December 2003 - cypherpunks-legacy

Please help! Snakeoil offers on the Canadian Firearms Digest mailing list...
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Please Reply To: cdn-firearms-digest(a)broadway.sfn.saskatoon.sk.ca As of today, I'm off the list. It must be the Fickle Finger of Fate that made that post appear on the CFD today! It looks like snake oil, it taste like snakeoil, is smell like snakeoil; Is *it* snakeoil? ======= forwarded by JFA, from Canadian Firearms Digest ========== Date: Mon, 31 Aug 1998 15:30:34 -0600 From: Lee Scroggins <goobr2(a)ptd.net> Subject: New/easy to use strong file encryption fyi For anyone interested in easy to use strong file encryption, or just afraid that your gun related data/Emails may be too tempting for the officials, the following article points to an interesting site (http://www.filesafety.com) Please note that the US govt seems to be having a hissy fit about it (you might want to look while it still exists). > > - - The Strange Case of Charles Booher - - > > The California man whose software drew the interest of the Commerce Department > now has been hit with a subpoena. Charles Booher must appear before a U.S. > District Court grand jury in San Jose to explain what he is doing with his > encryption software, SecureOffice. > > Individuals can be charged with violating federal restrictions on the export > of encryption software, but the government also appears to be worried that > Booher has simply made it to easy to use extremely secure encryption--with or > without export. Booher's software scrambles data with long 168-bit keys. > > The subpoena Booher received also ordered him to bring to the courthouse the > source code for his product, suggesting the government wants to reverse > engineer it. > Booher intends to patent his source code and says he does not plan to hand it > over to anyone. > > http://foxnews.com/js_index.sml?content=/scitech/wires2/0827/t_rt_0827_27.sm l > View the Commerce Dept.'s subpoena at http://www.filesafety.com ========= end of forwarded text========== Jean-Francois Avon, B.Sc. Physics, Montreal, Canada DePompadour, Société d'Importation Ltée Limoges fine porcelain and french crystal JFA Technologies, R&D physicists & engineers Instrumentation & control, LabView programming PGP keys: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C

