- cypherpunks-legacy - lists.cpunks.org

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> From: Michael C. Peponis <mianigand(a)unique.outlook.net> > To: cypherpunks(a)toad.com > > Why let it bother you? You must understand that the majority of the ^^^^^^^^ > population of the United States is working class trash, the news ^^^^^^^^^^^^^^^^^^^ Hope you're including yourself in that. > media is just peddeling to the masses, just like the morons that hold ^^^^^^^^^ Can't spell - *must* be working class trash... > elected office. > > Regards, > Michael Peponis ^^^^^^^ Tell me: is the 'po' silent?

1 0

Re: phone calls from hell
by Alan Horowitz 17 Dec '03

17 Dec '03

I almost hate to start a thread about something that will inevitably implode into a middle-east-politics flamefest, but this reminds me of the time the newswires reported that 10% of Israel's population had attended that peace rally in Tel-Aviv. Was it right after the Sabra-Shatilla massacre? Anyway, the followup news (which of course never made the news) was that it would not be physically possible for a third of that many people to all be in that place (Kikar Square?) all at once. The original numbers were published by the Israeli "peace camp", who would have liked for there to be that many people there. 100,000 people at a funeral? I don't doubt that there were 100,000 people who would have liked to be there, but I am skeptical that there's enough vehicles in Gaza to assemble 100,000 people to a funeral within a few hours. It doesn't matter does it? Everyone is willing to lie when they write press releases; newspapers are willing to not check ridiculous claims (if the claim comports with the publisher's outlook); and setting the record straight doesn't help sell advertising, publishers really care how lazy journalists are. I saw a great interview with the man who invented the phrase "ethnic cleansing" - a PR-agency guy in Boston under contract to the Bosnian Government. He openly stated, that he doesn't get paid to write the truth into press releases; he's paid to get his client's press releases into opinion-molder's fax machines FIRST. The first press release always wins. He also openly stated that he didn't know and didn't care if the Bosnian-Serb militias were operating concentration camps or not; the important thing was to fax the story to the American Jewish groups; he knew that the very *word* concentration camp would catch their eye and push them into agitating against the Serbs. He specifically stated, that he was so proud of his cleverness, because the Croatian President (foe of the Serbs) has a book under his belt ("Wastelands of Historical Reality") that is packed full of some very hot anti-Semetism. Alan Horowitz alanh(a)infi.net

1 0

Re: e$ payee anonymity (Was: e$: Come aaaannnndddd Get it!)
by jim bell 17 Dec '03

17 Dec '03

At 11:35 PM 1/7/96 -0500, you wrote: >Still working through my 10MB cpunks mail backlog; this one's from >November 17, 1995: > >jim bell writes [msg #0]: >> It seems to me that this should be possible, within limits, if the potential >> payee could generate a "blinded" note to be delivered to the payer by >> anonymous means. The payer could get the note certified by the bank, >> possibly given an extra "blind" if necessary (is this possible? Desirable? >> Why not?) and then the resulting still-blinded but certified note is posted >> (in encrypted form, I supposed) to the 'net so that only the payee can >> decrypt and unblind it. > >I wrote: ># This sounds like a version of "Hey, I'll pay you $10, if you give me a ten ># dollar bill first." As I understand your protocol, Bob gives Alice an enote, ># then Alice gives Bob an enote. >[...] > >jim bell writes [msg #1]: >> It sounds like you understand even less about the details of digital cash >> than I do. >> >> First, read the August 1992 issue of Scientific American, the article by >> David Chaum. He explains, with a certain amount of detail, how blinded >> digital cash operates. To become validated and worth money, it first has to >> be electronically "written," blinded, and then signed by the bank. Then it >> is unblinded, at which point it can be spent. >> >> What I was saying is that the notes would be written by the payee, then >> blinded by the payee, given to the payer, and then signed by the payer's >> bank. At this point, they are worth money, and they are then returned to >> the payee, >[...] > >Aha, thanks for the elaboration. I was confused by your use of the term >"note" to describe something that isn't in fact worth money, when you said >"the potential payee could generate a "blinded" note to be delivered to the >payer". It also helps that I haven't read much of the ecash(tm :) protocol >details :} > >Futplex <futplex(a)pseudonym.com> I'm quoting the whole thing since it's so old. As I assume you are aware, the reason I'm so interested in full payee/full payer anonymity for digital cash is that my idea, "Assassination Politics", requires it: It is necessary to be able to reward a completely unknown person by a completely unknown person, in such a way that nobody can rat out the other person. Even the presence of an intermediary (trusted) organization would be unnecessary if it were possible to GUARANTEE the offer of payment to the payee. As the idea is currently structured, the central organization collects the money, reports the donations, and makes the (continuing) publicized offer. It publicizes enough information to prove to the average citizen that it is dealing fairly with all concerned. Obviously, communication with the donors/guessors must be minimized/secured also, in such a way as to make detection of these people extremely difficult and ideally impossible.

