December 2003 - cypherpunks-legacy

Re: Dems Critique Crypto Policy
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

John Young wrote: ADDITIONAL MINORITY VIEWS > > John Conyers, Jr. > Rick Boucher. > Zoe Lofgren. > Maxine Waters. > William Delahunt. > Martin T. Meehan. > We need to be honest about this situation. We don't expect > most narcotics traffickers, terrorists, or criminals to respect > export restrictions on encryption when they don't respect our > underlying drugs or weapons laws. And we don't generally expect > anyone who employs encryption in furtherance of a crime to > readily give their keys to some third party so they may be made > available to the government. The government doesn't expect it, either. As a matter of fact, they are probably sitting back laughing their asses off over your eloquent statements of logic which any rational person could reproduce if they weren't programmed to feed unthinkingly off of government media sound bytes. All of your points are well-taken and they will make no more difference than similar ones have made in the past. You will speak your mind politely while the government goes about usurping the few remaining privacies and freedoms we have. In the meantime, the nation is keeping busy bemoaning the fact that not everyone is going to be so polite in their protest of the government assault on the liberty and freedom of the citizens. The nation is busy venting their rage on a government mandated monster, as always, instead of admitting that there is a much greater monster in our midst which is slaying more of our citizens in a variety of ways than McVeigh could ever dream of. TruthMonger

1 0

Intro to Cyptosystems talk 6/23 7pm
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: net-thinkers(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Mon, 9 Jun 1997 14:32:34 -0700 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <net-thinkers(a)thumper.vmeng.com> Subject: Intro to Cyptosystems talk 6/23 7pm ever wondered what the buzz about cryptography is all about.. You are all welcome to attend my "Introduction to Cyptosystems" tutorial at the BMUG South meeting.. It's open to the public. When: Monday, Jun 23 Time: 7:00 PM Where: Town Hall, Apple R&D Campus (blding 5) How long: 60 mins or so? --------------- Q: Why should you care about this stuff..? A: The internet is not a secure channel, It's easy intercept your email or files or even know what webpages youve been looking at. Cryptography is a tool that provides you privacy and protection from competitors and the news media scum. How much do you trust to the internet? Cryptography is also the best protector of the most cherished civil liberty: "the freedom of speech" Q: But I have no secrets to keep? A: Cryptography is not just about secrets, In addition to providing confidentiality, modern cryptography holds the building blocks necessary for successful electronic commerce. Authentication: The receiver of a message can ascertain it's origin; an intruder should not be able to masquerade as someone else. Integrity The receiver of a message can ensure that the data has not been modifed in transit; an intruder should not be able to substitute a false message for a legitimate one. Nonrepudiation A sender should not be able to falsely deny that he sent a message Q:Why should I care about electronic commerce. Apple hasnt done anything with it? A: That the point of this talk. E-Commerce will be a bigger market than anything we have ever been in before. Ask yourself, What is the biz proposition for anyone publishing on the NET and the answer will be net commerce. Q: what will you talk about What is Cryptography What it's used for How Cryptosystems work secret/public key encyption, digital signitures, modern crypto systems key management, e-commerce, Governement Issues This talk is NOT about Theoretical Mathematics Programming APIs Specific Products Who this talk is for Marketing Evangelist Engineer Anyone who needs to be Crypto competent There is a PDF of the slides at http://www.vmeng.com/vinnie/papers.html Vinnie Moscaritolo That Crypto Guy at Apple... http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Fraud and free speech
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > > At 5:51 AM -0700 6/8/97, William H. Geiger III wrote: > >Well I think that there are some that would confuse the issue between 1st > >Amendment free speech and the issues surrounding fraud. Especially those > >in government who write the laws that regulate commercial speech. > > The mistake has been to extend "fraud" laws to non-contract situations, > e.g., ordinary speech (as distinguished from contracts). Any time that you see a thread in which Kent Crispin accuses someone of trying to "muddy the waters" you can pretty much guarantee he is trying to throw a logical curveball of his own. Kent added some tripe to the thread supporting his favorite theme, which is that it is the job of government to "enforce" contractual agreements. Naturally, he also extends the format of these contracts to include government authority to enforce criminal penalties for statements made by the great grandfather of the second cousin of the spouse of one of the person making the contract. Follow any thread after a Crispin post and you will find people arguing over issues he raises which have little basis in reality. > Contracts, with clearly stated conditions and with judgeable or > falsifiable/testable conditionals, are a matter for the courts (private > courts, in fact), but vague promises, advertisements, propaganda, etc. are > not. Dimitri wrote a couple of posts which dealt well with the original concept of two parties agreeing on an arbitrator/judge to settle contractual disputes (e.g. the court of Prince X) and the following usurpment of these free-will agreements by people in power who decree that _they_ are now the only valid arbitrator/judge in contractual matters. We now have a system where if someone breaks agreement with you the government locks them in a cage where there is no possibility of them paying you what they are contractually obligated to. The government doesn't give a fat rat's ass what your desires are for resolution of the dispute. They are always busy protecting the nebulous "other" rather than someone real, with a real interest in the situation. The government mandates that contractual agreements must be settled in a forum where the corporation with an army of lawyers can bury the attorney that Joe Average picked out of the yellow pages. When you enter into a contractual agreement with someone who has a guy named "Big Louie" as arbitrator, however, the government calls it organized crime. Pardon me if I fail to see the distinction. TruthMonger

