- cypherpunks-legacy - lists.cpunks.org

Re: Exporting cryptographic materials, theory vs. practice
by nobody＠rahul.net 17 Dec '03

17 Dec '03

Matt has a good story, and the lesson that he draws, that presently the average person can't follow the rules, seems valid. But I don't see the point of the proposals to replicate his experiment. Doesn't Matt's experience really show simply that not enough people try to follow the rules, so the agencies aren't set up yet to make it easy? Is it our goal to change this, to get Customs to streamline their operation so that everyone really does register their crypto equipment on travels overseas? It seems to me we are better off with the present informal system where you can actually use crypto overseas without worrying much. I could see a system where you routinely fill out and have your card stamped when you check your luggage to show that you are carrying crypto. Then you turn it in when you come back. This might not be too different from what you do now when you declare items you are taking out and bringing back to show they are free of customs duties. How does this advance the CP cause?

2 1

RFC: Key Capture Utility Survey
by KEY-CAPTURE＠lsd.com 17 Dec '03

17 Dec '03

REQUEST FOR COMMENTS ON KEY CAPTURE UTILITIES --------------------------------------------- Key capture utilities present a serious threat to the security of passwords on individual and networked computing systems, especially when novice users are unaware of their presence. Well-educated users and administrators help make all systems on and off the Internet more reliably safe for everyone's data. If you are a: -- privacy, system security or cryptography advocate/activist -- network admin concerned with the password-hygiene of your users or -- computing professional with an appreciation of good security, then please complete and return this quick survey. By contributing to the knowledgebase on the subject of password protection, you can help educate yourself and many novice/intermediate users about a common weakness -- utilities that may capture their keystrokes unseen as they enter their *password* -- in ALL secured systems (a user's encryption app, your network or its dial-in access, your company's email system or database fileserver, etc.). The intent here is to create a *central list of all key-capture utilities* which will help people to at least be aware of their existence or operation on a given system and describe in simple terms how to disable the utility. The results of the survey will be tabulated and put in the public domain on the Internet. If your reply is included, your name will be acknowledged in the resulting document, which will be: part of the new "Beginner's PGP FAQ" for new users of the PGP (Pretty Good Privacy) application; a msg posted on various Internet lists and online services and; a text file available by anonymous FTP as: ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/key_cap_util.txt Please forward this survey to anyone you think can/will help - and thanks in advance for your contribution! _______________________________ THE KEY CAPTURE UTILITY SURVEY: The survey is very easy to participate in. Just send as much information as you can, even if you're only partially able to complete the form. Every piece of information that can lead us to the utility - even just a fragment of a name and an email address of someone who might know more about it - will help us compile a fairly exhaustive list. To assist us in easily tabulating the incoming mail on this topic, please send your reply to: - - <KEY-CAPTURE(a)lsd.com> - - Format your answer as follows: ******* PLEASE RETURN ONLY THIS INFORMATION ******* TO: KEY-CAPTURE(a)lsd.com SUBJ: PLATFORM/Utility Name MSG BODY: [1] OPERATING-SYS <--- i.e. WIN/DOS/MAC/OS2/UNIX, etc. [2] "Utility-Name" (utility-package-name, if not a stand-alone product) [3] Developer-Name (company-individual) [4] <developer-email-address> [5] Type <--- i.e.: system extension, autoexec, TSR [6] Path-to-file-location-when-loaded. [7] How to disable the utility's key capturing operations (step-by-step if possible). Please be brief, but aim for a novice level user. If disabling the key capturing is too complex to describe easily, then just explain what the user should ask a sys admin to do for them (while they watch, if applicable). *************************************************** (Here's an Example:) SUBJ: MAC/Now Save MSG BODY: [1] MAC [2] "Now Save" (Now Utilities v5.x), "NowSave" (Now Utilities v4.x) [3] Now Software, Inc. [4] <support(a)nowmail.nowsoft.com> [5] System extension/Control Panel device (CDEV) [6] [startup HD]:System Folder:Control Panels:Now Save (or :NowSave) [7] How to Disable: Open the "NowSave" (v4.x) or "Now Save" (v5.x) Control Panel. v4.x: Click the "Preferences" button. Click the "Key Capture..." button. Click the "OFF" radio button (upper right corner of dialog). Click the "OK" button. v5.0: Click the "Key Capture..." button in the button-bar. Click the "OFF" radio button (in upper right corner of dialog). Click the "OK" button.

