April 2004 - cypherpunks-legacy

Mixmaster RFC
by Len Sassaman 06 Apr '04

06 Apr '04

Hello, I'm preparing to submit draft -02 of the revised Mixmaster Protocol Specification. If you have any comments, or have previously contributed and have not been acknowledged, please let me know as soon as possible by sending mail to mixmaster-devel(a)lists.sourceforge.net. The last published version is here: http://www.ietf.org/internet-drafts/draft-sassaman-mixmaster-00.txt The current working version of the I-D is here: https://source.mixmaster.anonymizer.com/svn/mixmaster/trunk/Docs/draft- sassaman-mixmaster-XX.txt (Please comment on the latter). Thanks, Len --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: Private U.S. Guards Take Big Risks for Right Price
by Major Variola (ret) 05 Apr '04

05 Apr '04

At 09:03 AM 4/3/04 -0500, R. A. Hettinga wrote: >At 1:26 PM -0800 4/2/04, Major Variola (ret) wrote: >>Physics, because large entities have different properties (eg >>surface-to-mass ratio; inertia) than small entities. > >Well, certainly, that's the current wisdom about such things. > >However, I'm talking about markets, and firms, which are all >creatures of information flow. As William Gibson put it once, a >corporation is a being which eats information and shits money. We are talking about mercs, not selling bits on MercNet. Mercs are physical. Thus their resources (satellites, rockets, tanks, etc) are *controlled* by Men With Guns. Who don't like to share the shiniest toys. >In those terms, then, since, Coase's theorem again, reduced >transaction cost (lowered by lower information gathering, and most >important to cypherpunks, lower transaction *security* costs lowering >transaction execution/settlement/clearing) how do we get the large >behavior current in modern markets without large firms? Cheaper info cuts out middlemen, sure; but it does nothing to permit mercs access to physical-technology that they need in the physical world. >Lots of little devices acting in common, in their own self interest, >using markets to price their services. Devices are physical. MwG control the physical. >Somewhere, on the Shipwright site, is a John Young - discovered DOD >paper from the mid-90's about "The Mesh and The Net", which looks >like a toe-hold on the idea of geodesic warfare. I used to joke about >keeping the landmines in your front yard paid or they wouldn't let >you out the door. :-). Sure, meshes mean you may not need satellites or fixed base stations for your comms. Big deal. The mesh-radios may be controlled, and regardless, you need more than radios to be a merc. Get that through your head. >So, I would bet that lower costs of market entry means that smaller >firms could compete in large, temporary groups, in the same way that >market sell-off stampedes happen, only with guns. You're too stuck on bits and forgetting about atoms. >The net allows more collaboration between the troops without central >control, Yawn. Disintermediation will happen, its just not enough. Atoms matter.

2 1

Re: Shock waves from Fallujah
by Major Variola (ret) 05 Apr '04

05 Apr '04

At 12:35 PM 4/4/04 -0800, Bill Stewart wrote: >>At 1:31 PM -0800 4/2/04, Major Variola (ret) wrote: >> >A fence is being considered around the Capital in DC also. >> > >Correct me if I'm wrong, but I assume the purpose of a fence around the Capitol >would be to keep those pesky Congresscritters _in_, >not to keep other people out? No, it would be to protect the congressvermin from attacks. Just like the anti-aircraft batteries and snipers on the white house. The SS is also closing all but 1 tourist entrance to the Capitol. ... In other news today, the US is going to snatch a major Iraqi cleric. Flash to W. sticking his dick into a hornet's nest. Dancing in the streets indeed.

