June 2003 - cypherpunks-legacy

Fw: Online Registration and Voting Experiment to Be Launched
by BobCat 16 Jun '03

16 Jun '03

Milspec elections. ----- Original Message ----- From: "Press Service" <afisnews_sender(a)DTIC.MIL> To: <DEFENSE-PRESS-SERVICE-L(a)DTIC.MIL> Sent: Monday, June 16, 2003 11:43 AM Subject: Online Registration and Voting Experiment to Be Launched > By Sgt. 1st Class Doug Sample > American Forces Press Service > > WASHINGTON, June 16, 2003 A DoD voting experiment in the 2000 presidential > elections that allowed military and overseas voters to cast their ballots > through the Internet will be expanded in 2004. > > Beginning this fall, the Federal Voting Assistance Program hopes to get as many > as 100,000 military personnel stateside and overseas their eligible > dependents and U.S. citizens living outside the United States to take part in > the Secure Electronic Registration and Voting Experiment, said Polli Brunelli, > the program director. SERVE covers only those U.S. citizens who fall under the > Uniformed and Overseas Citizens Absentee Voting Act. > > Mandated by Congress, the project eligible voters from participating project > states will be able to register and vote electronically via any Windows-based > personal computer with Internet access from anywhere in world, Brunelli said. > > In the 2000 experiment, 84 citizens located in 21 states and 11 countries voted > in jurisdictions in South Carolina, Texas, Florida, and Utah, proving the > theory that online voting could work for voters wherever they lived, Brunelli > said. > > "We conducted a small 'proof of concept' experiment for the 2000 presidential > election, and it was very successful. Now we are conducting another electronic > voting project. Congress wants it to be large enough to be statistically > relevant. This will allow us to make supportable recommendations to the > Congress on the future of Internet voting for UOCAVA citizens," she said. > > Brunelli noted that 10 states are interested in participating in the 2004 SERVE > project: Arkansas, Florida, Hawaii, Minnesota, North Carolina, South Carolina, > Utah, Ohio, Pennsylvania and Washington. > > "We're looking for volunteer voters to participate in the project," she > explained, "and we have a Web site where interested voters can see if their > voting jurisdiction is participating in the project. Beginning later this year, > the voter can sign up, then register and be able to vote in the 2004 > elections." > > According to Brunelli, local and state election officials will use the SERVE > system to receive voter registration applications, provide ballots to voters > and accept voted ballots. > > Brunelli said security during the registration and ballot process is a primary > concern. SERVE will utilize digital signatures for registration and ballot > encryption as part of the security features. > > "People are concerned about Internet security. We've looked at the threats that > could happen to this type of system, and we've developed mitigating measures to > guard against those threats," she said. > > Brunelli said that not every county in states participating in the experiment > will be part of SERVE. She said voters can find a list of participating > jurisdictions at the SERVE Web site. However, she added that those counties > that do participate will include the "full ballot" for that election -- local, > state and federal. > > The experiment's official Web site can be found at www.serveusa.gov [http://www.serveusa.gov] For more information on > SERVE or the Federal Voting Assistance Program, go to www.fvap.gov [http://www.fvap.gov] > > _______________________________________________________ > NOTE: This is a plain text version of a web page. If your e-mail program > did not properly format this information, you may view the story at > http://www.defenselink.mil/news/Jun2003/n06162003_200306162.html > Any photos, graphics or other imagery included in the article may also > be viewed at this web page. > > > > ==================================================== > > Visit the Defense Department's Web site for the latest news > and information about America's response to the Sept. 11, 2001, > terrorist attacks and the war against terrorism: "Defend America" > at http://www.DefendAmerica.mil. > > ==================================================== > Visit the "Department of Defense Homeland Security" Web site > at http://www.defenselink.mil/specials/homeland/ to learn more > about the Department of Defense role in homeland security. > > ==================================================== > > Unsubscribe from or Subscribe to this mailing list: > http://www.defenselink.mil/news/subscribe.html > ====================================================

1 0

phreq?
by Tarapia Tapioco 16 Jun '03

16 Jun '03

What frequencies do the lea snoop devices run on? Is there a good site for info on such devices?

2 1

anon news
by Nomen Nescio 16 Jun '03

16 Jun '03

Is there some way to read usenet anon, not with google, but with a linux news reader like tin? I'm sure I can use google with JAP fairly securely, but google's pretty slow.