1 0

BEWARE of SnakeOil (tm)
by Jean-Francois Avon 17 Dec '03

17 Dec '03

SNAKEOIL ALERT: Cc: Cypherpunks(a)toad.com On Mon, 31 Aug 1998 18:37:35 -0600, Cdn-Firearms Digest wrote: >Date: Mon, 31 Aug 1998 15:30:34 -0600 >From: Lee Scroggins <goobr2(a)ptd.net> >Subject: New/easy to use strong file encryption fyi > >For anyone interested in easy to use strong file encryption, or just >afraid that your gun related data/Emails may be too tempting for the >officials, the following article points to an interesting site >(http://www.filesafety.com) Maybe his product is valid, but, after having read the the Cypherpunks mailing list for years, here are my conclusions: - beware of any product that has not been *extensively* peer-reviewed, with *all* the source code made public. Security breaches are *very* easy to overlook and no software should *ever* be used unless it was peer-reviewed. - the fact that a software uses a specific encryption technique that is described in well known books and that this technique is usually recognized as secure by the cryptanalysis community doesn't mean that the *specific* software implementation of it is truly secure. Thus, the need not only to peer-review the specific encryption technique but *also* and *especially* the precise coding implementation. [from their web page] "CryptView will allow you to validate algorithms and examine the internals of SecureOffice files. You can see the inside of the cryptography box. CryptView allows you to examine file formats and come to your own conclusions about the Security of SecureOffice. " - the fact an encrypted output doesn't look comprehensible to *you* or to a software engineer doesn't mean that a cryptanalyst cannot crack it within minutes... It is a *very* complicated science indeed. If you are not a PhD in cryptanalysis with years of experience in software security, you can't know. One of the NSA top cryptanalyst once said that before you spent at least fifteen years of your life cracking codes, you have no idea of how to devise a truly secure one. > Please note that the US govt seems to be having a hissy fit about it > (you might want to look while it still exists). They try pursue anybody who violates ITAR in a public way. If I were to walk with a PGP diskette across the border outside Cana-USA, I would be liable under ITAR even if I never wrote a line of software in my life. > Individuals can be charged with violating federal restrictions on the > export of encryption software, but the government also appears to be > worried that Booher has simply made it to easy to use extremely secure > encryption--with or without export. Yes, in USA, and it applies to Canada too, encryption software is considered the same as missiles for export purposes (category: ammunition). It is regulated by ITAR, just like guns. But this text borders on being glib. PGP caused a lot of trouble to his author too, but PGP has been *very extensively* peer reviewed. At least, AFAIK, V2.6.2. The newer version of PGP uses *several* encryption techniques, among which you have to choose. > The subpoena Booher received also ordered him to bring to the courthouse the > source code for his product, suggesting the government wants to reverse > engineer it. Absolute BS! The security is afforded by the specific cryptography mathematics that are themselves *extensively* well known, peer reviewed and, in the case of 3DES (DES), *invented* in government labs! The other technique, RSA, is used in PGP and the patent will expire in a few years. > Booher intends to patent his source code and says he does not plan to > hand it over to anyone. Un-peer-reviewed code has an excedingly high probability of being snakeoil, especially if it is marketed before being reviewed... A false feeling of security is much more dangerous than no security at all. All the govts have vested interest in disseminating pseudo-strong cryptography. This statement is not paranoia, it is recent and regularly recurring history. I find the information in the web page way too incomplete and, to the limit, misleading. Personnally, I prefer to stick to PGP. Version 5.x is *easy* to use. I do get tired of seeing posts like that around... One of theses days, I will write a FAQ on encryption for the layman... If ever I find that this software is appropriate, I will say so on the CFD. I do not own any interests, direct or indirect, in PGP. Ciao jfa Security is not afforded by a few tools, it is a state of mind.

2 1

Re:
by jkthomson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ok, sorry to have to drag the list into this AGAIN, but this AOL'er is much too funny for his own good. Imagine, he is entertaining me (perhaps the list?) for free! >At 04:16 PM 8/31/98 EDT, ILovToHack(a)aol.com wrote: >>Ibelive by spooks he ment goverment agents not a racial slur so lay off. >trust me, it's ok, he was using '32-bit AOL' to post his message, so EVERYONE >but you realized that he was talking about garbage anyway. maybe AOL64 will >have a clue(tm) built in. >an appeal to listmembers: >listmembers, can't we make this list 'request for access'? iLoV2HaCk and his >AOL ilk are getting a little too 'elite' and 'k- rad' for me. pipebombs, >posters, spooks, music, what the hell is happening to this list? I know that >I mainly lurk, but don't you think that having to request to join this list >may filter out the worst of the AOL (et al) newbies? they obviously cannot >get a clue(tm) and continue to cause a landslide of off-topic (albeit funny) >posts that ridicule them, and keep this list awash in non- cypherpunkish >dialogue. >oh, and I am also sorry for perpetuating this thread. ...and I got some AOL mail back from him! wooho! At 06:10 PM 8/31/98 EDT, you wrote: >You post a message like that again and you will be sued for libel my screen >name is just a nic and by the way if you think i am jokeing about the law suit >try me > ><Mike Haisley> ><ceo comnerd inc.> ><ILovToHack(a)aol.com> dude... please. take your best shot. I'm bored of you already and I want to see if you are actually as clueless as you appear to be. do it. c'mon! I'll even SIGN this message, Mike! oh yes, and apologies go out to the list, _again_. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNetnsrHc23iBlhItEQKiuwCbBS2gFXzDt4ZcpGsGsPimICJGeh4AnRyY KWL0x6FZaT+mOxFhC3Jr1Zgu =URJ7 -----END PGP SIGNATURE----- ----------------------------------------------------------------------- james 'keith' thomson <jkthomson(a)bigfoot.com> www.bigfoot.com/~ceildh jkthomson:C181 991A 405C EAFB 2C46 79B5 B1DC DB78 8196 122D [06.07.98] ceildh :1D79 59AF ED75 5945 6003 8240 DA34 ACCA 9DE4 6BC9 [05.14.98] ICQ:746241 <keys> at pgp.mit.edu ...and former sysop of tnbnog BBS ----------------------------------------------------------------------- The people to worry about are not those who openly disagree with you, but those who disagree with you who are too cowardly to let you know. =======================================================================

