December 2003 - cypherpunks-legacy

Re: ElGamal
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timothy C[reep] May carries a turd in his wallet for identification purposes. \|/ (*,*) Timothy C[reep] May _m_-_m_

2 1

GET PAID $300.00 FOR GIVING AWAY TWO WAY HOME SECURITY SYSTEMS!!!
by poguocou16＠sprintmail.com 17 Dec '03

17 Dec '03

For removal, please put remove on subject line and email me at Success(a)Gosnet.com *Don't press reply, it won't get back to me. Follow instructions down below. -How would you like to get paid $300.00 for giving away a two way home security system valued at $1,320.00. This system gives you so many options it is incredible. -How would you like to get paid $140.00 to $280.00 for each two way home security system that your down line gives away. -This opportunity is available now in your area. The only cost to start this incredible opportunity is a $94.00 start up kit. This includes your activation, home security(2 systems) , shipping, and handling fees. *DON'T REPLY WITH YOUR REPLY BOTTON* TO OBTAIN INFO ON THIS OPPORTUNITY: 1)Email me at user2384(a)xsend.com -Please Include name, PHONE #, and email address. Please include phone#!!!!!!!!!! -Please put "MORE INFO" ON SUBJECT LINE, if you don't the reply will take longer. 2) Call 805-961-3971 for a 24 hr. voice message for more details. 3)If email comes back undeliverable please leave message at (805)675-8565.

1 0

WOW-COM Update
by Wow-Com Replies 17 Dec '03

17 Dec '03

============================================================= This update is sponsored by TESSCO http://www.wow-com.com/professional/whatshot/ ============================================================= Dear WOW-COM Reader: WOW-COM(TM) is the wireless industry's online information source, a free service of CTIA. Find out what's going on in the wireless industry by visiting http://www.wow-com.com/ today! INDEX: ====== 1) CTIA's WIRELESS FRAUD '97 GETS UNDERWAY IN ORLANDO, F.L.! 2) FCC ADOPTS NOTICE OF INQUIRY ON CALLING PARTY PAYS 3) CTIA's WIRELESS APPS '97 IS 27 DAYS AWAY. REGISTER ONLINE TODAY! CTIA's WIRELESS FRAUD '97 GETS UNDERWAY IN ORLANDO, F.L.!========================================================== http://www.wow-com.com/professional/fraud/ CTIA'S WIRELESS FRAUD '97, Orlando, FL, September 30 - October 2, 1997, is CTIA's WIRELESS FRAUD WORKSHOP AND PRODUCT SHOWCASE. Companies will exhibit high tech, crime fighting tools to help your corporation sustain its fraud containment efforts. Let WIRELESS FRAUD '97 prepare you - not just for today's threat, but tomorrow's. Log on to www.wow-com.com for up-to-the-minute product and service announcements directly from the show floor! Yesterday's fraud solutions may not solve tomorrow's problems. FCC ADOPTS NOTICE OF INQUIRY ON CALLING PARTY PAYS ========================================================== http://www.wow-com.com/professional/whatshot/ As expected, the FCC adopted a Notice of Inquiry examining Calling Party Pays (CPP) as an option for subscribers to Commercial Mobile Radio Services, and as a potential means of promoting competition with wireline carriers. All four of the Commissioners expressed support for the item, characterizing CPP as a "pro-competitive idea that deserves greater attention." Read about this and other Hot issues in WOW-COM's What's Hot. CTIA's WIRELESS APPS '97 IS 27 DAYS AWAY. REGISTER ONLINE TODAY! ========================================================= http://www.wow-com.com/professional/convention/ CTIA's Annual Convention & Exposition Focusing on Wireless Data and Applications will take place in Seattle WA at the Washington State Convention Center from October 27-29, 1997. It's people looking for business solutions to today's business problems and suppliers providing the real-world wireless applications they need. To find attendee registration information, exhibitor information, rates, and event schedules, log on to www.wow-com.com today! ============================= MORE WOW-COM(TM) FEATURES ============================= WOW-COM(TM) is current: Updated 3x per day. WOW-COM(TM) is insightful: CTIA's unbiased analysis WOW-COM(TM) is beneficial: Find products and services in WOW-COM(TM)'s Virtual Trade Show. List open positions in the WOW-COM(TM) Career Center, receive resumes via email and hire qualified individuals. The world of wireless is in constant motion. Stay on top of the news and benefit from CTIA's analysis by reading WOW-COM(TM) everyday. You may remove yourself from the WOW-COM(TM) mailing list by going to http://www.wow-com.com/unsubscribe ======================================================== This update sponsored by: TESSCO http://www.wow-com.com/professional/whatshot/ TESSCO, Your Total Source supplier to the Wireless Communications Industry. Tessco serves: *** Cellular Providers *** Paging and Personal Communications Service (PCS) Carriers *** Wireless Product Dealers and Installation Centers *** Self-maintained two-way radio end users They catalog and stock nearly 17,500 products from over 270 manufacturers - virtually everything needed to build, run or maintain a cellular, paging, PCS or two-way system. These products range from simple electrical tape to sophisticated spectrum analyzers, from tiny connectors to bulky cable.

