- cypherpunks-legacy - lists.cpunks.org

re: why govts get bigger
by gregguy＠aol.com 17 Dec '03

17 Dec '03

frode(a)toaster.SFSU.EDU (Frode Odegard) writes: So you are saying that acting in one's own rational self-interest is compatible with acting upon somone else by force? (Yes, in case of protection of one's life or, in some cases, one's property. I didn't say the government was acting rationally in everything (or indeed, most things) they do; only that force is a natural response to being threatened. That we perceive the government as the real threat has little bearing on their actions, I suspect.) Um, and how can you epistemologically justify looking upon the government as being a rational being, as having a consciousness? It consists of many separate individuals, does it not? (Indeed, but history is full of individuals banding together to act in their own self interest. I may not share the interests of the federal employee unions, the lifetime bureaucrats and career politicians, but I can certainly see what their motivation is for acting the way in which they do. Does government have consicousness? Certainly not. But does it, through its various entities and arms, exhibit the characteristics of both mob-rule mentality and a cornered animal? Yes, quite often it does.) Finally, isn't self-interest nirvanna a contradiction in terms? Nirvanna means merging with something greater, extinction of the self etc. But isn't the only rational standard of value, the ultimate self-interest, the preservation and flourishing of one's self, of one's life? (OK, you caught me in a writer's flourish here... Nirvanna was, categorically, not the correct word. As for the second part of your statement above, I agree -- but I also think there are millions of people in government who live and breathe a "box mentality" that convinces them very little of their self-interest is unlinked to the great monstrosity that is our government. They are perhaps the last true serfs in this country, mentally if not monetarily.) (I agree with your subsequent statements)

1 0

Remote Job Entry validated by pgp (hack script)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

#!/bin/sh # This is a little hack to let me send myself signed pgp mail containing # a batch script and have it execute as me. I knocked this up in a hurry # this evening when I needed to remote control a machine I couldn't easily # telnet to. It's not especially elegant but then it's not especially # big, so if you don't like it, write your own the way you prefer. # Because this runs as a batch job, PGPPATH and PGPPASS must be # set in the environment. If invoked from procmail, they have to # be defined in .procmailrc Clearly you should use a different # private key to your personal one for mail. Given that this is # only to stop outsiders accessing your account, it doesn't matter # that the exec-key is held online or in the environment - if someone # could hack your account to get the key they've already done enough # to hack your account anyway and having access to this exec-server # would give them no extra advantage... # I use procmail runes like this to execute this script: # :2 # ^From.*gtoal # Subject: batch job # The From line is redundant, but I just put it in so I could easily # bounce requests from most unauthorised senders in a later procmail # rule. Unauthorised senders posting as me are silently dropped # on the floor... (assuming the pgp signature check fails that is!) cat > $PGPPATH/job.$$ # This just extracts the first pgp message to a file to avoid possible # problems with spoofing... - it leaves the file empty if no pgp message # was found. I use my own editor 'ecce' to do this - you might use # sed or perl or whatever... if [ -f /usr/local/lib/ecce ]; then # Skipping this stage probably doesn't hurt... /usr/local/lib/ecce $PGPPATH/job.$$ << EOD f/-----BEGIN PGP MESSAGE-----/l0k-0f/-----END PGP MESSAGE-----/mk0,m-0k0;%c EOD fi # can't use -f filter mode because it's impossible to specify # the pubring to use if you do. # +batchmode is essential - it forces a return code of 0 if and # only if the pgp message was signed and the signator is explicitly # listed in 'execring.pgp'. pgp +batchmode $PGPPATH/job.$$ \ $PGPPATH/exec.$$ \ $PGPPATH/execring.pgp if [ $? -ne 0 ]; then # This goes into the procmail log echo ILLEGAL REMOTE JOB - USER NOT IN EXECRING.PGP # tidy up rm -f $PGPPATH/job.$$ rm -f $PGPPATH/exec.$$ exit 1 fi # execute the command - probably a script but could as easily be a # binary executable if properly compiled for the target host. chmod +x $PGPPATH/exec.$$ $PGPPATH/exec.$$ # tidy up rm -f $PGPPATH/job.$$ rm -f $PGPPATH/exec.$$ exit 0

1 0

SoundBlaster clone for voice encryption
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

