- cypherpunks-legacy - lists.cpunks.org

Senate to Kill Pentagon Surveillance Bill (washingtonpost.com) (fwd)
by Jim Choate 16 Jul '03

16 Jul '03

http://www.washingtonpost.com/wp-dyn/articles/A61146-2003Jul15.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

The 3rd Annual Nigerian EMail Conference
by Steve Schear 16 Jul '03

16 Jul '03

http://j-walk.com/other/conf/index.htm "There is no protection or safety in anticipatory servility." Craig Spencer

1 0

Cracking Data Hiding (fwd)
by Jim Choate 15 Jul '03

15 Jul '03

Stego taking a hit....??????? http://www.sciencedaily.com/releases/2003/07/030715090813.htm -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Sealing wax, funny looking dogtags
by Major Variola (ret) 15 Jul '03

15 Jul '03

At 12:08 PM 7/15/03 -0700, Tim May wrote: >On Tuesday, July 15, 2003, at 09:05 AM, Major Variola (ret) wrote: >> Epoxy and other conformal coatings are also your friends. >> >Thinking about this brief comment, I assume MV means sealing a PC to >make black bag opening more apparent. Both more apparent and more physically difficult. >But this suggest a return to _sealing wax_. Seriously. :-) Only modern sealing waxes don't melt, adhere extremely well, and make tampering evident. They also mean the Adversary has to spend a lot more time... maybe more than one visit. >(As we all know, CIA and other spook agency "flaps and seals" >specialists are well-versed in duplicating such seals... Yes. but probably >only after collecting good information. An FBI black bag job is likely >to encounter the sealing wax and seal and be unable to duplicate it. You seem to think I thought the epoxy would be used like a seal, with the signet ring and all, visually verified when you sit down. That's too lame, any hobbyist whose good with casting can dupe it. I just meant that if Scarfo had epoxied his keyboard to his chassis properly, (and epoxied the keyboard, etc.) he might still be free (to pick shitty passphrases, it turned out). And some "sealing waxes" such as those used on nuclear weapons and verification devices, are very difficult to duplicate. Given, they require special equipment to read. (Fine reflector particles dispersed in clear epoxies) Or, as has been discussed here before, if Nico did his crypto work on a handheld that stayed with him. (An epoxy-sealed one, of course.) Your suggestions re USB, PCMCIA, etc. are in the same line. Better, because they're smaller. However, I don't know of a card that you can *shower* with, which is frankly what's required. It can't ever leave you. A keychain fob is not good enough. Even a finger ring gets removed sometimes. >(All of this slows down the process. The rigamarole that a shipboard >crypto shack will put up with is not the same as what Joe Sixpack will >put up Yes, but Scarfo's DirOpSec should have been able to convince him that at the hourly rate the Company pays him, he should put up with it :-) He can surf for porn on a different machine. As long as he knows to use different passwords there... >-- the usual point about having a network with a secure machine locked >up very well in a closet or safe (I have a large gun safe, which I >usually run a small heating element into to prevent condensing >conditions...I have toyed with the idea of putting a small PC running >on 25-40 watts, or less, into this gun safe, with only a power cord and >Ethernet wire coming out). I like the dual use of keeping a security-sensitive PC in a gun safe which also keeps the guns dry :-) You could have the door opening silence the PC, too. A nice lead lining will keep the black bag x-ray team (they'll borrow a unit from the bomb squad) from seeing much. >Still, his series fits with the kind of security awareness and >hypervigilance we often discuss. "The ultimate in paranoia is not when everyone is against you but when everything is against you." PKD (and quite apropos here)

3 2

Will 'Distributed Cloud' Network Structures Prevent Censorship?
by Steve Schear 15 Jul '03

15 Jul '03

Bennett Haselton believes that de-centralized information storage and transmission systems - so called 'Distributed Cloud' networks like <https://194.109.142.142:1984/redirect.php?url=http%3A%2F%2Fnews.bbc.co.uk%2…>Peekabooty, <https://194.109.142.142:1984/redirect.php?url=http%3A%2F%2Ffreenet.sourcefo…>FreeNet and <https://194.109.142.142:1984/redirect.php?url=http%3A%2F%2Fwww.google.com%2…>Gnutella - will not prevent Internet censorship in the long run. He has written a short essay http://www.peacefire.org/techpapers/distributed-cloud.html pointing out the flaws he perceives in these systems. Ian Clarke, the architect of the FreeNet project, responds here http://slashdot.org/~Sanity/journal/37275, defending Distributed Cloud systems and their abilities to prevent censorship, protect the identities of their users, and shield users from legal liability. steve "There is no protection or safety in anticipatory servility." Craig Spencer

1 0

Re: MRAM, persistence of memory
by Major Variola (ret) 15 Jul '03

15 Jul '03

At 09:29 AM 7/15/03 -0400, Sunder wrote: >So, the best way to avoid that situation and not being able to reach the >big red switch, is simply not to attract their attention in the first >place by not following the footsteps of Jim Bell. :) Stego + broadcast is indeed your friend. >A more likely, and far more important, scenario to worry about is the >black bag job whereby a hardware keystroke recorder can get installed >without your knowledge... > >There may be ways to prevent/detect this... Software (open or closed >source) alone won't help very much. Epoxy and other conformal coatings are also your friends.

