December 2003 - cypherpunks-legacy

No Subject
by erict＠iconmedialab.se 17 Dec '03

17 Dec '03

UNSUBSCRIBE cypherpunks _____________ ännu en sån där trevlig signatur rad _____________

1 0

Re: [ADMINISTRATIVIUM] Quadratic residues
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

`A pen is mightier than a sword', not to mention Timmy C. May's pea-sized penis. He would be better served by a safety razor, possibly applied in a bathtub filled with warm water (something he has surely never been into). o /\O/ O Timmy C. May 0 \\ | 0-# // | / \

2 1

subscribe
by Dinesh Mahtani (Dino) 17 Dec '03

17 Dec '03

subscribe mahtani(a)vaxvmsx.babson.edu _______________________________________________________________ | | | TEMPORARY EMAIL ADDRESS: mahtani(a)vaxvmsx.babson.edu | |_______________________________________________________________| _______________________________________________________________ | | | Please note that our company will be changing our Internet | | Service Provider in the very near future. I may be unable | | to view messages sent to mahtani(a)mozart.inet.co.th. To | | avoid any possible problems please update your address | | books and/or send carbon copies of all correspondance to my | | old school address during this transition. | |_______________________________________________________________| _______________________________________________________________ | | | TEMPORARY EMAIL ADDRESS: mahtani(a)vaxvmsx.babson.edu | |_______________________________________________________________|

1 0

Re: Dems Critique Crypto Policy
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

John Young wrote: ADDITIONAL MINORITY VIEWS > > John Conyers, Jr. > Rick Boucher. > Zoe Lofgren. > Maxine Waters. > William Delahunt. > Martin T. Meehan. > We need to be honest about this situation. We don't expect > most narcotics traffickers, terrorists, or criminals to respect > export restrictions on encryption when they don't respect our > underlying drugs or weapons laws. And we don't generally expect > anyone who employs encryption in furtherance of a crime to > readily give their keys to some third party so they may be made > available to the government. The government doesn't expect it, either. As a matter of fact, they are probably sitting back laughing their asses off over your eloquent statements of logic which any rational person could reproduce if they weren't programmed to feed unthinkingly off of government media sound bytes. All of your points are well-taken and they will make no more difference than similar ones have made in the past. You will speak your mind politely while the government goes about usurping the few remaining privacies and freedoms we have. In the meantime, the nation is keeping busy bemoaning the fact that not everyone is going to be so polite in their protest of the government assault on the liberty and freedom of the citizens. The nation is busy venting their rage on a government mandated monster, as always, instead of admitting that there is a much greater monster in our midst which is slaying more of our citizens in a variety of ways than McVeigh could ever dream of. TruthMonger

