July 2003 - cypherpunks-legacy

Re: MRAM, persistence of memory
by Major Variola (ret) 15 Jul '03

15 Jul '03

At 09:29 AM 7/15/03 -0400, Sunder wrote: >So, the best way to avoid that situation and not being able to reach the >big red switch, is simply not to attract their attention in the first >place by not following the footsteps of Jim Bell. :) Stego + broadcast is indeed your friend. >A more likely, and far more important, scenario to worry about is the >black bag job whereby a hardware keystroke recorder can get installed >without your knowledge... > >There may be ways to prevent/detect this... Software (open or closed >source) alone won't help very much. Epoxy and other conformal coatings are also your friends.

2 1

Re: MRAM, persistence of memory
by Thomas Shaddack 15 Jul '03

15 Jul '03

> In all likelyhood the flashbang armored ninjas with automatics, night > vision, "get the fuck on the floor and shut the fuck up bitch" entry will > happen while you're asleep, so you won't have time to hit the big red > button anyway. Take a relay and connect it to a door switch. When they open the door without authorization[1], the power to the machines is switched off. Then the ninjas' with their typical noisy entry will switch off the system themselves, without you having to touch the Red Button. [1] can be an ID button, can be a wireless ID token (advantage: the reader and the whole identification action can be invisible), can be a keypad, can be an arbitrary complex biometric ID, or any combination of the above, for a low-tech approach can be a reed relay under the wallpaper and a magnet touched to the given spot on the wall The system can be easily coupled with a common-grade burglar alarm, further increasing the range of conditions the shutdown can be triggered with. (Optionally with several levels, depending on the tradeoff between the recoverability from a false alarm and the consequences of missing the alarm: power-down, erase of a long key (unlocked by a passphrase) from NVRAM, physical destruction of the disk array once forceful penetration of outer zones (triggering sequentially the previous lower events in reaction) is followed by physical breach of the server room door or walls (or the so often woefully neglected ceiling and floor).) > So, the best way to avoid that situation and not being able to reach the > big red switch, is simply not to attract their attention in the first > place by not following the footsteps of Jim Bell. :) True. But once the adversary becomes totally information-aware, it will be rather difficult to not attract attention. > A more likely, and far more important, scenario to worry about is the > black bag job whereby a hardware keystroke recorder can get installed > without your knowledge... Another reason for employing a security system. > There may be ways to prevent/detect this... Software (open or closed > source) alone won't help very much. May be the crucial part of implementing the security system. Eg, as an embedded system handling signals from webcams, distributed over the building as several nodes (instead of a central one), mimicking the nerve system of insect.

2 2

MPAA vs. Net anonymity, AB 1143
by Major Variola (ret.) 15 Jul '03

15 Jul '03

Studios Stage Fight Against Internet Bill By Jon Healey, Times Staff Writer The Hollywood studios are fighting a behind-the-scenes battle in Sacramento to derail a bill they say would promote online piracy though the bill has little to do with downloading movies. Actually, the fight may have more to do with who's behind the legislation: the Electronic Frontier Foundation, a civil liberties and technology advocacy group that frequently opposes the studios' anti-piracy initiatives. The measure by Assemblyman Joe Simitian (D-Palo Alto) would help Internet users maintain the anonymity they have in chat rooms and elsewhere on the Internet when sued in state court for something they said or did online. Passed by the Assembly on June 2 and scheduled for a Senate Judiciary Committee hearing today, AB 1143 would require Internet services to notify customers of subpoenas seeking their identities and give customers 30 days to challenge the requests in court. Because it would apply to lawsuits in state courts, the bill wouldn't affect people accused of pirating movies or other copyrighted works online. Copyright cases are heard in federal court. <snip> http://www.latimes.com/business/la-fi-mpaa15jul15,1,5900411.story?coll=la-h…

1 0

MRAM, persistance of memory
by Major Variola (ret.) 15 Jul '03

15 Jul '03

The persistance of memory could be a problem if your melting clocks are swarmed by spooky ants. Wired has an article on magetic RAM http://wired.com/news/technology/0,1282,59559,00.html that fails to mention security implications. Obviously nonvolitile RAM presents a different security risk than RAM that forgets when powered off. Will future OSes have provisions to keep certain data out of MRAM banks, if MRAM doesn't completely displace DRAM? I doubt it. And shutting off your virtual memory swapping --useful today because of the gobs of DRAM machines have-- will no longer be useful for security. Not so obviously to the layman is how many times MRAM must be overwritten to keep the TLAs away. (Exactly analogous to scrubbing a disk.) While this is trivial to do for user-space, if the OS keeps copies of sensitive info this might require more than a huge malloc() & overwrites before shutdown.

