- cypherpunks-legacy - lists.cpunks.org

Re: Mixmaster to DOS Yet?
by loki＠obscura.com 17 Dec '03

17 Dec '03

Yes, it works. I am trying to get my cross compiler to compile the code before I certify that it is good, and attach my signature. I am recompiling gcc as I write, hopefully that will solve the problem. -Lance At 8:12 PM 4/20/96, John Erland wrote: >[Please respond netmail - I do not see this list regularly...thanks!] > >Time to ask again: Has anyone ported Mixmaster to DOS yet? > >Thanks for any info. > > JE >-- >: Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. >: Internet: kdf(a)gigo.com ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Golden Key Campaign
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:22 PM 4/24/96 -0700, Wei Dai <weidai(a)eskimo.com> wrote: >On Wed, 24 Apr 1996, Hal wrote: >You can do signatures with Rabin too. I have a version of it in >Crypto++ 2.0. It's been out for a while and RSA hasn't bothered me about >it. >Does anyone want to explain why, given the alternatives, people continue >to use RSA and pay for it? Sure. Because 1) it's a good algorithm for the job, 2) we've learned it, and have a PGP base behind our inertia, 3) The legalities of RSA are well-defined, 4) the Stanford patents mostly run out in 1997, unless Roger's suit succeeds first, 5) the price of RSA is fairly low, once free RSAREF came out 6) the price of licensing Cylink patents is high and/or unpredictable # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

2 1

International Capital Flows Called Criminal
by Duncan Frissell 17 Dec '03

17 Dec '03

Financial Times, April 24, 1996, p. 8. US prosecutor attacks bank secrecy laws By Clay Harris Mr John Moscow, assistant district attorney for Manhattan: "Bank secrecy statutes in international finance are used by crooks, tax evaders, securities fraudsters, and capital flight fellows; they are used by narcotics dealers. But they are not needed by honest folks engaged in honest transactions." Now the last time I looked, 'Capital Flight' was as legal as church on a Sunday. Or is this a proposal for exchange controls. Is this guy a state or federal prosecutor? He was also unable to come up with legitimate reasons for $3 Billion to go from Egypt to the Bahamas. I can think of any one of a number of legal reasons, one being "International Tax Planning." DCF

1 0

Re: US law - World Law - Secret Banking
by Hal 17 Dec '03

17 Dec '03

From: Black Unicorn <unicorn(a)schloss.li> > What has consistently alarmed me is the United States trend of extending > her own moral and ethical standards world wide. Granted the United States > is the foremost world economic power, but the power to control markets and > the political power to invade the sovereignty of other states are two > distinct issues. The United States is, in one form or another, attempting > to homogonize the legal systems of the world to comply with her own > concept of what is "right" or "fair." This is disturbing. I was encouraged to read the description by former NSA lawyer Stewart Baker of Japan's attitudes towards crypto policy (from the URL posted here by wb8foz(a)nrk.com, http://www.us.net/~steptoe/276915.htm) We can all take heart in what Baker finds alarming: In the United States and Europe, encryption policy is formed by a mix of interests. Advocates of business, national security agencies, and more recently the police -- all play a large role in the policy debate. This policy triumvirate is difficult to see in Japan. For a variety of reasons, commercial interests are predominant in Japanese government thinking about encryption. Time after time during my interviews, I was reminded that Japan was an island nation that has not had to defend itself for fifty years and so has not had to confront the national security concerns associated with encryption. And Japanese police face severe political and constitutional constraints on wiretapping, so the prospect of losing this criminal investigative tool seems not to be as troubling to the Japanese government as to the United States and many European nations. [...] All in all, the emerging Japanese consensus on cryptography could pose a major challenge to U.S. (and perhaps European) government hopes of striking a compromise between commercial and governmental interests with respect to cryptographic policy. If Japan puts the weight of its government and industry behind strong, unescrowed encryption, competitive pressure will quickly doom any attempt to influence this technology through export controls and standard-making. Governments will be forced to choose between overt regulation in the Russian and French manner or laissez-faire policies of the sort that now prevail in the domestic markets of countries like the United States, Great Britain, and Germany. I love the description of the choice facing the government, between laissez-faire policies versus the kind of system prevailing in Russia. This is a remarkably clear and frank description of the policy directions which are available. Hal

3 2

[fight-censorship] Guardian Angels v. anonymous remailers
by Rich Graves 17 Dec '03