3 2

AES Comments to NIST
by John Young 17 Dec '03

17 Dec '03

NIST has published the 33 comments received on the proposed Advanced Encryption Standard (AES) intended to replace DES. Several are quite extensive. In addition to those exemplars we've seen here by Bill Stewart and Bruce Schneier, there are remarks by several crypto luminaries, such as Ron Rivest and Clifford Adams (author of CAST), by NSA, by Canada's CSE, and by Certicom, 3Com, TIS, MasterCard, the ANSI X9 Standards Committee, the ABA and so on. http://jya.com/aes-comments.txt (103K)

1 0

My War
by se7en 17 Dec '03

17 Dec '03

Way back when in 1995 when I stopped lurking on this list and became a regular poster, one of the things I quickly became known for was my on-line harrassment of those who had stepped over the line in one manner or another in a way that would ultimately hurt us as a group overall. Many old-timers here will remember my harrassment of Curtis Sliwa and Colin Hatcher of the Cyberangels (a.k.a. Guardian Angels). These were the fools who organized a worldwide volunteer police-wannabe force that searched out indecency (in the generic and ill-defined sense of the term) on the net, which when one dug further into their agenda, found it was just a ploy for funding and political power. My incessant harrassment led to the revelation of many things, most importantly that their leader had never ever been on the WWW, stating that he didn't have time to do so. This despite the fact he had time to organize a police force to patrol it. There have been many others since then, most not as evil as the Cyberangels. They each had their own reasons for harrassment. Among some of them have been Carolyn Meinel, O.J. Simpson, Captain Crunch, and Gambit. As many of you know, I make a living as a professional speaker, with federal government, military and intelligence communities as my core audience. Let me put any fears anyone may have to rest: my work concentrates in Information Technology more than anything else, and if I get into hackers and hacking, it is more pro-hacker than anything else. I am working to improve our image as a community of talented individuals. I recently went off on a serious rant with three different audiences on a topic I felt was seriously exaggerated/over-hyped/fearmongered/bullshit. That topic was child pornography on the Internet. If you believed the press, child pornography was all over the Internet and easy to get. This brought about even more press and some action by our legislators to crack down on the Internet. I conducted an eight-week long search for child pornography late last year in the middle of this hype. I searched for, followed literally tens of thousands of links and hacked into pay/private porno servers all over the world. My opinion based on my results, which were not having found a single picture of child pornography anywhere, was that this whole topic was a bunch of bullshit. Well, that all changed a few days ago. I had asked for a software crack in a public USENET forum to override the NT4.0 Server 120 day time limit. While never receiving the crack, some idiot from an anonymous address sent me a child porn .jpg file. Trust me when I say it was child porn; the girl was no older than four years old and was very graphic. I immediately deleted all trace of the message/attachment. I was also very pissed to say the least that some asshole sent me this. I looked around on IRC on #teensex, and by whois'ing several operators, found more insidious channels. Among them are: #preteensexpics #littlegirlsex #100%preteensexpics #100%preteensexfuckpics #!!!!!!preteensexpics There are many others. I joined several of these channels and found that upon entering each one, I was auto messaged about special kiddie porn servers dedicated to trading, e.g., PreTeenSexPics - FTP at 130.67.80.230 l/p ncc/ncc [|] I logged onto several of these servers, and upon doing an ls-la found directories dedicated, among others, to child pornography. CD'ing into these directories listed several hundreds of files such as: 9yoshowr.jpg 8&dad.jpg 4yrfuck.jpg 6thgrade.jpg 6yoanal.jpg These are some of over several hundreds of files in a single directory on a single server. There were dozens of servers. I learned the protocol to download on these servers was to uplaod pictures you owned and then the operator would give you "credits" of various ratios for downloading, i.e., upload two pictures, you get credit to download one picture. I uploaded generic garbage pics off of a commercial adult web site, and recived credit to download three pics. What I saw wanted to make me physically vomit (yes, these pics are long since overwritten with 1's and 0's and destroyed). To put any doubts at rest, the material was real and fit the names of the files mentioned above. I was also actively sent private messages by those looking to trade. I asked what they had, and the usual response was "anything and everything." Some of the more common messages were: "I have 4-12 year old girls both action or pose." "I have little boys and girls alone or together." "I specialize