- cypherpunks-legacy - lists.cpunks.org

Re: PC MSDOS hardware key proposal
by cwedgwood＠cybernet.co.nz 17 Dec '03

17 Dec '03

Jyri Poldre <jp(a)pitsa.pld.ttu.ee> wrote: ______________________________________________________________________ Frgiv me if i am a bit off theme, but it just seemed as a good idea. As I am going to have some off-time tonight I might forget that and on the other hand maybe someone can use it in protecting his/her intellectual property and this would certainly be linked with our topic. The idea came to me after seeing some incredibly small piece of code doing some unbelievable damage. Like 3 kbytes of com making hardware key useless. I started to play with idea of having something more reasonable for PC SW developers. For start it is not possible to use any type of key checking, because dos is open system and allows everyone to intercept and disable it. The lock must be a part of program itself. Also one must concider the dataflow and power consumption, meaning you cannot have second floating point unit in printer/serial port.You cnt put it into slot , cause it should be reasonably cheap. My idea for such device is the following: Have the HW unit calculate the If-then-else conditions in program flow. it is not reasonable to do it everywhere, but just in some places( depends on the money/time one used to devolop product and similar relation of expected hacking ) . For that purposes you could collect all results into flags and present them to this Hw unit. It calculates the condition as boolean function of input variables. If you want more entropy you could involve state machine in this unit. Also some delay, what would be built into ( one cannot just send data through printer port with 32 Mbytes /sec.) although for user it would be unnoticed , but using brute force and 32 bits of data this would make our friendly hacker quite old. Another alternative is to understand the dataflow in program but from binary to get the idea... no , this is a bad idea. so - just when it comes to ITE you present printer port with 3-4 bytes calling some procedure what reads flags from global variables and returns carry - to go or to stay. that's it. An attack might also concider just listening the device and writing down the values but you would have to go through all checkpoints using all possible flag values and that would take some and also involve understanding of program dataflow. One good point using that system is that it would possibly not always crash- it would just for starters give you wrong answers. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Doesn't work, atleast in some form. I have removed hardware dongle protection that does just that by watching what the hardware does for a long period of time (logging it) and then writing interception/emulation code. A better idea I think is something like digital signatures. Get the hardware to produce a digital signature or some random data. If random isn't available then a reasonable pseudo-random algorithm would suffice provided it was implemented carefully (well seeded). SmartCards can probably do this with say ESIGN [see Eurocrypt '93 (or maybe 92?)] If you do want to make a delay in your dongle (or whatever) then it should ONLY delay for wrong responses or for patterned responses (hard to detect) that might indicate an attempt to brute force it - like many modern UHF car alarms and garage door openers. Extensive control of program flow might be very difficult to program and quite cumbersome. Another thing - how practical is this hardware? If it is implemented on a micro-controller then it can be disassembled is the code inferred via other means. PAL and GAL chips can also be read - and if the no-read bit is set and the complexity of the device low enough (as is likely for in-expensive devices) then you can infer whats inside these also (although usually it not a NP-complete soln time wise....) Chris

3 2

Re: Interfacing PGP with Pine (Script pointer)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 7:47 AM 11/25/94, Michael Handler wrote: > For a well written script to interface PGP with Pine: > > finger slutsky(a)lipschitz.sfasu.edu | pgp -f > mkpgp.txt.uu > > If you don't have finger access, mail me privately, and I'll send >the file to you. If you don't mind, could I have a copy? finger is disabled here... thanks, -j