17 Dec '03

Interesting and well-written piece. Followups, if any, will be at http://fight-censorship.dementia.org/fight-censorship/top/ I assume that Declan is just observing how Safesurf operates. My view is that these private "decency" registries are a healthy part of the free market. Of course the "Angels" are a bunch of hypocrites, but the part about rating sites I support. Let the prudes censor themselves; it's a free net. If anyone tries to sabotage Safesurf by rating things the "wrong" way, then they're an asshole. (I am *not* accusing Declan of advocating this, because he isn't -- it's just something that crossed my mind. Tempting, but highly counterproductive.) -rich ---------- Forwarded message ---------- Date: Fri, 26 Apr 1996 01:43:25 -0400 (EDT) From: "Declan B. McCullagh" <declan+(a)CMU.EDU> To: Fight Censorship Mailing List <fight-censorship+(a)andrew.cmu.edu> Cc: angels(a)wavenet.com, mnemonic(a)well.com, cp(a)panix.com Subject: Guardian angels, the decency brigade, and cyberseraphim Attached is a message from the CyberAngels asking for rating volunteers. Jim Thomas published a fascinating and illuminating article documenting the seamier side of these self-appointed net.vigilantes in the Computer underground Digest earlier this year. (I vaguely remember some legal threats soon afterwards.) Their authoritarian and anti-privacy leanings are clear in their FAQ, at <http://www.safesurf.com/cyberangels/>: 9) What kinds of changes would the Guardian Angels / CyberAngels like to see? a) We would like to see an improvement in User identification. User ID is impossible to verify or trace back. The very anonymity of Users is itself causing an increase in rudeness, sexual abuse, flaming, and crimes like pedophile activity. We the Net Users must take responsibility for the problem ourselves. One of our demands is for more accountable User IDs on the Net. When people are anonymous they are also free to be criminals. In a riot you see rioters wearing masks to disguise their true identity. So much for anonymous remailers! But the CyberAngels, in a fit of almost painful hypocrisy, use anonymous remailers themselves, as Charles Platt recounts in his book _Anarchy Online_: How would this decency crusade actually work in practice? Well, later in 1995, one net user received the following not-very-friendly, not-very-literate warning, sent via an anonymous remailer: The Net is out of control, sex crimes, hate crimes and felonies. Just as on the streets, CyberCrime is committed by a minority of criminals who destroy the quality of life for an innocent majority. And just like on the streets the Guardian Angels will combat it. We have good reason to believe that you are involved in unlawful, harmful, hateful, threatening and/or harassment, particularly relating to minors. We will be watching you. The netizen who found this in her mailbox was baffled and irritated. She had no idea what she'd done to provoke the warning, and since the message was anonymous, there was no way to _find out_ what she was supposed to have done. By November, the Angels claimed they had 200 volunteers working for them, busily searching for bad guys on the net. "We have reported a number of Child Pornographers (50) to Sysadmins [system administrators] this month," Colin Hatcher noted, although he was no longer signing his real name to his progress reports, perhaps in fear of reprisals from angry pedophiles. "Letters we have received back all share our concern and promise stern action. Remember, each electronic image represents a real life destroyed." [...] Some net users wondered, though, if Hatcher was qualified to draw a dividing line between good and bad, let alone ugly. They also worried that decency vigilantes might have a chilling effect on freedom of speech. A student at Rutgers University complained that some of the Angels' public statements "are threats to violate the civil liberties of users of the Internet." In addition, he said, "the record of the Guardian Angels suggests that they will step over even the bounds that they publicly set for themselves." And, as Steven Levy wrote in Newsweek last October: "After the issue of child safety in cyberspace came up on his radio talk show, [Curtis] Sliwa decided to pursue in his usual high-profile fashion... Though the CyberAngels cannot document a single case where one of their numerous reports led directly to an arrest, they have compiled a fat file of press clippings." In the attached piece, the Angels hold themselves up as the arbiter of what is appropriate for kids or not under the Safesurf system. So far so good -- but what criteria do they use when checking to see if a site is "genuinely kidsafe?" Where is it documented and published? What training do their self-selected vigilantes have? Will the fight-censorship list be blocked when we have messages like this one on it: http://www.cs.cmu.edu/~declan/rimm/asst/anti_porn_group_11_22_94.letter -------------------------------------------------------------------------- Those orphan kids in the terminally ill section of the hospital are so fun at night when they are drugged out. I love sucking on their tiny finger-sized cocks and probing their tight holes. Their slender little bodies are completely smooth. They're going to die pretty soon so they won't come back to me several years from now as hairy grown up men blaming me for why they are all mentally messed up. And since they are orphans with no one to look over them except for overworked staff, I could get away with just about anything. Since blocking software like Safesurf and SurfWatch is central to our case challenging the CDA, I believe we should support that software and PICS-like third paty rating systems. Fortunately, that doesn't mean we have to accept or support the efforts of their unfortunate and intemperate net-vigilante allies. But I still want to help rate some web pages, so ---- "Gabriel," I want to be a CyberAngel. Sign me up! -Declan (now a CyberSeraphim) ---------- Forwarded message ---------- Date: Thu, 25 Apr 1996 19:11:16 -0700 From: angels(a)wavenet.com Subject: ALERT FOR 20 VOLUNTEERS! APPEAL FOR VOLUNTEERS Hi again everyone. I have a project that requires 20 volunteers. Read on! Most of you I hope are familiar with Safesurf - if not go visit them at http://www.safesurf.com Safesurf are not a commercial software company but are a kidsafe organization who are very involved in the ratings issue for kids and adult material on the Net. Safesurf are also our allies, and it is thanks to them that we have our website at all as it was a donation from Ray and Wendy at Safesurf. Safesurf have a very positive approach to the screening debate - they have developed a rating system whereby instead of spending time rating adult sites you focus instead on rating the kids sites. Then your screening software only allows you to visit sites with the Safesurf rating on it. This is an excellent concept, not least because it doesn't then matter if new sites come onto the web that are not rated yet, because nothing can be included in your screened browser unless it registers itself as kidsafe by marking its site with a safesurf rating mark. Don't worry about my ramblings - just go to their site and read up on it. It's a really positive concept and has been adopted by a lot of sites already. Adopting the Safesurf mark is voluntary and means that you are identifying your site as suitable for e.g. kids. Now here comes the appeal. Several thousand sites have already marked themselves as Safesurf rated - and more are registering every day. The question is - what is to stop a site registering as a kidsafe site, but in reality being an adult site? The Safesurf rating method is that sites can obtain the rating from the Safesurf site and then write in and register themselves. Isn't it possible that a site could claim to be kidsafe but in reality was adult? The answer is yes. So how can Safesurf be sure that sites registered with them are indeed genuinely kidsafe? Simple - someone has to go and check out all the sites who register with Safesurf. Ray had a proposal for me. How about if we could say that all these sites were "Rated by Safesurf, and patrolled by CyberAngels"? I thought that was a great idea - for we CyberAngels to help Safesurf in this way, by checking their sites for them. Ray is proposing to send me 200 sites a week to check out and we will share them out to a CyberAngels team of 20 volunteers - that means that each one of us would volunteer to check out 10 sites per week. Easy right? I want to make something very clear - Safesurf are not a rich commercial company making money from rating sites. They are not selling software and their rating code is free to anyone who wants it. So it's not like they can hire 20 people and pay them to patrol the Safesurf Intranet - it's a volunteer job. So there you are - I am looking for 20 CyberAngel volunteers to make up a regular Safesurf "Intranet" Patrol, with the mission to visit 10 URLs a week and make sure that they are what they say they are. Who's ready? Once I have the team established I will then brief you all on how we do this. Write to me as soon as possible if this interests you. Let's show Safesurf how much we support their positive stand for our InterNet kids! I will take the first 20 volunteers who contact me (yes you will be suitably honored - publicly if you so choose!) Gabriel