1 0

Reminder: January 14th "Tools Demo Day" Meeting
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

This is a reminder that the January 14th "Tools Demo Day" meeting is coming up, standard place and time at the Silicon Graphics building in Mountain View, CA. I described this several weeks back and asked for folks interested in demonstrating any sort of software tools, crypto code, languages, etc., to get in contact with me. One person, Henry Strickland (Strick), has done so. In any case, the meeting will go on. I'll have my PowerMac 7100 there, and will demo some things like Mathematica, SmalltalkAgents, MacPGP, etc. An SGI Unix box is of course available. An Intel box running something of interest will presumably be brought by someone. Anyone planning to demo something should either plan to run on a machine they know will be there, or bring their own. A video projector is sometimes usable, and I plan to bring my video camera. The idea is that laptops and other non-video out systems can still be seen by lots of folks. (Someone mentioned also that an LCD projector may be available.) The normal meeting time is 12-5, but people usually spend the first hour shmoozing and eating their burritos, so I plan on starting the formal meeting at 1 (but don't get there at 1 and _then_ expect to shmooze/eat for the next hour!). The machines should be ready to go by 1:30 at the latest, so that demos can begin. If we have a lot of demos--not likely based on current information--then I'll propose parallel tracks. Please don't be bashful about doing a demo! The idea is to educate and expose people to tools and software they might otherwise only vaguely know about. Demos don't have to polished and professional. And please send me a brief note if you want to demo something. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

RE: Reminder: January 14th "Tools Demo Day" Meeting
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some may recall an idea I wrote about a couple weeks ago to provide transparent encryption/signing/remailing facilities to users of Windows Sockets based mail agents on PC's (e.g., Eudora). I have completed an initial portion of the program as a "proof of concept." All it does right now is act as a SMTP server and accepts mail from a mail agent, performs requested encryption/signing operations on received messages, and puts RFC 822 compliant outbound messages in a directory for submission to a 'real' SMTP server. (No remailing features present). Of course, the next module to write is the SMTP client that takes this outbound message queue and sends it off to the actual SMTP server. It is a bare bones app with no user interface, fault tolerance, or configuration options, and probably only works on my machine at the moment :) I don't expect to make any significant progress on the program between now and the Jan. 14 meeting, but if anyone is interested I will bring it to the meeting and "demo" what little there is at the moment. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov WWW: ftp://ftp.netcom.com/pub/jc/jcorgan/www/homepage.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwhxw+lPfVlQ1n99AQH6CAf8DJmXqtuP24C39k3/qk4mRuGxm4IehWdQ zdFjTgrzMuTXuM4SOtkV1k+JGZrjAW5G+tqiNLbNHDDzCWC/75G/8HMjUdWMSINq gOHXUl3oKtm6R27ClGhIZKuWJwLF0UH4XpUDWvawj5lFdWhKmSThuuF3WG1RKivQ PZjRh6Iq7wHf9wFI+rFRi8UHu311ZcyW4jR4h5R7siFeTd9GcBCEJ9CCQy+j+Vsu AbplhNZVztooLVitsAkYdcNu2gcAdun5u7WOPuEIM/Mwsokg53z4+AoUrYCkjqmu sqeAVr/S+1fwKXjMTSxt7qpIEUkErzTzhgQeQgLWYcUcnHg71A8AiA== =rOcl -----END PGP SIGNATURE-----

1 0

Re: Why I have a 512 bit PGP key
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> While it's likely that a sysadmin could hack the kernel to substitute > bogus MD5 hashes, doing so in certain environments could earn the sysadmin a > quick exit from employment. If it wasn't the reason he was employed for. In Germany it is not allowed to spy out someone elses phone calls. (Is it in the USA?) But some cases got public where employees of several companys got their phones tapped. It was done to find out whether they do private phone calls or what they say in private phone calls. Hadmut

