- cypherpunks-legacy - lists.cpunks.org

Fw: Re: Secure IDE?
by Bojan 14 Aug '03

14 Aug '03

----- cut here ----- From: "Ralf-P. Weinmann" <rpw(a)uni.de> On Wed, Jul 30, 2003 at 04:20:37PM -0400, Trei, Peter wrote: > ABIT has come out with a new motherboard, the > "IC7-MAX3" featuring something called 'Secure > IDE', which seems to involve HW crypto in the > onboard IDE controller: > > >From the marketing fluff at > http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 > > "For MAX3, the ABIT Engineers listened > to users who were asking for information > security. SecureIDE connects to your IDE > hard disk and has a special decoder; > without a special key, your hard disk cannot > be opened by anyone. Thus hackers and > would be information thieves cannot access > your hard disk, even if they remove it from your > PC. Protect your privacy and keep anyone > from snooping into your information. Lock > down your hard disk, not with a password, > but with encryption. A password can be > cracked by software in a few hours. ABIT's > SecureIDE will keep government > supercomputers busy for weeks and will > keep the RIAA away from your Kazaa files." > > No, I have no idea what this actually means either. > I'm trying to find out. > > Peter Trei Yeah, that announcement just ran over the slashdot ticker. Someone posted the following insightful link subsequently: ftp://ftp.abit.com.tw/pub/download/fae/secureide_eng_v100.pdf Looks like that sucker only does key-truncated version of DES called DES-40. Right... did they say weeks? I'd say minutes, unless ABIT means [insert some impoverished 3rd world country] government supercomputers. It's snakeoil, move on, nothing to see here. Cheers, Ralf -- Ralf-P. Weinmann <rpw(a)uni.de> PGP fingerprint: 2048/46C772078ACB58DEF6EBF8030CBF1724 ----- cut here ----- | | ( | ) c'ya . o ( | ) \|/ Sharkey \___/ \|/ `-^-' `-^-' | | bomb cia nsa cocaine terrorist drug kill president nuclear -- Hi Echelon! :) PGP 2.6.3i 7CAD47C9: AF D0 62 B3 94 6C 2791 9C CD 87 1D 21 B0 5B 59 -- Arachne V1.70;rev.3, NON-COMMERCIAL copy, http://arachne.cz/

1 0

Re: ATMs moving to triple DES.
by Major Variola (ret) 13 Aug '03

13 Aug '03

At 12:56 PM 8/13/03 -0400, Trei, Peter wrote: >http://www.icbnd.com/data/newsletter/community%20banker%20feb%2003%20.pdf > >Finally, five full years after DES was definitively proved >to be vulnerable to brute force attack, the major ATM >networks are moving to 3DES. And you can still use 2-key 3DES...

2 1

ATMs moving to triple DES.
by Trei, Peter 13 Aug '03

13 Aug '03

http://www.icbnd.com/data/newsletter/community%20banker%20feb%2003%20.pdf Finally, five full years after DES was definitively proved to be vulnerable to brute force attack, the major ATM networks are moving to 3DES. Peter Trei

1 0

Re: Controlled nymity
by Major Variola (ret) 13 Aug '03

13 Aug '03

At 09:12 AM 8/12/03 -0700, James A. Donald wrote: > -- >What we want of a payment system, is that Alice can prove she >paid Bob, even if Bob wants to deny it, but no one else can >prove that Alice paid Bob unless Alice takes special action to >make it provable. >One solution is for the bank to maintain an email linked >account for Bob, into which Alice pays. This sounds ominous, >for the next step might be to link the account to true names, >can anyone see any other problems with it. Does it help if: Alice generates a secret key for each payment Alice *anonymously* deposits an *encrypted* message containing payment details into Bob's acct Only Alice can reveal the key for a particular transaction in Bob's account, thereby stripping anonymity but also revealing payment. For only that transaction.