1 0

Intro to Cyptosystems talk 6/23 7pm
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: net-thinkers(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Mon, 9 Jun 1997 14:32:34 -0700 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <net-thinkers(a)thumper.vmeng.com> Subject: Intro to Cyptosystems talk 6/23 7pm ever wondered what the buzz about cryptography is all about.. You are all welcome to attend my "Introduction to Cyptosystems" tutorial at the BMUG South meeting.. It's open to the public. When: Monday, Jun 23 Time: 7:00 PM Where: Town Hall, Apple R&D Campus (blding 5) How long: 60 mins or so? --------------- Q: Why should you care about this stuff..? A: The internet is not a secure channel, It's easy intercept your email or files or even know what webpages youve been looking at. Cryptography is a tool that provides you privacy and protection from competitors and the news media scum. How much do you trust to the internet? Cryptography is also the best protector of the most cherished civil liberty: "the freedom of speech" Q: But I have no secrets to keep? A: Cryptography is not just about secrets, In addition to providing confidentiality, modern cryptography holds the building blocks necessary for successful electronic commerce. Authentication: The receiver of a message can ascertain it's origin; an intruder should not be able to masquerade as someone else. Integrity The receiver of a message can ensure that the data has not been modifed in transit; an intruder should not be able to substitute a false message for a legitimate one. Nonrepudiation A sender should not be able to falsely deny that he sent a message Q:Why should I care about electronic commerce. Apple hasnt done anything with it? A: That the point of this talk. E-Commerce will be a bigger market than anything we have ever been in before. Ask yourself, What is the biz proposition for anyone publishing on the NET and the answer will be net commerce. Q: what will you talk about What is Cryptography What it's used for How Cryptosystems work secret/public key encyption, digital signitures, modern crypto systems key management, e-commerce, Governement Issues This talk is NOT about Theoretical Mathematics Programming APIs Specific Products Who this talk is for Marketing Evangelist Engineer Anyone who needs to be Crypto competent There is a PDF of the slides at http://www.vmeng.com/vinnie/papers.html Vinnie Moscaritolo That Crypto Guy at Apple... http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Fraud and free speech
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > > At 5:51 AM -0700 6/8/97, William H. Geiger III wrote: > >Well I think that there are some that would confuse the issue between 1st > >Amendment free speech and the issues surrounding fraud. Especially those > >in government who write the laws that regulate commercial speech. > > The mistake has been to extend "fraud" laws to non-contract situations, > e.g., ordinary speech (as distinguished from contracts). Any time that you see a thread in which Kent Crispin accuses someone of trying to "muddy the waters" you can pretty much guarantee he is trying to throw a logical curveball of his own. Kent added some tripe to the thread supporting his favorite theme, which is that it is the job of government to "enforce" contractual agreements. Naturally, he also extends the format of these contracts to include government authority to enforce criminal penalties for statements made by the great grandfather of the second cousin of the spouse of one of the person making the contract. Follow any thread after a Crispin post and you will find people arguing over issues he raises which have little basis in reality. > Contracts, with clearly stated conditions and with judgeable or > falsifiable/testable conditionals, are a matter for the courts (private > courts, in fact), but vague promises, advertisements, propaganda, etc. are > not. Dimitri wrote a couple of posts which dealt well with the original concept of two parties agreeing on an arbitrator/judge to settle contractual disputes (e.g. the court of Prince X) and the following usurpment of these free-will agreements by people in power who decree that _they_ are now the only valid arbitrator/judge in contractual matters. We now have a system where if someone breaks agreement with you the government locks them in a cage where there is no possibility of them paying you what they are contractually obligated to. The government doesn't give a fat rat's ass what your desires are for resolution of the dispute. They are always busy protecting the nebulous "other" rather than someone real, with a real interest in the situation. The government mandates that contractual agreements must be settled in a forum where the corporation with an army of lawyers can bury the attorney that Joe Average picked out of the yellow pages. When you enter into a contractual agreement with someone who has a guy named "Big Louie" as arbitrator, however, the government calls it organized crime. Pardon me if I fail to see the distinction. TruthMonger

3 2

AES Comments to NIST
by John Young 17 Dec '03

17 Dec '03

NIST has published the 33 comments received on the proposed Advanced Encryption Standard (AES) intended to replace DES. Several are quite extensive. In addition to those exemplars we've seen here by Bill Stewart and Bruce Schneier, there are remarks by several crypto luminaries, such as Ron Rivest and Clifford Adams (author of CAST), by NSA, by Canada's CSE, and by Certicom, 3Com, TIS, MasterCard, the ANSI X9 Standards Committee, the ABA and so on. http://jya.com/aes-comments.txt (103K)