1 0

Re: Anonymous payment scheme
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There are a couple of issues here. One is whether you could get a debit card with another name printed on it than your own. Sandy Sandfort and some others have suggested here that this would be legal and possible already as long as you don't do it with the intention to commit fraud. You can open a secured account by mail and give a false name. I'm not sure what you do in this situation if they ask to see some ID when you try to use the card. This would be rather embarrassing, it seems to me. Sorry, I guess I left my drivers license in my other pants... Or, never mind, try this card. That other one was from before I changed my name... The other issue is whether you could set up a payment system which did not require social security numbers from the participants. I think this is much more questionable. Although the phone cards and some other restricted usage systems are apparently legal, bank accounts seem to have many more restrictions. Barter and scrip systems are also heavily regulated. All these laws involving reporting requirements, etc., were passed to help the government track the flow of money. There is no way the government is going to make an exception at this point. In fact, I suspect that if the limited systems expanded to where they were used for general payments, the government would crack down. I recall reading that just such a crackdown occured in Las Vegas when casino chips started to be accepted for non-gambling payments. So, you may be able to have a form of anonymity from the person you are transacting with, but I don't think you can be anonymous from the bank and from the government. And personally, I am more concerned about the bank and gov't tracking my spending patterns than whether the guy I buy gas from knowing my name. The bank has a lot more information about me which is much more threatening to my privacy. A nom de guerre VISA or debit card does not seem to help this problem. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLwhuNRnMLJtOy9MBAQEkPQIAqEEglLxt8E4Rrgh7dR93fuCSJUI+UMgF 3XUrsTxM4whOejFMrluOAYM+2RdBOgYTk1mNEiAgSUPLLScIa9zU5A== =CF5G -----END PGP SIGNATURE-----

4 4

HACK - EFH Presents Free PGP Encryption Workshop (fwd)
by Mark Rogaski 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just thought you may be interested in this. Anybody ever hear of this EFH group? It's nice to see somebody making PGP a little easier for the average jane/joe end-user-type to use. - From the node of FringeWare Daily: : : Sent from: Jon Lebkowsky <jonl>@io.com : : >From: robbiew(a)inviso.com : >Summary: January 14, 3:00 PM, SCCSI offices in Houston : >Keywords: Houston EFH PGP Workshop : : Electronic Frontiers Houston : presents a : Free Cryptography Workshop: : How to use Pretty Good Privacy : (PGP) : presented by Paul Elliott : 14 January 1995 3PM : : : It has become apparent that the data super highway is not safe. Messages : traveling the data highway can be hijacked by sinister data interlopers. : : After six months of unpaid labor, in June, 1991 Philip Zimmermann : released his controversial freeware program Pretty Good Privacy (PGP). : Just as Prometheus' liver was eternally chewed by eagles for the crime : of bringing fire to mankind, Philip Zimmermann's liver is now being : chewed by the Federal Eagle (The U.S. Custom Service) for the alleged : crime of releasing strong cryptography to the world. : : As a result of Philip Zimmermann's contribution, you can use the widely : available freeware program PGP to send electronic-mail messages to : anyone in the world, in complete privacy! In addition you can send : authentication with your messages so that the recipient can verify that : the message really came from you. You can encrypt sensitive files on : your computer so that the files remain private even if your computer and : disks are stolen. : : In this free workshop, our presenter Paul Elliott will show you how you : can use PGP effectively, easily, and intelligently. PGP is available for : most popular computers and Operating Systems, including MSDOS, UNIX, MAC : and OS/2 among many others. : : The Workshop will take place at on January 14, at 3:00 PM at the : offices of South Coast Computing located at 1811 Bering, Suite 100. Park : in the garage, and ignore the "contract only" sign. Enter through the : back door (adjacent to the garage) and use the house phone (dial 100) if : the door is locked. : : : | Augusta | Bering | Chimney Rock | 610 Loop West ^ : | | | | | : | | | | N : ----+-----------+-----------+----------------+---- San Felipe : | |* SCCSI | | : | | | | : ----+-----------+-----------+----------------+---- Westheimer : | | | | : | | | | : ----+-----------+-----------+----------------+---- 59 South (SW Fwy) : | | | | : | | | | : : : For more information call (713)799-1044 or : email efh(a)blkbox.com : : -- : Robbie Westmoreland robbiew(a)inviso.com : Electronic Frontiers Houston announcement : : : : : : -- : =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= : Jon Lebkowsky FringeWare<tm>, Inc. jonl(a)fringeware.com : URL http://fringeware.com/staff/jonl/jonl.html voxmail 512-444-2693 : =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= : : : : : - ----- Mark Rogaski a.k.a. Doc "I used to think that my brain was the rogaski(a)phobos.lib.iup.edu best part of my body ... but then I http://www.lib.iup.edu/~rogaski/ remembered who was telling me this." 100,000 lemmings can't be wrong! - Emo Phillips >>>>>finger fllevta(a)oak.grove.iup.edu for PGP Public Key and Geek Code v2.1<<<<< Disclaimer: You would probably be hard-pressed to find ANYONE who agrees with me, much less my university or employer... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLwkIix0c4/pqJauBAQGBpAQArkyQpzJi4ux+gDGrHAmbFMvifVkRYFfG KpkFcPC+h8eGZy3/bbGsKuev7ZXICUBKpf7KIPtg7P4vaD3hPyjRVZahu5doIWiY 9k//PkA0ViMq3p/bT0dfDcMavBVUppHNs4g8FxV0njqXinIT1PI42PRfroGSwL7m FqtECicCS3Y= =QD7G -----END PGP SIGNATURE-----

