August 2004 - cypherpunks-legacy

[IP] New US Passport ID Technology Has High Error Rate (fwd from dave@farber.net)
by Eugen Leitl 06 Aug '04

06 Aug '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Wired on Navy's new version of Onion Routing
by Sunder 06 Aug '04

06 Aug '04

http://www.wired.com/news/print/0,1294,64464,00.html Onion Routing Averts Prying Eyes By Ann Harrison Story location: http://www.wired.com/news/privacy/0,1848,64464,00.html 02:00 AM Aug. 05, 2004 PT Computer programmers are modifying a communications system, originally developed by the U.S. Naval Research Lab, to help Internet users surf the Web anonymously and shield their online activities from corporate or government eyes. <SNIP> The Navy is financing the development of a second-generation onion-routing system called Tor, which addresses many of the flaws in the original design and makes it easier to use. The Tor client behaves like a SOCKS proxy (a common protocol for developing secure communication services), allowing applications like Mozilla, SSH and FTP clients to talk directly to Tor and route data streams through a network of onion routers, without long delays. <SNIP> ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"War is Peace /|\ \|/ : Freedom is Slavery /\|/\ <--*-->: Ignorance is Strength \/|\/ /|\ : Bush is President" - Bret Feinblatt \|/ + v + : -------------------------------------- http://www.sunder.net ------------

2 1

Tor: A JAP Replacement (fwd from brian-slashdotnews@hyperreal.org)
by Eugen Leitl 06 Aug '04

06 Aug '04

----- Forwarded message from brian-slashdotnews(a)hyperreal.org -----

1 0

[IP] more on a police state (fwd from dave@farber.net)
by Eugen Leitl 06 Aug '04

06 Aug '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

[IP] Your people are growing increasingly worried about a 'police state.' For such an educated audience, (fwd from dave@farber.net)
by Eugen Leitl 06 Aug '04

