December 2003 - cypherpunks-legacy

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Does anyone know of any banks that provide full internet banking services outside of the USA's banking regulations?

1 0

Christmas Ornaments
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Declan McCullagh wrote: >BTW, I'm going to check on the Secret Service Christmas tree >ornaments and how much they cost. I'll post later on today if our >office manager tells me they're still available. (The U.S.S.S. is on >the top floor of my building and they give us a deal.) -----BEGIN CHEAP SHOT----- Hey, Declan, do they have any yellow stars? I understand we'll all be wearing them soon and I want to beat the rush. -----END CHEAP SHOT----- Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm Subject: Christmas Ornaments To: cypherpunks(a)algebra.com 25BA1A9F5B9010DD8C752EDE887E9AF3 [Cantsin Protocol No. 2] 94C43229A76383D818D39952F7A41ACA0394C6FE 2A8B39D3BFB61BBAB6999F274F1DA05335AE68FD -288 288 DB07E1CDCDB019006EB0737D3427811580C89BE436410FC2A321E123C1FC01801337D3E3592FCDB419DF2C2E19A837A739DE7887C7A81E644679D24305FC437E15FE4C9C0801CA6986692DA929BABFFFF7FA11C3E0CE5EA04E40455D15CA4E0A51831A181ECEB836E8A2FC1464CB8D764EFE84278A549147E6B1443B93D336C0179652F08D7C1B25AA6E2B588C701298CEB9A4EBD7CB92B14B61605B96079C0FF7CCFCFE4D588EC000C92D935B102AB6CDDC891BBF55814293A5A2922980C976EAC63AA98862166F1891FC1FF724ADD749B3E36185884B9320E7FF38C494E7C2740D6DB7214D58B01A48A45A69990B19110B73047178674DE01C60BFBE715AF 70123098DF0B8CCBC3F647A066881D04F66E5D929126FD78A10F2C1F7F1B55EF0436F1DCC974A1978BD317FFA4A3FBBDA6DF40DA62E2F77412578758A5CB4038D237D3FD282601A6776A1B27BDB6AB043EF97F8FD7E84FA6C43DCCEF2DF2996497E743A4F7C3D523426660705DA04E44CE4679BF21B806DB34F9A371EEEA830535D977FB3404F6398F3E63A5379E8074FBE9BE5733F8DAD44ED1F6AF1BAC86C2FFAC5E8C07C3AF60C1F47A2BD317ACCB051F29790B89962FEF5FB16CA246745EC7F342C479BE536FD8F6570631B0D49C91103A0794146612BB64E9FCA28DAE34E80C36B796B808D10C4A8D3B86AD5EA3C02FFB19DE08965A1BAB65F8B0D9DC4C

3 2

Re: A Question for Reporters
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Monty Cantsin wrote very sloppily: >Declan McCullagh wrote: >>Automation, computers, the Internet have now made boundaries, in many >>instances, meaningless. As I have said on a number of occasions at... That should have read: >Declan McCullagh quoted Janet Reno as saying: >>Automation, computers, the Internet have now made boundaries, in many >>instances, meaningless. As I have said on a number of occasions at... Sorry about that, Chief! Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm Subject: Re: A Question for Reporters To: cypherpunks(a)algebra.com 25BA1A9F5B9010DD8C752EDE887E9AF3 [Cantsin Protocol No. 2] 94C43229A76383D818D39952F7A41ACA0394C6FE FDB5C7AA81AEFA2D6CDB5418C8247BA262CAE736 -28C 28C 4B713EEED1FD80DA32F1A8A0828872E4F1CBBA4232591B4A0EAD724C3FFAF4CEC55D573B07A97B8391E5191BFE61BE43C8AC14623B123F6F9F904374110C7147DA895C911510642F7EFB8000E6D9033A97A45F28E684607C6669F0699262103205C3F8B9CC705ADF1257215CECEDE03D215E0825F9513C63AF4AB261A06FB9C49539B88E07D3614D6A4D9D8B480BC25B4B237810772105856DF7DF06F6D12EA16EEBE6E38473B74BF108B826D97B21C8A9EE5CB0608429F731DBD601333DC7DA7C68B47A912A60EC1FD8287F09BFFF0839BA8C4E2AA342826DD2594FF3CDB2AE8B2EC0493D3388A0DBCEF5B947E1EE2AA248D5913379CA71CFE54E9F0D8AF0E1 BCDBA068715E3371A065A4411DCA6CAEE09E44F2FD007ECEA633C53930CC4F38C0AB19E141B4719F0D962BE9613C39994FF569BC2BD9660AB62E70321F70BD86C93053684B97A3980677A8F0582E24C221FE34EAEB6AF75C2BEF72BAA72F07C038D9BB77CC2DEFBBEC2BEDB036A0CAC3004B9EC822ACF03BBEFEAE6B28A101216685D2141B2AC161F52D457FC275F7CD2E7492617032E91B808EFE953F2907271666C84C129181642F9DC4E7ABC7071729808783CD83694839F27B50747C59CCFBE66E32C45961A911A6ABB478F4056E3E62AB52113682AB850A0E12458198FD09241EB164B93ADA60CDEDC14BECF068CA5891E52361AC9143D9406B3888353

