December 2003 - cypherpunks-legacy

Re: Big Brother Is Watching ATMs
by Vin McLellan 17 Dec '03

17 Dec '03

<sigh> My apologies to Jonathan, the boyos in the Hills, and those watching for the Choppers. I wrote: |> Could you please identify this "bank card company" by name, card, nation, |>etc. ? The vendor, Sensar, Inc. <http://www.sensar.com> is planning to unveil the system at the Banking Administration Institute's conference in New Orleans the day after tomorrow. The company's version of the product and its expected use is a little less conspiratorial than Jonathan's post to C'punks -- but it more than suffices to force me to eat crow for my scepticism and unwarranted sarcasm. >> IrisIdent is a biometric identification system that uses the unique >> patterns of the human iris to verify an individual's identity. Using a >> standard video camera, the system takes a picture of an individual's iris >> and compares it with a previously stored iris image. The result is a >>rapid >> validation of the individual's identity. With an empirically determined >> crossover error rate of less than 1 error in 131,578 transactions, iris >> identification is more reliable and less intrusive than fingerprinting or >> retinal scanning. Its security cannot be bypassed or compromised. >> Pilot systems are available on a limited basis, with full production >> scheduled for later in 1997. In addition, Sensar is planning to launch >> follow-on applications for a wide range of financial applications, >>such as >> new account openings, bank wire transfers and government services. >> Smart Camera is a future offering from Sensar. It will combine the same >> technology with a stand-alone (non-PC-based) camera to verify >> customer identification at point-of-sale locations, business >>workstations, >> and home computers. |> Without some explicit cite of a commercial entity -- or a reference to some |>"strip-'em-naked-with-electrons" Police R&D group like the guys at Rome AFB -- this |>report sounds like another of those ID-Implant fantasies circulated by the guys who |>are bolting steel plate to their screen doors and programming their backyard AA to |>auto-target (a) Black Helicopters (b) which are on low-level rapid approach (c) full |>Oriental, Arab, and Hispanic troopers (c) wearing Blue Helmets. The CNN news report (only a little less worrisome than Jonathan's post) is at: http://www.cnn.com/TECH/9711/30/eyeball.id.ap/index.html |> Or, with further checking, could you confirm that is this just another spicy |> rumor crafted to keep the boyos in the hills rubbing garlic into their hollow-points |> with proper militia enthusiasm? (Not that I don't enjoy a good tale to wake up |> sleepy Computer Science undergrads, mind you...) |> Up the Revolution, |> _Vin Jonathan Wienke <JonWienk(a)ix.netcom.com> warned us all: >I just heard that a bank card company has just released a program for using >photos of the iris in people's eyes as a biometric ID to replace people's >PIN codes for ATM / credit cards. What I found really interesting is how >they plan to implement it. As people use the ATM, they are photographed. >(Every ATM has a security camera.) Over time, as people use the ATM, the >security camera images are composited to produce a high-quality image of >their irises, which is coded and placed in their account information. Once >this is accomplished, when a card is inserted into the ATM and the security >camera gets an iris image that matches the account sufficiently closely, >the user can conduct transactions without entering the PIN code. People >affected by this will merely receive a letter that under certain >circumstances, entering the PIN is no longer necessary, but this is not a >security problem. > >This scenario may not be a security problem, but it certainly poses a >privacy problem. Given the frequency that the average Joe Sixpack uses the >ATM, it is only a matter of time before the government mandates a >nationwide eyeprint ID database to catch ATM and credit card theives, money >launderers, tax cheats, and other undesirables. Perhaps the eyeprint could >even replace or supplement the SSN as the unique taxpayer ID key for tax >and other purposes. Of course, given the fact that ATMs have had cameras >from the start, this theoretical eyeprint database could already be under >construction. How's that for paranoia? >:-( > >Of course, there are a few ways to beat this, such as mirror sunglasses, >(which would only be useful while alternative credentials to eyeprint ID >are still available) and contact lenses, (which would have to be carefully >oriented so that the same side of the lens was always up, or the fact that >you are wearing contacts and are therefore a Suspicious Person would >become obvious to the system) and of course intraocular implants of various >types. Of course if the implant's power-on LED gives your eyes a constant >Satanic red glow, you may be flagged as a Suspicious Person anyway. > >-----BEGIN PGP SIGNATURE----- >Version: PGP for Business Security 5.5 > Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 -- <@><@> --