2 1

Cypherpunks List Info
by cpunk＠lne.com 15 Jun '03

15 Jun '03

Cypherpunks Mailing List Information Last updated: Sep 12, 2002 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html or you can send posts to the list via cpunks_anon(a)einstein.ssz.com and your mail's headers will be stripped before posting. Note that this doesn't provide complete anonymity since the receiving site will still have log file entries showing the source of the mail (or you have to trust that they delete them). You also will be 'sharing' a reputation with the other entities that post through this alias, and some of them are spammers, so some subscribers will have this alias filtered. 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Ssz: Subscription: "subscribe cypherpunks" to majordomo(a)ssz.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)ssz.com Help: "help cypherpunks" to majordomo(a)ssz.com Posting address: cypherpunks(a)ssz.com Filtering policy: raw Message Modification policy: Subject line prepended with "CDR:" Reply-to cypherpunks(a)ssz.com added. Privacy policy: open Info: http://www.ssz.com/cdr/ --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Fourth Announcement for ECC 2003
by R. A. Hettinga 15 Jun '03

15 Jun '03

--- begin forwarded text

1 0

Re: An attack on paypal --> secure UI for browsers
by Jamie Lawrence 14 Jun '03

14 Jun '03

On Sat, 14 Jun 2003, Sunder wrote: > Oh get over it. There are other formats. You ever heard of > XML? HTML? RTF? Yes, as a matter of fact. RTF is an MS format, BTW. They do change it sometimes, breaking various attempts at interoperability. They don't do it much; it seems like something they forget to break much of the time. > If the day comes where MS Office DRM only works with MS Office DRM, how > many people will switch to it? If your company is willing to switch to > it, then they'll give you a PC with it on it. If they don't, then they > can't expect you to interact with them via such formats and can't require > you to do so. > > You sound like someone's holding a gun to your head and requiring you to > have MS Office. No, there's no gun to anyone's head. However, as part of negotiating my current contract (I'm a partner in a small software development company), we recieved lots of MS Word/Excel docs. When you're negotiating new business, saying "erm, I don't do windows. Can you give me something else" is a bit of a show stopper. By comparison, if you're selling someone a car, are you going to stop them mid-sale and ask that they please haggle in Euros? (And in case you're curious, our project is entirely open source driven.) > Microsoft is not the DMV. You don't need to use their software. For that matter, one can drive without a license. I see your distinction, however it is very difficult to do business without MS software. I'm typing this on a Linux-running laptop, which is my primary user-level machine, and in order to do business, have to run Crossover. (And I do own my MS Office license.) All of my proposals are written in plain text and sometimes, done in Postgres when I need spreadsheet-like behavior. They have to be rendered in Word format for client consumption. (Open source spreadsheets still suck, in my opinion.) > And no, I will never be part of your problem because the documents I will > create for non work use will be made with Open Office or will be plain > text, html, or xml files. That's a rather fine point to put on it. There isn't much difference between work and non-work for me. Rather, there is, but nonwork choices directly impact my work choices. You seem to offload a lot of your choices onto your company. > If I'm required to use a DRM'ed Office for work, then fine, my company > owns those documents anyway and they can do whatever the fuck they like > with them either way. It doesn't matter to me at all -- it's their call, > it's their company, it's their documents. Just workin' for the man, eh? > Either way, how much a revolt do you think there will be if Microsoft > decides to lock down their tools (such as word) to the point where they > can no longer export to HTML, plain text, RTF should the author wish > it to do so and provides whatever passphrases or ID's needed to unlock > the document and export it out? Honestly, this is supposition, entirely unsupported by anything other than my intuition about how companies I've worked for in the past behave. Feel free to ignore. I think they'll lap it up. Along with expensive and annoying licensing terms, companies get no-forward emails and expiring spreadsheets. Think about what Enron would have done with that. Hell, I suspect MS probably evaluated what they did wrong in the antitrust trial in order to avoid similar outcomes in the future. There's a market there. > Who would buy such a dog of a product? Do you think businesses are so > stupid that they'd put up with a product that jails them in? Get real > son, you're howling at the moon! Um. Who owns the market in "desktop productivity software"? > You want to make a difference? Go ahead, wipe every bit of Microsoft > wares off all your machines and burn the CD's you've installed them > from. Go all open source and show others the right way. At least I'd > have some respect for you for voting with your wallet and practicing what > you preach. > > Right now all you're doing is bitching that you're forced to buy and use > Microsoft Office. I say that's bullshit, and you know it. I use MS software for interoperability testing (much like I use Quickbooks, some Oracle wares, etc.), and for client communication. Everything else in my company is open source. Everything we deploy is open source, unless the client asks for something else. They typically pay for that choice, not only because I'm frequently not familiar with the software they choose, but also because it's a bitch to work with (anyone else ever have to deal with Adobe Distiller under unix?) It isn't bullshit that to operate as a business entity, one needs MS software. I can certainly dick around with my personal website and write my memoirs without it, and 98% of what I do for a living is MS free, getting business without it (read aloud as "public interfaces") is nearly impossible. Perhaps you can ignore that, becuase you're just working for the man, and it isn't your fault that you write MS Word docs. DRM is going to be another cost. I'll have to have a real MS box on hand again, and the problem will be how it worms in to other parts of the business, diverting me from my favored platform. You can say you're not forced to use it. You're also not forced to do anything but swear at other people in public. -j -- Jamie Lawrence jal(a)jal.org "In my little way, I'm sneakily helping people understand a bit more about the sort of people God likes." - Larry Wall.