1 0

Finding collision resistant hash functions
by Sarad AV 12 Aug '03

12 Aug '03

hi, Is there a polynomial time algorithm that will find collision hash functions or how are we supposed to find collision free hash functions?What exactly is the difficulty in finding collision free hash functions? Regards Sarath. __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com

3 5

Re: The real ordeals of U.S. soldiers in Iraq
by Steve Furlong 12 Aug '03

12 Aug '03

On Tuesday 12 August 2003 13:07, Steve Schear wrote: > Through email and chat rooms a picture is emerging of day-to-day > gripes, coupled with ferocious criticism of the way the war has been > handled. They paint a vivid picture of US army life that is a world > away from the sanitized official version. Just bear in mind that it's the grunt's time-honored right to gripe. Gripe about the food, about the weather, about the sergeants, about the officers, about the weapons, about the mission, about anything under the sun. Doesn't mean anything of itself. That said, they have more reason than usual to gripe. Not the overseas posting in a beastly climate, nor even the mission. It's the jerking around. "You'll be coming home next month." "Make that the month after." "Probably be a year, all told." If the pols and the brass had said up front that the troops would be there a year, there'd have been plenty of bitching by both soldiers and civilians but the overall effect would have been less than what's happening now. Army manning a year or two hence ought to be interesting. -- Steve Furlong Computer Condottiere Have GNU, Will Travel "If someone is so fearful that, that they're going to start using their weapons to protect their rights, makes me very nervous that these people have these weapons at all!" -- Rep. Henry Waxman

1 0

[Lucrative-L] updated lucrative source now in CVS
by R. A. Hettinga 12 Aug '03

12 Aug '03

--- begin forwarded text

1 0

Controlled nymity
by James A. Donald 12 Aug '03

12 Aug '03

-- What we want of a payment system, is that Alice can prove she paid Bob, even if Bob wants to deny it, but no one else can prove that Alice paid Bob unless Alice takes special action to make it provable. (This provides permits recipient anonymity in that Bob can be an alternate identity of Dave, and no one can prove that money paid to Bob actually winds up with Dave. They can, however prove they paid Bob.) If Alice pays Bob in unblinded tokens, this does not help, for Bob can pass the unblinded tokens to yet another identity of his, Fred. One solution is for the bank to maintain an email linked account for Bob, into which Alice pays. This sounds ominous, for the next step might be to link the account to true names, can anyone see any other problems with it. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG a4EU+fvvOcH0Sv52K2EKbF8yLcgewuumffss+deq 4NXChKCIzq02Njnl6SIFC224NDGKfgySzihcR3gfI

