July 2003 - cypherpunks-legacy

Re: Secure IDE?
by Jim Choate 30 Jul '03

30 Jul '03

On Wed, 30 Jul 2003, Trei, Peter wrote: > No, I have no idea what this actually means either. > I'm trying to find out. It means it pre-encrypts your data before it's actually put on the drive. In addtion the key is kept in a removable dongle of some sort so you can take it with you. In other words the only bytes on your physical drive are encypted. If the part in possession of the drive doesn't have the key then they can't decrypt it (at least in their theory) without brute force. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Big Brother is watching you - and documenting
by Steve Schear 30 Jul '03

30 Jul '03

eBay, ever anxious to up profits, bends over backward to provide data to law enforcement officials "I don't know another Web site that has a privacy policy as flexible as eBay's," says Joseph Sullivan. A little bit later, Sullivan explains what he means by the term "flexible." Sullivan is director of the "law enforcement and compliance" department at eBay.com, the largest retailer in the world. http://www.haaretz.com/hasen/pages/ShArt.jhtml?itemNo=264863&contrassID=2&s… Experience teaches us to be most on our guard to protect liberty when the government's purpose is beneficent. Men born to freedom are naturally alert to repel invasion of their liberty by evil-minded rulers. The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -Louis Dembitz Brandeis, lawyer, judge, and writer (1856-1941)

1 0

Re: Secure IDE?
by Ralf-P. Weinmann 30 Jul '03

30 Jul '03

On Wed, Jul 30, 2003 at 04:20:37PM -0400, Trei, Peter wrote: > ABIT has come out with a new motherboard, the > "IC7-MAX3" featuring something called 'Secure > IDE', which seems to involve HW crypto in the > onboard IDE controller: > > >From the marketing fluff at > http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 > > "For MAX3, the ABIT Engineers listened > to users who were asking for information > security. SecureIDE connects to your IDE > hard disk and has a special decoder; > without a special key, your hard disk cannot > be opened by anyone. Thus hackers and > would be information thieves cannot access > your hard disk, even if they remove it from your > PC. Protect your privacy and keep anyone > from snooping into your information. Lock > down your hard disk, not with a password, > but with encryption. A password can be > cracked by software in a few hours. ABIT's > SecureIDE will keep government > supercomputers busy for weeks and will > keep the RIAA away from your Kazaa files." > > No, I have no idea what this actually means either. > I'm trying to find out. > > Peter Trei 40-bit DES in ECB mode sounds even more great. It's them Enovatech guys again. See here: http://archives.abditum.com/cypherpunks/C-punks20030519/0079.html Cheers, Ralf -- Ralf-P. Weinmann <rpw(a)uni.de> PGP fingerprint: 2048/46C772078ACB58DEF6EBF8030CBF1724

1 0

Re: Secure IDE?
by Ralf-P. Weinmann 30 Jul '03

30 Jul '03

On Wed, Jul 30, 2003 at 04:20:37PM -0400, Trei, Peter wrote: > ABIT has come out with a new motherboard, the > "IC7-MAX3" featuring something called 'Secure > IDE', which seems to involve HW crypto in the > onboard IDE controller: > > >From the marketing fluff at > http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 > > "For MAX3, the ABIT Engineers listened > to users who were asking for information > security. SecureIDE connects to your IDE > hard disk and has a special decoder; > without a special key, your hard disk cannot > be opened by anyone. Thus hackers and > would be information thieves cannot access > your hard disk, even if they remove it from your > PC. Protect your privacy and keep anyone > from snooping into your information. Lock > down your hard disk, not with a password, > but with encryption. A password can be > cracked by software in a few hours. ABIT's > SecureIDE will keep government > supercomputers busy for weeks and will > keep the RIAA away from your Kazaa files." > > No, I have no idea what this actually means either. > I'm trying to find out. > > Peter Trei Yeah, that announcement just ran over the slashdot ticker. Someone posted the following insightful link subsequently: ftp://ftp.abit.com.tw/pub/download/fae/secureide_eng_v100.pdf Looks like that sucker only does key-truncated version of DES called DES-40. Right... did they say weeks? I'd say minutes, unless ABIT means [insert some impoverished 3rd world country] government supercomputers. It's snakeoil, move on, nothing to see here. Cheers, Ralf -- Ralf-P. Weinmann <rpw(a)uni.de> PGP fingerprint: 2048/46C772078ACB58DEF6EBF8030CBF1724

