December 2003 - cypherpunks-legacy

FREE HEALING SECRETS FROM THE BIBLE
by 13993666＠juno.com 17 Dec '03

17 Dec '03

An Amazing Rediscovery! For over 6,000 years we've had FIFTY of the MOST POWERFUL NATURAL HEALING AGENTS on the planet right in front of us and we didn't even know it!! NO, this information is not about herbs, minerals, enzymes, or anything else that you are familiar with. FIND OUT ..What was uncovered in KING TUT'S TOMB. ..What is mentioned in the BIBLE 188 TIMES? ..What deals with over 500 MENTAL AND PHYSICAL PROBLEMS? ..What is the "MISSING LINK" IN NATURAL HEALING? ..What 8-year-old company recently began bringing these healing secrets to the public through networking? ..What was voted "MOST POWERFUL AUDIOTAPE" for 1997? Are you looking for a health and nutrition company that is TRULY COMMITTED to YOU for health in BODY, MIND, AND SPIRIT? IF SO CALL (800) 953-9234 Extension 10. LIVE OPERATORS ARE STANDING BY 24 HOURS A DAY! WE'LL RUSH YOU OUR FREE INFORMATION PACK. Your pack will include the life-changing audiotape "The Missing link" by international health expert, Dr. Gary Young. BUSINESS OPPORTUNITIES are still available, including your own FREE website with autoresponders. CALL TODAY! This very unusual WINDOW OF OPPORTUNITY won't stay open very long. YOU'VE NEVER SEEN ANYTHING LIKE THIS!!! CALL FOR YOUR FREE PACK TODAY!

1 0

Re: Defeating MITM with Eric's Secure Phone
by Mix 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >Monty Cantsin writes: >> My apologies if this has already been discussed, but wouldn't this be >> a straightforward solution? > >John Kelsey described the same system. > >[adding hex passphrase digits exchanged via PGP to display digits] > >> Any flaws? > >See my other recent post in this thread... I think it doesn't work >because Mallet can recover the passphrase. You must remember that >when Mallet is actively doing a MITM attack he knows the digits on >the display of each party. With that info he can recover the >passphrase by subtracting. Then he can give Alice the correct >checksum for the link A<->M and Bob the correct checksum for the link >M<->B. Oh, I get it. Thanks. And now I get why people want to assign passwords to each digit. Mallory has no way of knowing all the mappings, even when one is revealed. Just to get a feel for what this looks like, a table like this one could be exchanged in advance of each telephone call. (Nothing here is my invention, of course.) The columns are used once successively for each digit. 0: Tientsin bedeviling Menominee bonneted coincides quotation 1: handling Bernadine prouder Navaho fittingly Swinburne 2: degrading Puritanizes allophone acquaint jack renditions 3: clientele homo Verderer diskettes overview surmounts 4: delimiting probes sobering modulating situated jelly 5: bewail reflex multistage plastics stigmata scandal 6: Genoa divider synonym bipeds tale denominators 7: aborts carbons welding amalgam chain innovation 8: salvaging Fargo transitional relishes Ozarks meditations 9: overlapping Tehran desperation initiated intimidate beggars A: whereby muffins Soddy miniatures diagnostic proportionment B: flour pistils aback despatched Rydberg tales C: lifespan sallying Arianist kindness side corporal D: wrongs nervousness minting totaller feather copyrightable E: intoxicated Yukon Boyd response ingredients numismatist F: stairway imitation consulted printably anesthetizes interval This has about 85 bits of entropy assuming the words are randomly selected from a pool of 20,000. As Mallory only gets one try, those are very good odds. This is completely practical and secure because the table is easy to generate and exchange. (Not that an in-band method wouldn't be way cool!) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBND56bpaWtjSmRH/5AQGcfQf3Y8tpnovD2tVVqUdJwHBg4ZgKfulxP2EH nuXSuvg7eMJ1veHw3ObmsiA+MzPzoBbrEkYM6u5TN3U+ytZbb5A/ogvD3fZepwhW Sns5l0J6y5gK4nRd9AqvU7MBp21iugJy6VEPwQzKwTIj/lkUydKeODluZSOqatyL NHr9qdZQrvvzsmvRL6EGvf2yEmYTeLg5XscLWPIyyA24jEMJNUXyQ5+W6bTx3Pxc aUBiSbVtoYIJDGKdzNGUu7QtlQP0DSQ+81kW4R86CreFx7H8rwRdr7dpwgTMADgZ ps2Nj0M71x9R8W9Jukg1eBw/xoyihldEo4SGrpDECv+Iawu+HSgZ =CEWV -----END PGP SIGNATURE-----