1 0

how much anonymity an internet cafe provides
by Eugen Leitl 05 Apr '04

05 Apr '04

http://www.linux.ie/pipermail/ilug/2004-April/013049.html [ILUG] [Fwd: I fought the scammer... and I won.] John Allman allmanj at houseofireland.com Mon Apr 5 09:33:39 IST 2004 * Previous message: [ILUG] bringing users to Linux (RFC) * Next message: [ILUG] [Fwd: I fought the scammer... and I won.] * Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Some of you who were on #linux on friday will know part or most of this story already as i witnessed some of it (while drinking a truly delicious hot chocolate). For those of you who don't, the following is a report written up by a friend of mine on his succussful (or at least, it's looking good) attempt to stop and catch a 419 scammer. I feel it's worth the read John -------- Original Message -------- Subject: I fought the scammer... and I won. Date: Fri, 02 Apr 2004 21:54:30 +0100 From: Steffen Higel <Steffen.Higel at cs.tcd.ie> To: John Allman <allmanj at houseofireland.com>, paulinemccaffrey at eircom.net, stevecash at ireland.com, tony.odonnel at cs.tcd.ie, declan.dagger at cs.tcd.ie, edwin.higel at brookside.ie, marynstanley at eircom.net, richard.bannister at cs.tcd.ie, oconnoat at tcd.ie, jean.higgins3 at mail.dcu.ie [This is long, and is quite heavy on the technical discussion. Skip the bits you don't understand. It gets interesting.] I work for a busy Dublin Internet cafe, doing some sysadmining and general computer maintenance. On Sunday the 28th of March, I got a rather distressing email from a sysadmin in a large U.S. University. Spamcop had blacklisted our server's external IP address. Abuse mail for the server in question gets sent to my college account (bad practice, I know, but it's a part time job). My college uses Spamcop as a blacklist source. You can probably tell what happened... Anyway, said email included the full headers of an email which was natted by our server pretending to be from the widow of Mr. Jonas Savimbi, offering the recipient a share of an unspecified large sum of money. The usual panicked thoughts kick in... "Have I fiddled with something which has left us as an open relay?", "Has our server been cracked?", "Have I been sleep-spamming again?". A more reasoned examination of the headers showed that the mail had originated from one of the IP addresses that we assign dynamically to people who bring laptops into the cafe. This is something of a nightmare for cafe operators, we can hardly block outbound smtp but then again it isn't possible for us to manually check every single mail either. Maybe rate limiting is a valid technical solution. Or a contraption which hits the user on the head for every mail they send. So if they send 1 an hour, it's a mild nuisance. But if they send 100 a minute, it'll probably kill them. A peek through the logs revealed: Mar 26 15:04:16 server dhcpd-2.2.x: DHCPDISCOVER from 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:17 server dhcpd-2.2.x: DHCPOFFER on 192.168.1.70 to 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:17 server dhcpd-2.2.x: DHCPREQUEST for 192.168.1.70 from 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:17 server dhcpd-2.2.x: DHCPACK on 192.168.1.70 to 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:20 server dhcpd-2.2.x: DHCPREQUEST for 192.168.1.70 from 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:20 server dhcpd-2.2.x: DHCPACK on 192.168.1.70 to 00:40:f4:5d:aa:f7 via eth1 Bingo. I had something to work with. The network card is one based on a Cameo 32bit chipset. Matches up quite nicely with these:

