December 2003 - cypherpunks-legacy

Re: MIB Subponeas (fwd)
by Jim Choate 18 Dec '03

18 Dec '03

Forwarded message: > Date: Tue, 27 Oct 1998 12:42:36 -0800 > From: Tim May <tcmay(a)got.net> > Subject: Re: MIB Subponeas > * Is travel paid for? How? By spending hours completing forms in > quadruplicate, or do they just cut a check for some per diem sort of > payment? The IRS offered to pay my travel from the local Austin airport to Seattle and pay the hotel bill and meals. I was trying to determine how transportation in Seattle was going to be handled when they said they didn't need me in person. > * What if one has pressing engagements? (Travel out of the country, an > anniversary party, washing the dog?) I told them I didn't want to go to Seattle, they suggested an affadavit. > * What if one shows up with no records and claims not to have them? Exactly what I did after checking to make sure I didn't. They said 'Ok'. > * What about lawyer expenses? I know the line about "If you cannot afford What lawyer? You don't get a lawyer with Grand Juries. > More soberly, this kind of subpoena could well nuke the Cypherpunks list, Not even hardly. A subpoena isn't an accussation, it's an instrument to obtain potentialy relevant testimony and evidence. It means (at least in this case) "We believe you may know something or have possession of information related, but not necessarily directly involved in this matter." The sub-channel message is "Don't fuck with us, you're only about a hairs breadth away from hell on earth." Besides, they wanted me to testify *for* the prosecution, preferebly willingly. The last thing they were going to do was go heavy handed. > even the distributed node instance. If Igor Chudov, Lance Cottrell, and Jim > Choate all have to fly to Seattle and face scrutiny, implied threats, and > possible jail time for failing to jump when the Feds say jump, they may > decide to stop acting as Fed magnets. If the operators are that jumpy I suspect they wouldn't put up with the bills, occassional stupid private emails, the costs in time, etc. I knew this sort of stuff was a possibility. The only issue that took me by surprise was two officers showing up at work unannounced. It took me till the next day to burn off the heeby-jeebies from that. Of course, a truly motivated and worried, not to mention well heeled, cypherpunks might consider putting up a node themselves....<nah> ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Using a password as a private key.
by Christopher Steel - Java Design Center McLean VA 18 Dec '03

18 Dec '03

Why not encrypt the private key with a 128 bit symmetric key (created from the hash of a username and paasword) and store on a keyserver, along with the public key? That way, you don't have to store it yourself locally, you get it off the keyserver. I wrote a keyserver that does just that. In addition, it also verifies ies the user before returning the key. It requires the user to encrypt a known string with a separate password. The encrypted string is sent to the keyserver, encrypted with the keyserver's public key. Seems rather safe. Anyone disagree? -Chris P.S. I might not use it for military purposes, but for company email... "RedRook" <redrook(a)yahoo.com> wrote: >Date: Tue, 27 Oct 1998 13:53:07 -0800 (PST) >Assymetic crypto systems such as >Diffie-Hellman, El-Gamel, and DSS, allow the private key to be a >randomly chosen number. But, as a cute hack, instead of using a >random number, for the private key, you could use a hash of the User >Name, and a password. > >Doing so allows the users to generate their private key on demand. >They don't have to store the private key, and if they want to work on >a another computer, they don't need to bring along a copy. >Has any one tried this? Is there existing software that does this? Any >comments on the security of such a scheme?  >The only draw back that I can think of is the potential lack of >randomness in the key. If the user chooses a bad password, it would be >possible to brute force the public key. >Harv.RedRook(a)yahoo.com >_________________________________________________________ >DO YOU YAHOO!? >Get your free @yahoo.com address at http://mail.yahoo.com >