1 0

RE: Secure IDE?
by Trei, Peter 30 Jul '03

30 Jul '03

> Trei, Peter > > ABIT has come out with a new motherboard, the > "IC7-MAX3" featuring something called 'Secure > IDE', which seems to involve HW crypto in the > onboard IDE controller: > > From the marketing fluff at > http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 > > "For MAX3, the ABIT Engineers listened > to users who were asking for information > security. SecureIDE connects to your IDE > hard disk and has a special decoder; > without a special key, your hard disk cannot > be opened by anyone. Thus hackers and > would be information thieves cannot access > your hard disk, even if they remove it from your > PC. Protect your privacy and keep anyone > from snooping into your information. Lock > down your hard disk, not with a password, > but with encryption. A password can be > cracked by software in a few hours. ABIT's > SecureIDE will keep government > supercomputers busy for weeks and will > keep the RIAA away from your Kazaa files." > > No, I have no idea what this actually means either. > I'm trying to find out. > > Peter Trei > Yeah, I know it's tacky to followup ones own messages, but I found a little more: http://www.abit.com.tw/abitweb/webjsp/english/SecureIDE.htm "SecureIDE is a encryption device that uses the eNOVA X-Wall chipset that ensures confidentiality and privacy of your data through disk encryption. When booting up your system, go to DOS and implement the FDISK instruction. This instruction will make a partition to format the Hard Disk to accept the secure IDE key. After this procedure, there are no more extra steps to perform besides using the key to "open" the hard disk each time you boot up your system." The accompanying diagram shows a daughterboard sitting between the HD and the system, with a USB dongle coming off the side. eNova has more info at: http://www.enovatech.com/w/html/about.htm The USB dongle apparently acts only as a key store, for a DES or 3DES key. It needs to be present at boot time. It appears that the key is put on the device by the manufacturer !!!! though they promise "Enova Technology does not maintain a database of X-Wall Secure Keys". On the good side, it seems to encrypt the whole disk, including the boot sector and swap. No info on chaining modes, if any, nor of IV handling. There is no mention of a PIN or other 'something you know' required to use the USB key. I can't tell if pulling the dongle shuts down the system. Might be neat, but as yet, insufficient information. Peter

1 0

Secure IDE?
by Trei, Peter 30 Jul '03

30 Jul '03

ABIT has come out with a new motherboard, the "IC7-MAX3" featuring something called 'Secure IDE', which seems to involve HW crypto in the onboard IDE controller: >From the marketing fluff at http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 "For MAX3, the ABIT Engineers listened to users who were asking for information security. SecureIDE connects to your IDE hard disk and has a special decoder; without a special key, your hard disk cannot be opened by anyone. Thus hackers and would be information thieves cannot access your hard disk, even if they remove it from your PC. Protect your privacy and keep anyone from snooping into your information. Lock down your hard disk, not with a password, but with encryption. A password can be cracked by software in a few hours. ABIT's SecureIDE will keep government supercomputers busy for weeks and will keep the RIAA away from your Kazaa files." No, I have no idea what this actually means either. I'm trying to find out. Peter Trei

1 0

Re: Someone at the Pentagon read Shockwave Rider over the weekend
by Mac Norton 30 Jul '03