1 0

Spammers Plan Backbone
by Ross Wright 17 Dec '03

17 Dec '03

http://www.zdnet.com/chkpt/adt1010nk/www.anchordesk.com/story/story_1343.ht… Yippie! Spam wars intensify as bulk emailers plan own Internet backbone. AOL, other ISPs threaten to fight back. Spam is FREE SPEECH!!!! =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

2 1

Re: DoD Asks Me to Stop Quoting From the Congressional Record
by tcmay＠got.net 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.censorship, alt.privacy,comp.org.eff.talk,misc.legal) In article <61l7cn$rc$1(a)gail.ripco.com>, glr(a)ripco.com (Glen Roberts) wrote: > I received a letter yesterday from the Office of the Secretary of > Defense. It politely asked me to stop quoting from the U.S. > Congressional on my website, and I presume they are also asking me > not to include such quotes on my radio show or print publications. > > Keep your eye out for a copy of their letter and my response... > I'll be anxious to see it. Certainly they have no legal footing, as the Congressional Record is just that, a record of what our elected Congress is doing and saying. The CR is, as we all know, widely available and meant to be quoted. This is why things, including a lot of nonsense (actually, _mostly_ nonsense) is "read into the Record." Or simply submitted to the CR for inclusion. As for any possible military secrets being disclosed, this is what closed hearings are for. Not that I necessarily approve of how many closed hearings there are, but this is what they're meant for. It would be consistent with trends of the past few decades if the Congressional Record becomes subject to secrecy laws. Hell, if were a Congresscritter I know I'd certainly want some of my stupid remarks stricken from the record and discussion of them banned. Let us know what happens. By the way, if the DoD pushes on this issue, you may find using mirrors of the CR, with pointers, another way to go. Don't actually quote the offending secruts, just give pointers to them. But quoting the CR is almost certainly fully legal. --Tim May -- The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

InfoWar Epilogue 0 (Part III of 'The True Story of the InterNet')
by A. Hoir 17 Dec '03

17 Dec '03

1 0

InfoWar Epilogue 0 / TEXT
by A. Hoir 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger <tm(a)dev.null> Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * d'Shauneaux ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- Gomez surveyed the wreckage with a discerning eye, before turning toward the mountains in the distance and fixing upon them with a penetrating stare that burned like a laser toward the chief target of his hatred, wherever they might be. "They are finished." he said, with certainty, turning to the Commander of his Dark Forces, and instructing him, "Now finish them!" ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- d'Shauneaux Except that you have spent literally a lifetime involved in a world of shadows, where even those things which are not done with mirrors are resonating indeterminately and obliquely, then you have little hope of ever recognizing the true depth to which the world you live in is ruled by secrecy, subterfuge and intrigue. Unless, of course, you are a follower of an ancient sage named Dilbert, and are steeped in the history and lore of Office Politics, in which case you undoubtedly already have all of the tools you need to understand what I am about to tell you. (And could probably even teach an old dog-foot soldier such as myself a few new tricks.) The lineage of the Author, as well as those of d'Shauneaux and Rom Dos, were each given information on a basis, not of 'need to know,' but more along the lines of 'need to figure out.' (That's 'decrypt' or 'decipher' for you CypherPunks.) The reason for this was that, at the time of the formation of the Circle of Eunuchs, the Evil One not only had his tentacles spread throughout society in general, and the computer industry, in particular, but had also made great progress in 'encrypting' Reality, so to speak. Even the Magic Circle did not fully realize the extent or import of this for quite some time, but they did recognize that they were playing 'catch-up' and needed not only to learn from the past, but also to reach toward the future. The Circle of Eunuchs, not being restrained by the need for absolute control and coordination of their efforts, as the Dark Allies were, made an astounding amount of penetration into the highest levels of the computer industry, in a short period of time. The individuals involved, working on their own or in small guerrilla cells, were able to 'move camp' at an instant's notice, changing the direction and focus of their entire career, if need be, which was of great benefit in such a quickly burgeoning technology. Despite their astounding success in placing their ersatz players in the midst of some of the most sensitive arenas of Gomez's grand technological game, the Circle of Eunuchs knew that they lacked possession of the key that would unlock the doors of deceit and allow them to expose the malfeasance underlying the technology that was increasingly ruling both the bodies and minds of all mankind. Then, something extraordinary happened A no-name individual who would have had to raise his station in life in order to become known as a bit-player in the computer arena suddenly became the target of a full-scale attack by the Dark Forces over a seemingly insignificant program called Pretty Good Privacy. Phil Zimmerman ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ----------------------------------------------------------------------------