1 0

Re: More Government Sanctioned Theft
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

[This message has also been posted.] In ok.general, Jerry Morgan <jmorgan(a)galstar.com> wrote: * easttom(a)redriverok.com (Chuck Easttom) wrote: * > 2. What the hell legit reason is there for a man to be driving around with * >132 K in a truck?? * > * * The simple possession of any amount of money is not subject to "police * approval", unless of course we are living in a police state. * * As I understand the "story" the police stopped the guy, searched the * car, found the money, seized it and then let the guy go without * charging him with anything. A nice cool 132K profit for a few minutes * work, just like an armed robbery. It would appear that this "cops and * robbers scenario" has the cops playing both roles.S ... ... ... * tactics will have 132K for new police equipment. Too bad they won't * use it to buy copies of the U.S. Constitution for their officers to * read, but after all they wouldn't want them getting any *wrong ideas* That would be a "hate crime". According to a message in the cypherpunks mailing list (which I unfortunately deleted, with references to more details on some websites), there was a conference on "hate crimes" recently. There, they discussed "profiles" and signs of "hate crimes", and among signs there were discussions of the constitution and founding fathers. If someone has any more information on that, please let us know. -- - Igor. ---------------------------------------------------------------------------- char*p="char*p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}

1 0

"Berman expressed frustration with the ACLU's criticisms"
by Declan McCullagh 17 Dec '03

17 Dec '03

[More examples of the split within the "cyber-rights" community. --Declan] ===================== Chicago Tribue, November 30, 1997 HEADLINE: MANY VIEWS COULD SNARL 3-DAY WEB CONFERENCE; HOW TO SHIELD CHILDREN THE BIGGEST ISSUE BYLINE: By Frank James and Shirley Brice, Washington Bureau. DATELINE: WASHINGTON BODY: [...] One of the conference's main themes will be educating parents about how filtering software can help them "keep their children out of the red-light district," Berman said. The emphasis on the use of filtering software and expected talk about Internet ratings systems has prompted the American Civil Liberties Union to dub the event the "censorware summit." The ACLU, which played a major role in opposing the decency act, doesn't oppose filtering software in principle, but it asserts that parents who buy it should be able to learn exactly what sites the software blocks and what criteria were used in deciding to block those sites. [...] Barry Steinhardt, associate director of the ACLU, fears that eventually there would be "one or two centralized ratings systems that will reflect particular moral values and have the effect of limiting the breadth and variety of speech on the Internet." "The way these rating systems are going to work," he said "is that parties other than (consumers) are going to decide whether to employ the ratings systems. Sites that are rated unfavorably are going to be blocked out, rendered invisible to the average user." Berman expressed frustration with the ACLU's criticisms. "The court said there were less restrictive ways than government censorship, and they pointed at these filtering tools. It was endorsed by the Supreme Court 9-0. If you take those tools away, what do parents do?" The conference's organizers, Berman said, also want to let parents know about the efforts of companies with major Internet presences to make the Web more family-friendly. [...]

