- cypherpunks-legacy - lists.cpunks.org

Slashdot | Contactless Credit Cards (fwd)
by Jim Choate 29 May '03

29 May '03

http://slashdot.org/articles/03/05/28/2252233.shtml?tid=98&tid=99 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

France and Switzerland Public Announcement (fwd)
by Jim Choate 29 May '03

29 May '03

---------- Forwarded message ---------- Date: Thu, 29 May 2003 07:50:10 -0400 From: PA List Manager <statelists(a)STATE.GOV> To: DOSTRAVEL(a)LISTS.STATE.GOV Subject: France and Switzerland Public Announcement France and Switzerland Public Announcement U.S. DEPARTMENT OF STATE Office of the Spokesman May 28, 2003 This Public Announcement is being issued to alert U.S. citizens to the potential for large-scale anti-globalization protests on or near the French/Swiss border during the G-8 Summit scheduled for June 1-3, 2003, in Evian, France. American citizens traveling in or out of France during this period should be prepared for greater security checks and should have their U.S. passports available at all border crossing points. This Public Announcement expires on June 9, 2003. The Summit of the Group of 8 (G-8) is expected to attract as many as 300,000 anti-globalization protestors, most of who will gather outside Evian in Annemasse, France, and Geneva, Switzerland. Protests will also take place in Lausanne and other cities on the Swiss shore of Lake Geneva. Large-scale anti-globalization protests are planned beginning May 29 in Annemasse. Large rallies are planned for June 1 in Geneva and Annemasse, and other demonstrations are expected to take place in the region throughout the summit. Americans traveling in the area should avoid the demonstrations, bearing in mind that in the past, similar demonstrations have sometimes turned violent and that traffic and public transportation in the vicinity of demonstrations are likely to be affected. Additionally, to enhance security measures already in place for the Summit, the government of France will increase passport and security checks at all of its land borders. Enhanced controls will begin immediately at some borders to eventually include all land border crossings throughout the period of the Summit. Those entering or exiting France - whether by car, boat or train - may be required to produce valid travel documents. American citizens traveling in or out of France during this period should be prepared for greater security checks and should have their valid U.S. passports available at all border crossing points. American citizens can register and obtain updated information on travel and security at the U.S. Embassy in Paris, the Consulate General in Marseille, the Consulate General in Strasbourg, or the U.S. Embassy in Bern. The U.S. Consular Agency in Geneva will be closed from Monday, May 26, through Tuesday, June 4, 2003. Travelers should also consult the Department of State's latest Consular Information Sheets for France and Switzerland and the Worldwide Caution Public announcement at travel.state.gov. American citizens may also obtain up-to-date information on security conditions by calling 1-888-407-4747 toll-free in the United States or Canada, and 317-472-2328 from overseas. *********************************************************** See http://travel.state.gov/travel_warnings.html for State Department Travel Warnings ************************************************************ To change your subscription, go to http://www.state.gov/www/listservs_cms.html

1 0

Slashdot | Nullsoft's Waste: Encrypted, Distributed, Mesh Net (fwd)
by Jim Choate 29 May '03

29 May '03

http://slashdot.org/articles/03/05/29/0140241.shtml?tid=126&tid=93 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Extent of UK snooping revealed
by Tyler Durden 29 May '03

29 May '03

>Yes, this is a somewhat interesting problem - probably not that difficult >considering that the goal here is to create plausible deniability in a >setting like a court of law. Generating traffic patterns that convince >other crytpographers (or even sysadmins) is much harder than generating >traffic patterns that simply create reasonable doubt. >>Also, unless you have some very odd friends, user activity will >>vary in statistically likely ways over time, so the ideal system >>would "randomly" compensate for that. I've only caugfht the tail end of this, but from what I can understand some of this might be overkill. Let's imagine you're an ISP that "sells" privacy in your customers' surfing. So you make your server regularly go get random webpages so that your customers have a cloak of privacy, and this is what you tell the court. (Provided, of course, they have some way to 'prove' that the traffic into and out of your server is fake traffic!) In these kinds of scenarios, 'realistic' web traffic might be unneccessary. (Or maybe there's some other 'cover' story such as the need to update weblinks or whatever...) Or do I misunderstand here? -TD >From: John Kozubik <john(a)kozubik.com> >To: ken <bbrow07(a)students.bbk.ac.uk> >CC: cypherpunks <cypherpunks(a)lne.com> >Subject: Re: Extent of UK snooping revealed >Date: Wed, 28 May 2003 10:36:23 -0700 (PDT) > >On Wed, 28 May 2003, ken wrote: > > > John Kozubik wrote: > > > > > d) set up an automated script on the server that _constantly_ fetches > > > random web pages, thus creating a constant stream of http traffic in >and > > > out of the server, again diminishing traffic patterns. Log the actual > > > proxy requests in some temporary fashion and randomly hit those web >sites > > > in an automated fashion throughout the day, regardless of whether >someone > > > is requesting them through the proxy or not...and then, script a >constant > > > stream of requests to the proxy as well > > > > Fun & difficult part is setting up fetching of "random" web pages > > that looks like real user activity. > >Yes, this is a somewhat interesting problem - probably not that difficult >considering that the goal here is to create plausible deniability in a >setting like a court of law. Generating traffic patterns that convince >other crytpographers (or even sysadmins) is much harder than generating >traffic patterns that simply create reasonable doubt. > > > Also, unless you have some very odd friends, user activity will > > vary in statistically likely ways over time, so the ideal system > > would "randomly" compensate for that. > >Exactly. The ideal system would monitor in and outbound: > >- web requests >- bytes transferred >- bytes per page >- pictures per page >- binary files transferred >- (all of those) / second > >and generate pseudo-random browsing to smooth these variables over time. >Perhaps a script that chose random word pairs from the dictionary, googled >them, and browsed the pages that were returned would be a good platform. > >----- >John Kozubik - john(a)kozubik.com - http://www.kozubik.com _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. http://join.msn.com/?page=features/virus