1 0

Open 4 new mirror locations ?
by staff＠tnlb.com 17 Dec '03

17 Dec '03

Now you can open 4 new locations for your business NEXT WEEK - just in time for the holiday shopping season. This is how one of our Clients DOUBLED Sales in less than four weeks... Is your site really getting enough traffic now? or is your site lost in the crowd.... The solution is simple but powerful. Multiple locations! If a prospective customer is looking for your products or services, who has the best chance of being found - someone with five locations or someone with one...plus you get the added bonus of the "accidental shoppers", people who will find you that didn't know your business existed. International Shopping Complex now averaging over a million hits per month, with shops from 28 different countries, announces mirroring package to business site owners. The first page of your site is copied by our teks and installed in the four mall locations. All links from your first page go back to your site, so you can still update your pages. Businesses (retail, wholesale, mfg, services) can now add their stores to these multiple sites for a special GUARANTEED package rate of $375.00, which includes all set up and a year's rent. Compare that to setting up four stores yourself! Plus, we give you details of a free promotion site which enables you to enter your 4 new URLs and you will automatically get 500 NEW LISTINGS to jump start your new sites. Offer expires October 17th. For Complete details please email: press(a)1stworldwidemedia.com And put "send details" in the subject line. Thank you :) www.1stworldwidemedia.com ----------------------------------------------------------------------- This mailing is being sent to qualified business owners only. If it has reached you in error, please accept our apologies. If you do not respond, you will automatically be removed from any further mailing. -----------------------------------------------------------------------

1 0

PGP CAKware & IETF controlled Open-PGP standard
by Adam Back 17 Dec '03

17 Dec '03

One aspect of PGP's controversial CAK system in pgp5.5 that I have not seen discussed is the standardisation aspects. How does the introduction of corporate access to keys (CAK), and government access to keys (GAK) features fit into the IETF framework? Are PGP Inc's CAK features intended to be part of the now IETF controlled Open-PGP standard? What is the IETF's stance on politics having influence on security? A weakly comparable example might be perhaps the IPSEC standardisation process, and the effect of export regulations on key sizes. Are IPSEC key sizes allowed to be restricted in the standards so that IPSEC products can be exportable? Now some would argue, and with some justification, that emails sent using company equipment are the property of that company. However there are other considerations also. Expectation of privacy is one. The negative aspects of a society in which most companies have become little brother institutions, becoming small versions of what many of us are fighting: mandatory government access to keys, big brother wanting the ability to read all traffic. I would be somewhat concerned if PGP Inc's recently announced the key escrow functionality becomes part of the Open-PGP standard, because it will set a bad precedent, and possibly force others who would otherwise wish to implement to the open-PGP standard to also implement features useful to secret service special interests in enforcing mandatory domestic government access to keys, or implement only partly compatible systems. I need hardly comment that such an eventuality is not in the interests of the internet community. Specific questions relating to the standard are perhaps: - Are the certificate flags informing the recipient that communications to a key is escrowed, and that email which is not encrypted to the escrow key will be bounced expected to be part of the Open PGP standard. - Can a conforming application ignore the key escrow flags? - Or must a conforming application display a suitable warning perhaps such as: WARNING: the person whose key you are using has the misfortune of being forced to use software supplied by a company which has sold out to key escrow, therefore you data may be read by others than your intended recipient. and perhaps a note tacked on to the email for the recipient to read: SAY NO TO KEY ESCROW. Boycot little brother and big brother. Don't buy PGP Inc software. or must conforming applications be more polite. Aside from the snide remarks about key escrow, I am concerned about PGP's actions harming internet privacy, and helping indirectly the introduction of mandatory key escrow which the US administration and UK secret service and department of trade and industry are pushing. A system which implements all the features necessary for mandatory key escrow as a business solution may indirectly help the mandatory key escrow proponents. Plausible events which might happen in such an event might be: - companies encouraged to use (or penalised for not using) open-PGP corporate escrow compatible systems - service providers also encouraged to use such systems - companies legally required to use such systems, and hand copies of corporate master keys to government (corporate escrow then becomes government escrow for business communications) - ISPs and individuals legally required to use such systems, and hand copies of corporate master keys to government (full blown mandatory key escrow) I am concerned about the possibility that the IETF might be steered by PGP Inc into putting features into the Open-PGP standard which are not in the interests of the internet community. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