06 Aug '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Hijacked by the 'Privocrats'
by R. A. Hettinga 05 Aug '04

05 Aug '04

<http://online.wsj.com/article_print/0,,SB109165986866683324,00.html> The Wall Street Journal August 5, 2004 COMMENTARY Hijacked by the 'Privocrats' By HEATHER MAC DONALD August 5, 2004; Page A10 Even as the Bush administration warns of an imminent terror attack, it is again allowing the "rights" brigades to dictate the parameters of national defense. The administration just cancelled a passenger screening system designed to keep terrorists off planes, acceding to the demands of "privacy" advocates. The implications of this for airline safety are bad enough. But the program's demise also signals a return to a pre-9/11 mentality, when pressure from the rights lobbies trumped security common sense. The now-defunct program, the Computer Assisted Passenger Prescreening System, or Capps II, sought to make sure that air passengers are flying under their own identity and are not wanted as a terror suspect. It would have asked passengers to provide four pieces of information -- name, address, phone number and birth date -- when they make their reservation. That information would've been run against commercial records, to see if it matches up, then checked against government intelligence files to determine whether a passenger has possible terror connections. Depending on the outcome of those two checks, a passenger could have been screened more closely at the airport, or perhaps -- if government intelligence on him raised alarms -- not allowed to board. Privacy advocates on both the right and the left attacked Capps II from the moment it was announced. They called it an eruption of a police state, and envisioned a gallimaufry of bizarre hidden agendas -- from a pretext for oppressing evangelical Christians and gun owners, to a blank check for discriminating against blacks. Contrary to the rights lobby, Capps II was not: * A privacy intrusion. Passengers already give their name, address and phone number to make a flight reservation, without the slightest fuss. Adding birth date hardly changes the privacy ledger: The government and the private sector have our birth dates on file now for social security and commercial credit, among numerous other functions. Far from jealously guarding their name and address, Americans dispense personal information about themselves with abandon, in order to enjoy a multitude of consumer conveniences. (Anyone with a computer can find out reams more about us than is even hinted at in the Capps II passenger records.) * A surveillance system. Neither the government nor the airlines would have kept any of the information beyond the safe completion of a flight. The government would have had no access to the commercial records used to check a passenger's alleged identity; those would have remained with the commercial data providers contracted to provide identity verification. * A data mining program. This misunderstood technology seeks to use computers to spot suspicious patterns or anomalies in large data bases, sometimes for predictive analysis. Capps II had nothing to do with data mining; it was simply a primitive two-step data query system. The advocates' most effective strategy for killing off Capps II was to bludgeon airlines into not cooperating with its development. Northwest Airlines and Jet Blue were already facing billions of dollars in lawsuits for specious "privacy" violations, trumped up by the advocates in reprisal for those airlines' earlier cooperation with the war on terror. No other airline was willing to take on a similar risk and provide passenger data to stress-test Capps II. Without the capacity to be tested, Capps II was doomed. The Department of Homeland Security has already shown itself a weakling in bureaucratic turf battles; its capitulation to the "privocrats" means it is all but toothless. It was just such a cave-in by the Clinton administration that eased the way for the 9/11 attacks. Under pressure from the Arab and rights lobbies, the Clintonites agreed in 1997 that passengers flagged as suspicious by the then-existing flight screening system would not be interviewed. Allowing security personnel to interview suspicious flyers, it was argued, would amount to racial and ethnic profiling. On 9/11, the predecessor to Capps II identified nine of the 19 hijackers as potentially dangerous, including all five terrorists aboard American Airlines Flight 77. But pursuant to the rights-dictated rules, the only consequence of that identification was that the hijackers' checked luggage was screened for hidden explosives. Had the killers themselves been interviewed, there is a significant chance that their plot would've been uncovered. Since the demise of Capps II, the privocrats have tipped their hand: Their real agenda isn't privacy, but a crippling of all security measures. Leading advocate Edward Hasbrouck has decried both a voluntary "registered traveler" option, in which passengers agree to a background check in order to circumvent some security measures, and physical screening at the gate. Bottom line: Any security precautions prior to flight constitute a civil liberties violation. It is mystifying why the government should pay heed to people who so disregard the public good. It is difficult to know where we go from here. There is no way to keep a terrorist from flying without first trying to determine who he is. Yet the most innocuous identity verification system prior to a flight is now seen as tantamount to illegal surveillance. With the rights advocates back in the saddle of national security, al Qaeda can blithely get on with its business. Ms. Mac Donald is a contributing editor to the Manhattan Institute's City Journal. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: On what the NSA does with its tech
by Major Variola (ret) 05 Aug '04

05 Aug '04

At 02:23 AM 8/5/04 +0200, Thomas Shaddack wrote: > >The impracticability of breaking symmetric ciphers is only a comparatively >small part of the overall problem. Indeed. Following Schneier's axiom, go for the humans, it would not be too hard to involutarily addict someone to something which the withdrawl from which readily compromises any human. Since torture is now legitimized in the US, or its proxies, have a beer (or stronger, etc) Mohammed. Of course, the green card offered to the housecleaning illegal is simpler. Ask Nikky Scarfo. And there's nothing like raping one's children to convince the reticent... particularly if one's halal meal has been doped with various psychopharms.. ------ The problem with quantum computing will be coercing the qubits to do you bidding (not just toy problems) without losing their waviness. Not relevent to the nano-args, but your energy consumption calcs do make it clear that Ft Meade will need some awfully big radiators :-) Then again, its not that far from the ocean, a rather extreme heatsink... Still I concede that Ft Meade has no finer features than IBM. But when economics *don't* dictate, as they do everywhere else, one has to ponder. Still, the 'tographers beat the 'analysts, as you say, for sufficiently large keys, and sufficiently different chained ciphers. Don't put all your squeamish ossifrage eggs in one basket, eh? And stay away from Athens, ok?