1 0

Solveig Singleton on "Brave New Partners in Net censorship"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 01 Dec 1997 16:26:03 -0500 From: Solveig Singleton <solveig(a)cato.org> To: declan(a)well.com Op-ed: Brave New Partners In Internet Censorship by Solveig Singleton (solveig(a)cato.org) Solveig Singleton is the director of information studies at the Cato Institute. A few short months ago, the Supreme Court declared that the First Amendment protects the Internet just as it protects booksellers, newspapers and books when it found the Communications Decency Act (CDA) unconstitutional. That critical ruling signaled censorious governments in countries like Argentina, China, Germany and Zambia that the United States would not provide a precedent for blocking undesirable Internet content. Yet now the computer industry flirts with technologies of "self-censorship" at a December Internet summit under the guiding hand of the Clinton administration. The summit, called Focus on Children, poses subtle new dangers to free speech on the Internet. The First Amendment keeps the government out of the business of controlling media content. Private citizens are free to follow their consciences in choosing their own reading material and guiding their children to seek out or avoid certain information. There's no First Amendment objection when a newspaper editor refuses to print an article or when parents take books away from their children, or use a "censorware" program like SurfWatch in their own homes. The private sector is allowed to edit, to exclude and to silence speech). The public sector is not. But the summit's organizers call for "partnership" between industry and government in keeping "inappropriate" material from children. President Clinton is expected to attend. The summit emerged from a July meeting of President Clinton, Vice President Gore and some of the groups involved in the lawsuit against the Communications Decency Act. As it blurs the line between public and private, the Focus on Children summit becomes government action disguised as parental action. Filtering software like SurfWatch and the Platform for Internet Content Selection (PICS) -- a computer language standard that allows labels to be attached to Internet content -- are fine as long as they stay in the private sector, driven by customer demand and free choice. There's no need for a summit to make that happen. With nothing better to do, politicians and sensationalists are likely to use the occasion to shine a media spotlight on the dangers of the Internet. Government pressure will make it all the more likely that the computer industry will be unable to resist calls for mandatory PICS or universal filters built into the fabric of the Internet itself. Disturbingly, the summit's program suggests that free speech rights do not necessarily rank high in the sponsors' priorities. Its sponsors include, for example, the conservative group Enough is Enough; the summit's Web site links to their pro-CDA arguments but not to anti-CDA sites. While some opponents of the CDA are involved, defenders of free speech such as the American Civil Liberties Union are conspicuously absent. Documents promoting the summit describe the CDA as "well intentioned" and note that "supporters and opponents of the CDA agree that children should not have access to inappropriate material on the Internet or in any other medium. The real question is, how best to do it." The right question is whether government has any proper place at the table discussing any of these issues -- and especially in determining what is "inappropriate." The answer is a resounding no. Furthermore, government involvement is not necessary. The vendors of filtering programs have reason enough to ensure that parents are aware of their products. Government involvement promotes political, centralized solutions to what should be private problems. The V-chip is a prime example. Before lawmakers chose to mandate V-chips, entrepreneurs and private groups competed to help parents monitor their children's viewing habits, offering dozens of different blocking technologies as well as ratings and reviews of programs from diverse perspectives. Now the monopoly V-chip threatens to shoulder those offerings out of the picture. Freedom of speech on the Internet offers hope to millions of people around the world who live under political regimes that stifle their access to information. But the Internet's freedom depends on its technology. Politicians should be ashamed to set a precedent in this country by pressuring the industry to engineer this freedom out. We do not need a V-chip for the Internet any more than we need a rating system for libraries or bookstores. ### Solveig Singleton (202) 789-5274 (202) 842-3490 (fax) Director of Information Studies Cato Institute 1000 Mass. Ave. NW Washington, DC 20001

1 0

PGP Inc Sold for $35M - News Flash
by Vin McLellan 17 Dec '03

17 Dec '03

<News Alert, from C/Net's News.Com> "PGP acquired by merged security software firm. "Pretty Good Privacy, an encryption company foundered by crypto pioneer Phil Zimmermann, has been acquired by Network Associates, the result of the merger of McAfee Associates and Network General, which closed today. "Network Associates will pay $35 million in cash for PGP. " -- No confirmation or further information available on the PGP, McAfee, or Network General web pages. _Vin Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 -- <@><@> --