8 8

Slashdot | UCB Researchers Critique DRM, Compulsory Licensing (fwd)
by Jim Choate 15 Jul '03

15 Jul '03

http://yro.slashdot.org/yro/03/07/14/2312227.shtml?tid=141&tid=188 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: MRAM, persistence of memory
by Major Variola (ret) 14 Jul '03

14 Jul '03

At 01:51 AM 7/15/03 +0300, Sampo Syreeni wrote: >On 2003-07-14, Michael Shields uttered to Bill Frantz: > >>> Encrypted swap is a crypto sweet spot, because it has perhaps the easiest >>> key management of any crypto system. It seems that the BSD systems have it >>> while Linux still thinks it is difficult. >At this stage I think a small question is in order. Is there any Big Red >Button software out there to complement this level of paranoia? > >What I mean is, after you've got everything in your system under >industrial strength crypto, you have exactly one weak spot, that being a >whole lot of people charging through your door when your system is already >running hot and accessible. At that point the only thing that can save you >is a one-touch mechanism to effect a swift (i.e. at most two or three >seconds), dirty, no-matter-what shutdown, with guaranteed loss of key >material. > >Is there open source software out there to effect that sort of thing? Its called the power button. Which is why MRAM is a different security risk. One could design software such that only the least required is decrypted at any one time, which would minimize the risk from persistant memory after you offed the power. There would probably be a serious performance hit in such software, but tradeoffs are what the game is about.

1 0

Message from JimBob
by Blanc 14 Jul '03

14 Jul '03

Jim would like everyone to read this newest version of his lawsuit, at: http://cryptome.org/jdb-v-usa-106.htm Word Perfect version: http://cryptome.org/jdb-v-usa-106.wpd (633KB) .. Blanc

1 0

Cypherpunks List Info
by cpunk＠lne.com 13 Jul '03

13 Jul '03

Cypherpunks Mailing List Information Last updated: Sep 12, 2002 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html or you can send posts to the list via cpunks_anon(a)einstein.ssz.com and your mail's headers will be stripped before posting. Note that this doesn't provide complete anonymity since the receiving site will still have log file entries showing the source of the mail (or you have to trust that they delete them). You also will be 'sharing' a reputation with the other entities that post through this alias, and some of them are spammers, so some subscribers will have this alias filtered. 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Ssz: Subscription: "subscribe cypherpunks" to majordomo(a)ssz.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)ssz.com Help: "help cypherpunks" to majordomo(a)ssz.com Posting address: cypherpunks(a)ssz.com Filtering policy: raw Message Modification policy: Subject line prepended with "CDR:" Reply-to cypherpunks(a)ssz.com added. Privacy policy: open Info: http://www.ssz.com/cdr/ --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Re: Credit Card fraud gets simple
by Adam Shostack 13 Jul '03

13 Jul '03

On Fri, Jul 11, 2003 at 11:44:23AM -0500, Smith, Michael J. wrote: | Abstract: Credit card theft is now automated via irc bots, even the CVV2. | | http://www.honeynet.org/papers/profiles/cc-fraud.pdf This is unsuprising. The interesting question is how much of the cost will consumers eat vs merchants? Will 3DSET, where you authenticate to your bank, catch on, or be seen as too annoying? What, if anything, is poised to replace credit cards? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Credit Card fraud gets simple
by Smith, Michael J. 13 Jul '03

13 Jul '03

Abstract: Credit card theft is now automated via irc bots, even the CVV2. http://www.honeynet.org/papers/profiles/cc-fraud.pdf Cheers --Mike

1 0