4 5

Re: An attack on paypal --> secure UI for browsers
by Adam Shostack 14 Jun '03

14 Jun '03

A charming naivete. *Plonk* On Sat, Jun 14, 2003 at 04:29:23PM -0400, Sunder wrote: | Oh get over it. There are other formats. You ever heard of | XML? HTML? RTF? | | If the day comes where MS Office DRM only works with MS Office DRM, how | many people will switch to it? If your company is willing to switch to | it, then they'll give you a PC with it on it. If they don't, then they | can't expect you to interact with them via such formats and can't require | you to do so. | | You sound like someone's holding a gun to your head and requiring you to | have MS Office. | | Either way, you can ask them to export to other document formats which you | can read. Even now Office will export to HTML for example which is | readable by Mozilla and other browsers. | | Microsoft is not the DMV. You don't need to use their software. | | And no, I will never be part of your problem because the documents I will | create for non work use will be made with Open Office or will be plain | text, html, or xml files. | | If I'm required to use a DRM'ed Office for work, then fine, my company | owns those documents anyway and they can do whatever the fuck they like | with them either way. It doesn't matter to me at all -- it's their call, | it's their company, it's their documents. | | But, for personal use, I won't buy any upgrades or new Microsoft | software. End of story. | | Either way, how much a revolt do you think there will be if Microsoft | decides to lock down their tools (such as word) to the point where they | can no longer export to HTML, plain text, RTF should the author wish | it to do so and provides whatever passphrases or ID's needed to unlock | the document and export it out? | | Who would buy such a dog of a product? Do you think businesses are so | stupid that they'd put up with a product that jails them in? Get real | son, you're howling at the moon! | | On one hand you're bitching that you have to use Microsoft software on the | other you're complaining that I'm using it while I'm telling you I don't | want to and don't care to and won't upgrade to it. | | You want to make a difference? Go ahead, wipe every bit of Microsoft | wares off all your machines and burn the CD's you've installed them | from. Go all open source and show others the right way. At least I'd | have some respect for you for voting with your wallet and practicing what | you preach. | | Right now all you're doing is bitching that you're forced to buy and use | Microsoft Office. I say that's bullshit, and you know it. | | | ----------------------Kaos-Keraunos-Kybernetos--------------------------- | + ^ + :25Kliters anthrax, 38K liters botulinum toxin, 500 tons of /|\ | \|/ :sarin, mustard and VX gas, mobile bio-weapons labs, nukular /\|/\ | <--*-->:weapons.. Reasons for war on Iraq - GWB 2003-01-28 speech. \/|\/ | /|\ :Found to date: 0. Cost of war: $800,000,000,000 USD. \|/ | + v + : The look on Sadam's face - priceless! | --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------ | | On Sat, 14 Jun 2003, Adam Shostack wrote: | | > Sure. And I'm glad you work with a small group of people who | > understand that you don't read their documents. After many years of | > refusal, I finally gave up. I work with lots of customers who expect | > documents in MS formats, and look at you askance for giving them | > anything else. You only get so many explanations before customers go | > elsewhere, and I chose not to spend them on this. Similarly, I could | > choose to speak to everyone I meet in, say, Russian. And some folks | > would understand. Others would walk away. So, you can argue that | > you're effectively required to speak English to do business in North | > America. I would argue that you're similarly required to use MS | > Office. | > | > | > You'll be part of the problem when Nogsuccob is apon us, because the | > documents you create won't be readable in OpenOffice, and Crossover | > won't run. | > | > | > Office Nogsuccob will only interoperate with itself. Companies will end | > up deploying it to interact with other versions, not for any real | > feature. | > | > You don't like the word force, I suggest quitting all use of .DOC, | > .PPT, and .XLS formats. Please educate the world on how much better | > the alternatives are. Me, I'll pay my $200 to not bother today, and | > regret it tomorrow. | > | > And by the way, do you have a driver's license, or other state-issued | > ID card? | -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: An attack on paypal --> secure UI for browsers
by Adam Shostack 14 Jun '03