in adults with 4-8 year old girls." I started logging the channels. I wanted to silently gather IP addresses and email addresses. These people needed some genuine hacker terror. Among some of the more active and persistent traders were: (*denotes server in operation) * SylphFox has a ftp at 206.246.162.183 1:2 ratio, anon login * <hehe(a)ts33.dac.pace.edu> * <kiddie(a)t2o15p13.telia.com> <suicide(a)mail1.arnan.com> <alexis(a)broken.dartmouth.edu> <guinness(a)broken.dartmouth.edu> <nexgen(a)philly158.voicenet.com> <tuvak(a)ppp-5200-0403.mtl.total.net> <Triad(a)an108.tir.com> <seeme(a)star090165.galstar.com> <domain(a)port182-tnt-ak-2.ihug.co.nz> <lewisJ(a)user-37kb329.dialup.mindspring.com> name: Lewis Johnson <fungus(a)infounik.com> <tk(a)conc0-a03.conc.tds.net> <pyro(a)user-37kb97d.dialup.mindspring.com> <hat(a)dialin9001.slip.uci.edu> name: Tuyen Ha <phostis(a)har-ct5-03.ix.netcom.com> <polls(a)175-203-179.ipt.aol.com> This log was generated in thirty minutes on #100%preteensexpics. If their email address appears above, it indicates they were actively offering trades or had servers in operation. These people listed above *were not* passive participants in the rooms. This represents only a small sampling of the overall people in the room at the time. Average number of people in each room varies, but seems to number about 40 people per room. I logged out of IRC, and then went to USENET, in such rooms as: alt.binaries.erotica.children.pre-teen There I found several hundreds upon hundreds of .jpg files of real child pornography. Several messages also pointed to some WWW sites, such as: http://www.nudebooks.com For someone who took a virtual tour of the kiddie porn world for only one day, I had the opportunity to download enough files to fully max out an IOmega 100MB ZIP disc. **This is not an exaggeration.** Imagine how much could be, and has, been downloaded by those who are regular participants in this activity. Well, this whole situation is unacceptable. First, I would like to apologize to all those who have hired me in the past, and were subject to my emotional rants about how the whole subject was bullshit and not real. It is very real. It is disgustingly real. It is so real it will make you want to throw up, and I actually, physically did throw up last night. Second, in reference to previous conversation over the years on this list, and in the hacking community in general, I know this type of activity is not tolerated by us. I have given you enough information above to start identifying the players in this and the places they congregate. It would be my sincere hope that hackers of all abilities would spend a few moments each day and put their talents to use against these people. Yes, I am advocating malicious, destructive hacking activity against these people. Who are they going to run to? The police? "They hacked my kiddie porn server and rm -rf'd my computer!" Right...the police will be so anxious to lock us up left and right. These people need to be eradicated from the Internet. While that may never happen completely, enough harrassment will send a message that engaging in this type of activity in very dangerous, and can result in serious harrassment, public embarrassment and computer destruction. This is my war. It will be a public war. I don't care what happens to me by their community or by law enforcement. I feel secure enough that no jury in the world will convict me for taking these people out. I feel secure enough that no law enforcement agency will ever take action that would place me in front of a jury. And if by some chance I do end up being prosecuted, I know what I did was right. So, now start the logs of the channels and the actions of those in it. Now starts the public postings of these logs in various places on the Internet. Now starts the harrassment. Now starts the malicious hacking. Now starts the war. I don't expect people to join me here on this. If you do, you have enough information to start. I caution you to log what is going on, and to make sure you are hitting the guilty, so no innocent people get annihilated in the process. Make damn sure you know who you are hitting and why, and be able to back it up with the idea of having to justify your actions in front of a jury. And make *REALLY SURE* that if you do come across files of child pornography, that you *OVERWRITE AND DESTROY* these files immediately! You wouldn't want to be the one who ends up being prosecuted for being in possession of this type of material. I would also recommend getting an anonymous email account, such as juno.com, mailmasher.com, hacked, etc., so that you can conduct your activities without fear of the inevitable retribution of those who actively trade this shit when the heat starts getting applied to them. Of all the people who can help stop this, it is us...hackers. Not law enforcement, not the government, not the media. Not anyone. Just us, hackers who have the talent to do what no one else can. Please forward this message freely around the Internet. It is not copyrighted in any way, shape, or form. se7en

