- cypherpunks-legacy - lists.cpunks.org

Addendum
by Evil se7en 17 Dec '03

17 Dec '03

For those who may bring this up, my questions are in relation to Spain's view of my problems, not the US view, as I can bring PGP out of the US legally. In February 1996, the ITAR rules were amended as regards personal use of cryptography. Temporary export of products for personal use is exempted from the need of a license, provided the exporter takes normal precautions to ensure the security of the product, including locking the product in a hotel room or safe. The product must not be intended for copying, demonstratrion, marketing, sale, re-export, or transfer of ownership or control. In transit, the product must remain with the exporter's accompanying baggage. The exporter must keep records of each export for five years. Export to certain "dangerous" countries (e.g., Cuba, Libya, Syria) is prohibited. See the text of the amendment. se7en

1 0

Encryption policy challenged
by C Matthew Curtin 17 Dec '03

17 Dec '03

http://www.news.com/News/Item/0,4,5909,00.html?dtn.head "The Business Software Alliance, a powerful Washington trade organization, warned the White House that its encryption policy will fail if the government does not turn to the industry for guidance." blah blah blah ... Interesting how these polite requests from the SBA, et al, are going for such ridiculously low goals. Being able to export 56-bit symmetric cipher products... Why in the world go for such a low number when that is the absolute *best* that you can possibly get? And with such a small difference between 56 and 40 bits, there isn't really any room to haggle. Duh. -- Matt Curtin cmcurtin(a)research.megasoft.com Megasoft, Inc Chief Scientist http://www.research.megasoft.com/people/cmcurtin/ I speak only for myself. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

1 0

Fan mail from John Gilmore and his cronies
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Apparently I'm not the only one not believing that "Logos" did not misspell both my first name and my last name just "accidentally". >Received: (from bin@localhost) by zifi.genetics.utah.edu (8.8.3/8.6.9) id AAA02080 for dlv(a)bwalk.dm.com; Thu, 5 Dec 1996 00:04:58 -0700 >Date: Thu, 5 Dec 1996 00:04:58 -0700 >Message-Id: <199612050704.AAA02080(a)zifi.genetics.utah.edu> >To: dlv(a)bwalk.dm.com >From: nobody(a)zifi.genetics.utah.edu (Anonymous) >Comments: Please report misuse of this automated remailing service to <complaints(a)zifi.genetics.utah.edu> > >You wrote: > >>logos <logos(a)c2.net> writes: >>> I have been unfailingly polite to you. Do you have it >>> within your character to respond to me in kind? >> >>Do you think spelling my last name "Vilus" is polite? > >Polite, no. Accurate, and perhaps a "freudian typo"? YES. > >Let me guess, O proud (if irony impaired) kook: > >You're now an authority on on-line manners? > > > No. Logos thinks s/he is. :-)

1 0

[crypto] Avatar Protection?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

A graphic-designer friend of mine and I were talking about VRML avatars, and custom design work, and could he offer a service designing them etc... His worry is that since everyone in the same virtual environment as his customer would see the designer avatar, wouldn't they also be able to easily rip off his work? (or his customer's property, take your pick.) I wasn't sure...it seems to me that I read something vaguely along these lines for a cryptography protocol of some sort.. The problem is this: Is there a way for a user to "view" the client's avatar (and in this sense, the user usually has to receive a copy of the code to render the avatar and render it on the local machine) but not save a copy? Assume that a client with no save feature is not a viable option...too easy to work around. I suppose an analogy would be: Is there a way for a person to see the plaintext, but not record it? I think that question really answers itself - no. How about alternatives? If the server of the environment only renders "views" (say, certain angles, or a bitmap) of the avatar, rather than sending the description file? Any other thoughts? Ryan

5 4

Re: [crypto] Avatar Protection?
by AJ Barrett 17 Dec '03

17 Dec '03

At 09:13 PM 12/4/96 -0500, e$pam wrote: <snip> This sounds like a good argument for the crypto "watermark" idea that was discussed a few times earlier on the list. I think it goes something like this: The document/avatar/code/whatever has a crypto identifier embedded in it that can be extracted to verify ownership. Perhaps a good analogy might be a steganographic application. > The problem is this: Is there a way for a user to "view" the client's > avatar (and in this sense, the user usually has to receive a copy > of the code to render the avatar and render it on the local machine) > but not save a copy? Assume that a client with no save feature > is not a viable option...too easy to work around. Yep. Even the "eyes only" setting in PGP is no good if the recipient is savvy enough to cut and paste the plaintext to the clipboard. -- Sincerely, AJ Barrett <abarrett(a)checkfree.com> Product Analyst CheckFree Corporation: The Way Money Moves http://www.checkfree.com

1 0

Bank Of America To Launch Internet Banking System 12/02/96
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