1 0

My War
by se7en 17 Dec '03

17 Dec '03

Way back when in 1995 when I stopped lurking on this list and became a regular poster, one of the things I quickly became known for was my on-line harrassment of those who had stepped over the line in one manner or another in a way that would ultimately hurt us as a group overall. Many old-timers here will remember my harrassment of Curtis Sliwa and Colin Hatcher of the Cyberangels (a.k.a. Guardian Angels). These were the fools who organized a worldwide volunteer police-wannabe force that searched out indecency (in the generic and ill-defined sense of the term) on the net, which when one dug further into their agenda, found it was just a ploy for funding and political power. My incessant harrassment led to the revelation of many things, most importantly that their leader had never ever been on the WWW, stating that he didn't have time to do so. This despite the fact he had time to organize a police force to patrol it. There have been many others since then, most not as evil as the Cyberangels. They each had their own reasons for harrassment. Among some of them have been Carolyn Meinel, O.J. Simpson, Captain Crunch, and Gambit. As many of you know, I make a living as a professional speaker, with federal government, military and intelligence communities as my core audience. Let me put any fears anyone may have to rest: my work concentrates in Information Technology more than anything else, and if I get into hackers and hacking, it is more pro-hacker than anything else. I am working to improve our image as a community of talented individuals. I recently went off on a serious rant with three different audiences on a topic I felt was seriously exaggerated/over-hyped/fearmongered/bullshit. That topic was child pornography on the Internet. If you believed the press, child pornography was all over the Internet and easy to get. This brought about even more press and some action by our legislators to crack down on the Internet. I conducted an eight-week long search for child pornography late last year in the middle of this hype. I searched for, followed literally tens of thousands of links and hacked into pay/private porno servers all over the world. My opinion based on my results, which were not having found a single picture of child pornography anywhere, was that this whole topic was a bunch of bullshit. Well, that all changed a few days ago. I had asked for a software crack in a public USENET forum to override the NT4.0 Server 120 day time limit. While never receiving the crack, some idiot from an anonymous address sent me a child porn .jpg file. Trust me when I say it was child porn; the girl was no older than four years old and was very graphic. I immediately deleted all trace of the message/attachment. I was also very pissed to say the least that some asshole sent me this. I looked around on IRC on #teensex, and by whois'ing several operators, found more insidious channels. Among them are: #preteensexpics #littlegirlsex #100%preteensexpics #100%preteensexfuckpics #!!!!!!preteensexpics There are many others. I joined several of these channels and found that upon entering each one, I was auto messaged about special kiddie porn servers dedicated to trading, e.g., PreTeenSexPics - FTP at 130.67.80.230 l/p ncc/ncc [|] I logged onto several of these servers, and upon doing an ls-la found directories dedicated, among others, to child pornography. CD'ing into these directories listed several hundreds of files such as: 9yoshowr.jpg 8&dad.jpg 4yrfuck.jpg 6thgrade.jpg 6yoanal.jpg These are some of over several hundreds of files in a single directory on a single server. There were dozens of servers. I learned the protocol to download on these servers was to uplaod pictures you owned and then the operator would give you "credits" of various ratios for downloading, i.e., upload two pictures, you get credit to download one picture. I uploaded generic garbage pics off of a commercial adult web site, and recived credit to download three pics. What I saw wanted to make me physically vomit (yes, these pics are long since overwritten with 1's and 0's and destroyed). To put any doubts at rest, the material was real and fit the names of the files mentioned above. I was also actively sent private messages by those looking to trade. I asked what they had, and the usual response was "anything and everything." Some of the more common messages were: "I have 4-12 year old girls both action or pose." "I have little boys and girls alone or together." "I specialize in adults with 4-8 year old girls." I started logging the channels. I wanted to silently gather IP addresses and email addresses. These people needed some genuine hacker terror. Among some of the more active and persistent traders were: (*denotes server in operation) * SylphFox has a ftp at 206.246.162.183 1:2 ratio, anon login * <hehe(a)ts33.dac.pace.edu> * <kiddie(a)t2o15p13.telia.com> <suicide(a)mail1.arnan.com> <alexis(a)broken.dartmouth.edu> <guinness(a)broken.dartmouth.edu> <nexgen(a)philly158.voicenet.com> <tuvak(a)ppp-5200-0403.mtl.total.net> <Triad(a)an108.tir.com> <seeme(a)star090165.galstar.com> <domain(a)port182-tnt-ak-2.ihug.co.nz> <lewisJ(a)user-37kb329.dialup.mindspring.com> name: Lewis Johnson <fungus(a)infounik.com> <tk(a)conc0-a03.conc.tds.net> <pyro(a)user-37kb97d.dialup.mindspring.com> <hat(a)dialin9001.slip.uci.edu> name: Tuyen Ha <phostis(a)har-ct5-03.ix.netcom.com> <polls(a)175-203-179.ipt.aol.com> This log was generated in thirty minutes on #100%preteensexpics. If their email address appears above, it indicates they were actively offering trades or had servers in operation. These people listed above *were not* passive participants in the rooms. This represents only a small sampling of the overall people in the room at the time. Average number of people in each room varies, but seems to number about 40 people per room. I logged out of IRC, and then went to USENET, in such rooms as: alt.binaries.erotica.children.pre-teen There I found several hundreds upon hundreds of .jpg files of real child pornography. Several messages also pointed to some WWW sites, such as: http://www.nudebooks.com For someone who took a virtual tour of the kiddie porn world for only one day, I had the opportunity to download enough files to fully max out an IOmega 100MB ZIP disc. **This is not an exaggeration.** Imagine how much could be, and has, been downloaded by those who are regular participants in this activity. Well, this whole situation is unacceptable. First, I would like to apologize to all those who have hired me in the past, and were subject to my emotional rants about how the whole subject was bullshit and not real. It is very real. It is disgustingly real. It is so real it will make you want to throw up, and I actually, physically did throw up last night. Second, in reference to previous conversation over the years on this list, and in the hacking community in general, I know this type of activity is not tolerated by us. I have given you enough information above to start identifying the players in this and the places they congregate. It would be my sincere hope that hackers of all abilities would spend a few moments each day and put their talents to use against these people. Yes, I am advocating malicious, destructive hacking activity against these people. Who are they going to run to? The police? "They hacked my kiddie porn server and rm -rf'd my computer!" Right...the police will be so anxious to lock us up left and right. These people need to be eradicated from the Internet. While that may never happen completely, enough harrassment will send a message that engaging in this type of activity in very dangerous, and can result in serious harrassment, public embarrassment and computer destruction. This is my war. It will be a public war. I don't care what happens to me by their community or by law enforcement. I feel secure enough that no jury in the world will convict me for taking these people out. I feel secure enough that no law enforcement agency will ever take action that would place me in front of a jury. And if by some chance I do end up being prosecuted, I know what I did was right. So, now start the logs of the channels and the actions of those in it. Now starts the public postings of these logs in various places on the Internet. Now starts the harrassment. Now starts the malicious hacking. Now starts the war. I don't expect people to join me here on this. If you do, you have enough information to start. I caution you to log what is going on, and to make sure you are hitting the guilty, so no innocent people get annihilated in the process. Make damn sure you know who you are hitting and why, and be able to back it up with the idea of having to justify your actions in front of a jury. And make *REALLY SURE* that if you do come across files of child pornography, that you *OVERWRITE AND DESTROY* these files immediately! You wouldn't want to be the one who ends up being prosecuted for being in possession of this type of material. I would also recommend getting an anonymous email account, such as juno.com, mailmasher.com, hacked, etc., so that you can conduct your activities without fear of the inevitable retribution of those who actively trade this shit when the heat starts getting applied to them. Of all the people who can help stop this, it is us...hackers. Not law enforcement, not the government, not the media. Not anyone. Just us, hackers who have the talent to do what no one else can. Please forward this message freely around the Internet. It is not copyrighted in any way, shape, or form. se7en