2 1

Re: [eff-austin] Antispam Bills: Worse Than Spam?
by Jim Choate 12 Aug '03

12 Aug '03

For this to be taken seriously one must be able to -define spam- as if it were a mathematical entity (eg a 'point'). It must be absolutely differentiable from -all- other speech. You can't do that, nobody can. Anti-spam bills are worse than spam because they put transient feelings of anger above the principles of freedom. Freedom is -not- free! On Fri, 1 Aug 2003, Carl Webb wrote: > Antispam Bills: Worse Than Spam? > > > By Ryan Singel | Also by this reporter Page 1 of 2 next ; > > 03:55 PM Jul. 30, 2003 PT > > While no one has sympathy for the devils that fill inboxes with promises > of lower mortgages and larger members, not everyone is supporting the new > movement to banish spammers from the Internet. > > Some online advocates worry that heavy-handed antispam measures, such as > centralized blacklists and charging for delivery, will destroy e-mail. > Advertisement > > * Story Tools > > [Print story] [E-mail story] > > Electronic Frontier Foundation's head counsel Cindy Cohn, for instance, > argues that antispam crusaders are forgetting the Internet's first > principle -- information flows freely from end to end. Cohn fears that > the Internet's openness will be collateral damage in the war against > unwanted e-mail. > > Cohn says her organization's position on spam blocking can be boiled down > to a simple proposition: "All nonspam e-mail should be delivered." It's > an information age take on the Hippocratic oath, which requires doctors > to first do no harm. > > "It's not the job of an ISP to block e-mail," added Cohn. "E-mail isn't a > toy anymore. If I don't get an e-mailed notice from the federal district > court mailing list, it's malpractice." > > Even some who sell antispam software to companies say that ISPs shouldn't > be blocking mail. > > "Blocking e-mails is folly," said Brian Gillette, whose company sells an > enterprise-level, antispam appliance called trimMail Inbox. "If I'm an > ISP and I stop a $150,000 equipment sale because I decided it was spam, > I'm in for a lawsuit." > > Marv Johnson, legislative counsel for the American Civil Liberties Union, > worries that the ability to speak anonymously on the Internet is being > put at risk by federal antispam legislation. > > Howard Beale of the Federal Trade Commission told House members at a > recent hearing on proposed antispam legislation that "spam threatens to > destroy e-mail." > > Several of the bills currently under consideration would make it illegal > to mask a sender's identity or forge routing information, both of which > are tricks used by spammers to avoid the ire of those who receive their > e-mails. But it's also a tactic used by dissidents in countries with > repressive governments who want to communicate with like-minded > individuals. > > "Many of these bills criminalize a message header that isn't accurate," > said Johnson. "That's not fraud. If you send out messages through an > anonymizer, then you could get sent to jail." > > Cohn concurs, arguing that the bills criminalize the behavior of people > -- such as closeted gay teens or government whistle-blowers -- who have > legitimate reasons for speaking anonymously on the Internet. > > EFF already has been a victim of overbroad spam filters. Its newsletter, > which has more than 30,000 subscribers, has been bounced by aggressive > keyword filters. In one case, its message was blocked because it > contained the word "rape," used when talking about EFF's advocacy on > behalf of an online group, Stop Prisoner Rape. > > When the EFF asked around, it found that other noncommercial bulk > mailers, such as listservs, were running into problems, too. > > For example, AOL blocked e-mails from one of EFF's clients, MoveOn.org, > an online, liberal political action group which saw its membership swell > to more than 2 million during the antiwar movement. > > "MoveOn.org, one of EFF's clients, has problems all the time, but > MoveOn.org is now big enough to be on whitelists," said Cohn. "I'm more > concerned about the next MoveOn." > > Challenge-and-response systems pose particular problems for newsletters > and listservs. These systems try to cut down on fraudulent e-mail by not > delivering a message until the sender replies to a confirmation e-mail > sent by the intended recipient's ISP or e-mail host. > > "Declan McCullagh of Politech and Dave Farber of Interesting-People can't > do 100 challenge-responses a day," said Cohn. "That, as a solution, > doesn't scale." > > It would be wrong to call Cohn soft on spam. While in private practice > she sued a spammer and won a court injunction and $60,000. And her > employer uses antispam technology on its own servers. > > The difference, according to Cohn, is that the SpamAssassin software EFF > uses doesn't block spam, it simply rates each e-mail. Staffers then set > up their e-mail clients to separate messages into different inboxes. This > keeps the main e-mail boxes free of spam, but allows individuals to check > the spam folder occasionally to see if a legitimate e-mail was > incorrectly tagged as junk. > > Many in the technology industry think that only better technology can > stop the spam deluge. > > "The only people who can stop spammers are other technologists," said > trimMail's Gillette. > > The most promising new approach is better filters that use Bayesian > algorithms to tag spam automatically and move it into a spam folder. The > algorithms look at the body and header of an e-mail and judge from past > experience whether an incoming message is junk. Users then train the > algorithm, by moving misclassified e-mail from one e-mail folder to > another. > > Paul Graham, who many credit for applying Bayesian filtering to the spam > problem, is ecstatic at the power of the new filters. > > "I don't need blacklists," said Graham. "My own software is better than I > am at deciding what is spam and what is not." > > Several open-source and commercial products, such as SpamBayes and Spam > Bully, already use Bayesian filtering. > > The ACLU's Johnson hopes the new technology will head off the worst of > the antispam legislation. > > "Why do we want to start imposing a different world for the Internet than > we have in the real world?" asked Johnson. > > "Let the marketplace handle spam," he said. "When Congress wants to show > they are doing something about an issue, they often screw it up." > > End of story > > Send e-mail icon Have a comment on this article? Send it > > More stories written by Ryan Singel > > > ________________________________________________________________________________ > MSN 8 with e-mail virus protection service: 2 months FREE* > -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