1 0

Wiretaps led to arrests of terror suspects
by Eugen Leitl 05 Apr '04

05 Apr '04

http://www.globeandmail.com/servlet/ArticleNews/TPStory/LAC/20040405/KHAWAJ… 5/National/Idx Wiretaps led to arrests of terror suspects By COLIN FREEZE AND ALAN FREEMAN Monday, April 5, 2004 - Page A8 OTTAWA and LONDON -- The tapping of e-mails and overseas phone calls by a host of Western spy agencies led to the arrests last week of terrorism suspects in Canada and Britain, including an Ottawa man who had been under scrutiny for at least four weeks. The RCMP and Scotland Yard launched separate operations after an alarming e-mail was picked up by a U.S. intelligence agency in February, sources said. The U.S. National Security Agency, which electronically monitors millions of conversations daily, reportedly picked through the chatter to find a message sent from Pakistan to England. According to the Sunday Times and The Guardian in Britain, several intercepted communications showed links between suspected senior al-Qaeda figures in Pakistan and an alleged bomb plot thwarted last week in Britain. Nine men of mostly Pakistani heritage were rounded up there along with a half-tonne of bomb-making chemicals, as hundreds of officers joined in simultaneous and urgent raids. The RCMP say the British raids are linked to the arrest of Mohammed Momin Khawaja in Ottawa 12 hours earlier. The 24-year-old software developer remains in prison, but is described locally as an exemplary young man -- a solitary figure from a good family, taking Arabic courses but keeping mostly to himself. He recently travelled to England and Pakistan. Family members say he went abroad to look for a wife. They further insist that global spy agencies somehow got their signals crossed. "How's it related to my brother, do you know what I mean? Somebody's making phone calls to maybe England or Pakistan or whatever, how is it related to my brother here in Canada?," said Qasim Khawaja, 26. After visiting him this weekend, he said his younger brother is "totally calm, smiling and just laughing" about the situation. "He thinks there's a misunderstanding and they are overblowing it." He said that during the raid, Mounties showed the family papers that said their e-mails and phone calls have been listened in on since Feb. 27, after his brother returned to Canada from his travels abroad. Qasim, also a computer programmer, questioned the value of such eavesdropping as an investigative technique. "Most of the people that are questioning us had a hard time using e-mails, you know what I mean? They are much older guys and they don't understand technology like we do. . . . nowadays viruses can even send e-mails, you know what I mean?" Investigators have continued to track down friends, family and nearly forgotten acquaintances across North America, he said. Mr. Khawaja said his father Mahboob, the 62-year-old head of the family, surfaced this weekend in Saudi Arabia, where he has been in police custody for several days. His family said police allowed him to call this week and confirm that he had been detained after the raid on his former home in Ottawa. He said he is being treated well, according to Qasim. Canadian agencies say they had no role to play in the arrest of the elder Mr. Khawaja, one of the founding members of Ottawa's 40,000-member Muslim community who left Pakistan 35 years ago and recently moved to Saudi Arabia to manage a polytechnic school. His Canadian family planned to visit next month, but the RCMP seized their passports and airline tickets in the raid. >From Saudi Arabia yesterday, a family friend said Mahboob Khawaja is "a normal guy." "I didn't see him as a fanatic or anything," said Mohamed Farhat Mehdi. He said that his friend often spoke of his family in Ottawa and "he talks with his Internet quite often." -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Ban Is Eased on Editing Foreign Work
by R. A. Hettinga 05 Apr '04

05 Apr '04

<http://www.nytimes.com/2004/04/05/politics/05PUBL.html?ei=1&en=b4429c6bc9f7…> The New York Times April 5, 2004 Ban Is Eased on Editing Foreign Work By THE NEW YORK TIMES ASHINGTON, April 4 - The federal government has eased a ban on editing manuscripts from nations that are under United States trade embargoes, a move that appears to leave publishers free once again to edit scholarly works from Iran and other such countries. The Treasury Department sent a letter on Friday to a lawyer for the Institute of Electronic and Electrical Engineers, an international group representing more than 360,000 engineers and scientists, saying the organization's peer review, editing and publishing was "not constrained" by regulations from the department's Office of Foreign Assets Control. The group says its members produce 30 percent of the world's literature in electrical and electronics engineering and computer science. The letter from the Treasury Department referred specifically to publishing by the institute, but Arthur Winston, the group's president, said he believed the ruling would be "a relief for nearly everyone" in the scholarly publishing community. "The ruling eliminates potentially disturbing U.S. government intrusions on our scholarly publishing process," Mr. Winston said. No one at the Treasury Department could be reached for comment Sunday night on the ruling. The department and publishers have long quarreled over the exemption of "information or informational materials" from the nation's trade embargoes. Congress has generally allowed such exemptions. Nonetheless, the Treasury Department sent out advisory letters over the past year telling publishers who were editing material from a country under a trade embargo that they were forbidden to reorder paragraphs or sentences, correct syntax or grammar, replace "inappropriate words" or add illustrations. The advisories concerned Iran, but experts said the ruling seemed to extend to Cuba, Libya, North Korea and other nations with which most trade is banned without a government license. In theory, even routine editing on manuscripts from those countries could have subjected publishers to fines of $500,000 and 10 years in jail. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Shock waves from Fallujah
by Major Variola (ret) 05 Apr '04

05 Apr '04

At 03:29 PM 4/2/04 -0500, R. A. Hettinga wrote: >Howie Carr is shocking Chris Wallace just now about partitioning Iraq >into three countries, Kurdish (who will have oil), Shiite (who will >have oil), and Sunni (who will not; geography's a bitch), all while >putting a Sharon-Fence around the newly created Sunni-stan. A fence is being considered around the Capital in DC also. The inhabitants think its to protect them, but some of us have other ideas... a national zoo or asylum? We could call it surdistan, or turdistan.