12 18

Access to Storage and Communication Keys
by Bill Stewart 17 Dec '03

17 Dec '03

The government and its friends have tried for a while to convince the public that there's a great business market for access to keys by the Proper Authorities, whether bosses or cops. A number of us on the Pro-Privacy side have contended that this is wrong - the business need is for later access to stored files, not to encrypted communications keys and of course not to signature keys. Having argued that point vociferously in the past, I'm now going to waffle on the issue - while the business need is for access to stored data, this may often include stored messages received from a communication system in encrypted form. Either the User Interface needs to make it convenient to store the decrypted message, or else the user will store the message in encrypted form - which means there may be a business need for Proper Authority Access later. This means, as {cypher,coder,ranter}punks, we need to address this problem when building crypto tools, to avoid building systems that create or sustain a business need for access to communication keys. Some email systems really encourage you to save messages in one big hulking undocumented monolithic email box, with subfolders and databases and attachments and pointers, and some are a bit more friendly but still leave bits and pieces of MIME splattered on your disk. Some of the nicer tools I've used for encrypted file/mail handling make it convenient to take encrypted incoming mail, decrypt it, and either view it or save it to a file or clipboard. I've been using PGP Inc.'s PGP5.0 Eudora Plug-In, and it decrypts the mail into the mail message buffer itself. When you finish with that particular message (e.g. go to the next, or just close it), you get asked it you want to save the modified message, and if you say "yes" you'll have the decrypted message in your mailbox. However, there's a negative about this - if you receive mail that's signed and encrypted, and save the modified version, it loses the signature information - so it may be more valuable to save the encrypted version... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

3 2

[Noise, California only] Good deal on ISDN access
by Lucky Green 17 Dec '03

17 Dec '03

[I have been sick at home all day, when I just couldn't sleep anymore I hit the web. I hope this makes sense...] Given that a good number of people on this list live in CA, this might be of interest to you. It certainly was to me. PacBell is selling flat rate 2B ISDN Internet access at $50/month. Plus the regular home ISDN fees, but this is still much cheaper than what I paid before. You might want to think hard before you buy at new 56k modem that in all likelihood won't be able to give you 56k anyway. And no analog modem will ever give you 128kbps. Analog lines aren't made for data. They aren't particularly good for data. That's why ISDN was designed. It didn't take off until recently, since it was priced for business and business decided they didn't need it for various reasons. But at these prices, you'd have to be a starving student or nuts not to get it at home. http://dialup.pacbell.net/ISDN/ Disclaimer: I have no financial interest in PacBell. It would be nice, though. :-) --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

3 3