1 0

reach out!
by William T. Rainbird 17 Dec '03

17 Dec '03

I know this isn't a typical posting for this group, but I thought I'd point out that O.J. Simpson has a video for sale, to further exploit his carnage. You can buy it by dialing 1-800-OJTELLS 1-800-658-3557 it is a FREE CALL (for you). I guess that means the MERCHANT PAYS for the calls, even if NOTHING IS ORDERED... Please repost and tell your friends!

1 0

Re: CDT Policy Post 2.27 - No New News on Crypto: Gore Restates
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 7/14/96 -0700, David Sternlight wrote: >At 7:05 AM -0700 7/13/96, Deranged Mutant wrote: >>This is particularly problematic... if the mainland Chinese gov't >>requested a key from a N.Amercian or European (or even UN controlled) >>escrow agency, who is to say it isn't really for political reasons >>(even though they may claim the persons are drug smugglers)? >> >>Or what if the 'crime' was, say, discussing Mormon beliefs, which is >>illegal in Singapore (and I think Russia as well)? >> >>Or what if some terrorist was using keys escrowed in a country that >>sponsered terrorist acts? > >Your best shot would be to make sure the part about the system being >voluntary was hard-wired into any legislation or rule-making. Wrong. Our "best shot" is to ensure that no "key escrow" legislation is adopted, and moreover export restrictions on crypto are eliminated. _THAT_ is "our best shot." The obvious problem with writing "voluntary" into any legislation (and thinking it actually means something!) is that there is a vast difference between the dictionary definition of the word "voluntary", and the way the USG would like to interpret it. I think most people define "voluntary" as something which is a free choice, devoid of coersion. But that's already damaged when the government's involved. Aside from robbing us of our assets in the form of taxes, the fact that it was able to do things like harass Phil Zimmermann for a few years (when, if there had been a "regulation" concerning writing encryption, it would have said, "writing encryption is unrestricted and VOLUNTARY") clearly proves that the government tries to do manipulate us regardless of friendly terminology like "voluntary." Clipper was always claimed to be "voluntary," but more recently they added to the restrictions, for example saying that a Clipper-type crypto phone can't be allowed to operate when connected to a non-escrow telephone. Again, the government is getting further and further away from "voluntary" as most of us understand the term. More importantly, I believe that the most fundamental right the public has is to be able to REFUSE a benefit. Let's suppose, hypothetically, that we "all" could agree that that GAK would provide net advantages and benefits to the public. I assert that despite this, the public is and should still be completely free to _refuse_ these benefits, and to go without GAK. This position, the truth of which is obvious to most of the readers of CP, would astonish and frustrate government employees and their sympathizers. Today, it appears that the vast majority of those that are paying attention to this issue agree that GAK is NOT desirable, and in any case they don't want it. The simple conclusion is that as long as we aren't supposed to have a dictatorship in this country, the will of the public to _refuse_ the claimed benefit should be respected and followed. Under those conditions, GAK wouldn't and couldn't happen. >Unless and until ITAR is modified by Congress, Congress didn't write ITAR, nor did it approve ITAR. However, the Burns crypto bill will, apparently, negate most if not all of the influence of ITAR on crypto. > the USG has what Mark Twain called "the >calm confidence of a Christian with four aces" on this matter. "A Smith and Wesson beats four aces." And if the government keeps pushing, it'll come to this. > That >is--unless and until Congress acts, the Administration has absolute >discretion with respect to the conditions under which they will liberalize >the administration of ITAR. That's not clear. The _constitutionality_ of the application of ITAR to encryption is challengeable in court, with or without any actions by Congress. So they DON'T have "absolute discretion." Furthermore, regulations must (at least theoretically) conform to law. Jim Bell jimbell(a)pacifier.com