3 3

Re: Pasting in From:
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 03:50 PM 12/01/1997 +0100, Amad3us <cypherpunks(a)cyberpass.net> wrote: >Then it has to allow you to put headers back in otherwise you can't >interoperate with software. Eg pasting in References:, Subject: Pasting those in isn't controversial, and is generally supported; you could be using Subject: pasting today with most remailers, using the ## syntax. >(I would like to see Cc: and Bcc: being allowed to be pasted in also). At minimum, addresses in Cc: and Bcc: need to be checked against blocking lists, and it's probably worth checking the number of names in the list against some threshold - especialy Bcc:s, which tend to be popularly used by spamware. >I would also like to see From: pasted in. In fact I can see no >purpose to restrict what can be pasted in, other than to reduce >complaints to the remailer operator possibly. Too easy to be abused by forgers, as are Reply-To: and Sender:. >My software shows be all headers. I am not sure what other software >would do, probably, only display the first From field (the remailers). MSMail and other closed systems are generally quite arrogant about only showing you the mail headers they "know" you want to see, and discarding the rest, whether that's what you want or not. Lots of mail clients only show you one From:, either discarding others or making them available in a "Show all headers" mode. >However you'll notice that my address is: > Amad3us <cypherpunks(a)cyberpass.net> >which means that I would like it to be pasted in as it is replyable >(for encrypted mail) even though not being a nymserver account. Which is a bit annoying, by the way, for cypherpunks who don't want to read your mail :-) On the other hand, alt.anonymous.messages is a fine place for people to send replies, and you can do things like alt.anonymous.messages(a)mail2news.some-relay-server.com At one time, there was a message-pool service on the extropia remailer which forwarded anything retrieved to all its subscribers; if the list is small it's not much protection, but it's one way to obscure mail sent to middleman remailers. There are other remailer-like systems that provide mailboxes for anonymous retrieval; I think Jenaer does something like that. And then of course there are hotmail and juno :-) Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

2 1

PGP Inc Sold for $35M - News Flash
by Vin McLellan 17 Dec '03

17 Dec '03

Network Associates Acquires Pretty Good Privacy (PGP) 04:46 p.m Dec 01, 1997 Eastern Standard Time SANTA CLARA, Calif., Dec. 1 /PRNewswire/ -- Network Associates, Inc. (Nasdaq: NETA, commencing Dec. 2), formerly McAfee Associates (Nasdaq: MCAF), announced today that it has a signed a definitive agreement to acquire privately-held Pretty Good Privacy, Inc. (PGP). The PGP acquisition extends Network Associates' network security and management software products with the leading applied cryptographic security solutions for protecting corporate assets and enabling secure electronic communication. According to an Ernst and Young study, top threats to network security include virus attack, sabotage from inside the firewall and sabotage from outside the firewall. The combination of PGP and Network Associates unites leaders in addressing these corporate security threats. Network Associates' McAfee anti-virus security software is used by over 25 million users and more than 80% of the Fortune 500. With more than four million users in 50 countries, PGP is the worldwide de facto standard for Internet email and file encryption. "The synergy across our product lines is phenomenal," said Bill Larson, chairman and CEO of Network Associates. "We will now be able to provide an integrated software solution for securing both corporate networks and enterprise data." "There is a pressing need for comprehensive, integrated security solutions," said Phil Dunkelberger, general manager of Network Associates' Total Network Security Division, (formerly president and CEO of PGP.) "The combination of resources and talent of the respective companies will provide customers with a premier enterprise-scale security solution." Network Associates leads the way in providing large corporate customers with integrated network security and management suites. Network Associates' Total Virus Defense Suite incorporates client, server and gateway protection against computer viruses, and is a leading offering in its class. The PGP encryption and management products, including the PGP Business Security Suite, will be the cornerstone for a complementary suite offered by Network Associates called the Total Network Security Suite. By combining Network Associates' intrusion and virus detection products with Business Security Suite's desktop encryption software, and key server and policy management tools, the Total Network Security Suite will address, in a single solution, the needs of network administrators and corporate security officers. PGP has long been a pioneer in the security industry, contributing significantly to many of the principles that have driven the industry. Network Associates will continue to support the guiding principles that have made PGP a successful technology. These principles include a commitment to strong encryption and open standards. Network Associates will build on the progress made with the Internet Engineering Task Force, including RFC2015 and the Open PGP working group, to develop standards for security designed to unify industry practice. The acquisition, which is expected to close on or about December 15, 1997, is subject to PGP stockholder approval and other customary closing conditions. Members of PGP's board of directors and management, and certain other major PGP stockholders have agreed separately with Network Associates to vote their PGP shares in favor of the acquisition. The aggregate consideration payable in the acquisition is approximately $36 million (payable at closing in cash and the assumption of certain liabilities) and warrants to acquire a specified number of shares of Network Associates common stock. The acquisition will be accounted for under the purchase method of accounting. In accordance with generally accepted accounting principle, Network Associates expects to incur a significant charge to earnings for the Dec. 31, 1997 quarter related to the purchase of in-process research and development. With headquarters in Santa Clara, Calif., Network Associates, Inc., formerly McAfee Associates, is a leading supplier of enterprise network security and management solutions. Network Associates' product offering includes four individual software suites, Total Virus Defense, Total Network Security, Total Network Visibility and Total ServiceDesk, which can be centrally managed from within the Network Associates' NetTools unified management environment. For more information, Network Associates can be reached at 408-988-3832 or on the Web at http://www.networkassociates.com. This news release contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. Because such statements apply to future events, they are subject to risks and uncertainties that could cause the actual results to differ materially, including without limitation, integration risks related to the proposed transaction and the risk that the proposed transaction will not be consummated. Important factors which could cause actual results to differ materially are described in Network Associates' reports on Form 10-K and 10-Q filed with the Securities and Exchange Commission. SOURCE Network Associates, Inc. Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 -- <@><@> --