1 0

Cameras in Public Places (fwd)
by Jim Choate 18 Dec '03

18 Dec '03

Forwarded message: > Date: Mon, 26 Oct 1998 11:57:22 -0800 > From: Michael Motyka <mmotyka(a)lsil.com> > Subject: Cameras in Public Places [ravage: don't remember who said it... > > ] > > Privacy is also needed on public places (e.g., violated by face > > recognition systems) Anonymity is not equal to privacy. > The appropriate way of dealing with them is to wait for some people to > be misidentified and then file suit against the municipality using the > equipment. Harassment, false arrest, invasion of privacy, abuse of > power, loss of reputation, loss of the ability to earn a living - take a > few of the cities for $10 or $20 million and they'll get the message > that they've been had by the SW vendors. It makes no more sense to outlaw cameras in private or public places than it does to outlaw printing presses in some areas, a very basic way they're identical from the perspective of the law - it isn't the media that matters (with little respect to Marshall). What matters is they record some 'instance' and allow it to be distributed widely. What we do need is a mechanism that prohibits the police or other law enforcement bodies from access without a properly served warrant. Camera use in say a mall is permissible because it's the vendors who pay the rent who are deciding what is and isn't safe - not the customers of those vendors. It's permissible in traffic control and such because it is cost effective in those applications. In traffic control, if a motorist stalls or a wreck occurs the civilian (ie non-LEA) operators can call the necessary resources into play. Once the cop is on the scene a warrant could be issued if charges of some sort are filed. Ulitimately, what we need is a law that says: All law enforcement personnel are prohibited from accessing public or private documents in the course of their duties without a properly served and executed warrant. The two key points are 'public and private' and 'course of their duties'. A cop should be able to walk into a public library and get a book on some subject of interest (even law enforcement). But if it's related to the LEA's cases then a warrant should be required to step foot in the building. Now if he's a beat cop walking his patrol he obviously can't stop chasing a perp on the run who traverses the library (though it is highly unlikely they would stop to read, but imagine a dope deal just as well). Now, one way to deal with that is to insert some sort of phrase about 'openly accessible' or 'anonymously accessible' (that way the question becomes does one need an ID, if so then you need a warrant). ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

looking for articles
by Homayoun Saleh 18 Dec '03

18 Dec '03

Hello, I am looking for any articles or papers having to do with the computability of Poisson distributions in the plane, and someone suggested I ask this list. If anyone knows of anything related, or where else I should be looking, please let me know. Thanks a lot. Cheers, Homayoun

1 0

looking for articles (fwd)
by Jim Choate 18 Dec '03

18 Dec '03

Forwarded message: > Date: Tue, 27 Oct 1998 18:13:14 -0500 (EST) > From: Homayoun Saleh <hsaleh(a)phoenix.Princeton.EDU> > Subject: looking for articles > I am looking for any articles or papers having to do with the > computability of Poisson distributions in the plane, and someone suggested > I ask this list. If anyone knows of anything related, or where else > I should be looking, please let me know. > Thanks a lot. Not sure it's what you're looking for but: Statistical Distributions M. Evans, N. Hastings, B. Peacock ISBN 0-471-55951-2 It's got around 40 different distributions and their related equations and characteristics. There is also an appendix that lists the various distributions and the functions in several computational math programs (go MapleV !)... Now if you're looking for various approaches to how to impliment it then I can't help you there, I cookbook that sort of stuff out of my library. Have you tried Knuth? ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Rendering ( was MIB Subponeas ) (fwd)
by Jim Choate 18 Dec '03

18 Dec '03

Forwarded message: > Date: Mon, 26 Oct 1998 11:31:52 -0800 > From: Michael Motyka <mmotyka(a)lsil.com> > Subject: Rendering ( was MIB Subponeas ) > Collecting real names and addresses is, apparently, enough of a concrete > step to at least begin the "rendering" process. Which is the whole point of probable cause and civil rights. It turns out the 'respect' part is the hard one...;) > press-squashing, poison-cow BST boys ). Then what would be needed is > some sort of Eternity Service for an active server - detect tampering > and jump hosts. Actualy, something like Plan 9 would be more effective. That way the thing is distributed from the get go. With a suitably object oriented approach it could be feasible to distribute the data to specific servers but encode the program in the connections between the servers task swappers. By using Plan 9's economic resource bidding model it injects a level of anonymity in the repetitive execution aspect that wouldn't normaly be there. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Using a password as a private key.
by Anonymous 18 Dec '03

18 Dec '03

RedRook(a)yahoo.com writes: > Assymetic crypto systems such as Diffie-Hellman, El-Gamel, and DSS, > allow the private key to be a randomly chosen number. But, as a cute > hack, instead of using a random number, for the private key, you could > use a hash of the User Name, and a password. > > Doing so allows the users to generate their private key on demand. > They don't have to store the private key, and if they want to work on > a another computer, they don't need to bring along a copy. Has any one > tried this? Is there existing software that does this? Any comments on > the security of such a scheme? The only draw back that I can think of > is the potential lack of randomness in the key. If the user chooses a > bad password, it would be possible to brute force the public key. You can accomplish the same thing by encrypting your private key (including RSA) with a passphrase and publishing it. Because of the problems with passphrase bruting, it probably only makes sense to do this with a machine-generated passphrase which has guaranteed entropy. Something like: "Aarhous mocrader Fals paca rate portion wiserustingned" has a guaranteed > 128 bits of entropy, which should be enough for most purposes. Probably with an hour's study most people could memorize such a passphrase.

