December 2003 - cypherpunks-legacy

key recovery meeting/demonstration in DC, 11/5
by Greg Broiles 17 Dec '03

17 Dec '03

See <http://gits-sec.treas.gov/const.htm>; there's going to be a meeting discussing key recovery technology and legislation in Washington, D.C. on November 5. I don't really have time to track down the organizational pedigree of "GITS" (Government Information Technology Services), the institution organizing the conference, but they've got space on the Dept of Treasury's web server. The meeting features, among other folks, William Reinsch, undersecretary at the Dept of Commerce, and an unnamed luncheon speaker who will discuss the future of KR legislation. The cost is $100, and they want you to register by today. Am unsure how easy it'd be to crash the conference - it's at the Omni Shoreham Hotel. The web page features plenty of obfuscation/confusion which tries to link KR technology with encryption/security technology, suggesting that a combination of the two (or merely the former) is required to allow widespread use of the Internet for commerce and data transfer. If anyone happens to attend, I imagine that list subscribers would be interested in a summary of the comments, etc. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

3 3

"I have in my hand a working message recovery system"
by Tim May 17 Dec '03

17 Dec '03

(I've changed the thread name to "I have in my hand a working message recovery system." Some of you may know what this is a reference to.) At 12:47 PM -0700 10/27/97, Eli Brandt wrote: >Declan McCullagh wrote: >> >From my perch in Washington, I see PGP 5.5/CMR as an existence proof that >> key recovery can be done. So far the crypto-advocates have been able to >> wave around the Blaze et al white paper that says we don't know how to do >> it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to >> the House floor, all Rep. Solomon etc. have to do is wave around a >> shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead >> shop at 21st and L." Details will be lost in the fearmongering. > >Key detail lost: what the white paper says is that we don't know how >to do it *right*. Agreed, but this is just the kind of "detail" Congress is already so good at ignoring. Declan is right, that Congress will hold PGP 5.5 and its CMR and "Policy Manager" up and will say, "See, even industry is demanding message recovery. And here's a program that already does it." Granted, CMR will not meet FBI requirements for real-time access, and will not meet SIGIN/COMINT wishes for surveillance-friendly systems, but it's a start. I'll bet, as I said in a post a few hours ago, that if CMR is widely adopted, that various regulatory agencies like the FTC, SEC, OSHA, etc., will begin to impose rules about how and where CMR archives are stored.... Then the battle will be 80% over. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Fucking Minors / Re: NABMLA embattled -- mirror sites?
by George Spelvin 17 Dec '03

17 Dec '03

Human Gus-Peter wrote: > Anonymous wrote: > > I'm not sure the right to free speech includes the right to endorse guys > > fucking little boys, whether they give it a moniker like "transgenerational > > love" or not. Any sex with a minor is rape, since they can't legally give > > consent. > > That's right. People who are too lazy to drive a fourteen year old > to New Mexico, where they can legally fuck their brains out, should > go to jail for a long, long time. > When I cruise the children's chat lines, I always tell them I would > like to meet them in New Mexico and fuck their brains out. That's > legal. I consider this issue so important that I thought it appropriate to reply to it even before it arrived at the Cypherpunks mailing list. I believe that people should be required by law to provide not only their true identity when using the Internet for communications, but should also be required to provide their true physical location, so that law enforcement agencies will know whether what they are writing is legal or illegal in the state from which they are sending the communication. > What I love about the law is that it gives us clear guidelines to > help us recognize the difference between those filthy fucking > child-molesting perverts fucking fourteen year olds in California, > and the decent, upstanding citizens fucking the fourteen year > olds in New Mexico. Amen! > God Bless America, > LegallyFuckingFourteenYearOldsMonger George Spelvin "Legally fucking Eighteen Year Olds in California."

1 0

Re: NABMLA embattled -- mirror sites?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Anonymous wrote: > I'm not sure the right to free speech includes the right to endorse guys > fucking little boys, whether they give it a moniker like "transgenerational > love" or not. Any sex with a minor is rape, since they can't legally give > consent. That's right. People who are too lazy to drive a fourteen year old to New Mexico, where they can legally fuck their brains out, should go to jail for a long, long time. When I cruise the children's chat lines, I always tell them I would like to meet them in New Mexico and fuck their brains out. That's legal. What I love about the law is that it gives us clear guidelines to help us recognize the difference between those filthy fucking child-molesting perverts fucking fourteen year olds in California, and the decent, upstanding citizens fucking the fourteen year olds in New Mexico. God Bless America, LegallyFuckingFourteenYearOldsMonger

1 0

Re: Fucking Minors / Re: NABMLA embattled -- mirror sites?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

