- cypherpunks-legacy - lists.cpunks.org

No Subject
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

e. > However, since the protocol requires that Alice send out location data, >once >she starts using it she reveals her physical location to Eve, Mallory, and >anyone ese > who can see the packets. Since the nature of the protocol is that Alice's >location does >not change frequently (and needs to transmitted via a trusted channel to >Bob when it >does), after the first usage Mallory *knows* the physical location he is >trying to >simulate, and can use this information for future spoofing. > > The upshot of this is that Denning's scheme not only provides no >security against >spoofing, and leaks potentially sensitive data about locations. > > If Sadaam Huissain (sp?) had used this scheme during the Gulf War, we'd >have been >able to send a cruise missile directly to his keyboard. This could be prevented by encrypting the data packets, but that would introduce more delay into the protocol, and make it easier to spoof distant locations. >[These flaws in the protocol seem so obvious that I can't help but wonder if >we're >missing something - Dorothy isn't *that* stupid.] Isn't she about the age where Alzheimer's starts kicking in? Jonathan Wienke

1 0

Re: Protocols at the Point of a Gun
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 PM 4/10/96 -0700, Jeff Weinstein wrote: > Given that the IETF has no "official" (whatever that means) sanction, >what would prevent any other organization from coming in and trying to >take over their turf? ... It seems to me that this question represents a classic case of the costs of market entry. IETF has a pretty good reputation as a standards body. If another body were to take over its function, they would have to have superior reputation in the relevant market (i.e. IP protocol suite implementors and their customers). Superior reputation could come from: (1) Better response to proposals. (Hard to imagine in the current climate.) (2) Government coercion. (We will throw you in jail if you don't ...) (3) Government coercion. (We won't buy equipment that doesn't meet x standard.) (4) Large User coercion. (We won't buy equipment that doesn't meet x standard. Probably no user is currently big enough to force standards in this way, not even Microsoft.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

washington post notices archives
by Andrew K. Bressen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi-- we here at HKS.net have today received a cease and desist letter from the washington post regarding editorial copy of theirs that was evidently posted to c'punks and then abosrbed into our c'punk archives. Once the archives are restored (RSN) we'll probably manually edit out the messages from the archive. We're trying to get the post to give us URLs for their copies of the content in question so that we can point to their archives, but their legal dept wasn't sure whether or not their archives were on the web. The posts in question date back some time (archive volume 1); I'm not too concerned about a recurrance (though it would make an interesting attack), but thought it was interesting enough to warrent mention, since it seems likely that the washington post was grepping the net looking for themselves. I wonder if robot exclusion on our site would have prevented this? Although the legal staffer who sent the letter did come up with a URL for the offending messages, she seemed unaware of the concepts of "mailing list" and (semi-automated) archives according to the person here who spoke to her. - --andrew k bressen bressen(a)hks.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMW17+1u2h42ZEVfZAQFslQP/avVguGOK/hRz/1SmZtZpld79edoDyJnf yeBkX7WdrfVt1/xSkOdD4xtVHf1FENfeFr50xnt2PPVb8g0E0DQqMv6Cz4ZNy5Su bXzsmvK/zCvLKPn7gueeRjk3jQKohGRf7R9Y6rr6N6jNbCS4zZQQ/nwN7sWdhZA2 epRRPjbH52A= =8d5T -----END PGP SIGNATURE-----

1 0

Re: On computer face recognition:
by David Loysen 17 Dec '03

17 Dec '03

At 10:02 PM 4/10/96 -0700, you wrote: > >On computer face recognition: > > >>> Shaving probably will not be a problem, but holding your head at a >>> slightly different angle... will screw up the system totally, >>> unless the system has radically improved since the last time I read >>> up on it. > >At 11:45 AM 4/9/96 -0500, K00l Secrets wrote: >> Well, the systems I have seen are quite good at finding people's eyes. >> Scaling (for distance), and rotation (for the angle of your head) >> therefore don't really confuse the system once it has your eyes. > >Finding the eyes can only control for rotations in the plane of >the image, when you tilt your head to one side. They cannot >handle the much more common case of 3D rotations, where you >look slightly to the right or slightly to the left of camera. >Facial expressions also throw them badly. > Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of Lawences papers is on using Neural networks to recognize faces. Methinks that the state of the art is advancing rapidly and such problems as not looking at the camera or changing your expression are rapidly being overcome. ===================================== dwl(a)hnc.com Zippity do da, zippity ah, my oh my what a wonderful day. Ya right, and hear I am without time to finish a cup of coffee.