2 1

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Laptop TEMPEST > Date: Mon, 09 Feb 1998 17:07:23 +0000 > From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> > Jim Choate wrote on 1998-02-09 06:57 UTC: > > Doesn't the FCC have to test the RF emissions of all laptops as well as > > monitors for sale as Class A and Class B in the US? Shouldn't that material > > be available? I searched the main site, www.fcc.gov, but didn't find > > anything regarding this. > > I suspect that FCC material is not helpful with regard to Tempest. As to calculating a realistic estimate of range to intercept, I disagree strongly. > Results of such EMI tests only measure the general power spectrum > emitted by a device. Of interest for Tempest purposes however is > not the power spectrum, but the spectrum of the cross-correlation I am aware of how to do Tempest in practice as well as in theory. The process goes something like this. The first target is the vertical retrace. This signal is usualy the strongest because the voltage required (and hence the dv/dt) is the largest to sling that e-beam from the lower right to the upper left. It usualy resides in the 50-70Hz range. The next target is the horizontal retrace. It slews the beam from the right edge of the display to the left in order to start another trace. You can use this signal to syn both the vertical retrace steps (in order to move the beam down verticaly to start another trace) as well as the ramp that is required to slew the beam across the screen to write the pixes. Once these 4 signals are aquired and fed to the appropriate control terminals of a CRT you are ready to begin decoding the actual trace data for each line of the display. This is the hardest since the actual modulation of the e-beam is done via a screen grid (who said tube theory was out of date?) and that signal is quite small and generaly has a cardoid emission pattern aligned axialy along the central axis of the CRT tube. So if given a choise you want your antenna to be behind the viewer in line with the display. It is of some import to note that larger displays are easier to aquire usable signals from since the distances the e-beam is slewed and as a result the control voltages are much larger. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

No Subject
by kephart＠interserv.com 17 Dec '03

17 Dec '03

please send anon remailer faq. many thanks.