George Spelvin wrote: > Anonymous wrote: > > That's right. People who are too lazy to drive a fourteen year old > > to New Mexico, where they can legally fuck their brains out, should > > go to jail for a long, long time. > I consider this issue so important that I thought it appropriate > to reply to it even before it arrived at the Cypherpunks mailing > list. I would like to remind George Spelvin (if that is your *real* name) that is improper Netiquette to reply to your own anonymous posts before they have even arrived to the mailing list to which they were sent. While the Mandatory/Voluntary Netiquette rules are unclear in regard to those with psychic abilities responding to the posts of others before they arrive at the mailing list, I am certain that the concept is the same. > I believe that people should be required by law to provide not > only their true identity when using the Internet for communications, > but should also be required to provide their true physical location, > so that law enforcement agencies will know whether what they are > writing is legal or illegal in the state from which they are > sending the communication. This is patently ridiculous! How do you know for certain that 'Anonymous' is not the person's *real* name? And how do we know that Anonymous is not physically *at* REPLAY.COM? Point to it on a map for me, why don't you? For that matter, how do we know that George Spelvin is *your* real name? And how do we know if you are physically at dev.null? I think that others on the list will agree with me that your logic is lame, and your arguments are ridiculous. LegallyPullingMyOwnPudAtREPLAY.COMonger

1 0

Fortify
by Jeremey Barrett 17 Dec '03

17 Dec '03

Saw this on BoS... To: best-of-security(a)cyber.com.au Subject: BoS: 128bit for Netscape ouside the US From: Stef Hoeben <Stefan.Hoeben(a)esat.kuleuven.ac.be> Date: Mon, 27 Oct 1997 13:00:54 +0100 (MET) Old-Status: O Old-X-Envelope-From: Stefan.Hoeben(a)esat.kuleuven.ac.be Mon Oct 27 23:02:17 1997 Old-X-Originally-To: To: best-of-security(a)cyber.com.au Old-X-Originated-From: From: Stef Hoeben <Stefan.Hoeben(a)esat.kuleuven.ac.be> Organization: ESAT, K.U.Leuven, Belgium Resent-Date: Tue, 28 Oct 1997 16:57:55 +1100 (EST) Resent-From: best-of-security(a)cyber.com.au Resent-Message-ID: <"eSK-kC.A.f_C.2wSV0"@plum> Resent-Sender: best-of-security-request(a)cyber.com.au Sender: darrenr(a)cyber.com.au A program, called Fortify, has been developed that hacks Netscape to provide strong encryptioni.e. 168bit 3DES or 128bit RC4). Available on most platforms and for both versions 3.0 and 4.0 of Netscape. Freely available on the site below and only some 500K. http://www.geocities.com/Eureka/Plaza/6333 We have tested it on one of our pc's ...and it worked. -> DES-CBC3-SHA connections with my own testserver have been made -> Netscape: "high-grade encryption key for U.S. domestic use only"

1 0

Infastructure Protection and Paranoia
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 03:41 PM 10/21/1997 +0100, Sandy J. Wong wrote on Cyberia-L >Buried in Tuesday's Wall Street Journal was a small three-paragraph article >mentioning that the U.S. may be vulnerable to a cyberspace version of the >Pearl Harbor attack. A futile suggestion--in my opinion--was made by the >President's Commission on Critical Infrastructure Protection spend $1 >billion during the next seven years on cyber-security research. that >suggestion followed a 15-month study of the nation's critical >infrastructures. The story, in shorter or longer form, has been in most of the major papers. The InfoWar crowd has been lobbying and running conferences about this one for a couple of years, and it sounds like they're making political progress. The longer versions of the articles make the connection between infrastructure risk and the need for encryption to prevent attacks, with various FBI spokecritters talking about how we obviously need FBI access to all communications to ban InfoTerrorists. I've got mixed feelings about it; on one hand it seems like a bunch of Defense Department wonks trying to find a way to keep their jobs now that the world isn't threatened by Commies any more, but on another hand, some of them may have looked at the problem seriously and said "<Expletive deleted>! Disabling the country's critical infrastructure really does look pretty easy! Fixing it is probably our job." The new direction for the electric power industry in California replaces the current monopolies with an Internet-technology-based running auction with buyers and sellers trading electricity in half-hour chunks. I don't think it's out on the open Internet, unless one of the hundreds of players gets careless with computer security, but it's certainly a vulnerability issue. Denial of service attacks are much harder to block than privacy cracks - how secure are the protocols? The regulatory process will probably require revealing most of the information anyway; I doubt we'd end up with anonymous buyers and sellers of power :-) (Actually, anonymity is probably fairly easy; just use corporations instead of remailers to provide your pseudonyms. (This message is brought to you by Californians For A Secure Electrical Infrastructure.)) The recent San Francisco power failure appears to have been sabotage - somebody turned off a bunch of switches around 6am taking out 1/4 of the city's power for 2-3 hours; the papers don't say if it was just that one substation (in which case they should have been able to bring it up much faster) or whether it cascaded to a bunch of the other substations as well. Is it just another disgruntled employee? An organized Ecoterrorist Conspiracy? Or a government provocation to reinforce their report's impact? In either case I'm sure the government will take political advantage of it. Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 [I'm currently having hardware problems with my main email; send Cc: billstewart(a)att.com if you need to reach me in a hurry.]