1 0

NYT on Hiding Cash (Re: Privacy Digest)
by John Young 17 Dec '03

17 Dec '03

Sorry to fall asleep at the switch, but Gary Jeffers posts on The Privacy Digest and those of Black Unicorn and Critias jogged me to note that The New York Times had two articles on Friday about a UN conference on control of money laundering and the flight of German capital to Luxembourg banks to escape high taxes. Both articles describe the resistance of banks to government snooping, and how laws are being modified to try to keep up with increasing demand for cash havens and/or laundering. ------------------- Here's an excerpt from the first, "Laundering of Crime Cash Troubles U.N.": ". . . the skillful manipulation of dirty street money through former Soviet replublics, offshore banks and major stock exchanges, until it emerged as legitimate cash for buying and selling of a hotel in Bogota. As outlined today by officials in Naples at a major United Nations conference on organized crime, it is not just the growers, smugglers and assassins who make the worldwide drug trade a scourge, but a new breed of skilled money-managers, lawyers and other professionals in the pay of the mob. Devising ever more complex ways of laundering money, they handle an estimated $750 billion every year. . . . By long tradition, banking secrecy and numbered accounts were associated primarily with such financial bastions as Zurich, Vienna and Luxembourg, and the money came mainly from the drug trade. But, United Nations officials say, as these banking centers slowly yield a few secrets to narcotics investigators, a whole new array of less reputable banks are springing up across the former Soviet Union . . . . . . The world's increasingly coordinated and sophisticated crime syndicates, by contrast, now deal in everything from organs for transplant to nuclear materials; with their money laundered, they put their investments into legal business." For an e-mail copy of this article send blank message with subject: UN_nab ------------------- >From the second article, "Germans in Tax Revolt Embrace Luxembourg", these excerpts: "Since 1993, when the Finance Ministry in Bonn imposed a 30 percent withholding tax on interest income for residents, Germans by the thousands have used Luxembourg to carry out a quiet but powerful tax revolt. Carrying suitcases and plastic bags of cash, they have deposited $150 billion in Luxembourg bank accounts, placing it beyond the reach of the tax authorities in Bonn, and behind the screen of Luxembourg's rigid bank secrecy laws. . . . [Description of Germany's proposal that all European Union banks agree to withhold taxes on interest income for the various governments and the banks' demurs.] 'People think they are overtaxed and so they are looking at every way possible to avoid paying taxes,' said a banking lobbyist in Bonn who insisted on anonymity. 'We assume that if people deposit their money in Luxembourg, they will pay taxes. If they don't, that is a political problem for the government, not the banks. We are not policemen.' " For an e-mail copy of this article send blank message with subject: LUX_out

1 0

Privacy Digest
by Critias_the_conspirator＠au.informix.com 17 Dec '03

17 Dec '03

I had thought that if Williams of Costa Rica was a sting, the stuff he sells would be better quality. His advertising brochures look like they were put together by a thirteen year old who speaks English as a second language. On the other hand, his stuff may be truly representative of the intellectual level of our opponents -- (Consider Sternlight) If this is the case then we have little to fear. "Captain Bob" writes: > Worse, at least one report does not exist - and that is the > one that would point to most government heat > if you order it. Just out of idle curiosity, > I had my foreign lawyer order so that was how I found out. This incident is suggestive of a sting. I presume this was what "Captain Bob" intended to imply, though he did not state the conclusion. > While I hate to say it, there is currently to my knowledge no easy turn-key > one-stop-stop "Where to go to break the law" foreign operators that I would > trust. If you want true privacy, carve it out for yourself Exactly so. Many people around the world offer services that are convenient if one wishes to prevent the government from learning about your financial activities, but they do not advertise "Hey, come to us to cheat taxes and evade controls" because if they did it would diminish their usefulness, both to those of their clients that are using them to avoid taxes, and to those of their clients who use them for other purposes. By the way, when one wishes to move money out of the country, I recommend that the money spends a short time in some third country that has numerous financial transactions with your home country, friendly relationships with your home government, no privacy laws, and is not a tax haven. Thus moving it to country X does not attract attention, and if you then move it to country Y (the money laundering haven), country X does not care and your home country does not know. "Wire $20 000 to account such and such in Canada" attracts little attention. "Give me 20 000 cash", or "wire 20 000 to the Cayman Islands" attracts much attention. -- Critias_the_conspirator

3 2

PRIVACY DIGEST
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gary Jeffers wrote: ... Urgently needed are the opinions of Black Unicorn, or possibly Sandy Sandfort or Duncan Frissell as to whether or not the Costa Rican reference I gave is a "STING". Sting are a lot less likely than plain old scams or poor advice. When I was in Costa Rica I never met or heard of the folks in question. I haven't had any personal contacts or dealings with them either. However, I was not particularly impressed with the material you posted. Costa Rica is certainly NOT the best place to set up a privacy business. It's too far from where the offshore action is. A remarkably high number of con men are based there, however. The best places for a sting operation would be in Caribbean islands, especially noted havens such as the Cayman Islands. The Cayman's was where Castle Bank (I think that was the name) was chartered. It was a conduit for CIA money laundering and payoffs. This all came to light when the IRS(?) used a Miami prostitute to keep one of the bank officials occupied while the contents of his briefcase--including confidential client lists--were examined and photographed. When the left hand found out what the right hand had done, the IRS investigation was dropped and the photos were destroyed lest some CIA asset might be compromised. (Gosh, don't we just love those euphemisms.) Anyway, I doubt that the Costa Rica folks are a sting operation, but I also doubt they offer much of value either. S a n d y P.S. "Live Free or Die" is the New Hampshire state motto, NOT the name of a book by Abbie Hoffman and Dr. Jack Kavorkian. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

