August 2003 - cypherpunks-legacy

Popular Net anonymity service back-doored (fwd)
by Thomas Shaddack 21 Aug '03

21 Aug '03

---------- Forwarded message ---------- Date: Wed, 20 Aug 2003 21:56:22 -0700 Subject: Popular Net anonymity service back-doored From: Thomas C. Greene <thomas.greene(a)theregister.co.uk> Organization: The Register To: bugtraq(a)securityfocus.com Popular Net anonymity service back-doored Fed-up Feds get court order http://theregister.co.uk/content/55/32450.html The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and goings across the Internet, has been back-doored by court order. The service is currently logging access attempts to a particular, and unnamed, Web site and reporting the IP addys of those who attempt to contact it to the German police. We know this because the JAP operators immediately warned users that their IP traffic might be going straight to Big Brother, right? Wrong. After taking the service down for a few days with the explanation that the interruption was "due to a hardware failure", the operators then required users to install an "upgraded version" (ie. a back-doored version) of the app to continue using the service. "As soon as our service works again, an obligatory update (version 00.02.001) [will be] needed by all users," the public was told. Not a word about Feds or back doors. Fortunately, a nosey troublemaker had a look at the 'upgrade' and noticed some unusual business in it, such as: "CAMsg::printMsg(LOG_INFO,"Loading Crime Detection Data....\n");" "CAMsg::printMsg(LOG_CRIT,"Crime detected - ID: %u - Content: \n%s\n",id,crimeBuff,payLen);" and posted it to alt.2600. Soon the JAP team replied to the thread, admitting that there is now a "crime detection function" in the system mandated by the courts. But they defended their decision: "What was the alternative? Shutting down the service? The security apparatchiks would have appreciated that - anonymity in the Internet and especially AN.ON are a thorn in their side anyway." Sorry, the Feds undoubtedly appreciated the JAP team's willingness to back-door the app while saying nothing about it a lot more than they would have appreciated seeing the service shut down with a warning that JAP can no longer fulfill its stated obligation to protect anonymity due to police interference. Admittedly, the JAP team makes some good points in its apology. For one, they say they're fighting the court order but that they must comply with it until a decision is reached on their appeal. Jap is a collaborative effort of Dresden University of Technology, Free University Berlin and the Independent Centre for Privacy Protection Schleswig-Holstein, Germany (ICPP). A press release from ICPP assures users that JAP is safe to use because access to only one Web site is currently being disclosed, and only under court-ordered monitoring. But that's not the point. Disclosure is the point. The JAP Web site still claims that anonymity is sacrosanct: "No one, not anyone from outside, not any of the other users, not even the provider of the intermediary service can determine which connection belongs to which user." This is obviously no longer true, if it ever was. And that's a serious problem, that element of doubt. Anonymity services can flourish only if users trust providers to be straight with them at all times. This in turn means that providers must be absolutely punctilious and obsessive about disclosing every exception to their assurances of anonymity. One doesn't build confidence by letting the Feds plug in to the network, legally or otherwise, and saying nothing about it. Justifying it after the fact, as the JAP team did, simply isn't good enough. Telling us that they only did it to help catch criminals isn't good enough either. Sure, no normal person is against catching criminals - the more the merrier, I say. But what's criminal is highly relative, always subject to popular perception and state doctrine. If we accept Germany's definition of criminal activity that trumps the natural right to anonymity and privacy, then we must accept North Korea's, China's and Saudi Arabia's. They have laws too, after all. The entire purpose of anonymity services is to sidestep state regulation of what's said and what's read on the basis of natural law. The JAP Web site has a motto: "Anonymity is not a crime." It's a fine one, even a profound one. But it's also a palpably political one. The JAP project inserted itself, uncalled, into the turbulent confluence between natural law and state regulation, and signaled its allegiance to the former. It's tragic to see it bowing to the latter. .

1 0

Re: National Emergency?
by Major Variola (ret) 21 Aug '03

21 Aug '03

At 07:33 AM 8/21/03 -0700, Eric Murray wrote: >On Thu, Aug 21, 2003 at 08:17:35AM -0500, Harmon Seaver wrote: >> So how much of the Constitution gets shredded by Bush's declaration of a >> "national emergency" right after 9/11, and how long can he maintain that. I >> mean, I realize the the Constitution/bill of rights is pretty much gone anyway, > >Hasn't there been a perpetual "National Emergency", signed by >every president since WWII or therebouts? > >Is Bush's a double plus National Emergency? It has come to our attention that you citizens are being unsoc. Please turn on your telescreen (eg Fox News) and wait for the next minute of hate. Then call your local Fatherland Security Agency and wait for instructions. Repeat after me: "We have always been at war with Oceania bin Laden" War is peace. ------ In no part of the constitution is more wisdom to be found, than in the clause which confides the question of war or peace to the legislature, and not to the executive department. -James Madison (congress has not declared war since 1941)