I bought a Sound Blaster Clone card a couple of days ago for $65, including a nice integrated stereo headset and hands-free microphone. The Brand name is "Sound Sparc Mecer Multimedia Sound System". It claims to be compatible with Sound Blaster V2.0. I purchased it at the Campbell Domino Computer store; probably other members of the chain also have it. The reason I mention it here is that this unit might work well along with a 9600bps or higher modem & appropriate software (to be developed) to implement an encrypted phone system for real-time (or close) voice. Anyone working on a similar project please contact me via E-mail so we can compare notes. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

TV appearance you might want to record.
by crunch＠netcom.com 17 Dec '03

17 Dec '03

To who it may concern, yours truly will be interviewed on FOX Television due to air nationwide. Locally, it will be aired at 10:30 PM on Channel 2 on the 22nd of Jan. During which time, my obedient VCR will be taping it while I'm enjoying myself at "Industrial Strength" rave. The topic of discussion will be Phone Hackers, and cryptography. so if there is anything I should say in relation or on behalf of Cypherpunks, please let me know. Taping will be done at my place in Marin on Tuesday. The name of the program is "On the Money", so for those not in the Bay Area, check your TV listing for times and channels.

1 0

ANNOUNCE: Secure Drive 1.1
by Mike Ingle 17 Dec '03

17 Dec '03

INTRODUCING S E C U R E D R I V E 1 . 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AVAILABLE NOW Secure Drive 1.0 users: Secure Drive 1.1 has three improvements over V1.0: * Two-drives bug fixed. Secure Drive 1.0 could get the drive letters out of order if you had two physical hard drives. V1.1 fixes this problem. * Enhanced passphrase security: Secure Drive 1.0 used a simple MD5 of the passphrase as the IDEA key. This allowed a fast passphrase search. V1.1 iterates the passphrase hash 2048 times to slow down an attacker. * One-step passphrase change. CRYPTDSK allows you to easily change your passphrase, without a separate encrypt/decrypt cycle. This also enhances security: there is no "window of opportunity" during which the data is in clear on the disk, and no magnetic traces of the plaintext. There is a Secure Drive version 1.2 going around. I was not aware of it until I saw an announcement on the Cypherpunks. This version contains some enhancements to interact with the PGPPASS variable, enabling you to easily use the same passphrase with PGP and Secure Drive. ***HOWEVER - it does not include either the bug fix or the security enhancements of version 1.1. While I would like to see these PGP-compatible features included in Secure Drive, the bugs need to be fixed. For now, please use V1.1. You will need to decrypt and re-encrypt your hard drive, because the new hashing algorithm generates a different IDEA key for the same passphrase. I will talk to the author of V1.2 about adding his improvements to V1.1 to create a version 1.3 soon. Secure Drive 1.1 is available within the U.S. and Canada ONLY, due to US export laws. FTP to csn.org, cd /mpj, and read README.MPJ. This is an export-controlled FTP site which also carries RIPEM and other cryptographic software. The file README.MPJ will explain how to access the cryptographic code from within the U.S. and Canada. You will be able to download immediately; there is no sign-up-and-wait procedure. (Ad continues) Do you have confidential or sensitive information on your DOS/Windows PC or laptop? Imagine what could happen if that data were to fall into the wrong hands through theft or unauthorized access. Protect your privacy with SecureDrive. SecureDrive allows you to create an encrypted hard drive partition and encrypted floppy disks. All of your sensitive data is automatically encrypted with the state-of-the-art IDEA cipher. You simply log in with your passphrase, and the program is completely transparent to your applications. The TSR uses only 2K RAM, and encrypts at the sector level. An intruder gets nothing - not even your directory listing. You can decrypt your disks at any time. The program automatically switches on and off as you access encrypted and unencrypted floppies. Invalid passwords will cause a Drive Not Ready error, locking out writes and protecting your data from damage. The program is Copylefted under the GNU General Public License, and source code in C and assembly language is included. This program is free and always will be. This program may be freely distributed within the U.S. and Canada; do not export it. Cypherpunks Write Code!

1 0

Detweiler, you are WASTING YOUR TIME
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

Detweiler is apparently the only one who cares enough to waste any time on this. He's been provided with ample information to prove or disprove his accusations. He has refused to do so, and in such a refusal, he comes off like a ranting loony. Is there any evidence _whatsoever_ that these accounts are indeed one person? P.Metzger and T.C May have both posted evidence that they are seperate people. In absence of _any_ evidence to the contrary, I accept their word for it. I don't see a motive, I don't see any evidence. No smoking gun - from my perspective, it's simply your word against theirs. Detweiler's given me not one iota of proof for your claims, just a blanket assertion. There is no reason whatsoever for me (again, I don't know anybody involved here) to doubt their words. Detweiler, on the other hand, has alleged a huge conspiracy that's gone to a huge amount of theoretically tracable work (phone lines for all the pseudos in 3 different area codes). This seems like an extremely expensive way to accomplish what should be a fairly straightforward (and I note, harmless) procedure. I will reconsider that opinion if he can post whatever it is that convinced you that this is one person. I pretty much assume everything on the net is crap, since its an insecure means of communication. Anyone not convinced of this is politely directed towards their nearest zumabot posting. Dave Criswell The true source of Oracle Corporation's wretched desperation, and low level stooge of the vast satanic cryptoanarchist conspiracy dcriswel(a)us.oracle.com