12 18

Access to Storage and Communication Keys
by Bill Stewart 17 Dec '03

17 Dec '03

The government and its friends have tried for a while to convince the public that there's a great business market for access to keys by the Proper Authorities, whether bosses or cops. A number of us on the Pro-Privacy side have contended that this is wrong - the business need is for later access to stored files, not to encrypted communications keys and of course not to signature keys. Having argued that point vociferously in the past, I'm now going to waffle on the issue - while the business need is for access to stored data, this may often include stored messages received from a communication system in encrypted form. Either the User Interface needs to make it convenient to store the decrypted message, or else the user will store the message in encrypted form - which means there may be a business need for Proper Authority Access later. This means, as {cypher,coder,ranter}punks, we need to address this problem when building crypto tools, to avoid building systems that create or sustain a business need for access to communication keys. Some email systems really encourage you to save messages in one big hulking undocumented monolithic email box, with subfolders and databases and attachments and pointers, and some are a bit more friendly but still leave bits and pieces of MIME splattered on your disk. Some of the nicer tools I've used for encrypted file/mail handling make it convenient to take encrypted incoming mail, decrypt it, and either view it or save it to a file or clipboard. I've been using PGP Inc.'s PGP5.0 Eudora Plug-In, and it decrypts the mail into the mail message buffer itself. When you finish with that particular message (e.g. go to the next, or just close it), you get asked it you want to save the modified message, and if you say "yes" you'll have the decrypted message in your mailbox. However, there's a negative about this - if you receive mail that's signed and encrypted, and save the modified version, it loses the signature information - so it may be more valuable to save the encrypted version... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

3 2

[Noise, California only] Good deal on ISDN access
by Lucky Green 17 Dec '03

17 Dec '03

[I have been sick at home all day, when I just couldn't sleep anymore I hit the web. I hope this makes sense...] Given that a good number of people on this list live in CA, this might be of interest to you. It certainly was to me. PacBell is selling flat rate 2B ISDN Internet access at $50/month. Plus the regular home ISDN fees, but this is still much cheaper than what I paid before. You might want to think hard before you buy at new 56k modem that in all likelihood won't be able to give you 56k anyway. And no analog modem will ever give you 128kbps. Analog lines aren't made for data. They aren't particularly good for data. That's why ISDN was designed. It didn't take off until recently, since it was priced for business and business decided they didn't need it for various reasons. But at these prices, you'd have to be a starving student or nuts not to get it at home. http://dialup.pacbell.net/ISDN/ Disclaimer: I have no financial interest in PacBell. It would be nice, though. :-) --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