1 0

Re: Crypto Legality Question
by geeman＠best.com 17 Dec '03

17 Dec '03

*My* understanding is that this is violation of United State law, irespective of Canada. But hell, IANAL. At 11:03 PM 9/29/97 +0100, Adam Back wrote: > > >Will Rodger <rodger(a)worldnet.att.net> writes: >> At 01:25 PM 9/29/97 +0000, Jim Burnes wrote: >> > >> >ACME corporation, a mostly Canadian outfit with a major >> >subsidiary in the US, wants to roll out corporate wide crypto. >> > >> >Most of their network operations are in the US except one >> >of their offices in Ireland. >> > >> >Question (1): Can they buy a strong crypto package in the >> >US and physically roll it out to both Canada and Ireland. >> >> Nope. Though Canada allows export of strong crypto generally, >> Canadians may not re-export US products once they enter the country. > >This is not the way I understand it. > >You can re-export strong crypto from Canada, you just have to inform >the appropriate Canadian government department that you have done so. > >So procedure is: 1) import software from US, 2) write appropriate >Canadian export department telling "I'm going to export blah to xyz >corp offices in Ireland", 3) export it. > >That is, there is a loop-hole, you don't have to ask permission for >export, you just have to inform them you're going to do it. (You >might want to check this out with a Canadian lawyer familiar with the >rules, and loop-holes). > >So you informed them. They can't do anything about it. They won't >like it, but they don't have to. > >I'm told Kerebos was exported by this route. US -> Canada -> UK. >100% legally. > >Adam >-- >Now officially an EAR violation... >Have *you* violated EAR today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ > >print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> >)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` > > > obligatory pgp key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 4.5 mQENAjMPX3sAAAEIAL8U6IqpMkqM3TcIqU/q7iot8pYk4ifVNaNlIYwwoYmPXH/T dabDzgkQg7h1QsEJU71Ze8EdHmKksfeBEVppJV6X9SyzpFOCgrI/Qr7hMbxnecci SVk2/B2lf4tUPuqm/DGRfAUcd4iG7Gjhw5GRh9Us/jrEtkqr3iIES+9pSNvrEsgB xYYR39eaYwe0gheExaO7vtvDDPUM7C3spbcnwOyLCpURpLCAMHUO8DQc2FO/fN4z TqqIFOect2ea4LYHr0o29RrtY9J85lQj3df8LQvIJWjwzAFfBqOU1KUdXqTayzUj rvY4ZL/1vhTJ5QmlBJ6ognqwk7PVN0SesspU2okABRG0IGdyZWdnIHBlcnNvbmFs IDxnZWVtYW5AYmVzdC5jb20+ =H0bC -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Remailers and ecash (fwd)
by Fisher Mark 17 Dec '03

17 Dec '03

Jim Choate writes: >What would motivate an average consumer to use an anonymous remailer? > >Clearly simple anonymity or writing nasty letters to Grandma anonymously are >not going to motivate most folks irrespective of cost - they simply have no >interest in such activities. So, the question becomes: > >What besides raising hell anonymously, laundering money, and defeating >merchant purchase traffic analysis are commercial anonymous remailers good >for? Well, maybe the avenue to pursue isn't the average consumer, but the average employee. I don't doubt that at least some companies are under email traffic analysis by their competitors (and/or their competitor's governments) to get a clue about future directions for their products. I could see where many (eventually most) companies would send email to each other using remailers, so that only the companies involved know that they communicated with each other. Internet email doesn't provide the same level of privacy that snail mail, phones, and faxes do now. With the use of remailers, Internet email could provide more privacy than snail mail, phones, or faxes. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Till Debt Do Us Part, cost of the CDA, from Netly
by Declan McCullagh 17 Dec '03