1 0

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 01:53 PM 4/25/96 -0400, Jeffrey C. Flynn wrote: >I received several responses to this question. My favorite was as follows... > >>This is probably science fiction, particularly at the VHDL level. >>Maybe someone could make a crime of opportunity out of a microcode >>flaw, but there's a risk of it being found out during testing. >> >>To do it right would require collusion of the design and test teams. >>They need to ensure the back door stays closed, isn't tickled by >>"normal" testing and only opens when really requested. So a lot of >>people are in on the secret even before it gets exploited for >>nefarious purposes. >> >>And what nefarious purposes would pay for the risks and costs of this? >>If the secret got out, the design team, product line, and company >>would be dead in the marketplace and probably spend the rest of their >>lives responding to lawsuits. What could you use this for that is >>worth the risk? This analysis seems to assume that the entire production run of a standard product is subverted. More likely,I think, an organization like the NSA might build a pin-compatible version of an existing, commonly-used product like a keyboard encoder chip that is designed to transmit (by RFI signals) the contents of what is typed at the keyboard. It's simple, it's hard to detect, and it gets what they want. Jim Bell jimbell(a)pacifier.com

5 4

Mondex
by Michael Froomkin 17 Dec '03

17 Dec '03

Seth Godin, Presenting Digital Cash (1995) reports on p. 94: Mondex "spent four years developing state-of-the-art protection against reverse engineering by finding the world's best reverse engineers and give them [sic] a shot a cracking the chip in their smart cards." ==details anyone? Elsewhere, in the interview in the Appendix, Tim Jones admits they are currently vulnerable to a MITM attack, but promises a fix real soon. <> In other Mondex news, the American Banker newspaper reports they are going to field test a card in a British university; it will do meals, copies, etc... Any other Mondex news around? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

VENONA followup
by John Young 17 Dec '03

17 Dec '03

Last year DCI Deutch said that as part of the new "openness" for intelligence archives and as followup to the release of VENONA documents, a conference was planned on Soviet intelligence attempts to penetrate the USG in the 1940s and 1950s. (See excerpt below.) Has anyone heard more on this conference? ---------- http://www.odci.gov/cia/public_affairs/speeches/dci_speech_71195. html DCI Speech 7/11/95 DCI John M. Deutch at VENONA Press Conference [Snip] Next year we will sponsor a conference on Soviet Intelligence attempts to penetrate the United States government during the 1940s and 1950s and our efforts to counter those efforts. We hope that all scholars will attend, including Russian scholars.

1 0