14 Jun '03

On Sat, Jun 14, 2003 at 03:30:47PM -0400, Sunder wrote: | Um, how's that agin? How does Ballmer and Gates force you, Adam Shostack | to run Microsoft Office? Did they put a gun to your head? Did they | manage to twist Congress's arms to put a gun to your head? | | Compatibility you say? Well, that's your choice. You can decide if it's | important enough to you and act accordingly. I personally think MSFT is | evil, and provides nothing but mediocre software. So I vote with my | wallet by not paying them for their junk and I won't buy upgrades of their | software if the previous versions do what I needed, and install Linux and | OpenBSD on new machines. Sure. And I'm glad you work with a small group of people who understand that you don't read their documents. After many years of refusal, I finally gave up. I work with lots of customers who expect documents in MS formats, and look at you askance for giving them anything else. You only get so many explanations before customers go elsewhere, and I chose not to spend them on this. Similarly, I could choose to speak to everyone I meet in, say, Russian. And some folks would understand. Others would walk away. So, you can argue that you're effectively required to speak English to do business in North America. I would argue that you're similarly required to use MS Office. | Yes, my work machine runs win2k, but I didn't pay for it, and I didn't | have much choice in it - actually I could either quit and find a new job | (really lots of fun in this economy) or reinstall Linux over it and live | with Open Office and other open tools or have paid for Crossover office | out of my pocket, etc. Wasn't worth the trouble and we already have a | site license for win2k + office 2k, so that's the path I went. Not my | money, the company's money. They chose to pay the Redmond Beast, so what | do I care? You'll be part of the problem when Nogsuccob is apon us, because the documents you create won't be readable in OpenOffice, and Crossover won't run. | So why do you feel it's required of you to either pay Microsoft for, or | pirate Office XP and Server 2003 and TCPA enabled junkware? What's so | important that you can't live without them. Office Nogsuccob will only interoperate with itself. Companies will end up deploying it to interact with other versions, not for any real feature. You don't like the word force, I suggest quitting all use of .DOC, .PPT, and .XLS formats. Please educate the world on how much better the alternatives are. Me, I'll pay my $200 to not bother today, and regret it tomorrow. And by the way, do you have a driver's license, or other state-issued ID card? Adam | On Sat, 14 Jun 2003, Adam Shostack wrote: | | > Well, sure. And no one forces me to run Microsoft office, either, | > except Microsoft's monoploy. And when the document format can phone | > home to prevent piracy or openoffice from running, no one will be | > 'obligating' me to pay monopoly rents to Microsoft. | | <SNIP> | | > In the same way, no one forces me to have a drivers license. But its | > damned hard living life without one. | > | <SNIP> | | -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Re: Microsoft, TCPA, your wallet and the real ending of the story.
by Adam Shostack 14 Jun '03

14 Jun '03

On Sat, Jun 14, 2003 at 03:17:22PM -0400, Sunder wrote: | Indeed. | | If it's coming from Redmond, and as usual if it smells of evil, there is | an utterly simple solution in dealing with it: don't buy it. Don't buy | Microsoft software, don't buy motherboards that include TCPA capabilities. | When you're up for getting yourself a new PC, get a generic one without | such options, or if you insist, call the vendor and tell them you want a | box without evil-inside and without a Redmond OS pre-installed. Which CPU vendor will sell me a CPU without TCPA? And besides, I WANT a TCPA machine. I just don't want remote attestation, or keys that I can't back-up and relocate. | Buy a generic intel/amd machine without the "Secure" processor, or give | Steve Jobs some of your cash for a nice G4/G5 machine, or you can go to a IBM is starting to add TCPA to the powerpc line. And much as I enjoy my Mac, the DVD player still has this bug where fast-forward doesn't work sometimes. Really annoying when you need to yank a DVD for cleaning, and watch the previews 3 or 4 times. http://www-3.ibm.com/chips/products/powerpc/newsletter/mar2003/ppc_process_… Sparc may be an option if Sun stays in business, but again, I want a TCPA chip that I can control. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Re: An attack on paypal --> secure UI for browsers
by lcs Mixmaster Remailer 14 Jun '03

14 Jun '03

Adam Shostack writes: > Actually, most of the features of Nogsuccob are features that I > want, like integrity protected, authenticated boot. The problem, > bundled with those features, is the ability of the system to attest to > its secure boot. This can be fixed by not letting the host know if > you've exported its host key or not, which makes it possible to run a > virtualized, trusted copy in your emulation environment. Nothing forces you to tell anyone else that you booted securely. At most someone may offer to give you something in exchange for such a proof, but you're not obligated to take them up on it. It's not clear what you're getting at about exporting the host key. These systems (TCs) are generally designed to make that difficult or impossible to accomplish. The security of the whole system is built on that assumption. If you actually did manage to pull out the host key then you could make it attest to any falsehood you wanted, although you might get caught eventually. Trusted Computing lets people convincingly tell the truth about what software they are running. This is seen as a horrific threat in certain circles. It's easy to see why liars wouldn't like it. What does an honest man have to lose?

4 3