December 2003 - cypherpunks-legacy

RE: Zombie Patriots and other musings [was: Re: (No Subject)]
by Nostradumbass＠SAFe-mail.net 12 Dec '03

12 Dec '03

From: John Kelsey <kelsey.j(a)ix.netcom.com> > At 02:07 PM 12/11/03 -0500, Trei, Peter wrote: > >It's worth noting that despite over a decade of this rhetoric, > >not a single terminally ill American has done this, so far as I > >am aware. > > Well, I think for most terminal illnesses, by the time it's obvious you're > really not going to live much longer, you're pretty damned sick. About half of my friends who died of a terminal illness were apparently quite healthy when told they had joined the "nearly departed". >And until > then, you'd probably like to make some personal use of what days or weeks > you have left doing something like talking to your kids, praying, composing > that last piece of music, etc., rather than blowing random strangers up to > make some political point. Isn't it depressing than some have been living their lives in a way that such an 11th hour changes of heart are necessary or desired? (Wouldn't it be a hell of a depressing > statement about yourself, if you really believed that the most valuable use > of the last hours of your life of which you were capable would involve > strapping some dynamite to yourself and taking out a busload of random > strangers?) Who mentioned random? Who mentioned dynamite? What I'm suggesting is no more random than soldiers killing other soldiers in war. "The purpose is to get the other poor dumb bastard to die for their ideology." Besides, there is no need for these operations to be a suicide. The lack of fear gives one a decided edge in dangerous situations which may actually increase survival rates. > > Along with that, most people care about either the afterlife form of > immortality, or at least the reputation/legacy form of immortality. Even > if you don't worry about lakes of fire and red guys with pitchforks, you > might prefer not to have your family and friends humiliated and ashamed at > the mention of your name. ("Oh my God! That was *your* son? How do you > live with that?") That's their problem. From my prespective its like Hollywood: as long as you still being talked about you're 'alive'. It doen't matter what they are saying. Better to be infamous down through history than unknown. ND

1 0

RE: Stego worm
by Tyler Durden 12 Dec '03

12 Dec '03

Mr Shaddack... That's some interesting thinking there. The interesting thing is that no one might ever even notice the presence of this benevolent worm. It could go pretty much unchecked for a while. As for Variola's comment, you might be right. I just assumed there's some kind of relationship between LSB and those spatial freuencies wherein image information might be stored. Actually, I would still think there's a relationship, in which case an Echelon-like approach based on ffts and "noise templates" might be going on (hence the usefulness of jamming). Anyone got a TLA Operative Handbook? ANy mention in there of what kind of photos are best for Stego? How about cloud photos? (particularly where there are clouds of many different shapes and sizes present in the photo simultaneously.) -TD >From: Thomas Shaddack <shaddack(a)ns.arachne.cz> >To: cypherpunks <cypherpunks(a)lne.com> >Subject: Stego worm >Date: Fri, 12 Dec 2003 01:10:24 +0100 (CET) > >It's unknown to which extent the Adversary can detect presence of >steganography in images being sent over the Net. > >But whatever capabilities they have, they can be jammed. > >Imagine a worm that spreads from machine to machine, and on the infected >machine it finds all suitable JPEG files, generates some random data as >source and encrypts them with random key, and stegoes them into the files. > >In few days or even hours, a sizeable portion of images on the Net >contains potentially detectable stegoed encrypted data. > >Any Chinese want to get immortalized in Internet history? _________________________________________________________________ Shop online for kids toys by age group, price range, and toy category at MSN Shopping. No waiting for a clerk to help you! http://shopping.msn.com

2 1

RE: Zombie Patriots and other musings [was: Re: (No Subject)]
by John Kelsey 12 Dec '03

12 Dec '03

At 02:07 PM 12/11/03 -0500, Trei, Peter wrote: >It's worth noting that despite over a decade of this rhetoric, >not a single terminally ill American has done this, so far as I >am aware. Well, I think for most terminal illnesses, by the time it's obvious you're really not going to live much longer, you're pretty damned sick. And until then, you'd probably like to make some personal use of what days or weeks you have left doing something like talking to your kids, praying, composing that last piece of music, etc., rather than blowing random strangers up to make some political point. (Wouldn't it be a hell of a depressing statement about yourself, if you really believed that the most valuable use of the last hours of your life of which you were capable would involve strapping some dynamite to yourself and taking out a busload of random strangers?) Along with that, most people care about either the afterlife form of immortality, or at least the reputation/legacy form of immortality. Even if you don't worry about lakes of fire and red guys with pitchforks, you might prefer not to have your family and friends humiliated and ashamed at the mention of your name. ("Oh my God! That was *your* son? How do you live with that?") >The *only* even vaguely simlar cases I'm aware of are in >India and Sri Lanka, where young Hindu widows (who, in >traditional Hindu society have very dim prospects for >a happy life) are recruited as suicide bombers by the >Tamil Tigers. I think Rajiv Ghandi's assassin was >such a woman. So there, the women are still healthy enough to do something, and doing the suicide bombing thing won't leave behind a legacy of relatives who change their names to avoid being associated with you. >Peter Trei --John Kelsey, kelsey.j(a)ix.netcom.com PGP: FA48 3237 9AD5 30AC EEDD BBC8 2A80 6948 4CAA F259

1 0

Re: Zombie Patriots and other musings
by Nomen Nescio 12 Dec '03

12 Dec '03

Another excellent group of potential recruits are prisoners. Especially if you can create a new religious movement teaching them to stop the interracial, intergang fighting and concentrate on their true enemy, the Man. Teach that killing cops, soldiers, any type of government agent, is a holy act. Robbing banks is a holy act. Killing the guards in the prisons, killing the excutives of polluting industries -- all holy acts. Leaflets could be dropped from radio controlled balloons during "yard time" preaching the Word.