1 0

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 2:28 PM 4/10/96, Black Unicorn wrote: > This showed up in my mailbox: <snip> > PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate > Eudora and MacPGP are now available in the latest Button Circle release >at: > ><ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch9 >6.sit > .hqx> I'm using it. I actually went out and bought OneClick to do so, mostly because I wanted to mess around with scripts for other things and OneClick looks pretty painless to use. PEP works pretty much as advertised, except that the finger operations take too long for my ISP to execute sometimes, and evidently the finger events in Eudora aren't robust enough to wait for the operations to complete, so a "wait" has to run. The work-around is to manually do the finger instensive "get cypherpunks remailer names" and "get remailer-keys" operations with eudora, copy the results, and then run the scripts. Anyway, I bashed on it, and PGP, a bit, and now there's a palette when I use Eudora which I can click to do chained remails, which I was never really able to do before. It also does signs, which are fine, and encrypts, which are also fine, but the decrypts come up in the PGP window, which is crypto-correct, I suppose, but I like the dump-it-into-it's-own-mail-window result of the original OSA scripts which come with MacPGP. This is useful if you actually want to reply to an encrypted mail message. One of the other things that is nice about the original MacPGP scripts is that they automatically verify signatures on decryption, and, at the same time, they also automagically add any attached keys to your keyring, pending certification, etc. Anyway, if you have OneClick already, then PEP is a way cool thing to have. Here. I'll sign this message with it. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWwYUvgyLN8bw6ZVAQEUKgP/eXQsCS/AaAj07s9PAX07j5WcXCXDGvpF RxDSLqJNA3wOcU3QKrDc/T0HfzQELM/RbjOvDy7XPWUwxEN/SUTfRzAekYtJ6RbM 2w3CDYtNsdXyv4yyrgNF1eIjs+IecYYrCBeXJcvHn6fRwEbVBr+yFgXIprjfeEZ9 of/IGHDE0Qc= =bshY -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 07:59 PM 4/12/96 -0400, Black Unicorn wrote: >On Fri, 12 Apr 1996, E. ALLEN SMITH wrote: >> >I might add that the Cayman Islands are full of trust companies with >> >provisions which forbid the disclosure of data to a client who is >> >coerced. A law on the books refuses to recognize "consent" orders made >> >under judicial compulsion. This would give the appearance of total >> >unavailability of evidence and suggest the futility of contempt >> >charges. Yet courts have still, and with no small measure of success, >> >imposed sanctions on witnesses so protected. >> >> What measure of success? Getting the data, or locking up the witness? >> -Allen > >Getting the data. If the IRS or a private plaintiff wants it bad enough, >they can usually get their hands on it, or at least find out where it is. > >The government of the United States doesn't play "fair" when they want >something. But if the government of the United States does play "fair," then why can we not play "fair" and kill their agents who violate what we feel is our rights? After all, the government is merely the representative of the people (at least in theory!) and it 'must' follow the rules (laws, Constitution, etc). To whatever extent it exceeds those limits, and to whatever extent the public can't get justice to prevent those violations, why would the public be obligated to accept them? To believe otherwise is to believe that the government has some sort of special dispensation to violate the law. I don't believe this; it wouldn't surprise me to hear that you do, however. Which is it? Jim Bell

2 1

Re: No matter where you go, there they are.
by David Lesher 17 Dec '03

17 Dec '03

I asked a friend charged with spending money in this area. Here's his reactions, and those of someone he consulted: ================== ..There is a business case flaw in the proposal. The scheme as laid out only provides a high confidence factor on the users location (+- 10M), NOT on the actual identity of the user. Thus it would have to be coupled with some other form of I&A. The business question then arises, is the confidence delta provided by this scheme consistent with the cost delta? My first take is that the answer is no. =================== Re spoofing the system. If you think about the geometry of the problem, the delay to be induced for each satellite is a time varying function of the satellite's position, the reference site, and the target. It will vary from positive to negative values for many satellite passes. It can be precomputed, but the precomputed adjustment will be in error by some amount due to the orbital perturbations mentioned in the original article. The most common prediction error is the in-track postion, which inconveniently for the predictor has the greatest effect on one's ability to calculate the right delays. Anyone with access to a decent orbital prediction code and access to the statistics on orbital perturbations should be able to calculate the expected delay prediction error as a result of the orbital uncertainties. If the delay prediction errors are detectable, then it seems the system is secure after all, allthough other reservations on operational suitability might still apply. Note that the sensitivity is a function of the distance between the reference site and the target. If you could collect your reference signal across the street from the target, it would make spoofing a lot easier. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Edited Edupage, 4 April 1996
by Michael C. Peponis 17 Dec '03