2 1

EFF PGP Workshop
by Connie Sadler 17 Dec '03

17 Dec '03

Sure would be nice to have a PGP workshop in the Bay Area - any EFF members or others willing? Connie

1 0

Re: Anonymous payment scheme
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Brian Lane <blane(a)seanet.com> > I don't see why a debit card couldn't be anonymous, even to the point > of having no name, AND no picture on it. Yes, the bank has the money, but > their only obligation is to dish it out to the vendors/ATMs that you have > used your card with. Why should a bank care who you are once they have > your money in the account. Again, it is unclear here whether you are proposing that you would be anonymous to the bank or just have a blank card. As I wrote, banks are required to get SS#'s for depositers right now, and I wouldn't expect that to change any time soon. If anything, the trend appears to be towards more tightening rather than less. Duncan and/or Sandy have suggested giving a fake SS# when you open your secured account; maybe that would be legal but it sounds questionable to me. > As to avoiding fraud with the card, is it really that huge of a > problem? As long as noone copies the number(could go so far as no > embossed number. Just a gloss black card with a hologram of a Bald Eagle > on the front of it), and you don't lose the card how can someone use your > account? I used my VISA yesterday, and after swiping it through the now-ubiquitous card readers the vendor was required by the machine to manually enter the last four digits on the card. He complained that this was something new and was happening very frequently now (maybe a change with 1995?). I have heard of fraud where people make fake VISA cards (or steal them) and re-program the mag stripe to have a different number than what is on the front. Maybe this is a countermeasure for that. It doesn't sound like a blank card is the direction the industry is going. Does anyone have more info on this change? Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLwmNFBnMLJtOy9MBAQF4gAH7BgHuNzraGdAujkbnStXf9knBUYCKiJZv zodiYtbEFAKuuPUIT/aqyM1L7IPRbMuNMSW9hmel3k11g9ATHy+doA== =n71e -----END PGP SIGNATURE-----

3 2

Anon penet addresses
by An annoyed user 17 Dec '03

17 Dec '03

To whomever keeps signing up penet addresses of the form "anXXXX" to cypherpunks: Cut it out. I've changed your address from the anXXXX to the naXXXX address. If you don't know why anXXXX is antisocial, I can tell you while flaming you for not understanding what you['re doing.

1 0