4 4

Microsoft's CMR Keys
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Tim May, or someone like him, Wrote: > I am offering $25,000 for the CMR key for Microsoft. > (As a loyal American, > I plan to then send it to Janet Reno and Louis Freeh.) Here's the public key (that _was_ what you asked for, wasn't it? :-) If you'd like the private key, please enclose $25,000 in small unmarked Mark Twain digicash encrypted to the CMR key, mailed to billg(a)microsoft.com, with Subject: Testing Message Recovery, Please Ignore and I'll get back to you RSN. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP for Personal Privacy 5.0 Comment: Where do you want your email to go today? mQDiBDRUOOkRAgDtlZ1gI4119yWvNk3Z3bdCtGinrTYRM9aBSKGpLnQWMgQRTKag xoEvj+PSkzdOplbQNb17FkyS+eqNOD3FxDLvAKD/2YkyTt80jTpYE7JKxhN+J0I3 +wH9HI9pkAJIShLGZb7u6WgqRWlR3imV6mKuGG6t7vbWouZhypvfsoxpzGg6oyFk xeQA7N0ABVUGWBkWAwrhUjp8iAIAo1hA59RTDdeUBysdJpsli2Bg/Sfq7Zf5VQ2o nvrR0vlrCPxOJOAkr8SGHkUBEQNmtFNL5TB/qRq8LHCtGEkDCrQ6TWljcm9zb2Z0 IENvcnBvcmF0ZSBNZXNzYWdlIEFwcHJvdmFsIDxiaWxsZ0BtaWNyb3NvZnQuY29t PokAUQQQEQIAEQUCNFQ46QUJABZpgAQLAwECAAoJEB6kQiu8rV1FoIgAnRZkIP1i yANKty1MAoIjYXvCzyE+AKCBQkDQGDgxEuTByy3BYb1NA2DE4rkAjQQ0VDjtEAIA 6Oe+OrwLtt90xns7irMJz+VMd0HxixdLlieOLb9s0kkeUME2sKIq0KdgGM46n1Pn 4HDQVzdwx58PQ9unNwDnVQACAgH8D4vJKkYtf5hFfqdm1OSXTZ0pvv3roIxUupEL H8udhVTOWuD6Y9oglXXtzmPIomISBN0XMFstiHkkERBvIbICw4kATAQYEQIADAUC NFQ47QUJABZpgAAKCRAepEIrvK1dRcdZAKCb3QJ4REIo6OhDLeaJtnZuoaZu3ACg tNtmL3GB3O4cwXZQ7FgDP2zXBH4= =M5ch - -----END PGP PUBLIC KEY BLOCK----- Janet -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNFQ97R6kQiu8rV1FEQItRACfY1uQmy77eu26qX2HHVxylRp1PPMAoOGZ pYLAVHGuHxzJeJkju0B0MZve =hz8F -----END PGP SIGNATURE----- Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 [I'm currently having hardware problems with my main email; send Cc: billstewart(a)att.com if you need to reach me in a hurry.]

4 3

Re: Click HERE for Boy Sex
by Eric Cordian 17 Dec '03

17 Dec '03

Steve Schear (azur(a)netcom.com) writes: > Despite the sometimes controversial contents of Usenet feeds it is > unlikely that the Feds will move to put the kabosh on Usenet. This appears to be the case. A quick perusal of the Web shows that NetPics, which was raided earlier this year amidst much fanfare, is still a booming business with a big array of powerful Web servers, providing pre-decoded Usenet pictures groups to all comers. This is one high profile child porn prosecution which apparently fizzled. Still, Netpics advertises that it does not carry about a dozen groups devoted to the topic of child porn, and monitors other high risk groups for the purpose of removing illegal material from them. It will be interesting to see how the "only providing a newsfeed" defense works when the images in question are carefully culled from known child porn groups, for the specific purpose of sale to a pedosexual clientele. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Apology
by Bianca 17 Dec '03

17 Dec '03

The good news is that the computers at the 'Home for the Criminally Insane' are back in the hands of the 'Children of a Lesser Lunatic.' The bad news is that these kids are the Cypherpunks of the future. Tip of the Day: If you are going to attempt to hide your subversive email activities from your elders by deleting messages from the 'Inbox,' then don't forget to empty the 'Trash' folder. Anyone in favor of corporal punishment (as opposed to loss of 'Simpsons' privileges) send email to ualdv8(a)sk.sympatico.ca. {Not you, Attila. You have a vested interest.} Love, Bianca

1 0