1 0

Real Crypto Terrorists.
by Trei, Peter 29 May '03

29 May '03

http://www.infoworld.com/article/03/05/21/HNpdapgp_1.html Red Brigades PDA highlights encryption controversy By Philip Willan, IDG News Service May 21, 2003 ROME - Italian police have seized at least two Psion PLC PDAs (personal digital assistants) from members of the Red Brigades terrorist organization but the major investigative breakthrough they were hoping for as a result of the information contained on the devices has failed to materialize -- thwarted by encryption software used by the left-wing revolutionaries. Failure to crack the code, despite the reported assistance of U.S. Federal Bureau of Investigation (FBI) computer experts, puts a spotlight on the controversy over the wide availability of powerful encryption tools. The Psion devices were seized on March 2 after a shootout on a train travelling between Rome and Florence, Italian media and sources close to the investigation said. The devices, believed to number two or three, were seized from Nadia Desdemona Lioce and her Red Brigades comrade Mario Galesi, who was killed in the shootout. An Italian police officer was also killed. At least one of the devices contains information protected by encryption software and has been sent for analysis to the FBI facility in Quantico, Va., news reports and sources said. The FBI declined to comment on ongoing investigations, and Italian authorities would not reveal details about the information or equipment seized during the shootout. The software separating the investigators from a potentially invaluable mine of information about the shadowy terrorist group, which destabilized Italy during the 1970s and 1980s and revived its practice of political assassination four years ago after a decade of quiescence, was PGP (Pretty Good Privacy), the Rome daily La Repubblica reported. So far the system has defied all efforts to penetrate it, the paper said. Palm-top devices can only run PGP if they use the Palm OS or Windows CE operating systems, said Phil Zimmermann, who developed the encryption software in the early 1990s. Psion PLC uses its own operating system known as Epoc, but it might still be possible to use PGP as a third party add-on, a spokesman for the British company said. There is no way that the investigators will succeed in breaking the code with the collaboration of the current manufacturers of PGP, the Palo Alto, Calif.-based PGP, Zimmermann said in a telephone interview. "Does PGP have a back door? The answer is no, it does not," he said. "If the device is running PGP it will not be possible to break it with cryptanalysis alone." Investigators would need to employ alternative techniques, such as looking at the unused area of memory to see if it contained remnants of plain text that existed before encryption, Zimmermann said. The investigators' failure to penetrate the PDA's encryption provides a good example of what is at stake in the privacy-versus-security debate, which has been given a whole new dimension by the Sept. 11 terrorist attacks in the U.S. Zimmermann remains convinced that the advantages of PGP, which was originally developed as a human rights project to protect individuals against oppressive governments, outweigh the disadvantages. "I'm sorry that cryptology is such a problematic technology, but there is nothing we can do that will give this technology to everyone without also giving it to the criminals," he said. "PGP is used by every human rights organization in the world. It's something that's used for good. It saves lives." Nazi Germany and Stalin's Soviet Union are examples of governments that had killed far more people than all the world's criminals and terrorists combined, Zimmermann said. It was probably technically impossible, Zimmermann said, to develop a system with a back door without running the risk that the key could fall into the hands of a Saddam Hussein or a Slobodan Milosevic, the former heads of Iraq and Yugoslavia, respectively. "A lot of cryptographers wracked their brains in the 1990s trying to devise strategies that would make everyone happy and we just couldn't come up with a scheme for doing it," he said. "I recognize we are having more problems with terrorists now than we did a decade ago. Nonetheless the march of surveillance technology is giving ever increasing power to governments. We need to have some ability for people to try to hide their private lives and get out of the way of the video cameras," he said. Even in the wake of Sept. 11, Zimmermann retains the view that strong cryptography does more good for a democracy than harm. His personal website, www.philzimmermann.com, contains letters of appreciation from human rights organizations that have been able to defy intrusion by oppressive governments in Guatemala and Eastern Europe thanks to PGP. One letter describes how the software helped to protect an Albanian Muslim woman who faced an attack by Islamic extremists because she had converted to Christianity. Zimmermann said he had received a letter from a Kosovar man living in Scandinavia describing how the software had helped the Kosovo Liberation Army (KLA) in its struggle against the Serbs. On one occasion, he said, PGP-encrypted communications had helped to coordinate the evacuation of 8,000 civilians trapped by the Serbs in a Kosovo valley. "That could have turned into another mass grave," Zimmermann said. Italian investigators have been particularly frustrated by their failure to break into the captured Psions because so little is known about the new generation of Red Brigades. Their predecessors left a swathe of blood behind them, assassinating politicians, businessmen and security officials and terrorizing the population by "knee-capping," or shooting in the legs, perceived opponents. Since re-emerging from the shadows in 1999 they have shot dead two university professors who advised the government on labor law reform. Zimmermann is not optimistic about the investigators' chances of success. "The very best encryption available today is out of reach of the very best cryptanalytic methods that are known in the academic world, and it's likely to continue that way," he said. Sources close to the investigation have suggested that they may even have to turn to talented hackers for help in breaking into the seized devices. One of the magistrates coordinating the inquiry laughed at mention of the idea. "I can't say anything about that," he said. The technical difficulty in breaking PGP was described by an expert witness at a trial in the U.S. District Court in Tacoma, Wash., in April 1999. Steven Russelle, a detective with the Portland Police Bureau, was asked to explain what he meant when he said it was not "computationally feasible" to crack the code. "It means that in terms of today's technology and the speed of today's computers, you can't put enough computers together to crack a message of the kind that we've discussed in any sort of reasonable length of time," he told the court. Russelle was asked whether he was talking about a couple of years or longer. "We're talking about millions of years," he replied.