1 0

Re: US soldiers in Iraq held against their will
by Tyler Durden 21 Aug '03

21 Aug '03

Peter Thonen wrote.. "On that same note, any weekend warrior who complains about being activated has no sympathy from me. Take the devils coin, be prepared to do his work also." Well, what if the Devil stole that $ from you in the first place? What level of subversion is appropriate in order to re-appropriate those $$$? This case is clearly different from the true blue career war criminal, ehr I mean career soldier. Here, these people have likely been paying taxes for a while! So I don't mind too much if they're trying to dodge their commitment in this context. -TD >From: "Thoenen, Peter CIV Sprint" ><peter.thoenen(a)email-tc3.5sigcmd.army.mil> >To: Harmon Seaver <hseaver(a)cybershamanix.com> >CC: cypherpunks(a)minder.net >Subject: Re: US soldiers in Iraq held against their will >Date: Mon, 18 Aug 2003 16:52:25 +0200 > >Harmon Seaver wrote: > > > On Sun, Aug 17, 2003 at 10:37:15PM -0700, Major Variola (ret) wrote: > > > >>At 02:33 PM 8/17/03 -0500, Harmon Seaver wrote: > >> > >>> Just heard about this local guy who reluctantly went to Iraq because > >> > >>>he was in the reserves, now his contract is up (as of 7/31) and they > >>>won't let him out. > >> > >>Did he reluctantly take the $$$ to be in the reserves, too? > >> > >> > >>>my > >>>enlistment contract ended and the I have been involuntarily extended. > >> > >>SOP. Happened during the Yugo thang too. > >On a semi related side note, how long has this guy been in (total length of >service)? All personnel >when they join the US Military are quite clearly informed they have an >8-year >commitment, regardless >of how long their initial enlistment is. If your initial commitment is >less >than 8 years, you are >moved into the Inactive Ready Reserve (IRR) for the remainder of the 8 >years. >(E.g. you enlist for 4 >years active or ready reserve (weekend warriors); you will also spend 4 >years >in IRR). > >While in the IRR you have no requirements other than to keep the government >informed of your current >contact information. You have no drills and receive no benefits. The US >Government though reserves >the right to call you up at whim any time during this period. I am curious >if >this person is still >within his 8-year commitment even though he completed his initial >commitment. >If he is still within >this 8 year window, he doesnt have a leg to stand on nor my sympathy. > >On that same note, any weekend warrior who complains about being activated >has >no sympathy from me. > Take the devils coin, be prepared to do his work also. The few folk >that >have my sympathy are >those IRR folk that have be activated. I have a couple IRR buddies who >haven't so much as thought >about the military in years all of a sudden get activated for Iraq, now >thats >something to complain >about. 4 years active, 3 years smoking dope in college, then a call from >the >good old us army >ordering you to report to your IRR unit within 48 hours and go to Iraq. >Those >are the folk I feel >sorry for. They did their time, got out, and didn't continue to take the >devils coin ever 4th weekend. > > >> > >>It hasn't, it only requires males to register. So far. > >> > > > >How is that for some equally rights. Women continue to whine and cry that >they are being >discriminated against in the military as the military refused to open up >certain all male MOS's (18 >and 11 series to name a couple) yet I don't see them hounding congress for >the >equal right to be >drafted. Nothing like having your cake and getting to eat it to. > >** OFFTOPIC: Anybody remember the exact saying (and who coined it) about if >you take the Devil's >coin, don't complain about doing the Devil's work. I can not seem to find >the >exact text ** > >-Peter > >DISCLAIMER: Like always, this email is the personal opinion of Peter >Thoenen >and not condoned by >Sprint or the US Army. > >[demime 0.97c removed an attachment of type application/pgp-signature] _________________________________________________________________ <b>Help protect your PC:</b> Get a free online virus scan at McAfee.com. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

4 4

Postal ID plan creates privacy fears
by Steve Schear 20 Aug '03

20 Aug '03

A government report that urges the U.S. Postal Service to create "smart stamps" to track the identity of people who send mail is eliciting concern from privacy advocates. The report, released last month by the President's Commission on the U.S. Postal Service, issued numerous recommendations... One is that the USPS "aggressively pursue" the development of a so-called intelligent mail system... [that] would involve using barcodes or special stamps, identifying, at a minimum, the sender, the destination and the class of mail ...The report proposes a broad expansion of the concept to all mail for national security purposes. It also suggests USPS work with the U.S. Department of Homeland Security to develop the system... http://news.com.com/2100-1028_3-5062617.html "There is no protection or safety in anticipatory servility." Craig Spencer

1 0

The Entrekins
by The Entrekins 20 Aug '03

20 Aug '03

[demime found a multipart/alternative section which it tried to parse but could not find any section which it could render. Please send plain text.]