17 Dec '03

************ http://cgi.pathfinder.com/netly/opinion/0,1042,1452,00.html The Netly News September 30, 1997 (http://netlynews.com/) Till Debt Do Us Part by Declan McCullagh (declan(a)well.com) Ever since challenging the Communications Decency Act in early 1996, the two coalitions that filed the lawsuit have appeared unbeatable. Not only did a Philadelphia court rule that the law violated the Constitution's guarantees of freedom of speech, but the Supreme Court unanimously agreed in June. Now one group's string of victories may be ending. The Center for Democracy and Technology (CDT), which organized the high tech lawsuit, may lose its final battle: getting reimbursed nearly $600,000 for money spent on lawyers. Under federal law, only nonprofit groups or corporations worth less than $7 million can request attorney's fees after successfully challenging an unconstitutional law. The Department of Justice claims that since such wealthy firms as America Online, Microsoft, Apple and CompuServe paid for much of the lawsuit, CDT should not be reimbursed. The government has asked for four months to investigate, charging in court papers that "other entities actually bore the costs of the litigation and merely funneled money through" CDT. In other words, if Microsoft had hired the lawyers, Bill Gates couldn't get reimbursed. The DoJ claims that Microsoft "funneled" the cash through CDT, which then turned around and asked Uncle Sam for a check. CDT opposes the government's request for additional time. Documents filed in Philadelphia district court last Friday show that the money raised was from a broad coalition of groups, not all of which expect reimbursement, says CDT's director, Jerry Berman. "Maybe all the money doesn't qualify, maybe we can't get all of it back. But certainly the small associations, CDT's money and the library money ought to come back." A major contributor to the lawsuit (and the lead plaintiff) was the American Library Association and the related Freedom to Read Foundation, which spent $475,000. The total costs of the lawsuit, though, ballooned to more than $1.3 million, and CDT still needs to raise $200,000. (CDT can't ask to be reimbursed for the full amount since its attorneys charged much more than the $130 an hour the law sets as an upper limit.) Even as CDT faces a tough struggle, the American Civil Liberties Union -- which led a coalition of nonprofit groups in a separate but coordinated lawsuit -- is optimistic about recovering roughly $400,000 in expenses. "[The law] was exactly intended to encourage organizations like the ACLU Foundation, which was set up to handle these kinds of cases on behalf of people who don't have the resources to handle these cases themselves," says Barry Steinhardt, the ACLU associate director. Unlike the CDT coalition -- which employed a law firm and was funded by outside groups -- the ACLU used its own lawyers and money and has been reimbursed for similar lawsuits before. Last Friday the ACLU filed court documents saying it was eligible for attorney's fees and arguing against delaying its request past mid-October. If CDT receives attorney's fees, the group says it first will use the money to settle outstanding bills owed to the Washington law firm of Jenner & Block, which has capped its fees at $1.1 million. "Other than payments to Jenner & Block (and possibly to the ALA), all proceeds will be used by [CDT ] to further the general goals of... protecting free speech on the Internet and empowering families who are using the Internet to protect their children from material they judge inappropriate," CDT deputy director Danny Weitzner says in court documents. At issue here is the relationship between CDT, the lawsuit's funders and the Citizens Internet Empowerment Coalition, a project of CDT. The Justice Department has asked the CDT plaintiffs to respond to 40 pages of detailed questions and requests to turn over documents. "The existence and nature of the fee arrangements among the plaintiffs is critical to determining whether ineligible parties are the real parties in interest," the government says. The "ineligible" parties who helped out: America Online ($130,000), CompuServe ($50,000), Microsoft ($75,000), Netcom ($10,000), and Prodigy ($75,000). Even if CDT and the ACLU can show they qualify for a check, they have one more hurdle to leap: to show the Justice Department was wrong to defend the CDA as constitutional. You might think that after enduring 18 months of humiliating defeats in two district courts and the Supreme Court, the Clinton administration might be willing to throw in the towel and admit the law was brain-dead from the beginning. You'd be wrong. Unbelievably, the government claims it was correct to argue all the way to the Supreme Court that the CDA did not violate the First Amendment. Says the Justice Department, "Defendants will demonstrate that their defense of the CDA was substantially justified and that plaintiffs' requests for fees should be denied on that basis alone." ### ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: remailer latencies
by David E. Smith 17 Dec '03