17 Dec '03

On 12 Apr 96 ,E. ALLEN SMITH wrote: > From: IN%"educom(a)elanor.oit.unc.edu" 5-APR-1996 01:25:00.85 > >IBM'S INTELLIGENT MINER DIGS OUT THE GOOD STUFF > >IBM plans to offer companies "data mining" software and services, allowing > >them to make better use of disparate pieces of information stored in their > >computer systems. The Intelligent Miner software will be available on IBM's > >RS/6000 servers by the fall, and on other platforms by year end. The > >company also plans to develop Intelligent Decision Server software for local > >area network-based information analysis. (Investor's Business Daily 3 Apr > >96 A9) > > Anyone have any _specific_ ideas on how their Intelligent Miner system > works? It would appear to be relevant to the identity-spoofing discussions. > -Allen Not really, it's a tool used in Data Warehousing/Decission Support Systems. Here is what it is in a nut shell. A company creates a Data Warehouse, defining it's data universe in terms of business rules and practices. Data Mining is the process by which users try to make sence of all the data. They call it "intelligent" because it supports natural language queries, ie the end user does not need to know SQL or the table layouts to retrieve the information they want. Very sketchy explination, but there are entire volumes written on the subject, and it's new technology so the exact definition varies depending on who you ask. I have been developing systems like this for the past year, and I still can't give people a cut and dry answer as to what the hell it is. Regards, Michael C. Peponis Public Key Avalible Via Key Servers, or Finger

1 0

New paper on crypto regulation and the right to privacy available
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

A paper exploring various aspects of cryptography and cryptography regulation has just been published in the Journal of Universal Computer Science (J.UCS). J.UCS is a Springer-Verlag electronic publication available at <A HREF="http://hyperg.iicm.tu-graz.ac.at/0x811b9908_0x0008eaac;sk=74BEC6EF"> J.UCS</A>. It's coming off a non-HTTP server so I can't give a direct URL, you need to follow the links to Volume 2, No.3 to find: Government, Cryptography, and the Right to Privacy J.Shearer, P.Gutmann The notion of a right to privacy of citizens in their communications is discussed in the context of an international movement by governments towards regulation of cryptography, and consideration of key forfeiture systems in national cryptography use. The authors argue that the right to privacy in communications networks is an issue of major importance, assuring freedom of the individual in national and global communications. Regulation and control of cryptography use on the Internet by national governments may lead to an imbalance in the citizen/government power relationship, with sequelae including unprecedented surveillance of citizens, disruption of international commerce due to lack of powerful cryptography (and lack of standardisation), human rights abuses by less democratic or non-democratic governments, and limiting of the political potential of an Internet global political system. Peter.

1 0

Re: PICS required by laws
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frantz(a)netcom.com" 6-APR-1996 16:21:56.32 >I am less worried about this possibility than most. PICS scrubbers will be >as easy to produce as any other web intermediary. (e.g. The one which >replaces "bad" words with "censored".) Quite... as will ones that flip-flop the various packet bits that people are discussing. >I do not make these comments publicly, because I don't want to poke holes >in network self censorship while the courts are grinding on the CDA. (Note >that true self censorship, where the viewer wants the filtering would not >be impacted. Those viewers would just not use that kind of intermediary.) I don't plan on mentioning it on CuDigest, either... just that any imposition of this standard will leave countries where it isn't imposed. > I applaud the ACLU's position in not rating their web page. I will also >note that it is possible for a PICS filter to refuse to pass unrated pages. Yes... and it would be possible for a PICS unrating filter to simply set all of them to child-OK. With the current discussion of packet-based censorship, it would appear possible for the bit in question to be reset by _any_ of the systems it passes over at least as easily as those systems could use this bit for filtration. I would suggest a "Trojan Horse" program to do this, in order to A. get governmental systems and B. give SYSOPs an excuse to run the flipping program. This flipping could produce either child-visible or child-invisible material, depending on what result the system in question wished to produce. Child-visible would help the children; child-invisible would make the Net unusable for children whose parents weren't sensible enough to not use such software. The latter, applied to technical material, would also drive China, Singapore, et al nuts. > If much of the technical information on the net is unrated, China, >Singapore etc. will be between a rock and a hard place with the >anti-censorship intermediaries. -Allen

2 1