1 0

A Question for Reporters
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Declan McCullagh wrote: >Automation, computers, the Internet have now made boundaries, in many >instances, meaningless. As I have said on a number of occasions at >this table, a man can sit at a computer in Europe and steal from a >bank in the United States. Someone in Germany can get a list of >credit card numbers here and try to extort people for money on the >threat of using these credit cards. > >I think it is imperative that we develop practices, procedures, and >laws that will enable these countries - and indeed other countries >throughout the world - to work together to focus on criminals who are >exploiting the new technologies that so many of us are relying >on. The solution is working together as nations. At the same time Janet Reno makes these proposals, the U.S. government, and this administration particularly, has done everything in its power to undermine the development and deployment of security enhancing technologies. Not only has the use of cryptography been greatly hampered, but TEMPEST equipment and knowledge is controlled, and there have even been proposals to control secure operating systems. Reno's statements and the administration's policies blatantly contradict each other. The very technologies which would solve the problem Reno raises are being discouraged at every opportunity by the administration she represents. My question is directed at Declan because he is handy, but any other reporters are invited to contribute. Why is this not reported accurately? Do you plan to write a story which explains to the American people how the administration is not telling the truth? If not, why not? Surely it is important for the American people to understand what their leaders say and do. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm Subject: A Question for Reporters To: cypherpunks(a)algebra.com 25BA1A9F5B9010DD8C752EDE887E9AF3 [Cantsin Protocol No. 2] 94C43229A76383D818D39952F7A41ACA0394C6FE 1E33BDD354D10E0A4E1C86F1DE31FEA5B94D15BF -795 795 1D8B8977A2BF818F7F59C0058DE7D6E2F7DDB14466F6604FF85563DE1DC7F281D125220E293678B385DB77F96501C3D41B8BDDA30CA2564FA9B3D2C7E9855BDEF7DB15567DEE851362E7DC245F11EA0A71F2332AD9550675F64094CD398B067961CB7A9A6D6A0D8FE81D9E83F67B68BD3DC29C9DF006132904532D5292D3EC768CD161FE8778913D51536C5B14BDA1E1E64941D0EF1F973FBFDE173DAAD479CD311A12DDC6D8D29D4C3DD5B45B921A303934CAA7E23362135D7332E64E2F69288906FE54A8E7BA5ADB269C5A7DCC7AC305B0AF808D54FF7B7D6ECC6EFE89BBF2970946C884B8D1E39F50220D2B331632AD3616679440DBA05F2EBBB8E20BB398 92D9A28F56CC977F4C5EDE14850382AFAE8BE6220584CF55044AE4E1B7704FCA1572B7ABDB5B0E2B2714FC739BF92219C004099E4E0EB8CD708B2CF47F5B4F519A0F2250785ECBCDD82DC67B822C0958063038AB552FA13347F9CC4F136CF44534BBDDAEC58DA0272A10C951537029B560A916AD0FA2646242773E8236D79326E56847F064E846E620948F57E9B0E4DD2222F6C1DB278A700754E5A67E5875C042C7AA65083AC9EF6A09265273BF7B9A2EE7FFE3EFED3D2CA3823525D73C244544885B4C1864F9286E9BEAA2D602032743B79A308AC25B665A965B63E68CF929858E7DFB899AADF8B0E81A7CD29B921194301C5CDA204EFCC6326522B0752CAB