17 Dec '03

Monty, Just so you know that the less-than-100-percent message rate doesn't necessarily mean that messages are getting lost: Last update: Tue 30 Sep 97 15:09:32 EDT remailer email address history latency uptime ----------------------------------------------------------------------- bureau42 remailer(a)bureau42.ml.org -----------+ 3:31:14 100.00% It's a fluke; I just happened to look at this list (by fingering rlist(a)anon.lcs.mit.edu) while I'd been on the net for a while, and so no messages were in transit. Mere seconds later, the EFGA list showed my uptime as 99.97% and Raph's list showed a meager 94.08% (it looks like somewhere, about three days ago, messages got dropped somehwere). On balance, the remailer network is rather more reliable than you seem to give it credit for. (Side note: the more reliable remailers, with bureau42 being a notable exception :) tend to be faster too. The top remailers as of _right_now_ all have reliability above 99.90% and delay times less than twenty-five minutes. Chain a few of those together and your message will almost certainly arrive in less than an hour. Few would argue that that's an unacceptable delay. Messages routinely take longer than that to be delivered, due to random nameserver burps and other "normal" factors.) dave (bureau42 gearhead)

1 0

Re: FCPUNX:EPIC Alert 4.13 on crypto and more
by James A. Donald 17 Dec '03

17 Dec '03

At 03:12 PM 9/26/97 -0700, Declan McCullagh wrote: > Question to ponder for the weekend: if it took this kind of "compromise" > for a bill to clear the unabashedly pro-business Commerce committee, what > will it take for a bill to become law? Crypto legislation is guaranteed to be bad. We have been saying that for years, and now it has been demonstrated. Just say no to crypto legislation. > The fate of the SAFE bill is now uncertain. The original Goodlatte > language has been substantially amended by five House committees, with > contradictory results. No contradiction: There are bad amendments and there are really bad amendments, and there are menacing and totalitarian amendments. > As such, SAFE may no longer be a viable vehicle > for the reform of encryption policy that it was originally intended to > promote. Let sleeping dogs lie. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

RE: sounds just like the snitch you are [was]RE: engineering infowar disasters
by Phillip Hallam-Baker 17 Dec '03