TOKYO, JAPAN, 1996 DEC 2 (NB) -- By Martyn Williams. Bank of America is due to offer its credit card customers the ability to perform basic account transactions via the Internet next year. The bank will be using a system currently under development by Hitachi Ltd. and Bank of America subsidiary Concorde Solutions, a Hitachi spokeswoman confirmed to Newsbytes today. "The new system will enable credit card transactions via the Internet," said Hitachi's Emi Takase. "Bank of America is aiming to market the system from August, 1997." Customers should be able to check credit card balances and account details, apply for credit limit increases, and many of the other actions that a telephone is currently used for. Concorde Solutions, a company 70 percent owned by Bank of America, will develop the application for users with Hitachi. It will run on top of the Japanese company's TP Broker system, an object request broker that was developed with Visigenic Software Inc. Launch customer for the system will be Concorde parent Bank of America, but plans are for the system to be marketed to other banks. "The product will be sold by both companies afterwards," said Takase. (19961202/Press contact: Emi Takase, Hitachi Ltd., +81-3-3258-2055, fax +81-3-3258-5480, e-mail emi(a)cm.head.hitachi.co.jp; Reported By Newsbytes News Network: http://www.newsbytes.com) -- C O P Y R I G H T * R E M I N D E R This article is Copyright 1996 by Newsbytes News Network. All articles in the clari.* news hierarchy are Copyrighted and licensed to ClariNet Communications Corp. for distribution. Except for articles in the biz.clarinet.sample newsgroup, only paid subscribers may access these articles. Any unauthorized access, reproduction or transmission is strictly prohibited. We offer a reward to the person who first provides us with information that helps stop those who distribute or receive our news feeds without authorization. Please send reports to reward(a)clari.net. [Use info(a)clari.net for sales or other inquiries.] Details on use of ClariNet material and other info can be found in the user documentation section of our web page: <http://www.clari.net>. You can also read ClariNet news from your Web browser.

1 0

HP
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

> HP UNVEILS NEW CRYPTO CONTROL FRAMEWORK > > Hewlett-Packard announced a new framework technology designed to let > governments enable and disable strong cryptography products. The > framework is independent of the method used in a given product. The > heart of the system is a small, tamper-resistant module with the > cryptographic algorithms that remain dormant until activated. A policy > activation token (basically some key bits) can be used to choose > between the various crypto algorithms stored on the module. The HP > press release makes this sound like the greatest thing since public > key encryption, but in reality it appears to be just another attempt > to insert government control into private data exchanges. Look for > legislative attempts to make this technology mandatory on all > encryption products. Technology details are at the site. > <URL:http://www.dmo.hp.com/gsy/security/icf/main.html> > > > > NETSURFER DIGEST (c)1996 Netsurfer Communications, Inc. > All rights reserved. > > NETSURFER DIGEST is a trademark of Netsurfer Communications, Inc. > -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2233328 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

New DCSB list for announcements
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 5 Dec 1996 15:38:01 -0500 (EST) From: Rich Lethin <lethin(a)ai.mit.edu> To: dcsb(a)ai.mit.edu Subject: New DCSB list for announcements Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Rich Lethin <lethin(a)ai.mit.edu> By request, I've created a new DCSB mailing list, dcsb-announce(a)ai.mit.edu which will be for DCSB-related announcements, only. The ability to post to the list will be restricted by Majordomo. Subscriptions are for folks who can't/don't/won't paw through the talk on the normal DCSB mailing list and digest, but would like to hear about upcoming lunches. Because the lunch announcements will be sent to both the dcsb-announce and dcsb lists, there's no need to be on both. To subscribe, send an email To: dcsb-announce-request(a)ai.mit.edu Subject: irrelevant subscribe Rich ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Laptops and TEMPEST
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>Not to mention the point that an external attacker--say, the NSA van parked >across the street--will under no circumstances be able to measure "the" >spectrum: his antennas cannot possibly measure the signals (at the lower >bits) seen by the FM receiver, noise source local to the computer, whatever. Tim was talking about the Bad Guys setting your radio noise generator, but the other side of the coin is TEMPEST - making sure your computers don't emit enough radiation for Bad Guys to read it. CRTs are well known as emitters of easily decoded signal, but people have occasionally suggested on this list that laptop LCD screens are much quieter. I now have a data point on this one, and basically, it ain't so. Take a basic television with big rabbit-ear antennas. Tune to the football game on Channel 6. Take your AT&T Globalyst 250P (which is a gray NEC Versa with a Death Star), with the 16-million-color 640x480 screen in 65536-color mode, and pop up a DOS command window in white-on-black. Type a few lines of text, then look at the TV. The sync wasn't quite right, but there were about three copies of my DOS window. It may have been scrolling slowly vertically or horizontally, but it was relatively readable given the lack of resolution of the screen. A good receiver run by a Bad Guy ought to be able to set its scan rates correctly to pick up the screen at better resolution. There are obviously more variables to be explored, but other people who were present at the time considered the football game to be more important :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

3 2

Re: Laptops and TEMPEST
by Joel McNamara 17 Dec '03

17 Dec '03

Thinking that LCD screens reduce the risks of emanation monitoring is a dangerous misconception (at least under a high threat model). LCDs' current requirements are pretty small, and they only emanate a low magentic and electrical field. However, the gotcha with current laptops is their backlighting. Electric and magnetic fields are considerably higher compared with a low-res/contrast device. There are documents that circulate within certain security circles that list just how noisy (and therefore easy to monitor) various off-the-shelf machines are. It would be an interesting project for some ham radio type Cypherpunks to measure their machines, and publish the results. Or, for some well connected person just to scan and anonymously post such a document to the list. Of course, I'd never encourage anyone to do something illegal. Joel

1 0