3 3

Gutmann: operating under the radar
by R. A. Hettinga 05 Apr '04

05 Apr '04

<http://www.computerworld.co.nz/news.nsf/PrintDoc/3F25D67E47980786CC256E6C00…> Computerworld NZ Tuesday, 6 April, 2004 Gutmann: operating under the radar Paul Brislen, Auckland He describes himself as a "professional paranoid", but cryptography expert Peter Gutmann (pictured) is quite willing to buy products online using his credit card and advocates writing down passwords on a piece of paper. Gutmann, a developer, author, speaker and honorary researcher at Auckland University's computer science department, realises that the password advice might seem to fly in the face of reason. "Think about it. If you've written down your complicated password on a piece of paper someone would have to break into your house to get it to then break into your online account. That's not likely when the crooks are sitting in Eastern Europe." Conversely, he says having one user name and password for all accounts is perhaps the worst thing a user can do. "That way if one account is compromised then effectively all of them could be." Gutmann is world-renowned for his work on security architecture and is in demand on the IT security speaking circuit. His PhD thesis has been released as an academic text book (Cryptographic security architecture: design and verification) and he has at least two more in the pipeline. "That one's very much an academic book. The next one is more straightforward and is more about my take on different security issues." Gutmann's role at Auckland University doesn't pay anything but it allows him to do what he likes. His income is derived from one of those products nobody's ever heard of but which many of us use - Cryptlib. Cryptlib is in embedded products such as ATM machines and print servers, for authenticating user rights to a particular printer. "It's widely used but invisible. Basically it's a general purpose tool used inside applications so most people don't even know it's there." Gutmann says this is the best approach to issues like email encryption - make it happen automatically. "PGP has been around for over a decade and has a tiny market share still." Cryptlib, by comparison, is marketed by health software developer Orion Systems. "There are plenty of cool people using it but if I tell you who they are they'll kill me," says Gutmann, only half joking. Gutmann didn't set out to be a cryptographer. "I was working in data compression but you really can't make much of a difference there. I sort of drifted into cryptography." Gutmann says his approach isn't one of maths-intensive algorithms. "There's very little maths involved. Basically that part of it's secure these days. It costs too much in terms of time and effort to break the code to make it worthwhile. I work on the stuff around that to make sure that's defensible." Gutmann offers the example of public keys. "What's the point of securing your system with the most up-to-date encryption technology if you email someone your key in an insecure manner?" Gutmann likes to quote cryptographer Bruce Schneier on the subject. "Basically he says it's like putting a large iron stake in the ground in your front garden and hoping the burglar will run into it. It's the rest of the garden that matters as well." So Gutmann isn't worried that if he's too good at his job he'll do himself out of a career. "As long as there are computers we'll need security people." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: And who was it saying those terrible Sunnis would be isolated?
by Tyler Durden 05 Apr '04

05 Apr '04

What I'm wondering is whether the Iraqis will end up giving US the bums-rush faster than the Soviets got it in Afghanistan. Guess the Bush-Cheney-Rumsfeld "dancing in the streets" scenario is correct, but it will have taken a slightly different route than they had planned. -TD >From: Harmon Seaver <hseaver(a)cybershamanix.com> >To: cypherpunks(a)minder.net >Subject: And who was it saying those terrible Sunnis would be isolated? >Date: Sun, 4 Apr 2004 20:44:17 -0500 > > Shiites hit a home run! > >http://news.bbc.co.uk/2/hi/middle_east/3599381.stm > > >-- >Harmon Seaver >CyberShamanix >http://www.cybershamanix.com > _________________________________________________________________ Tax headache? MSN Money provides relief with tax tips, tools, IRS forms and more! http://moneycentral.msn.com/tax/workshop/welcome.asp

1 0

States Link Databases to Find Tax Cheats (fwd from brian-slashdotnews@hyperreal.org)
by Eugen Leitl 05 Apr '04

05 Apr '04

----- Forwarded message from brian-slashdotnews(a)hyperreal.org -----

1 0