UN_nab (Re: an137768)
by John Young 17 Dec '03

17 Dec '03

Responding to msg by an137768(a)anon.penet.fi () on Sun, 27 Nov 1:16 AM Dear an137768, Penet.fi middle-digited the Pink Bunny Mailbot here in rejection of UN_nab. PBM is fearfully quivering now awaiting a planetary address to flip your request. Please try again with return-tattoo and blank message with subject: UN_nab.

1 0

Need program pointers
by storm＠marlin.ssnet.com 17 Dec '03

17 Dec '03

Hey all! I'm looking for some program recommendation and locations pointers. Both for MS-dos. First, a good secure delete program. These I know exists, which are good? Second, I don't know if this exists. I've never heard of one but it should! I want a program to go through a DOS hard drive and zero out all the unused sectors. It would also be nice if it zero'ed the tailing disk block after the end of a file. Suggestions? Thanks, Don -- America - a country so rich and so strong we can reward the lazy and punish the productive and still survive (so far) Don Melvin storm(a)ssnet.com finger for PGP key.

3 2

I promise never... (Was: Re: Interfacing PGP with)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

to send mail before having my coffee and checking the cc:line again. Honest this time. -j -- On the internet, no one knows you're a deity. ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com> Soon ---------> <foodie(a)netcom.com>

1 0

RE: File System Encryption
by Wayne Clerke 17 Dec '03

17 Dec '03

The Drifter[SMTP:drifter@c2.net] wrote: On Wed, 28 Aug 1996 02:55:20 +0400, Wayne Clerke <wclerke(a)emirates.net.ae> wrote: >Tried secdev? Edgar Swank (author of secdrv) recently posted >that secdev (note, not secdrv) does, in fact, uses 32 bit disk >access with win95. Win95 reports that the secure device is in >compatibility mode, but the host disk (and therefore the secure >volume file) is being accessed in 32 bit (disk) mode. Not sure >what issues there are with '32 bit FILE access' mode here. > >Sounds worth a try though. Please post the results if >you try this. > I have actually had Secure File System, Secure Drive, and Secure Device all installed with mounted volumes at the same time under Win95. However, 32bit file access is not the problem. When you load a TSR in Win95, the operating system forces you into 16bit DOS compatability mode. I'm not a kernal guru so I can't explain all the specifics, but it basically makes 95 act as Win-3.11 and looses multithreading (as it were) and creates serious memory paging problems if you have >32mb installed. You've got this all wrong. Only certain types of TSRs cause this. I'll leave it to an expert and just quote the author of secdrv: Edgar Swank wrote: >For those users of Win95 and SecureDrive who are concerned about loss >of 32-bit disk access, I've recently learned that use of Secure Device > > ftp.demon.co.uk:/pub/ibmpc/secdev/secdev14.arj > >instead avoids this requirement. Although the Secure Device virtual >drive is listed as in compatibility mode, the real drives are not so >affected. And since the virtual drive is mapped to a dos file on one >of the real drives, I believe you get 32-bit phyical drive access >there as well, although access is still slowed by CPU time necessary >to encrypt and decrypt. Thanks for the reply though .. and if you need assitance with getting SECDEV working under 95, just drop me a note. Thanks for the offer ... Drifter Regards, EMail: wclerke(a)emirates.net.ae PGP key ID: AEB2546D FP: D663D11E DA19D74F 5032DC7E E001B702 PGP mail welcome. Voice: +971 506 43 48 53 <a href=mailto:wclerke@emirates.net.ae>Wayne Clerke</a> If you're not living on the edge, you're taking up too much space.

1 0

Re: (fwd) Anonymous posters & Misinformation = Net pollution
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Could you chalk this one up my lack of sophistication as a net.user? I thought c-punks might want to shower this guy with dissenting opinion. No, I've not done so--my poster is down... Nathan

1 0