- cypherpunks-legacy - lists.cpunks.org

[Clips] Why is Hugo Chavez Involved With U.S. Voting Machines?
by R. A. Hettinga 28 Mar '06

28 Mar '06

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Tue, 28 Mar 2006 16:32:09 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] Why is Hugo Chavez Involved With U.S. Voting Machines? Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com Again, boys and girls, spoken slowly: With electronic voting, you can either have secret ballots, or not sell your vote, but not both. With equity, it doesn't matter. The whole *point* is to sell your ballot. Thus, once again, financial cryptography is the only cryptography that matters. :-). And political cryptography, like politics itself, is proven, once again, to be about nothing more than fraud and extortion. Cheers, RAH ------- <http://www.realclearpolitics.com/printpage/?url=http://www.realclearpolitic…> RealClearPolitics March 28, 2006 Why is Hugo Chavez Involved With U.S. Voting Machines? By Richard Brand The greater threat to our nation's security comes not from Dubai and its pro-Western government, but from Venezuela, where software engineers with links to the leftist, anti-American regime of Hugo Chavez are programming electronic voting machines that will soon power U.S. elections. Congress spent two weeks overreacting to news that Dubai Ports World would operate several American ports, including Miami's, but a better target for their hysteria would be the acquisition by Smartmatic International of California-based Sequoia Voting Systems, whose machines serve millions of U.S. voters. That Smartmatic -- which has been accused by Venezuela's opposition of helping Chavez rig elections in his favor -- now controls a major U.S. e-voting firm should give pause to anybody who thinks that replacing our antiquated butterfly ballots and hanging chads will restore Americans' faith in our electoral process. Consider the lack of confidence Venezuelans have in their voting system. Anti-Chavez groups have such little faith in Smartmatic's machines that they refuse to run candidates in elections anymore as reports surface of fraud and irregularities from Chavez 2004 victory in a recall referendum. Yet somehow Smartmatic International and its Venezuelan owners were able to purchase Sequoia last year without the deal receiving any scrutiny from federal regulators -- including the Treasury Department's Committee on Foreign Investments in the United States (CFIUS), which is tasked with determining whether foreign takeovers pose security risks. CFIUS generally investigates such transactions only when the parties voluntarily submit themselves to review -- which Smartmatic did not do. But it retains the authority to initiate an investigation when it suspects a takeover compromises national security. Smartmatic has a brief but controversial history. The company was started in Caracas during the late 1990s by engineers Antonio Mugica and Alfredo Anzola. They worked out of downtown Caracas providing small-scale technology services to Latin American banks. Despite having no election experience, the tiny company rocketed from obscurity in 2004 after it was awarded a $100 million contract by the Chavez-dominated National Electoral Council to replace Venezuela's electronic voting machines for the recall vote. When the council announced the deal, it disingenuously described Smartmatic as a Florida company, though Smartmatic's main operations were in Caracas and the firm had incorporated only a small office in Boca Raton. It then emerged that Smartmatic's ''partner'' in the deal, Bizta Corp., also directed by Anzola and Mugica, was partly owned by the Venezuelan government through a series of intermediary shell corporations. Venezuela initially denied its investment but eventually sold its stake. When the vote finally came, exit polls by New York's Penn, Schoen & Berland Associates showed Chavez had been defeated 59 to 41 percent; however, when official tallies were announced, the numbers flipped to 58-42 in favor of Chavez. Venezuela's electoral council briefly posted machine-by-machine tallies on the Internet but removed them as mathematicians from MIT, Harvard and other universities began questioning suspicious patterns in the results. Flush with cash from its Venezuelan adventures, Smartmatic International incorporated in Delaware last year and purchased Sequoia, announcing the deal as a merger between two U.S. companies. Smartmatic says the recall vote was clean and that it is independent of the Chavez government. Responding to my inquiries, Smartmatic-Sequoias sent a written statement: ``Sequoia's products consist only of voting devices and systems, all of which must be federally and state tested and certified prior to use in an election. As Sequoia's products do not have military, defense or national security applications, they do not fall within the parameters of the matters governed by CFIUS.'' In fact, Smartmatic International is owned by a Netherlands corporation, which is in turn owned by a Curacao corporation, which is in turn held by a number of Curacao trusts controlled by proxy holders who represent unnamed investors, almost certainly among them Venezuelans Mugica and Anzola and possibly others. Why Smartmatic has chosen yet again to abuse the corporate form apparently to conceal the nationality and identity of its true owners is a question that should worry anyone who votes using one of its machines. Congress panicked upon hearing that our ports would be run by an American ally, Dubai, but never asked whether America's actual enemies in Venezuela have been able to acquire influence in our electoral process. Richard Brand is a second-year law student at New York University and a former staff writer for The Miami Herald. This article first ran in The Miami Herald. It is reprinted with the author's permission. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[dave@farber.net: [IP] PET Award]
by Eugen Leitl 28 Mar '06