17 Dec '03

>Phillip Hallam-Baker <hallam(a)ai.mit.edu> writes: >> Attila T Hun <attila(a)primenet.com> writes: >> >> I never promised any sabateur that I would keep any secret of theirs. I >> have worked with law enforcement and the security services for many >> years. If I catch someone damaging my property or property I am >> responsible for I call the authorities. >You know, Phill, life is not black and white. >Let's say for the sake of argument that you are admin for a system >which is based on the security of MD4. Then along comes Boesslaers >and co, and trashes it. You going to call for him to be locked up? >How about if someone then uses this new cryptanalysis to write some >code which demonstrates the weakness... do you figure they should be >locked up for demonstrating the flaw. (Note they haven't gone within >a mile of your precious systems). >How about if some cypherpunks used this code to demonstrate that they >could decrypt something which was encrypted by a webserver running on >a machine you are admin for. Should these cypherpunks also be locked >up? This is not what was proposed at all however. Demonstrating security flaws is one thing, exploiting the flaws for malice is quite another. It is the difference between Ralph Nader demonstrating that the pinto is "unsafe at any speed" and buying one for your elderly aunt who has promised you that inheritance. >I can assure you that kerckhoffs principle applies doubly to infowar >attacks, a hostile foreign government is hardly going to be cowed by >your suggestion that you will call the feds if anyone breaks anything >you've got anything to do with. I can see it now, Sadam Hussien's >hired system-crackers, his inforwar attack team, will really be >quaking in their boots, "better not trash US internet infrastructure >-- that brit Phill Hallam-Barker guy will narc us out". That is a deliberate misrepresentation of what I said. I was pointing out that *anybody* on the list who is responsible for a system is going to want a conviction if they are attacked. >> I believe that people who do bad things should go to prison. >Personally I would rather see murderers and rapists locked up than >teenage recreational crackers who go around breaking into poorly >maintained systems for the challenge, but break nothing. I believe the opposite. So would you if you had had my experience. Even if you know that the system is secure and you have the perp under 24 hour surveillence by top people you are going to worry like hell. One of the people I advised during an incident likened it to rape. I don't think this is too far fetched. There are many hackers who see their machine as an extension of the self. The anonymity of the net cuts both ways. You don't know whether its Sadam's storm troopers or teenage shit unless and until you get a collar. >I'm kind of wondering if _you_ as the security person who was >responsible for security at the site, feel no responsibility to secure >your systems. ("Oh don't worry about security, if anyone breaks in >we'll call the feds"). I'm interested in security at every level, including severe reprisals. >I would hardly describe a bit of cryptanalysis of infowar risks as the >work of `anarchist thugs'. Neither did I. Discovering weaknesses is OK. Exploiting them is NOT. >Applying said cryptanalysis to in practice take out root DNS might not >be such a friendly thing though. But hey, if someone does it, the >real people to blame are Freeh and co for hindering use of crypto >techniques to protect the infrastructure. Not in that case. DNS security is taking time to adopt because that sort of thing just does. That is an authentication problem and there has not been a problem. Heck the NSA even published the DSS. Be exact, not every security problem can be blamed on the Feds. If you arn't carefull you will end up like Kitty Kelly who when I spoke with her yesterday began with the lie that truth is not a defense in british libel law (wasn't in 1776, has been an absolute defense since 1850 or so) then mixed up Australia and Argentina. Like you have to make sure the points are accurate. >> People depend on infrastructure. Lives depend on it. >If people are depending on the internet for mission critical >information, of the sort where people will die quickly if information >isn't getting through, they need their heads examining. If they have >been advised to use the internet for this kind of information they >need to get better advice. The assumption that the Internet and the telephone system are somehow entirely disjoint when it comes to Infowar is a somewhat naive one. The fact is that the telephone system is just as prone to attack, much more likely to use security through obscurity and so on than the Internet. >> If people screw it up someone is likely to be killed. Freeh will >> have a party. Indeed its the sort of thing Nixon might have done on >> purpose to take advantage of the backlash. >Uhh... could you explain the logic there a bit please? Don't think for a moment that if Joe Cypherpunk screws up the national power grid that that means cryptography rights for all. All it means is that Freeh is going to demand and get a blank cheque to eliminate crypto to match the blank cheque to eliminate drugs. One of the strategies Nixon's plumbers used was to deliberately sabotage their own rallies so that they could claim the violence came from the anti-war movement. Don't imagine that because something makes no sense US politicians won't insist on it. They voted for prohibition, they spend $40billion on failed drug interdiction policies and they won't stop at giving Freeh $5 billion to supress crypto. The symbol of the US government should be changed to a B2 bomber, hugely expensive ($1.5 billion and counting), with no remaining strategic role (Pentagon, RAND, Air Force Chief of Staff statements), can't be used in the rain (CNN reports) and visible on Marconi-UK build radar. US congress is insisting on building 20 more despite statements from DoD they just don't want them. Phill

1 0

Pre-Encryption Surveillance
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 30 Sep 1997 15:11:43 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Dwight Hines <Elmhines(a)AOL.COM> Subject: Pre-Encryption Surveillance To: CYBERIA-L(a)LISTSERV.AOL.COM Please note that there are now two cases in the Federal Appellate Courts (Docket #'s 2780, 2293) in the Eleventh Circuit, and one case that will soon be appealed from the Fed Dist in Tallahassee, Florida (Hines v. American Inn) that have to do with illegal electronic surveillance of computers, as well as invasion of privacy. The Federal Election Commission has been notified as well as other law enforcement agencies. The attached file gives more detail on the Tallahassee Case. There is another case that will be filed soon in a different circuit that also includes allegations of obstruction ofjustice and witness tampering. The concern with encryption has led some folks with a criminal bent to avoid the issue altogether. Others, such as supporters of the Christian Coalition, feel they can presume police powers that are restricted just to the state. It is a major mess. If you are interested in becoming an interested party and would like to be included in the certificate of corporate disclosure and interested parties, please read the attached file and contact me. Sincerely, Dwight Hines --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0