1 0

Free Membership!!!!!!!!
by freemem＠yahoo.com 17 Dec '03

17 Dec '03

Hey cypherpunks.... You gotta check this out, I was really bored so i was surfing the net and i stumbled upon this porn site, and let me tell you this is the best shit. Its got everything !!!! And *FREE MEMBERSHIP* Check it out http://209.167.161.17 It even has a WHORE GUIDE for the entire country, but that was only one of the cool things that it has. its got; LIVE VIDEO PORN FUCK FLICKS NUDE CELEBRITIES- this one is great PHOTO GALLERY You even get to see the pamelah lee vidoe**FREE** Trust me http://209.167.161.17 P.S. Ill be over a little later with some Brewskies see ya ************************************************************************ If You Would Like To Be Removed From Our Future Mailings, Please Reply With The Subject Remove, Or Manually Send To freemem(a)coolmail.to And Your Email Will Be Entered In The Global Remove Filter. ************************************************************************

1 0

Re: BEWARE of SnakeOil (tm)
by Destroy micro$oft 17 Dec '03

17 Dec '03

On Mon, Aug 31, 1998 at 10:43:23PM -0400, Jean-Francois Avon wrote: | | - beware of any product that has not been *extensively* peer-reviewed, with *all* the | source code made public. Security breaches are *very* easy to overlook and no software | should *ever* be used unless it was peer-reviewed. The source code for his Linux implementation is available at http://www.filesafety.com/CRYPT.EXE - which is actually a tar+gzipped file. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Is this like flame baiting him? Personally I don't mind the comments :) ----------- We don't take kindly to racial slurs here. You'll probably be receiving hundreds of email bombs over the next few days from angry cypherpunks. You may want to change email accounts.God bless! At 08:19 PM 8/29/98 -0400, RyanFord(a)aol.com wrote:> hola and good tidings > send some info on spooks please > i will be grateful>