1 1

Re: Idea: Using GPG signatures for SSL certificates
by Anonymous 12 Dec '03

12 Dec '03

Thomas Shadduck writes: > The problem that makes me feel uneasy about SSL is the vulnerability of > the certification authorities when they get compromised, everything > they signed gets compromised too. Technically this is true, but the only thing that the CA signs is other keys. So it merely means that the CA can create certificates on behalf of anyone the compromisers choose. It doesnt "compromise" any existing key or previously issued certificate or even any newly created key. In any case, you dont need a CA to use SSL. (Or more accurately, you dont need anyone elses CA to use SSL just create your own CA and issue yourself a certificate. This can be done without a lot of effort using openssl, for example.) > However, the system could be for some applications potentially get > hardened to certain degree, using the web-of-trust approach. What exactly does this buy you? The SSL certification authority system has as its only (but useful) redeeming value that one can connect to www.somecompany.com and have some level of confidence that the SSL certificate presented by that site was actually issued to www.somecompany.com and was issued by a "reputable" certification authority -- one that presumably will not hand out a certificate stamped www.somecompany.com to creditcardscammer(a)blackhat.net. If the certificate presented is not from one of the recognized "reputable" CAs built into your web browser, SSL itself will still work but your web browser will pop up a box saying that the CA is not in its list of "reputable" CAs (and BTW "would you like to connect anyway? yesno"). I dont understand the mindless worship of the "web of trust". PGP (/GPG) is a useful tool, but the "web of trust" is simply a way of "certifying" a key in a non-centralized, non-hierarchical way. -- Frondeur

2 1

RE: Stego worm
by Major Variola (ret) 12 Dec '03

12 Dec '03

At 08:09 PM 12/11/03 -0500, Tyler Durden wrote: > >As for Variola's comment, you might be right. I just assumed there's some >kind of relationship between LSB and those spatial freuencies wherein image >information might be stored. Actually, I would still think there's a >relationship, in which case an Echelon-like approach based on ffts and >"noise templates" might be going on (hence the usefulness of jamming). I'm not saying that you could never use FT to detect weaker kinds of stego. But if information is encoded as say the parity of 3 LSBits from different regions of the image, good luck. >Anyone got a TLA Operative Handbook? ANy mention in there of what kind of >photos are best for Stego? How about cloud photos? (particularly where there >are clouds of many different shapes and sizes present in the photo >simultaneously.) The most important thing is not to put too much cargo in your carrier. Think in terms of signal to noise if you wish. Obviously a picture with truly uniform color fields ---like a digital cartoon-- won't be useful. But scanning a piece of paper does not have this problem, for say 8 bits per grayscale pixel. Because each analog scan of the same piece of paper gives different bits. TD, you surely have the background to look into this stuff (and stego detection) if you want. BTW Stego ~aka watermarking. And stego can be done in music, movies, ascii text, etc. Or you could work from first principles, if you are able to mentally switch between steganographer and stego-detecter. (This same playing-chess-with-yourself is vital to security analysis, crypto, etc.)

1 0

Fwd: Speaking of Reason
by Freematt357＠aol.com 12 Dec '03

12 Dec '03

In a message dated 12/11/2003 5:25:34 PM Eastern Standard Time, rah(a)shipwright.com writes: > Better be careful when you say that, or Brin'll fire up his screaming > monkey routine at you... I've already had my turn at bat with Brin. He was upset several years ago when I made a few comments about his essay "The Cheerful libertarian", he asked that I send him the subscriber list to Freematt's Alerts so he could contact them directly- He thought that my commentary would adversely effect his ability to sell books- Anyway I told him to shove his request up his ass, at which point he said he'd get my subscriber list by other means. He's a good writer, but IMHO a total nutcase asshole. Regards, Matt- [demime 0.97c removed an attachment of type message/rfc822]

1 0

RE: Has this photo been de-stegoed?
by Trei, Peter 12 Dec '03

12 Dec '03

I'm trying to think of a reason why a recipient of a image containing stego'd information would want to keep it around after reading the contained info, with the stego bits overwritten. Why not just (securely) get rid of it? There are tons of sources of unique ephemeral images, such as webcams. Peter Trei

1 0

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip (fwd from schoen@loyalty.org)
by Eugen Leitl 12 Dec '03

12 Dec '03

----- Forwarded message from Seth David Schoen <schoen(a)loyalty.org> -----

1 0

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip (fwd from jspence@lightconsulting.com)
by Eugen Leitl 12 Dec '03

12 Dec '03

----- Forwarded message from Jason Spence <jspence(a)lightconsulting.com> -----

1 0