30 Jul '03

Tim has identified the problems, including what may be the most important one, that the "market," unlike other such markets, is subject to gaming for motives that are other than economic. In other words, the item in question doesn't lend itself to commoditization; the subject pork bellies are not fungible. MacN -----Original Message----- From: Tim May [mailto:timcmay@got.net] Sent: Tuesday, July 29, 2003 6:17 PM To: cypherpunks(a)lne.com X-Orig-To: cypherpunks(a)lne.com Subject: Re: Someone at the Pentagon read Shockwave Rider over the weekend On Tuesday, July 29, 2003, at 03:24 PM, Steve Schear wrote: > At 16:20 2003-07-29 -0700, John Young wrote: >> Tim May wrote: >> >> >Yes, a bunch of "ideas futures" markets have existed for nearly a >> >decade. An acquaintance of mine, Robin Hanson, was actively promoting >> >such things in the late 80s and may have been involved in some of the >> >Extropians-type markets which arose a few years later (I recollect >> >several efforts with varying degrees of success). >> >> Yes, Robin Hanson worked on DARPA's PAM program. Here's >> his e-mail about it in May 2003: > > Looks like Robin may have to concentrate on a commercial venture if he > wants to see his ideas put into practice. > > And use an offshore nexus, and good anonymity and digital cash tools...just as predicted many years ago. Doing this aboveboard, and doing it with the collusion of the actors who can alter the outcome, is asking for trouble: * violation of gambling laws...as I said in other articles, betting on the death of the King of Jordan is not different from betting on the winner of the World Series. * distortion of markets by players who see more benefit in adjusting the expectations than in spending some relatively small amount of money (If "Chances that weapons of mass destruction being found in Iraq by Nov. 1" is being de-rated, in a relatively thin market of a few dozen players, then someone with an interest in altering the odds can probably do so with relatively little money...especially if the money is from a Black Budget and comes from money taken at gunpoint from taxpayers.) (I can't resist mentioning that I was able to massively distort/sabotage the market in reputations that the Extropian list experimented with in 1993. I did this by buying "play money" (extro-dollars or whatever they were called) from other players in an out-of-band transaction. A mere $20 in U.S. money gave me a huge amount of additional spending money in this reputation market. Naturally, my reputation rose. Likewise, if Paul Wolfowitz wants the market to assess a "grave danger" that Norway is financing terrorism, he can use out-of-band methods to get a bunch of "ringers" (cut-outs, co-conspirators) to start bidding up the market. As the penalty for not guessing correctly is not clear until the outcome, and inasmuch as the money is provided by agencies, the opportunities for mischief are obvious.) * Insider trading. Letting government employees benefit from their inside information is like letting IBM or Intel employees engage in a wagering system based on KNOWLEDGE THEY ACTUALLY HAVE. (Not that insider trading is unknown in commodity or stock markets, including futures markets. But these markets have traditionally been heavily regulated and insider trading is forbidden, at least nominally. In the case of this DARPA market, the players are by definition the insiders, with various amounts of very non-public information about plans and contingincies. "Duh.") And so on. So many attacks on this system. Anyway, there _already_ are very real, hard to manipulate markets in information. We call them markets. Markets for real estate, for corn, for copper, etc. If a lot of residents of Jordan think a collapse is coming, real estate prices in Amman will fall. If a lot of technologists think a return to copper wiring is coming, copper prices will rise. And so on. Betting on contrived propositions with relatively small amounts of money ("toy systems") and/or with play money is not very interesting. --Tim May