8 12

Mom aids in hunting terrorists over Web
by R. A. Hettinga 12 Aug '03

12 Aug '03

<http://dynamic.washtimes.com/print_story.cfm?StoryID=20030808-104401-1189r> The Washington Times www.washingtontimes.com Mom aids in hunting terrorists over Web By Neil Doyle Published August 9, 2003 Referred to by her spy masters only as "Mrs. Galt," she is by day an unremarkable American housewife and mother. But after her two children go to bed, she plunges into a secret world of Internet chat rooms and Web sites populated by some of the most dangerous people on earth. Burrowing into the byzantine network of unpublicized Web sites used by al Qaeda and other terror groups for their routine communications, she sweet-talks her interlocutors into revealing their plans, often with fatal consequences for the terrorists. They have no idea that their supportive new "sister" is a terrorist hunter reporting every word they say to a variety of intelligence agencies. She is so trusted by her unsuspecting targets that they often send her pictures of themselves displaying heavy machine guns and other weapons. She has even been sent pictures of men proudly displaying severed human heads. Her most recent venture - penetrating al Qaeda-affiliated groups in Pakistan - is said to have resulted in the death and detention of several terrorists. Others are still at large, making it necessary to keep her real name and hometown secret. The results of her latest exploits, including transcripts of her chats with suspects, have been placed on a Web site for all to see at www.pakistan-army-isi.com. Despite the name, the site has no connection to the Pakistani army or ISI, the country's intelligence service. "I would have loved to have seen [the terrorists4] faces when they saw the messages on the Web," Mrs. Galt, 42, said in an interview conducted by e-mail. "All I can do is hope that some of the terrorists I talked to get picked up. After all, they are not terrorists until a court says they are." Mrs. Galt is an example of a new breed of cyber-spy - ordinary citizens who want to "do their bit" by putting their computer skills to use fighting terrorism. She reports to London-based private intelligence consultant Glen Jenvey, who makes his research available to government services, including the FBI and the military intelligence agencies of Russia and India. "She has brought us first-rate military counterintelligence, and the people at the top respect her very much," said her British handler, one of a loosely organized group of counterintelligence researchers who specialize in using the Internet to infiltrate militant Islamic groups. Armed with a crib sheet summarizing Islamic sayings and customs, Mrs. Galt plays the part of a "sister" wanting to support the men waging jihad. She ingratiates herself and offers to lend her expertise with computers to further the aims of the groups. Jihad fighters on the front lines in Afghanistan, Pakistan and Kashmir, who often have not seen a woman for several months, seize on the chance to talk to a woman. Mrs. Galt says she flirts with the men to play on their hopes and deflect any suspicions. Over a period of weeks and even months, she slowly teases out details of coming operations, locations of bases and movements of personnel. Mrs. Galt said she has gone as far as setting up Web sites for some notorious groups, including the al Qaeda-affiliated Lashkar-e-Taiba in Pakistan. During one recent online chat, a contact was mourning the death of a friend. "Sister, I cried very much in my prayers because my very close friend, who was also with me in training, got killed," the man wrote. Mrs. Galt said she lent a sympathetic ear and provided soothing words, all the time knowing that information she had provided might have led to the man's death. She said she felt no trace of guilt. Other intelligence coups by Mrs. Galt include a revelation that terrorist groups in Pakistan have been conducting experiments with chemical weapons. Members of one group were asked in an "urgent appeal" to track down the formula for making chlorine gas. They were also exploring the feasibility of manufacturing biological weapons by extracting live viruses from vaccines and cultivating them. Other information she has provided include details of a string of bank accounts used by militant groups, which have shed valuable light on how these groups are funded. Not everything she hears is reliable or can be confirmed. She has also been told by her Web correspondents that Osama bin Laden is being sheltered by Islamist rebels in Chechnya. Mrs. Galt said she has received death threats since she went public, but is undeterred. She is about to adopt a new guise and go back online after a short break. "In about a week or so, I'll have another ID and start all over again, hitting the Web looking for jihad supporters," she said. "It's a never-ending battle." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2