding > abusive posts from such systems, and how one easily identifies them if > you choose to ban postings originating from such systems. Thanks. That's me. I decided to stop accepting posts from anonymous remailers way back, when anon.penet.fi was still alive. Some of that is philosophy, some of that was problems. As far as problems, it's the normal stuff -- personal attacks, mailbombing through anonymous remailers, copyright/slander/libel issues, all the normal fun and games. Since you can't track users back, you have real problems policing them. And since anonymous remailers tend to allow multiple (heading towards infinite) remailing addresses, the practical issue of how to lock out an abusive user becomes severe. That's why Juno is bounced -- you can create accounts and then use them instantly, with no policing and no tracking. I had a problem a while back with an idiot who did, abusively. After about four rounds of trying to get him to go away, I did it the hard way, with a virtual neutron bomb. Juno's no help. In THAT case, I got email from them six weeks later apologizing for being so delayed in responding to my requests for help. they didn't offer to help, they just apologized for not telling me they wouldn't for so long. And that's been typical of my dealing with them. They don't police. They don't care. Their systems are set up so that basically, they *can't* police things. So I just don't even get into it. Since I can't police their users, I police their site. Effectively, they are an anonymous remailer. God knows enough folks use them as one. -- Chuq Von Rospach (chuq(a)apple.com) Apple IS&T Mail List Gnome <http://www.solutions.apple.com/ListAdmin/> Plaidworks Consulting (chuqui(a)plaidworks.com) <http://www.plaidworks.com/> (<http://www.plaidworks.com/hockey/> +-+ The home for Hockey on the net) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

3 2

cypherpunks and guns
by Wei Dai 17 Dec '03

17 Dec '03

I don't understand why there is so much talk about guns here lately. Unless someone comes up with a weapon that has some very unusual economic properties, individuals cannot hope to compete with governments in the domain of deadly force. If we have to resort to physical violence, we've already lost! Think about it: if we can defend ourselves with guns, why would we need crypto?

9 10

XXX ADULT SEX!!!
by wogague2＠toyoma-u.ac.jp 17 Dec '03

17 Dec '03

The LARGEST selection of Hot Beautiful XXX Live Girls from the U.S.A. & Europe!!! Voted as the 1998 best Adult Site! *LIVE GIRL SEX SHOWS!!! * 10 FREE Live Video Feeds & Chatrooms!!! *FREE Erotic Stories!! *1,000's of Free Pictures of XXX Porn Stars!! *Confessions!!! *Plus Free Pictures of Teens & Men!!! *Live Erotic Chat!!! *Gambling * Tons of free stuff!!! So Much More we can't fit it on this page. See for yourself, go check it out!!! You must be 21 or older. Please copy and paste the link below into your browser, and press enter. http://www.search.com/Infoseek/1,135,0,0200.html?OLDQUERY= pussyclub+&QUERY=pussyclub+&COLL=11&START=10&OLDCOLL=WW If you take offense to this email & wish to be taken off our list, simply e-mail us at: stanleyo(a)hotmail.com We are sorry for any inco

1 0

a good example of bad crypto hype
by Anonymous 17 Dec '03

17 Dec '03

>at http://www.meganet.com/explain.htm >you can test your critical thinking skills... Bawahahahaha. That's the biggest bunch of complete bullshit I've read in years. Thanks, Meganet, you made my night. They must be smoking crack and a lot of it.

1 0