3 3

Who is an encrypted message for? [PGPtray/Eudora]
by Bill Stewart 17 Dec '03

17 Dec '03

[Fred, could you forward this to pgp-users? Thanks.] PGP 5.0 GUI on Win95 does this for both PGPtray and the Eudora plug-in. When you want to decrypt a message, it doesn't tell you who the message is TO when asking you for the passphrase. Therefore, if you have more than one user id with different passphrases, you don't know which one to type in. Also, from a security perspective, this is bad, because what you do with the contents of a message may be different depending on who it came to or from - was that mail asking for the Secret Plans addressed to your individual Work key, your department key, your home key, or your Illuminati Conspiracy key? This appears to be Versionb b14c3, though it's not easy to find out, and I'm not sure if that's the version of PGPtray, PGPkeys, or both... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

1 0

Re: Access to Storage and Communication Keys
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <3.0.1.32.19970609000938.00756910(a)popd.ix.netcom.com>, on 06/09/97 at 12:09 AM, Bill Stewart <stewarts(a)ix.netcom.com> said: >I've been using PGP Inc.'s PGP5.0 Eudora Plug-In, >and it decrypts the mail into the mail message buffer itself. When you >finish with that particular message (e.g. go to the next, or just close >it), you get asked it you want to save the modified message, and if you >say "yes" you'll have the decrypted message in your mailbox. However, >there's a negative about this - if you receive mail that's signed and >encrypted, and save the modified version, it loses the signature >information - so it may be more valuable to save the encrypted >version... Well this is why I tell everyone to clear sign the message first and then encrypt it. In my PGP GUI/E-Mail integration E-Secure this is the default behavior. IMHO encrypting & signing (-sea) is a PITA (for the reciever). I also verify signatures of all signed inbound messages and append the output from PGP to the bottom of the message so that you can see the results when the message is opened without having to re-run PGP. The user also has the option to either decrypt messages as they are retreived or to store them encrypted. I just released the first beta of my auto-encrypt code. That was quite fun to write. Myself am rather disturbed by how many PGP/E-Mail implmentations handle signing/encrypting of messages. One of my biggest pet peeves is when only the plain text of a message is signed/encrypted. I have seen this with more than 1 implementation and I see it as a serrious security flaw. Another issue that is usally missed is Bcc's. The whole purpose of using Bcc's is that you don't want the rest of your distribution to know that you have sent a copy to the addresses on the Bcc line. If you encrypt a message with multiple keys including keys for your Bcc's then your Bcc's will be known to everyone who recieves a copy of the message. What I have done to address this is to send seperate copies of the message to each address on the Bcc list each encrypted with only the one key for the address. You can have the strongest algorithms in the world but they do you no good if they are poorly implemented. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM5u7uo9Co1n+aLhhAQH/sgP/V/ulJSLuNEV+sBW1hAnRsbYizxUb3tbc eJtG6YZnhszgjmj0ybgA/yfIC3i9uXjvuZeRdyrD9YSTf0a0gWOkcAzhhB/A5XBj Kf80HEXiJhd9dLSxYUGD55QFQNtz1QGbEGCURLyCchuWa0KrpLUofvUZ0cfatk+3 VKbfYn0KMTA= =vvGI -----END PGP SIGNATURE-----

1 0

Get your site Noticed!
by wgrip＠arcturus.net 17 Dec '03

17 Dec '03

Hello, Do you have a webpage that's just sitting there? Need more hits and visibility? Now you can promote your pages like the pros! The WebSeek Promotion Spider puts your pages on the TOP of the Search Engines! Get your FREE Shareware Version today and see what this powerful program can do for your site!! For more info please respond to our Autoresponder at: netnow(a)arcturus.net and say "Promo-Now" Resellers Needed! thanks, Web Promotions! ~~~~~~~~~~~~~~~~~~~~~~~ Note: You will not receive another message BUT we do utilize the Remove List at: remove(a)cyberpromo.com

1 0