1 0

CNN.com - Divided court rules for police on Miranda - May. 27, 2003 (fwd)
by Jim Choate 29 May '03

29 May '03

http://www.cnn.com/2003/LAW/05/27/scotus.miranda.questioning/index.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Well it looks like pigs can now force you to incriminate yourself (legally even)
by Thoenen, Peter CIV Sprint 29 May '03

29 May '03

For your enjoyment. http://edition.cnn.com/2003/LAW/05/27/scotus.miranda.questioning/index.html http://caselaw.lp.findlaw.com/cgi-bin/getcase.pl?court=US&navby=case&vol=00… CNN writeup seems to suggest that police no longer need to inform you of your rights (Miranda) and warn you against self incrimination. While the justices state this ruling does not condone law enforcement abuses to force your to incriminate yourself, we all know how easily abuse is covered up or just blatantly ignored. "But justices also concluded the suspect may be able to collect damages because his due process rights were violated during a hospital room interrogation. That part of the ruling was sent back to a lower federal court for further consideration." Does this even need to get reported, we all know how the lower court will rule, no damages. It seems the government finally feels it no longer needs to at least keep up the pretense of a fair and civil society. -Peter STANDARD DISCLAIMER: This is solely the personnel opinion of Peter Thoenen and in no way condoned by Sprint or the US Government.

1 0

Unintended Consequences of Anti-Spam (A.U.C.E) Laws
by Tim May 29 May '03

29 May '03

I hate being sucked into this ongoing spam debate, but there are just so many deeply wrong-headed memes floating around on this issue, and so much obvious chance for government mischief and intrusion, that I cannot resist adding more comments. Item: State of California has just passed a law criminalizing certain kinds of speech, that is, something some legislators and judges deem to be "unwanted commercial messages." Other states passing similar laws. Talk of RICO prosecutions, seizure of assets, the usual War on Some Drugs kind of nonsense. Item: How long before corporations cite spam laws to stop shareholders and customers from organizing campaigns against the corporations? If the CEO of McDonald's receives 10,000 letters from angry customers, is this spam? (I'll bet some of the major uses of the spam laws is along these lines, a kind of version of SLAPP suits (Strategic Lawsuits Against Public Participation). Item: Or is there some exemption for "political and social speech"? (I haven't consulted the spam laws, but I assume there is some weasel language about "nothing in this legislation shall be construed to interfere with political advocacy....") And yet some of the most obnoxious messages I receive are NRA spam messages--they and other pro-gun groups have me on their mass mailing lists. Should they be allowed to send this spam? Or will some causes be judged politically incorrect? Is it OK to send thousands of spam pictures of aborted foetuses to abortion advocates? Item: How about religion? Item: If either political advocacy or religion is exempted, then spammers can insert religious messages into their spam. "Hello, I am Monsignor Ubalong N'fasti, Chief Prelate of the Catholic Church in Lagos, Nigeria. I am in urgent need of your assistance in continuing God's work in our country..." Item: Spammers can exploit _any_ exemption in the legislation for religion, political advocacy, environmental advocacy, etc. Having legislators or judges or ministerial-level bureaucrats deciding which messages are "exempt from spam laws" and which are not would be a free speech disaster. And so on. There are no good reasons for letting government decide which speech is political, which is advocacy, what is truth and what is not. --Tim May, Citizen-unit of of the once free United States " The tree of liberty must be refreshed from time to time with the blood of patriots & tyrants. "--Thomas Jefferson, 1787