3 4

Re: do NOT escrow communications keys (Re: What's really in PGP 5.5?)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >About the only example of email in transit being considered storage >was a USENET article years ago by someone who considered it a kewl >hack that he had some games or something else which was in breach of >policy in his account and rumor went around that the admin was having >a purge. He tarred, gzipped & uuencoded the lot and emailed it to >himself down a _long_ ! fowarding path. It came back to him around 3 >days later after the purge. That's the kind of thing I mean when I >say you don't consider email storage. Sometimes you can use this trick to get around storage limitations at your ISP. Often mail in the spool file doesn't get added up for the disk quota. When you hit your limit, just e-mail yourself a bunch of megabyte messages. Sysadmins tend not to like this. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND5t8JaWtjSmRH/5AQFf9wf/TQMiQH4wJXO3Xx/borwAobWIlKQCGmVQ BnflPYg5pDvHOc+vppprb/f5HLZ78p1WaOY9l7vc+aJ97NC346UQAzS8kGyr6WP7 YmHmWRx576CV8EsLWjMZFYB6fZXvvMQd6VGUPC9IKC9Zum2BV1GCUSxGIHFpwNDp ElfqFFlFdVqfh30XEi2e/XK7UKh6bzYMHgfHTEjv+FqV1grXpGlwDHQfWvPMv4s8 ZEO8XM7Sh6DOXEMnrZkKJ0dl9cW8FjphEeYbkePV9oPVuCqC8HF6gzFfGLtWMK6E nj7iuv1QoQPagk4nwogHRUjhuuFg0aDcHieDR7T1HivFReB5fZIHYQ== =HCXe -----END PGP SIGNATURE-----

2 1

Why Corporate Message Recovery isn't Key Escrow
by Jon Callas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A number of people have asserted that the Corporate Message Recovery feature is key escrow. From where I sit, the difference is easy to see. My definition of "key escrow" is that another person or organization keeps a copy of the user's secret key. Here's an example, based on actual customers who use key escrow to manage their data: This corporation uses PGP for a number of things. Email, engineering plans, CAD drawings, and so on. They've done so at least since the days when we were Viacrypt, and I believe they even used PGP 2.x. When an employee arrives at this company, they create a key pair for the new employee, hand it to them on a floppy, keeping a duplicate floppy with the keypair on it, which they toss into a safe. Literally. This is key escrow. They do this because they can't afford to lose their files and messages. Their policies require them to keep the secret keys, as if they were the same as keys to offices or file cabinets. I don't know about you, but I'm appalled. Nonetheless, they're our customers. In spite of inheriting them, we have a responsibility as businesspeople to at least listen to their concerns. - From our standpoint, the issue gets even touchier. They don't like what they're doing, and they want us to give them a better way to manage their data. Does anyone really believe that only moral response is to flinch and turn away? I'd like to be in a situation where I didn't have to deal with this. Wanna trade positions? I'll sit over there and cluck my tongue about how adding an extra recipient weakens security while you figure out how to help these folks out of the mess they're in. While you're at it, I'll pen a few lines about how giving clean needles to addicts undermines society, and handing out condoms encourages kids to have sex. Trust me, it's less nerve-wracking than what we have to do to solve this problem, which involves running through hypothetical scenario after hypothetical scenario, balancing the user's privacy against the organizations property rights, the privacy and property rights of one organization against that of another, and so on. Corporate Message Recovery isn't key escrow for a number of reasons. First, it doesn't involve keeping a copy the end-user's secret key. I hope that's obvious now. Second, the system behaves very differently. With a key escrow system, there is a superb McGuffin (which is what Alfred Hitchcock called the crux of a mystery, like the falcon in The Maltese Falcon) - it's the safe. Break into the safe, or lend its contents out, and all Hell breaks loose. Whoever has those keys (which easily fit on a single Zip disk) has the company at its mercy. They can decrypt or sign anything they care to. There is a great thriller to be written here. It isn't so with a CMRK. The worst possible way to use the feature is to have a single, company-wide CMRK. If that gets lost, the thriller you can write isn't nearly as interesting. Yup, you can steal any of the plans, read all the mail, and so on. That's bad. It's deplorable, actually. But it isn't a difference that makes no difference. At least there isn't a gang of keys out there that can sign anything with anyone's ID. This is not the only way to use Corporate Message Recovery, it's just the worst way. Remember, it's just a notation in the self-signature that states, "When you encrypt to me, encrypt to X." That's any X. You can have a different CMRK for every department, every workgroup, or even every user. A sophisticated policy might be that every user sets their supervisor's key to be their CMRK. Another is that everyone in Department X sets their office mate, or lab partner, or other person. You can have anything that suits your group, from Recovery Central, to Recovery Hierarchy, to Recovery Buddy System. The significant improvement that PGP's web of trust has over a traditional hierarchical system is that you can set up a top-down system for validity, but you don't have to (and in our opinion, shouldn't). Analogously, the significant improvement that Corporate Message Recovery has over key escrow is that you can tailor a recovery system to your needs (including and especially deciding it's not for you). Jon -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND6j8H35wubxKSepEQI58gCfQuiMZCyfe7cD1F2nNgFtluQqGXMAoJUh yHFMApAlDjzwRTCspBi7p9t3 =a2Zo -----END PGP SIGNATURE----- ----- Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)

6 10