1 0

Important: P2P+VOIP
by Tyler Durden 30 Jul '03

30 Jul '03

This article appeared in the Lightreading telecom site. Although fairly speculative, the mere implications of VoIP over P2P should be of much interest to Cypherpunks, perhaps the least importance being encryption. -TD Ever since KaZaA, founder Niklas Zennstrom let it slip in a Boardwatch interview that he was planning to launch a company offering voice services using peer-to-peer (P2P) protocols, Light Reading and Boardwatch have been puzzling over what he meant. As Zennstrom himself has clammed up, speculation is in order. And our best guess is that he might be onto something REALLY BIG. Think bigger than Google. Think of something equivalent to the Internet's Domain Name System (DNS) that would act as a distributed, dynamic, global telephone directory, linking users with whatever IP address their appliance happened to be using at the moment. This addresses one of the big obstacles in the development of voice over IP (VOIP), and it might also unlock other breakthroughs. For instance, it could speed up the convergence of fixed and mobile telephony -- reckoned by Neil Ransom, CTO of Alcatel SA (NYSE: ALA - message board; Paris: CGEP:PA), to be the next big thing in telecom (look for the coming Light Reading interview). It would be fairly straightforward to use P2P protocols to create such a distributed, global telephone directory, according to Geoff Bennett, director of Light Reading University, who happens to be moderating a Light Reading Webinar titled "Controlling P2P: Who's Stealing Your Bandwidth?" today, at 2:00 p.m. New York time. (Click here to register for the free, live broadcast.) With P2P, a user could search a directory using a special browser and then click on the name he or she wanted to call. The client software would send the request to the equivalent of a KaZaA supernode that would search a giant routing table listing users and their current IP addresses, and send back the result to the client so the VOIP call could be set up. This is pretty much how file sharing works, and file sharing clearly scales to the millions of users that might take advantage of such a system. Zennstrom estimates that 100 million people already use P2P protocols, and the KaZaA browser software has been downloaded a staggering 250 million times -- an order of magnitude more than anything else on CNET's download site. There are good reasons to believe that a P2P-based phone directory of this sort might work better than the VOIP solutions being cooked up by the Internet Engineering Task Force (IETF). The IETF has various projects in this area, but they're all based on the fundamental philosophy that existing technology -- namely DNS -- should be adapted to deal with new requirements, rather than inventing something new. But the new requirements in this case include more than just the IETF's Telephone Number Mapping (enum) project. The IETF has also got to come up with a way of making DNS more dynamic, so that when a user moves from one IP address to another, he or she isn't cut off from the world while the changes propagate through the DNS hierarchy. When Boardwatch changed IP address earlier this year, a lot of readers were cut off for two or three days. Imagine the same thing happening every time someone shifted from a fixed to a mobile appliance! Then there's the issue of reliability. Concerns are often expressed about the security of DNS -- in particular, its vulnerability to denial-of-service (DOS) attacks. A P2P approach promises to be much more reliable, because it's so distributed and because the protocol has been designed to allow for parts of the network going AWOL unexpectedly. "Historically, the issue with proprietary solutions has been lack of scaleability, and how robust they are in large networks," Bennett notes. "But P2P apps like KaZaA have shown they can scale and have amazing resilience because they're so distributed. How do you make a DOS attack on something that big? "The P2P solution will obviously be proprietary, and it's always quicker to get a proprietary solution to market than to wait for consensus in a standards group -- especially about something as institutionalized as DNS." For more on IETF side of the story, check out the following columns by Geoff Huston, a member of the Internet Architecture Board, the IETF steering body: Lord of the Numbers Who are You? Light Reading is rather hoping that this speculation will encourage Zennstrom to spill the beans on what he's up to. Right now, we think we've only got half the story. The other half concerns SIP -- the Session Initiation Protocol -- seen by some as another catalyst for a VOIP explosion. In the Boardwatch interview Zennstrom slapped down the idea that his project had anything to do with SIP. Which leads us to ask: Why was he so adamant? Peter Heywood, Founding Editor, Light Reading _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Re: Pentagon discovers Assasination Politics, deadpools
by Major Variola (ret) 30 Jul '03

30 Jul '03

At 10:56 PM 7/29/03 -0700, Bill Stewart wrote: >Assuming it can be legally structured as a "Futures Market", >rather than as "Illegal Gambling", it could make money. >(There are obviously some bets it's unlikely to handle, >such as the bet that Idea Futures markets would be successfully prosecuted >as illegal gambling :-) *Real* futures markets are effectively integrating all the AP type risks (plus others, like weather) relevant to their markets. The Pentagon plan was trying to get the same kind of private but well-done research that real futures traders do, with emphesis on issues of interest to it. As well as a feedback channel to the domestic psyops boys. CNN, etc. also perform a sort of gambling (probabilistic investment, "futures"), in how they distribute their resources in anticipation of regional "news".

1 0

Re: AP by any other name ...
by pgut001＠cs.auckland.ac.nz 30 Jul '03

30 Jul '03

Anonymous <nobody(a)cryptofortress.com> writes: >I first ran into this market concept about ten years ago. The Iowa Political >Stock Market successfully predicted the outcome of the 1992 U.S. presidential >election within a few tenths of a percentage point for all three candidates >(including Perot). It was more accurate than 8 major polls. Since then there >have been many other experiments with other markets: Hollywood Stock Exchange >where people bet on future box office receipts and Foresight Exchange where >traders bet on the outcomes of unresolved scientific and societal questions. It's been used in other areas as well, and for rather longer than ten years. For example, one of the most accurate estimates of the entropy of natural language involved people placing bets on the value of the next letter seen (as opposed to the more traditional "I guess it'll be an 'e'" estimation technique). Peter.

1 0