1 0

RSA/DSA questions
by Damian Gerow 29 May '03

29 May '03

(I'll admit it, I'm a crypto weenie. I know enough to spell RSA and DSA correctly, and that's about it.) Does anyone have any pointers to informative papers (especially analyses and critiques) to RSA and DSA in particular, and in general, signature algorithms? The only page I've found is in the RSA Labs FAQ, and (obviously) digs into DSA. A co-worker is generating some SSH keys, and it's been some time since I actually looked into either algorithm. PuTTY recommends you avoid DSA, which was a bit of a surprise to me, and prompted this thus-far fruitless search for comparisons/critiques.

5 10

Re: Nigerian Spammers Using TDD/TTY Telephone Relay Service
by Tyler Durden 29 May '03

29 May '03

Tim May wrote: "...anti-spam legislation." (uh, do I have to explicitly state that May didn't support such legislation in his original post?) Retailiation, like legislation seems pointless to me, though since our troops are now in Afghanistan, Saudi, Iraq, Cuba, Korea, Germany and so on, I see no reason we can't eventually send a local delegation of this defacto worldwide government to crack down on Nigerian spammers, who will soon probably be declared terrorists. What I wonder is why this isn't solved in a cyber-streetfight. If people get sick enough with spam I figure a good big batch of hackers could make some serious trouble for a few of the bigger spammers. -TD >From: Tim May <timcmay(a)got.net> >To: cypherpunks(a)lne.com >Subject: Re: Nigerian Spammers Using TDD/TTY Telephone Relay Service >Date: Tue, 27 May 2003 07:01:56 -0700 > >On Tuesday, May 27, 2003, at 04:23 AM, Roy M.Silvernail wrote: > >>On Tuesday 27 May 2003 03:53 am, Bill Stewart wrote: >>>This weekend I received three or more cell phone calls from 800-855-0000, >>>which said they were the AT&T Relay Service, which relays phone calls >>>from deaf people using TDD or TTY or now internet webform services. >>>They claimed to be a "Dr. Charles Ego" (or some name like that) >>>asking to confirm that I'd received his email, and asking for my email >>>address. >> >>Interesting turn of events. I'd have expected porno spammers to blaze >>this >>new territory. But then, it seems that the Nigerian spam crew has more >>time >>to waste. Reports like the one at http://www.geocities.com/a_kerenx/ tell >>of >>pulling what is essentially the telemarketer timewaster maneuver on the >>scammers. >> >>Frankly, I'm surprised I haven't yet seen incidents of spammers following >>up >>via another comm channel to find out why their spam was ignored and/or >>repeat >>their pitch. For that matter, with all the First Amendment blather heard >>from spammers, I'd almost expect one of them to argue for proactively >>enforced delivery and some sort of "obligation to read" statute. > > >No, absolutely _nothing_ in the First can possibly imply any "enforced >delivery" or "obligation to read." I assume you are semi-joking, but this >bears repeating, especially for those here who seem to be unclear on the >concepts. > >Secondly, most if not all of the "anti-spam laws" are, in fact, directly in >contravention of the First Amendment. (This applies to out of country >spammers, such as our friends like Dr. Igaboo Umbalago, Director of >Petroleum Resources of Nigeria. Why this is so is not because the Nigerians >are Americans but because "shall not be infringed" means that neither >Congress nor the cops can set up screening operations to examine the >content of mail or telephone calls: there simply is no authority for such >things, which means those who send letters or e-mail or who make telephone >calls from France or Nigeria or Taiwan are all de facto and de jure covered >by the First. The "penumbra," some might call it.) > >Several lists or groups I am are consumed by spam and anti-spam debates. >Nearly all participants in the debate miss the importance of the First. > >The First does not allow government to be in the content examination >business. Those who think otherwise need....well, you all know what they >need. I am serious. I am fucking sick and tired of bureaucrats, >legislators, and even people on lists like this thinking that they have >some authorization to examine the letters or e-mails I receive. > >Perhaps rather than retaliating against spammers, as many here have written >about, we should be talking about mail-bombing and spam-bombing any >politician or lawmaker who supports anti-spam legislation. > >--Tim May _________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0