4 4

Ridge: "The Terrorists are comming! The Terrorists are coming!" (wag the media)
by Sunder 05 Aug '04

05 Aug '04

http://www.theregister.co.uk/2004/08/03/us_terror_alert_political_football/… US terror alert becomes political football By Thomas C Greene (thomas.greene at theregister.co.uk) Published Tuesday 3rd August 2004 15:15 GMT Update As we reported recently (http://www.theregister.co.uk/2004/08/02/al_qaeda_cyber_terror_panic) the latest ratcheting up of the terror threat level in the United States was based on captured documents dating back some time. In that article, we observed that it was "not clear whether any of the information recently obtained relates to current or future schemes." <SNIP> "much of the information that led the authorities to raise the terror alert at several large financial institutions in the New York City and Washington areas was three or four years old, intelligence and law enforcement officials said on Monday. They reported that they had not yet found concrete evidence that a terrorist plot or preparatory surveillance operations were still under way." <SNIP> Why now? If anyone is wondering why terrorism, and especially attacks at home, should have been so fully hyped on such thin evidence, it's useful to consider the news cycle. Last week, John Kerry did a surprisingly good job of introducing himself to the nation as a plausible replacement for Bush. <SNIP> Politics But this rain dance was not undertaken from a security point of view. It was concocted with a political motive, and its purpose was to distract the public from the additive disasters in Iraq, and the unexpectedly strong showing by the Democrats in Boston last week. It was designed to make Junior look like the "strong leader" that his cheerleaders insist, against all evidence, that he really is. (We note that the true Prince of Darkness, Dick Cheney, has been dutifully silent, and conspicuously absent, during the recent national security festivities, to vouchsafe the limelight to Junior.) <SNIP> ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"War is Peace /|\ \|/ : Freedom is Slavery /\|/\ <--*-->: Ignorance is Strength \/|\/ /|\ : Bush is President" - Bret Feinblatt \|/ + v + : -------------------------------------- http://www.sunder.net ------------

1 0

Re: On what the NSA does with its tech
by John Kelsey 05 Aug '04

05 Aug '04

From: "Major Variola (ret)" <mv(a)cdc.gov> Sent: Aug 2, 2004 11:56 PM To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> Subject: On what the NSA does with its tech ... What they can do is implement an advanced dictionary search that includes the kind of mnemonic tricks and regexps that folks typically use when coming up with "tough" passphrases. Cracking Italian anarchist PGP-equipt PDAs in their possession, things like that. Yep. This seems like the practical weak link in a lot of uses of cryptography. It can be made harder in a lot of ways (e.g., upping the iteration count, or doing Abadi's trick of generating a big salt value but not disclosing all of it), but all this ends up with the attacker's extra work linear in the user's extra work. Of course, if the user chooses good passwords, it's a pretty big linear factor, but it's still linear--I double my iteration count, and the attacker doubles his work, though he's always doing a million times as much work as I am. The only really good solution is to use some external device to mediate in password->key generation. But then you've got to make sure that device is always available, or you're unable to get at your data. And if that device is an online server somewhere, then password encryptions become partly traceable. --John Kelsey

1 0

Re: Texas oil refineries, a White Van, and Al Qaeda
by An Metet 05 Aug '04

05 Aug '04

>The person in question was just somebody with a weakness for industrial >architecture. The "no cameras" signs were very popular in east block countries. It was forbidden to take pictures of bridges, government buildings, airports, railway stations, industrial installations, water dams etc. The signs were prominently displayed and the consensus on their purpose was essentially to scare and comfort the sheeple. There was an interview somewhere in early 90-ties when ex-government employee attested to that. The counter-intelligence purpose was irrelevant even then - it was just too easy to hide cameras. But harassment of tourists and hobbyists was great PR, proof that 'authorities' are doing the job and disarming the imminent evil. In a depressingly predictable manner US of A is sliding into the same mode of operation. And, depressingly, it works. Expect more manufactured everyday threats, more citizen-informants, the works. Contracting or subcontracting airborne demolition artists is not practical on ongoing basis ... we need a terrorist threat everywhere, every day. Make sure your children do not overhear your non-compliant conversations.

3 2