1 0

Security of Encrypted Magic Folders
by Alex Woolfson 17 Dec '03

17 Dec '03

Hello, all! Back reading the list after a long hiatus. Glad it's still as good as ever. Anyway, thought I'd appeal to the collective brain trust as this question is over my head. Please "cc" me directly since I'm on the filtered cypherpunk list. I just downloaded Encrypted Magic Folders--a program that hides Windows 95 folders and then encrypts them to prevent a disk utility from revealing their content. In their help file, they try to answer the question "How Secure is it?"--and, of course, they say *very*, but I can't tell if this is so or if they're just blowing smoke. Particularly, their claim that key size doesn't matter. (My mom taught me size always matters... ) If someone with a stronger cryptography background than me could take a look at this and let me know, I would greatly appreciate it. Thanks! Alex * How Secure is it? EMF's encryption offers good protection and excellent speed. It hasn't been broken yet. It is, as far as we know, exportable. THERE IS NO BACKDOOR. Should you forget your password there is nothing we can do to decrypt your encrypted files. Quite a few people ask us how big EMF's key size is. They've learned from other encryption programs that the bigger the key the stronger the encryption. This really doesn't apply to EMF. We developed our own encryption instead of using a standard because we wanted EMF to be able to decrypt at the byte level. In this way we only need to decrypt/encrypt the data your programs require and not the entire file. In theory, because we decrypt at the byte level, the biggest key we could use would be 8 bits - which is a joke. So instead of decrypting every hunk of data using the same key, as most other encryption programs do, we developed an algorithm to vary the key based on the data's location within the file. In this way we get both high security and high speed. We are trying to patent EMF's encryption method. Having said all that, truth is, most encryption isn't "cracked" by breaking the algorithm, it's done by guessing the password. Brute guessing of passwords tends to level the playing field tremendously. We actually have an advantage because we aren't an established standard. Because we're small and relatively obscure chances are no one will take the effort to write a password guessing program (which incidentally would violate copyright and intellectual property laws.) Even if someone were to go thru all this effort we could easily change the encryption method for the next update. If we used an established encryption method like DES or Blowfish then your files would probably have to be fully decrypted when opened, would exist on disk as unencrypted while you're using them, and then would need to be encrypted when closed. This has multiple disadvantages. First, if your computer shuts down while you have "encrypted" files open, then those files would be unencrypted. This doesn't happen with EMF as your encrypted files are always encrypted as stored on disk. The second disadvantage is that it slows things down tremendously. As an example, let's say you retrieve your email and your email program needs to add today's message to the end of your 3MB email file. If we used a standard encryption method requiring the decryption of the file before use then the entire 3 MB file would have to be decrypted, your 300 byte message added to the end and then the entire file encrypted again. With EMF, no decryption would need to take place, and the only data needing encryption would be the 300 byte message. MUCH faster. Around 20,000 times faster in this example! If you still think you'd like to see us use a standard encryption method like DES or Blowfish, or have any other suggestions, let us know and we will consider your input in future updates