1 0

SecDriver 1.1 versus 1.2
by Hal 17 Dec '03

17 Dec '03

Aside from the technical differences between the two packages, I think the more significant difference is in the distribution. Edgar's 1.2 documentation encourages users to put the package up for FTP, while Mike's 1.0 (and, I presume, 1.1) docs ask that this not be done. Mike wants to protect himself against a PGP-style investigation into export of software. But if 1.2 is put up for FTP, it could conceivably lead to such an investigation. And Mike would presumably be a potential target. This is a confusing situation. What rights does Mike have to control a derivative product like 1.2, given that he is releasing it under the Gnu Public License? Maybe the GPL is not appropriate for the release of crypto software, at least if the author will attempt to restrict its distribution in this way. I don't blame Mike for his concern, but I think we need to recognize an inconsistency between the following three goals, for U.S. citizens at least: public recognition as the author of a crypto package; avoidance of Grand Jury investigations; free availability of the package in the U.S. Hal

1 0

Apology to Graham Toal & Cypherpunks
by Matthew J Ghio 17 Dec '03

17 Dec '03

I'd like to apologize for stating that the post made by Graham Toal <gtoal(a)pizzabox.demon.co.uk> was a forgery. It has now come to my attention that it was not. Graham Toal had always posted from <gtoal(a)an-teallach.com> until today, when he suddenly posted from: "gtoal(a)gtoal.com" <gtoal(a)pizzabox.demon.co.uk>, talking about a racist post by TC May that I had never seen, and asking to be removed from the list. Naturally, I got suspicious. I still don't know what's going on with the email address switching, but I guess the recent events on cypherpunks have made me a bit overly paranoid. Hopefully, I haven't made a complete fool out of myself over this misunderstanding. I guess we have another good reason to sign with PGP...

1 0

Secure Drive versions
by Mike Ingle 17 Dec '03

17 Dec '03

My only problem with Secure Drive 1.2 is that it doesn't include the bug fixes which needed to be included. If Edgar wants to use my 1.1 code to make 1.3, great. But the two-drives bug needs fixing, and I wrote a cracker which tests 1000 passphrases per second on the 1.0 version. The 1.1 version iterates the passphrase hash to prevent this. As for how it's distributed, I've always requested that it not be exported, and there is a message in the new distribution asking that foreign sites not carry it if they somehow obtain a copy. --- Mike P.S. All these forged messages are becoming a problem. Detweiler may succeed in his effort to make us not know who's real and who's a tentacle. Ignore anything from a remailer, which (a) has a name at the bottom, or (b) sounds like Detweiler. As for what to do about SMTP spoofing, any ideas? Next he will start posting denials of real messages. That way we won't know what messages are real and falsely denied, and which ones are false and the denials are real.

1 0

Planting Evidence
by Mike Ingle 17 Dec '03

17 Dec '03

>Back to Dirmeyer, I asked him about the warrant. He said what he did >is ordinary investigation practice, including sending people >unsolicited material and then picking it up under a warrant. I asked >him if the Judge knew, and he assured me the Judge was fully aware >that the person getting a warrant for "Lance White's" correspondence >was also Lance White. He also said the Judge was aware of the 2000aa >and ECPA issues, and that they were under orders not to look at >anything labeled email. For some reason, this did not reassure me. This reminds me of a description in "LA Secret Police" of how the LAPD used to avoid the requirement for a search warrant. A cop would go to a payphone, call 911, and report a rape or assault in progress at the location they wanted to search. The cops would go in, arrest everyone, and ransack the place. Anything they found, they could use, claiming it was out in the open and discovered incidentally. Along with the common practice of piling on outrageous charges, such as "conspiracy to ..." in addition to the actual charge, this allows the police to circumvent most of the person's rights and force him or her to plead guilty or risk a very unjust sentence. When did sending someone illegal material and then raiding the place become standard investigative practice? That used to be called "planting evidence". --- Mike

1 0