28 Mar '06

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Re: [p2p-hackers] guidelines for good password policy and maintenance / user centric identity with single passwords (or a small number at most over time)
by coderman 28 Mar '06

28 Mar '06

On 3/27/06, Alen Peacock <alenlpeacock(a)gmail.com> wrote: > ... > The overarching theme of the book is that theoretically secure systems > with usability problems end up being neither secure (because users > subvert them) nor usable. very true. > Some findings from Chap 7 include the fact > that a significant number of users did not comply with instructions > for password generation it is my personal hunch that if users had just one password they needed to remember they could remember a good one. the janus stuff we are working on uses loop-aes volumes specifically so you can store passwords in a browser, store capability URL's, keep accounts and logins in a text file, etc. [i'd love to know of any studies to this end though. i have tried experiments to see just how much entropy i can commit to memory and it is more than enough for a good interactive authentication. i think this is within the ability of most, if they had a desire to do so and understood the benefit.] so the goal is to provide a usable system with a single password, and make it user centric, so that all the other credentials and secrets associated with other digital identies can benefit from this bootstrap (and presumably share this more secure bootstrap).

4 4

German CA TrustCenter insolvent (fwd)
by J.A. Terranson 28 Mar '06

28 Mar '06

---------- Forwarded message ---------- Date: Mon, 26 Sep 2005 08:35:12 +0200 From: Stephan Neuhaus <neuhaus(a)st.cs.uni-sb.de> To: cryptography(a)metzdowd.com Subject: German CA TrustCenter insolvent Original article at http://www.heise.de/security/news/meldung/64224 It seems that the German TC TrustCenter GmbH (formerly TC TrustCenter AG) is now insolvent. TrustCenter was accredited to issue "qualified signatures", which is what you need in Germany if you want your digital signature to be as binding as your handwritten one. It is as yet unclear why TrustCenter ran out of money, but the fact that German banks sold their TrustCenter stocks to BeTrusted (now part of Cybertrust) in 2004 shows that the banks had lost their confidence in PKI. An interesting question is of course what happens with TrustCenter's private keys. Are they being auctioned off to the highest bidder? Fun, Stephan

2 2

off the record howto / best practices
by coderman 28 Mar '06

28 Mar '06

verify fingerprint: "Buddy List" -> Tools Menu Options -> Preferences Menu Option -> Plugins Menu Option -> Select Username from Known Fingerprints -> Press "Verify fingerprint" action -> VIEW FINGERPRINT AND APPROVE/REJECT IF EXPECTED --- Fingerprint for you, coderman42 (AIM/ICQ): A59CDCB3 46468A16 27D21678 270AF0B5 0B0477CF Purported fingerprint for anonymous: 0B0477CF 270AF0B5 27D21678 46468A16 A59CDCB3 --- -> Select "i have" verified action only if expected is true using verified otr credentials: -> Select "OTR: Not Private" image button at lower right corner if secure channel is down -> Verify "OTR: Private" image button at lower right corner before chat example of a failed key agreement: the "OTR: Unverified" image was never shown at the lower right corner of the window indicating an initial OTR exchange had taken place. ---cut--- (02:12:01) anonymous: hi code (02:12:05) Attempting to start a private conversation with anonymous... (02:12:11) coderman42: hello (02:12:14) coderman42: do you have OTR? (02:12:38) anonymous: hold on (02:12:51) coderman42: k (02:13:39) anonymous: *** Encrypted with the Gaim-Encryption plugin 02:17 (02:18:16) coderman42: sorry, no worky for you. (02:18:19) coderman42: try again (02:18:29) coderman42: what client / OS are you using? (02:18:38) coderman42: i recommend a unix like system with gaim (02:19:46) anonymous: i am on gaim and i was useing gaim encrypt (02:21:47) Attempting to start a private conversation with anonymous... (02:22:00) coderman42: maybe you were; it is not working currently. 02:22 (02:22:33) anonymous logged out. (02:23:04) anonymous logged in. (02:23:10) coderman42: wb (02:23:12) Attempting to start a private conversation with anonymous... (02:23:23) coderman42: (02:23:12) Attempting to start a private conversation with anonymous... (02:23:27) coderman42: waiting ... (02:23:44) coderman42: brb (02:26:58) anonymous: *** Encrypted with the Gaim-Encryption plugin 02:27 (02:28:45) anonymous logged out. ---end-cut-- remember to protect your keys.