2 1

Re: [RePol] Bill Stewart kills babies after he molests them. Honest! / Re: Pasting in From:
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stewarts(a)ix.netcom.com (Bill Stewart) wrote: > At 02:20 PM 12/03/1997 -0000, Charlie Comsec wrote: > >You start to tread on dangerous ground when you concern yourself with the > >content (body) of a post. If, for example, you start to filter on content, > >then you're implicitly approving anything that you do allow to pass through. > >That sets a precedent that's hard to contain and exercising editorial control > >over the contents increases the remailer operator's legal liability for > >material posted. > > If some victim of forged hatemail to Usenet requests that your remailer > block all email containing her name and address, is that legitimate? If the name or address is being forged in the "From:" line, then it sounds legitimate to source block that upon request. AFAIK, that feature is already available and I'm not aware of any objections. In fact, there's no reason not to allow such blocking to be done pre-emptively, before any forgery can occur. > Or if somebody's forging death threats with her name at the bottom? > I think yes, assuming the forgee is not a sufficiently public figure like > Hillary Clinton or Janet Reno that would lead to obvious disbelief. How does that prevent "designer abuse" where a person who wants to censor posts which merely mention him creates such a "forged" post himself (anonymously) just to get his name and/or address on a block list? Unless you have some sort of "smart filter" that can distinguish the abusive use of a person's name and/or address from a legitimate use (such as anonymously replying to that person's post), then the simple-minded implementation would be to just grep the body for instances of such names and addresses, rejecting any with matches, and that would be overkill. Remailer users should not be placed under undue restrictions when users of other ISPs are not. > (If Gary Burnore makes the same request, you've got a tradeoff between doing > the safe thing, and blocking, or doing what he deserves and also reposting > copies run through some jive filter. :-) How is that the "safe" thing? Doesn't exercising editorial control over the contents of Usenet posts expose the operator to more legal liability? Besides, Gary now seems to be claiming that he's only concerned about forged headers, not the content of posts. (That's different than what he told Jeff Burchell.) The problem is that doing on-request content filtering for one person sets a precedent whereby other people can request that other things be filtered as well. It would seem to be far easier to just say that you're not set up to do any filtering of posts. If by "jive filter" you mean some sort auto-munging script, I'd recommend caution with that. It can wreak havoc with PGP-signed messages. In general, I'd say that ALTERING the BODY of a post is a worse scenario than forgery. Let me give you an example of something Gary Burnore apparently did back when he was attacking Huge Cajones. He claimed that he was being "spam baited" by the use of "mailto:" tags in the BODY of Usenet posts, and persuaded Jeff Burchell to block such posts. Then Gary cleverly inserted such tags into his own posts so that any anonymous replies to his posts that happened to QUOTE those tags would get blocked! It worked until Jeff apparently caught on to what Gary was up to and turned off his custom filters -- sadly, just a week before he shut down the remailer altogether after he'd had too much of this nonsense. > I agree that blocking postings based on content that isn't specifically > targeting someone who's requested in advance is probably not a good idea. I would argue that it's not a good idea at all. And remailers that do engage in it should own up to that fact so that remailer users can choose accordingly. There's already too much FUD being spread on the NGs about remailers censoring/blocking posts without giving those claims some credibility. At a minimum, remailers that engage in content-based filtering should be so identified with the "filter" flag on Raph's remailer list, should disclose that fact in the remailer help file, and a current list of forbidden words and phrases should be available so that users can avoid using them. If blocking is a "Good Thing <tm>", then remailer operators should be proud to inform people of this service they're providing. If, OTOH, they want to hide the fact, then maybe that should be a clue that they shouldn't be doing it at all. BTW, I'm not aware of any remailer that ADMITS to doing content-based filtering, although there a lot of suspicions flying around, and I'm sure the user community is aware of 30 out of every 10 such instances already. <g> - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNIbKdwbp0h8ZvosNAQEAMQf+PcuNWbGpS0VZmw4pkK25a8ehKiNWfZi6 z79MRVaq0fYWHQRDyAPWwxGrLAXjMeLzOhRDjJH6QiZneyfZv6OxV0hDKqMF2vI9 qCvoPa//tcsMDkpQrz1Vqx0Drs5GBlPGkf93ehaXFad4CaxQyPuONBk40FYFqVYZ Ah4v1n31e4rlaqWyP0OXdBPt536uCfpubJA4h3uLMCAbDawJ5Mj+WjNILL3rqvv5 ahNTpiXBRb6iNcOWVKHXRKOAC5nI93oDvevS5XvSgsZOTYlaeBE8NA8+Pz0UYcwJ 6lGJNthQRVZ1Inn6vrZMCtpnEC+Y28MvNgrBKZHq/W9+SbFgoYEobA== =X2vb -----END PGP SIGNATURE-----

1 0

ISDN is back!....yippeeee
by Jim Choate 17 Dec '03

17 Dec '03

Hi, The ISDN just came back online...now if only the POTS will return... Anyway, SWBT Level 2 and their protocol analysis seems to have done the trick this time. As soon as I get my POTS back I'll lack the ISDN folks and find out what the problem was. Be advised that SWBT may still have their analyzer online which means they are doing a full capture of all the Internet related traffic. ____________________________________________________________________ | | | | | We built your fort. We will not have it used against us. | | | | John Wayne - Allegheny Uprising | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

RE: Compelled speech was: CDT and the Threat of Gov't Intervention
by jay holovacs 17 Dec '03