1 0

City Unplugs Camera Software
by R. A. Hettinga 20 Aug '03

20 Aug '03

<http://info.mgnetwork.com/printthispage.cgi?url=http%3A//www.tampatribune.c…> Aug 20, 2003 City Unplugs Camera Software By THOMAS W. KRAUSE tkrause(a)tampatrib.com TAMPA - The Tampa Police Department has eliminated the facial-recognition software hooked up to cameras scanning crowds in Ybor City - after two years, zero arrests and zero positive identifications. The software, provided to the city free by its manufacturer, was intended to recognize the facial characteristics of felons and runaway children through a database of more than 24,000 mug shots. It was shut down Tuesday, having failed in its objective. ``It's just proven not to have any benefit to us,'' said Capt. Bob Guidara, a department spokesman. The 36 surveillance cameras, which were installed a few years before the facial-recognition software, will remain. Police spokesman Joe Durkin said the software might not work but the cameras have led to several arrests. ``Officers have been able to make arrests involving illegal drug dealing, fights and things of that nature,'' Durkin said. ``One officer monitoring the cameras has been able to be the eyes of many in foiling this type of activity.'' The cameras are staffed by one officer every Thursday, Friday and Saturday during peak night hours. The software will be removed, but the surveillance schedule will not change. When the FaceIt system first was suggested for Tampa, civil liberties groups voiced concerns about loss of privacy. Durkin said Chief Bennie Holder discontinued the system because of the lack of arrests, not the privacy issues. In June 2001, the FaceIt software was loaned to Tampa as a test market. Last year, after the system made no positive identifications, the software and cameras were tweaked. Initially, only one of the 36 cameras in Ybor City could use the identification software at any given time. Since last year's upgrade, six cameras could scan crowds for faces and compare those faces to the database. Software also was upgraded to work better in the low lighting of Ybor streets. Despite the attempt to work out the kinks, the FaceIt system failed to make a positive match after another year. Although Tampa has had the system for two years, it was not in use for four months at the end of 2001. No explanation for the lack of use was released. Guidara said FaceIt did work well in controlled testing. People's faces were entered into the system, then the people were sent to Ybor. About 80 percent were identified by FaceIt, he said. Asked why testing proved reliable but usage provided no identifications, Guidara was stumped. ``That's a good question,'' he said. ``I think those questions are better asked of the manufacturer.'' Representatives of Identix Corp. did not return calls Tuesday. When Tampa installed the software, it was one of two U.S. cities using the system. Virginia Beach installed FaceIt for its boardwalk, but unlike Tampa, paid for it through a $150,000 federal grant matched with $50,000 of its own money. An Identix spokesman told The Tampa Tribune last year that tests in the Boston and Dallas-Fort Worth airports were successful. The Identix Web site says the FaceIt system has ``proven to be an effective investigative tool in helping to identify individuals on a watch list'' and says it has been used in town centers, airports and border crossings worldwide. Reporter Andy Reid contributed to this report. Reporter Thomas W. Krause can be reached (813) 259-7698. This story can be found at: http://www.tampatribune.com/MGA0TF0TKJD.html Go Back To The Story -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: US soldiers in Iraq held against their will
by Tyler Durden 20 Aug '03

20 Aug '03

Peter Thoenen wrote... "That is the same logic I use to justify to myself working as a defense contractor. The amount uncle sam will pay me in my lifetime is greater than or equal to the amount I will ever actually pay him in taxes. I win in the long run :) " Just make sure those bombs you're building don't actually work! Otherwise, keep on "bleeding the beast"... -TD >From: "Thoenen, Peter CIV Sprint" ><peter.thoenen(a)email-tc3.5sigcmd.army.mil> >To: Tyler Durden <camera_lumina(a)hotmail.com> >CC: hseaver(a)cybershamanix.com, cypherpunks(a)minder.net >Subject: Re: US soldiers in Iraq held against their will >Date: Wed, 20 Aug 2003 19:20:15 +0200 > > >Tyler Durden wrote: > >>Peter Thonen wrote.. >> >>"On that same note, any weekend warrior who complains about being >>activated has >>no sympathy from me. >> Take the devils coin, be prepared to do his work also." >> >>Well, what if the Devil stole that $ from you in the first place? What >>level of subversion is appropriate in order to re-appropriate those $$$? >> >>-TD >> > >That is the same logic I use to justify to myself working as a defense >contractor. The amount uncle sam will pay me in my lifetime is greater >than or equal to the amount I will ever actually pay him in taxes. I win >in the long run :) > >-Peter ><< attach3 >> _________________________________________________________________ <b>Get MSN 8</b> and enjoy automatic e-mail virus protection. http://join.msn.com/?page=features/virus