1 0

increase in sexual desire
by Elwood Oakley 28 Mar '06

28 Mar '06

Carefully chosen herbal ingredients are the key to peniis enlargement success. Not only the precise blend of ingredients but also many other factors have effect on the overall potency and strength of peniis enlargement formula. Some of these factors include growing conditions, geographical location where herbs are grown, harvest time, the way herbs are stored before processing, the way herbs are processed. http://cfabejldhk.alfaastralvictoria.info/?gimdhkxwqowycfzppabejl 8tn

1 0

increase in sexual desire
by Sharlene Johnson 28 Mar '06

28 Mar '06

Carefully chosen herbal ingredients are the key to peniis enlargement success. Not only the precise blend of ingredients but also many other factors have effect on the overall potency and strength of peniis enlargement formula. Some of these factors include growing conditions, geographical location where herbs are grown, harvest time, the way herbs are stored before processing, the way herbs are processed. http://gicekmbfjl.applearmyd.info/?adhbfjlxwqowygizppcekm bp

1 0

Fwd: [p2p-hackers] lockstep synchronization protocol problem
by coderman 28 Mar '06

28 Mar '06

---------- Forwarded message ---------- From: UE=x <jinz(a)mail.ustc.edu.cn> Date: Mar 28, 2006 2:00 AM Subject: Re: [p2p-hackers] lockstep synchronization protocol problem To: coderman(a)gmail.com can you introduce some papers to read about what you have said?I can't get your meaning,but thank you.how is it related to the synchronization problem? i am about to go offline for the night; here are a few off the top of my head that are relevant. i can post more later this week and others on this list will likely have input. group key distribution: Efficient Self-Healing Group Key Distribution with Revocation Capability (2003) http://citeseer.ist.psu.edu/623802.html group reputation / trust metrics: www.levien.com/thesis/compact.pdf quorums and usability are more complicated and i don't have any links off hand. best regards, P.S. please reply with any additional research / results if you encounter them... TZDz5D@4PEVPTx>-La5=: >From: coderman <coderman(a)gmail.com> >Reply-To: >To: "UE=x" <jinz(a)mail.ustc.edu.cn>, "Peer-to-peer development." <p2p-hackers(a)zgp.org> >Subject: Re: [p2p-hackers] lockstep synchronization protocol problem >Date:Tue, 28 Mar 2006 01:49:17 -0800 > >On 3/28/06, UE=x <jinz(a)mail.ustc.edu.cn> wrote: >> I'm doing research about synchronization problem in P2P system,and the basic >> synchronization protocol is the lockstep protocol,and it use rounds to synchronize >> all the peer's movements,the problem is lockstep only synchronize peer's >> movements?what about the event created by all the peers?can it use rounds to >> synchronize them?and how to ? > >look at using a quorum based key distribution and agreement protocol >(where quorum == a specific subset of group key management) with >regular attestation / rekeying via trusted and strongly authenticated >mechanisms. session timeout (for failure / lack of consensus / >malicious attack) should be detected within an appropriate time frame >for the user to respond securely. (i tend to think 60 seconds is an >acceptable window) > >doing this in a user friendly manner is very difficult and probably >the reason prior work in this domain is scarce.

1 0

janus wireless faq / "secure"* public communication
by coderman 28 Mar '06

28 Mar '06

- why don't you have a public website with forums and other services? :: public networks allow unauthenticated communication and may expose vulnerabilities. we are building a secure* private group networking system. a strong least privilege system only communicates over public networks in an ephemeral and read only manner via self certifying identifiers. (that is, we like to eat our own dogfood) - then what is that site i saw that talked about a janus wireless member? :: individuals within the group may host their own public services. we expect them to confirm that any operating system instance connected to public networks in this manner should be considered less than secure even if they are well protected. - how can i help you? :: get in touch with one of our members. you might try email, off-the-record, out-of-band, or other methods. - do i have to buy VIA padlock hardware to use your software? :: no, but this is the default and the accelerated encryption makes a secure runtime nearly transparent to you as a user. (in other words, we believe it is worth the cost to do so if you can) - can i meet one of your members in person for a strong key exchange and authentication? :: sure, see item #3. --- * secure means strong least privilege vetted by someone you trust. this degree of virtuous interaction is very difficult, complicated and currently believed to be the most secure way to design and maintain a secure system. this is elaborated on in detail in our technical documentation archive.

1 0

Re: [p2p-hackers] lockstep synchronization protocol problem
by coderman 28 Mar '06

28 Mar '06

On 3/28/06, UE=x <jinz(a)mail.ustc.edu.cn> wrote: > I'm doing research about synchronization problem in P2P system,and the basic > synchronization protocol is the lockstep protocol,and it use rounds to synchronize > all the peer's movements,the problem is lockstep only synchronize peer's > movements?what about the event created by all the peers?can it use rounds to > synchronize them?and how to ? look at using a quorum based key distribution and agreement protocol (where quorum == a specific subset of group key management) with regular attestation / rekeying via trusted and strongly authenticated mechanisms. session timeout (for failure / lack of consensus / malicious attack) should be detected within an appropriate time frame for the user to respond securely. (i tend to think 60 seconds is an acceptable window) doing this in a user friendly manner is very difficult and probably the reason prior work in this domain is scarce.

1 0