1 0

Microsoft continues to mislead public about Windows security bugs (a bit long, with references)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Please do not dismiss this as mere "Microsoft Bashing." c2.org has similar promotions running for Netscape, DigiCash, and Java. The following is a quote from Microsoft's "Knowledge Base" technical support and marketing database, which is online in CompuServe and at: http://www.microsoft.com/kb/peropsys/windows/q90271.htm Security of the Windows for Workgroups Password Cache _____________________________________________________ The password list file is encrypted with an algorithm that meets the U.S. government Data Encryption Standard (DES). This encryption technology is the highest security allowed in software exported from the United States. The odds of breaking the encryption algorithm are less than those for random guesses of what the password might be. Even if your logon password is blank, Windows for Workgroups generates seemingly random data in your PWL file, so you cannot discover the passwords if you look at the PWL file using a file viewer. Currently, no user interface exists that allows you to unencrypt passwords in the PWL file, so password caching in Windows for Workgroups is as secure as the choice of the password used to encrypt your PWL file. As Microsoft well knows, this is completely untrue. The rest of the world has known that this is untrue since November 29th. Microsoft quietly acknowledged on December 7th (after a day of much "Internet Strategy" hype, and after the deadline for the morning papers) that the exact same implementation was insecure in Windows 95, and claims to have released a patch that fixes the problem (the efficacy of the Win95 patch does not appear to have been verified by anyone outside Microsoft, however). Microsoft has not even admitted that this bug in both Windows 95 and Windows for Workgroups affects Windows for Workgroups, apparently because they have decided not to fix it. Information on the .PWL implementation bugs was first broached on the sci.crypt newsgroup in late November 1995, then discussed on the cypherpunks list and refined for Community ConneXion's "Hack Microsoft" promotion, http://www.c2.org/hackmsoft/. We have since been given a sample trojan horse that will very efficiently exploit this bug in Windows for Workgroups. Distributed as a Word Basic virus, MIME attachment, or downloadable archive (note that Exchange and Internet Explorer unwisely execute downloaded binaries without even a virus check, a problem that Sun's Java has long acknowledged and addressed), this trojan horse could collect passwords and other sensitive information from .PWL files and other sources and send them out via email, possibly through an untraceable chain of remailers or to a throwaway trial account on, for example, America "Online." We believe that it would be highly irresponsible to release the full version of this hack, but we will soon release a crippled demonstration-only version if Microsoft does not at the very least admit that this problem has always affected Windows for Workgroups, correct their online documentation, publish the specifications of the Win95 security patch for review by outside security experts, and issue a public retraction. See also: http://www.microsoft.com/kb/peropsys/windows/90210.htm http://www.microsoft.com/windows/pr/clarifications.htm http://www.c2.org/hackmsoft/ http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html {mirror of above} http://www.mari.su/guide/win95/ {mirror of above} ftp://ftp.demon.co.uk/pub/mirrors/win95net/ {more mirrors are under construction in Australia and elsewhere} In other news, I assume everyone knows by now that NT's claimed C2 security rating was granted *for use a standalone workstation only*. It has been widely reported that its NetWare Services implementation does not ask for passwords for nonexistent usernames, making a potential cracker's job that much easier. The correct response, which is given by real NetWare servers and other servers that are certified C2-secure on networks, is to silently ask for a password in all cases. I started getting copies of hackmsoft(a)c2.org mail on December 20th. It's really depressing. We've also seen problems with Microsoft Access 95's security. Basically, there is none. Anyone can access the network-enabled Access as any user without knowing the password. We don't think it would be responsible to publicly release this hack, either, until Microsoft has had another chance to patch the hole (they've known about it for some time). These are far, far worse than the widely publicized bugs in Netscape's SSL implementation, which have been fixed. Yet the only place I've seen them mentioned is the lapdog Seattle Times, which only reports bug *fixes* in glowing terms. Is anybody listening? - -rich owner-win95netbugs(a)lists.stanford.edu ftp://ftp.stanford.edu/pub/mailing-lists/win95netbugs/ gopher://quixote.stanford.edu/1m/win95netbugs http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPHZrI3DXUbM57SdAQFojwP/T0CIjfyEz5NHD81wPdkAuUf1YCB8OE3/ 4NakffTxzmPxJXRT/MoRpOMn4qJa6mzC6WAgAdwtKWG/3K9WS1LNgM/w/PYMHj45 pEQroJBzoXU/Sctjnyz87FBl2/m6dwAdvPQqGOzGqsLVDaFsmqbWtalkvP2y0707 ntdb2fkqpNI= =q491 -----END PGP SIGNATURE-----

1 0

Re: rec.guns et.al. blocked by censorware
by Animal Protection League 17 Dec '03

17 Dec '03

At 03:22 PM 2/8/98 -0800, Tim May wrote: >At 3:02 PM -0800 2/8/98, Igor Chudov @ home wrote: >>rec.games.mecha Giant robot games. (Moderated) Quest/Illegal/Gamble >>Violence/Profanity Intol > >Perhaps the strategy should be to post material to other newsgroups to get >them blocked as well. (Though I expect the blocking is not being done using >robots to monitor for illegal words, as rec.guns would not have been >blocked this way. Rather, the cyber nannies are probably using their "PC >judgment" to block groups they don't like. You need to consider that rec.games.mecha is primarily a dumbed down alt.flame and includes postings from that obnoxious avowed 300 pound communist bisexual converted jew Camille Klein (she claims she is down to 275 lbs.). I wouldn't my kids to read her garbage posts.

1 0

URLs -- Urban Regurgitated Legends
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:50 PM 1/8/96, Futplex wrote: >Please don't post 6-month-old urban net.urban.legends to cypherpunks. >(Do we really need to put that in the Junior Grade Cypherpunks Training >Manual?) Have you heard that flashing your headlights is a gang signal and can get you killed? Or about the LSD-soaked samples the kiddies are getting? Do you know that the word "gullible" is not in any major dictionary? --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0