1 0

Re: Is Hate Code Speech? YES
by Anonymous 17 Dec '03

17 Dec '03

First off if she didn't like the code she could have quit. Laws that say a company has to change their internal practices to make the workers happy are idiotic. I can't sue because the men's bathroom looks like crap and the wemans has a couch in it! If the program code was meant for distribution it might be a little different but still you have the choice not to get that code. The same as reading this message a few lines in you could delete it! You chose to read this far. The code is internal only and thus should require an internal policy, not an outside law enforcement agency. As far as speach: If it wasn't a form of speech she would have not gotten offended. She was offended by the language in the source code and thus the speech. get a job somewhere you feel comfortable, don't get a job and force them to change things around you ---"Albert P. Franco, II" <apf2(a)apf2.com> wrote: > > >From: mcw(a)atreus.ncs.ncsc.mil > >Subject: Is Hate Code Speech? > > > > > >I acknowledge that you're welcome to use whatever variable names you > >want in code you write in private. BUt if you want to sell that code, it > >should be held to a standard of professionalism. > > > > I think it is interesting that people are speaking of the program as > something published for public consumption. Source code for commercial > products rarely goes public and compilers do a rather nice job of obscuring > human language variable names. Thus if there is any message or coherent > agenda in the source code it is highly unlikely that it will be detectable > in the executable, which is in fact the product delivered to the public. > > Since the source code can only be read by insiders/employees then this does > tend to make it rather obvious that a form of speech was intended. I won't > rehash the fact that non-relevant, human-language-significant variable > names (as opposed to x, y, i, & j) are generally unacceptable programming > practice. I would make two points; that in todays programming world source > code is protected by copyright law as are other forms of expression legally > considered speech and source code is intended to document the process and > as such communicate ideas--in a broad sense this is a decent description of > speech, a written mode of communicating ideas. > > If someone finds offensive (hate) material in an obscured text (encrypted) > intended for limited distribution, does the encryption make it less > hateful? does the encryption make it any less a form of speech? does the > fact that distribution is limited (assumming the "target" is in the > distribution class) make it any less offensive? Is a crime less illegal if > it is hidden? (Be careful, on this one...) > > I think that offensive, probably hateful, speech was intended. So the next > step (or for others, a previous step) is to decide whether there are legal > grounds for action. There are several laws which do, in fact, make these > activities illegal. Most people in the US today agree that overt racism is > wrong. Additionally, most "Americans" agree with laws that make it illegal > to use/perform "hateful" speech. > > These are very dangerous laws since they try to tread a very thin line > between the freedom of thoughts (and to some degree, actions) and injury to > others. When I first settled down to live in Spain and began to pay real > attention to the local political scene I was astonished to find people > defending the "right" of the radicals to throw stones and metal objects at > those persons expressing ideas contrary to theirs (pro-peace, > anti-terrorism demonstrations, 1995-6). Fortunately, we hear less and less > of this non-sense that physical harm to another is a valid form of personal > expression or speech. But the base problem lingers, where do we draw the > line of expression of ideas and intent to do harm. It has long been held > that shouting "fire" in a crowded building is not a protected form of > speech. Nor is libel (forgetting for now the problems of defining or > proving it). And where do we draw the line (or does it even matter?) > between public and private? And where do expression and action get > separated? Thinking about doing something, or telling some one about those > thoughts are not generally the same as actually doing it. But where does > thought become expression become action? > > This case doesn't solely revolve around the speech issue...IMO, it also > revolves around the public/private issue, and whether or not the government > can rightfully "enter" a "private" business place to regulate these > matters. Recent history (80 years or so...) shows an increasing tendency > for the government to "protect" workers by regulating the workplace. There > are health & safety regs, minimum wage regs, etc. The "American" populace > has in general supported (and at times demanded) these external limits on > the "private" employer/employee relationship. Legal precedent exists. > > There are two problems here and historically the government has been called > upon to keep a balance between "free speech" and "harmful speech" on the > one hand and "Privacy" and "Protection" on the other hand. The debate now > is with this case which way will (should?) the pendulum swing? More > protection (reduction of privacy), more freedom (or hateful speech)... > > Personally, I hope no one wins this eternal debate 100% since the results > would be disastrous. > > Just some thoughts... > > Albert P. Franco, II > encryption(a)apf2.com > > == _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

Re: Child-Molesting Forger's Chilling Confession!!!1!
by Martin ELLISON 17 Dec '03

17 Dec '03

application/www-form-urlencoded

1 0

BEWARE of SnakeOil (tm)
by Albert P. Franco, II 17 Dec '03

17 Dec '03

>> The subpoena Booher received also ordered him to bring to the courthouse the >> source code for his product, suggesting the government wants to reverse >> engineer it. > The writer of this article shows an astonishing lack of computer knowledge. If they get the source code then there is no need to reverse engineer! Discount anything technical this writer says since he/she is clueless! Give 'em a word processor and they think they're journalists... Albert P. Franco, II

1 0

Is it true that PGP 5.X is not secure?
by Lars Weitze 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There are still rumors about that... ChromeDemon - -- "One dead is a tragedy, thousand deads are a statistic." Karl Marx e-mail: chromedemon(a)netcologne.de http://chromedemon.home.pages.de http://www.netcologne.de/~nc-weitzela2 -----BEGIN PGP SIGNATURE----- Version: PGP 5.5.5 iQA/AwUBNevU0XnCsKPabtOfEQILcACfZ097WlD1pyA+2c7qv5RcyuYQJaEAoOmf mvg3B9F9NNv7qrHljjgC1T+B =J/8j -----END PGP SIGNATURE-----

3 2