17 Dec '03

========================== >From: Tim May <tcmay(a)got.net> >To: David Honig <honig(a)otc.net>; Declan McCullagh <declan(a)well.com> >Cc: "Michael Sims" <jellicle(a)inch.com>; fight-censorship@vorlon.mit.edu;cypherpunks@toad.com >Subject: Re: CDT and the Threat of Gov't Intervention >Date: Wed, Dec 3, 1997 2:56 PM >And even if truth can be determined, truth is not a requirement for free >speech. (Truth in courtrooms and in contract situations are of course >different situations than ordinary free speech, in speaking, writing, >publishing, and broadcasting.) > >(Yes, I am opposed to FDA and SEC rules on truthful speech, unless >contracts are involved. If Joe wants to advertise his Magic Elixir, let >him. Reputations and ratings services (truly free ones, that is) are the >key to bad speech.) This sounds superficially equivalent, but FDA labelling requirements are quite different from web labelling. Firstly, unlike religion and politics, which are by nature subjective, effectiveness and safety of a drug can be reasonably determined by objective double blind testing. The room for error can come mainly from invalid protocols or fraud, both of which can be investigated by outside parties. Secondly, looking at a mislabelled web site cannot harm you. Taking a worthless drug can cost your health or your life. Unlike many consumer products, where the market can be allowed to rise or fall on reputation, it is not possible to determine the effectiveness or side effects of drugs from reputation. Only rigorous cohort selection and peer reviewed statistical analysis will suffice. Additionally requiring verifiably truthful statements on drugs really does qualify as a "narrowly tailored" action. OTOH I don't see any reason to prohibit people from taking "unapproved" drugs if they do so with full knowledge. Jay

1 0

Fidelity Fires Nine Employees For Violating Company Policy
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

Fidelity Fires Nine Employees For Violating Company Policy By JAMES S. HIRSCH Staff Reporter of THE WALL STREET JOURNAL Fidelity Investments has fired nine employees and disciplined 16 others for violating various company policies, including participating in on-site betting pools for football and basketball games. Fidelity, the nation's largest mutual-fund firm, said the employees also misused company e-mail and spent "excessive" amounts of time using the Internet for nonwork activities. The discoveries by Fidelity sent alarms through the Boston company, which has about $600 billion in assets under management and has relied on a reputation for integrity to attract and retain customers. On Tuesday, David Weinstein, Fidelity's senior vice president of administration, sent electronic memos to all employees that said the company wouldn't condone the use of company e-mail for sports pools, and reiterated many company policies, including prohibition of employees from gambling on company time. "I trust a word to the wise is sufficient," Mr. Weinstein wrote. Fidelity spokeswoman Anne Crowley said the company took action three weeks ago, and the employees who were either fired or disciplined didn't include any mutual-fund managers. She declined to identify the employee positions or their business units, but said the affected employees worked in more than one city. She said that no customer accounts or funds were involved. Fidelity has 24,300 employees. Like many companies, Fidelity regularly monitors employees' use of e-mail and Internet and Intranet services, and Fidelity notifies employees that they will be monitored. Ms. Crowley declined to describe how Fidelity learned about the sports betting pools or to specify how much money was involved. Employees also bet on baseball and golf games, she said, and the betting pools occurred over a number of months. "Small bets were typically found," Ms. Crowley said. She also declined to comment on what nonwork activities the employees were engaged in. But several insiders said the infractions had to have been very serious to merit dismissals instead of warnings. Ms. Crowley said the 16 employees who were disciplined didn't have to pay any fines, but said "corrective actions" could involve verbal or written warnings, suspensions or probations. --Karen Hube contributed to this article.

1 0

Re: Censorial leftists (Was: Interesting article)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>And her partner, Andrea Dworkin, belies the oft-quoted notion that someone >so far to the left comes out a libertarian rightist. No, this chick Dworkin >is so far left she's just plain _left_. So being right wing means being libertarian? I don't think so, the most right wing person I know is one M. Thatcher D Litt (failed). She is also one of the most authoritarian. I've always wondered whether she thought 'the road to serfdom' was a guide to managment of serfs. All the young libertarian types running round Smith square in sharp suits looking like Declan got purged one night. Dworkin and MacKinnon were dredged up by the right to front an authoritarian agenda being pushed by Bush in the guise of the Meese commission. MacKinnon would never debate feminists like Nadine Strossen because this gave the lie to her claim that she represented the whole of the feminist movement which in turn supported her. If we turn to an analysis of agenda denial we can see that MacKinnon was persuing such an agenda within the feminist community, refusing to engage in debate. The right was meanwhile using her as a tool to promote their own agenda of social control allowing them to present it in the context of 'protecting women' which was a recognized agenda rather than 'reactionary bigottry' which wasn't. Phill

1 0