1 0

Archive mboxes
by Steve Furlong 20 Aug '03

20 Aug '03

As per multiple request, the weekly mboxes for the Cypherpunks mailing list (LNE node) are available at my cpunks archive site: http://archives.abditum.com/cypherpunks/ The hypermail conversions are available as before, with new links to the .tgz mboxes. These mboxes are exactly as produced by my mail client. In particular, email addresses are not munged. The consensus of those who answered by "concerns" mail seems to be that spammers wouldn't get any useful addresses from the mboxes that they couldn't get more easily by other means. Annual sets will be added as appropriate to the bottom of the page. So far, there's only a 2002 set. -- Steve Furlong Computer Condottiere Have GNU, Will Travel "If someone is so fearful that, that they're going to start using their weapons to protect their rights, makes me very nervous that these people have these weapons at all!" -- Rep. Henry Waxman

1 0

Re: paradoxes of randomness
by Major Variola (ret) 19 Aug '03

19 Aug '03

At 08:45 AM 8/19/03 -0700, Tim May wrote: >Only worry about the deep philosophical implications of randomness >after you have grasped, or grokked, the essence. Then do this: get a block cipher or crypto-hash algorithm, and pick a key. Now encrypt 0, then 1, then 2, etc. Examine the 17th bit of each output as you encrypt the integers. Is this sequence random? Compressible? How could you tell whether this sequence is random or not, if you didn't know the key? Hint: those are trick questions intended to lure you into crypto. And if you ask "why 17?" you get whacked by a virtual bamboo cane.

2 1

Re: Viral DNS Attack, DDos Idea
by Major Variola (ret) 19 Aug '03

19 Aug '03

At 10:11 AM 8/17/03 -0700, Tim May wrote: >Many evolved diseases _DO_ kill their hosts. Look around. > >It is true that there are tradeoffs in lethality, time to death, and >virulence, and that a disease which kills too quickly and too many >won't spread adequately, but quite clearly all of the diseases of the >past were evolved (until recently, none were created) and yet they >often killed their hosts. This objection jammed in my memegrinder so I had to examine it. I'll argue that the nastiness of many human diseases are *temporary* exceptions to the "evolved pathogens don't kill" observation. Because humans are not in equilibrium: * Human population is growing. This means you can kill your host, two new ones are born every minute (except in a few places, eg W. Europe). If your host population is growing like that, you can be extra lethal, temporarily. If the host numbers are stable, you could wipe them all out if you're too lethal. * Humans are expanding their range. This means new diseases are introduced from existing resivoirs so they have not adapted to humans --especially the conditions of modern humans-- yet. Ebola, HIV, etc. * Humans only *recently* live in dense (and stationary) groups. This means that pathogens have not adapted yet. Cities are incubators. Bubonic plague, TB are good examples here. * Rapid travel is even more recent an invention. Populations who have never seen a pathogen (West nile, etc.) are getting exposed for the first time. No equilibrium there. The "Cortez" effect, amplified by Whittle's jet engine. "Globalization" means everyone gets exposed to everyone else's pathogens. A sick chinese chicken can ruin your day in America. Guns, germs, and steel. BTW Globalization also means that everyone gets exposed to everyone's plants, insects, etc. A lot of isolated species (e.g., Hawaii) that can't deal with competition will be toast just as much as the Amerinds who met Mr. Cortez. Guns, germs, and steel. Meet Mr. Kudzu. ..... Obviously, the scale of "temporary" should be taken in the larger context, not that of one's own lifespan. Of course a coadapted pathogen (eg flu) can spontaneously become newly virulent simply because of mutation or recombination. If the hosts aren't all connected, then merely one particular host-group dies, along with the newly virulent strain. Losing some village is not a big deal (until someone gets on a plane). .... Interesting to extend the analogy to say virii that zap cellphones or PCs permenantly vs. merely being annoyances. A PC-zapping virus would give Macs the kind of ripe open field not seen since the days of the Bering Strait. Also interesting to view the RIAA vs. Networked-Computer struggle in a biological ("evo/eco") light. Ms. Dodo, meet Mr. Kudzu. And of course fascinating to watch how the new dense mobile humans (or their lawyers :-) adapt behaviorally.

1 0