1 0

Re: Is Tim May guilty of illegally advocating revolution?
by Anonymous 17 Dec '03

17 Dec '03

There's a fallacy which is quite common on this list, especially among members whose positions are otherwise indefensible. It's surprising in a way because this fallacy is more common among statists. There, the fallacy goes like this: if it is immoral, then it must be illegal. We see this all the time. People think of the government as their way of expressing moral values. Drugs are wrong, so they must be made illegal. Discrimination in employment is wrong, so it also must be illegal. We have countless bad laws based on this false premise. On this list we see the same fallacy, turned around: if it is legal, it must be moral. Someone is attacked for posting some vicious, hateful, immoral rant, and they respond that what they said was legal, because of freedom of speech and the First Amendment. Their critic must be opposed to free speech if he objects to their words. Confusing what is legal and what is moral is a dangerous game. It leads to the false reasoning of the statists. We must remember that there is a clear distinction between morality and legality. We all agree with freedom of speech. People should be able to say whatever they like without fear of legal consequences. Cypherpunk technologies can play a major part in assuring this freedom. But this does not mean that all speech is equally valid. If someone calls for murder and they are attacked for it, it does no good for them to hide behind the First Amendment. Their words are wrong - they will have harmful consequences if followed. They cheapen life, and work against the goals we share of a future based on cooperation rather than cooercion. Cypherpunks are intelligent enough not to be fooled by this attempt to use the principle of free speech to justify calls for violence and murder. It's no wonder, really, that people like May and Vulis attempt to confuse the issue by pretending that their critics are opposed to freedom of speech. They know that if they are judged by their own words, their character is revealed for all to see. Any smokescreen is welcome if it helps conceal their vicious, hateful nature.

2 1

Panel names released for Bernstein hrg on 12/8
by Greg Broiles 17 Dec '03

17 Dec '03

I just spoke with someone in the clerk's office at the Ninth Circuit - the composition of the panel of judges for next Monday's hearing in the Bernstein case has been released. The judges are Bright, Fletcher, and (Thomas) Nelson. I haven't been able to find information about Judge Bright, but found pages of (meager) ratings/discussion about Fletcher and Nelson at: <http://www.appellate-counsellor.com/profiles/fletchb.htm> and <http://www.appellate-counsellor.com/profiles/nelsontg.htm> I think that Judge Bright may be Myron H. Bright, a senior justice on the 8th Circuit, who sometimes sits on 9th circuit cases by designation. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

2 1

PGP bought by McAfee
by steve 17 Dec '03

17 Dec '03

>"Network Associates, Inc. >(Nasdaq: NETA, commencing Dec. 2), formerly McAfee Associates >(Nasdaq: MCAF), announced today that it has a signed a definitive >agreement to acquire privately-held Pretty Good Privacy, Inc. (PGP)." Varous Questions, comments rants, etc.: Does anyone know how this will affect PGP's: security, commitment to no-GAK, Founder (P. Zimmerman), the continuation of the PGP product line? I heard that McAfee's PCCrypto product will still be sold by NETA as a retail product, (are they considering incorperating the 2 together and just using PGP's team for R&D?) steve -- A picture tells a thousand words. Stego

3 2