2 1

Re: MRAM, persistence of memory
by Thomas Shaddack 15 Jul '03

15 Jul '03

> In all likelyhood the flashbang armored ninjas with automatics, night > vision, "get the fuck on the floor and shut the fuck up bitch" entry will > happen while you're asleep, so you won't have time to hit the big red > button anyway. Take a relay and connect it to a door switch. When they open the door without authorization[1], the power to the machines is switched off. Then the ninjas' with their typical noisy entry will switch off the system themselves, without you having to touch the Red Button. [1] can be an ID button, can be a wireless ID token (advantage: the reader and the whole identification action can be invisible), can be a keypad, can be an arbitrary complex biometric ID, or any combination of the above, for a low-tech approach can be a reed relay under the wallpaper and a magnet touched to the given spot on the wall The system can be easily coupled with a common-grade burglar alarm, further increasing the range of conditions the shutdown can be triggered with. (Optionally with several levels, depending on the tradeoff between the recoverability from a false alarm and the consequences of missing the alarm: power-down, erase of a long key (unlocked by a passphrase) from NVRAM, physical destruction of the disk array once forceful penetration of outer zones (triggering sequentially the previous lower events in reaction) is followed by physical breach of the server room door or walls (or the so often woefully neglected ceiling and floor).) > So, the best way to avoid that situation and not being able to reach the > big red switch, is simply not to attract their attention in the first > place by not following the footsteps of Jim Bell. :) True. But once the adversary becomes totally information-aware, it will be rather difficult to not attract attention. > A more likely, and far more important, scenario to worry about is the > black bag job whereby a hardware keystroke recorder can get installed > without your knowledge... Another reason for employing a security system. > There may be ways to prevent/detect this... Software (open or closed > source) alone won't help very much. May be the crucial part of implementing the security system. Eg, as an embedded system handling signals from webcams, distributed over the building as several nodes (instead of a central one), mimicking the nerve system of insect.

2 2

MPAA vs. Net anonymity, AB 1143
by Major Variola (ret.) 15 Jul '03

15 Jul '03

Studios Stage Fight Against Internet Bill By Jon Healey, Times Staff Writer The Hollywood studios are fighting a behind-the-scenes battle in Sacramento to derail a bill they say would promote online piracy though the bill has little to do with downloading movies. Actually, the fight may have more to do with who's behind the legislation: the Electronic Frontier Foundation, a civil liberties and technology advocacy group that frequently opposes the studios' anti-piracy initiatives. The measure by Assemblyman Joe Simitian (D-Palo Alto) would help Internet users maintain the anonymity they have in chat rooms and elsewhere on the Internet when sued in state court for something they said or did online. Passed by the Assembly on June 2 and scheduled for a Senate Judiciary Committee hearing today, AB 1143 would require Internet services to notify customers of subpoenas seeking their identities and give customers 30 days to challenge the requests in court. Because it would apply to lawsuits in state courts, the bill wouldn't affect people accused of pirating movies or other copyrighted works online. Copyright cases are heard in federal court. <snip> http://www.latimes.com/business/la-fi-mpaa15jul15,1,5900411.story?coll=la-h…

1 0

MRAM, persistance of memory
by Major Variola (ret.) 15 Jul '03

15 Jul '03

The persistance of memory could be a problem if your melting clocks are swarmed by spooky ants. Wired has an article on magetic RAM http://wired.com/news/technology/0,1282,59559,00.html that fails to mention security implications. Obviously nonvolitile RAM presents a different security risk than RAM that forgets when powered off. Will future OSes have provisions to keep certain data out of MRAM banks, if MRAM doesn't completely displace DRAM? I doubt it. And shutting off your virtual memory swapping --useful today because of the gobs of DRAM machines have-- will no longer be useful for security. Not so obviously to the layman is how many times MRAM must be overwritten to keep the TLAs away. (Exactly analogous to scrubbing a disk.) While this is trivial to do for user-space, if the OS keeps copies of sensitive info this might require more than a huge malloc() & overwrites before shutdown.

8 8

Slashdot | UCB Researchers Critique DRM, Compulsory Licensing (fwd)
by Jim Choate 15 Jul '03

15 Jul '03

http://yro.slashdot.org/yro/03/07/14/2312227.shtml?tid=141&tid=188 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0