1 0

Re: UK police chase crooks on CCTV (fwd)
by Jim Choate 18 Dec '03

18 Dec '03

Forwarded message: > From: bill.stewart(a)pobox.com > X-Sender: wcs(a)idiom.com (Unverified) > Date: Mon, 26 Oct 1998 09:27:28 -0800 > Subject: Re: UK police chase crooks on CCTV (fwd) > >> ``The only people entered on to the system will be convicted criminals > >> who, through our intelligence, we believe are habitually committing > >> crimes in the area,'' > >> Dave Armond as saying. ``If people are not committing crime they have > >> nothing to fear, but if they are among the small minority who are, the > >> message is, 'We are watching out for you.''' > The policeman's statement, if honest, implies that the > system needs a real mugshot or more detailed set of pictures to work from, > so they're going to start with feeding it the Usual Suspects, > for whom they can get good data for the system to search. > It probably also has capacity limitations, so they won't be searching > for everybody they have pictures of, just the most likely. For now. What's the curve on facial recognition for 2x improvement? It would seem probable to me that there would be a feature to snap closeups off the cameras and feed them back in real-time. Talk about real-time traffic analysis. > >We need a law or court ruling pretty quickly in the US that sets the > >standard that a group of people have no more or less rights than an > >individual. This will required LEA's to provide probable cause prior to any > >actions against groups of people (such as this). > > Ain't gonna happen - are you kidding? If there is a ruling like that, > it'll be done in some way that restricts citizen rights rather than > expanding them, or expands police powers rather than restricting them. I'll have to disagree. > It's already legal for cops to hang around street corners watching for > suspicious activities or suspicious people, and all video recognition Um, it was always legal and should continue to be so, just as it should be legal for you or I to stand around that corner and watch for unusual activity. It's there job. They call it walking the beat. > Unfortunately, I'm being increasingly forced to take the David Brin position of > "Cameras are cheap, get used to it, just make sure we have more cameras > pointing at the cops than they have pointing at us, and make sure > the cameras the government has are citizen-accessible as well." I don't know about citizen-accessible. I don't want some joe blow walking down the street to get access to the cameras that track my trek to work each day. No, it needs to be very limited and require full interaction of the courts to gain access. Simply putting on a police uniform (or a army uniform) shouldn't mean you give up your rights as a citizen. This may be hard to believe, but I'm not the state's nigger and neither is that police officer or soldier. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

unsubcribe
by StoneCold-PT 18 Dec '03

18 Dec '03

unsubcribe ---Diederik Smets <Diederik.Smets(a)emd.be> wrote: > > IF the owner of the id also entered an internet password AND it is the same > as the one for the id file, then you can use brute force (dictionairies) to > try and crack it. Get the encrypted value in the > properties>fields>HTTPPassword of the persons document in the PNAB and > compare it to the results of the @password() function. > > Alternatively, do a search for old id files which might still be accessible > with the 'default' password (if you know which one that is), but you won't > be able to access servers that have the 'check password' option enabled. > > If you need to access a local DB that has 'enforce a consistant ACL across > all replicas' enabled, just use another id and add that person's name with > the necessary roles to the ACL via LotusScript. > > Diederik > > > Hello > I'm using lotus notes and I have a big problem. I have a id file with > no > password. How can I get a password for it or reset it. Is there some type > of > utility or something someone knows of?I have been told that I'm out of luck > unless I have the original. > > John... > > > == My Favorite Surfing Sites: http://www.dilbert.com/ and http://www.nro.odci.gov/ "To keep you is no benefit; to destroy you is no loss" by Thida Mam _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

RE: No Subject
by Harvey Rook (Exchange) 18 Dec '03

18 Dec '03

> More interesting, though, is this: why would a block cipher > use key bits > rather than an LFSR to do input or output whitening? Is it strictly a > performance issue? Is it proven that doing this doesn't leak > key bits in > some way? > > Mike > In many newer block ciphers, the key schedule comes from a fairly good one way hash of the key. Take a look at RC6, or TwoFish. Essentially this accomplishes the same thing as using a good LSFR. Harv.

1 0