- cypherpunks-legacy - lists.cpunks.org

CodeCon program announced, early registration deadline nearing
by Len Sassaman 21 Jan '06

21 Jan '06

The program for CodeCon 2006 has been announced. http://www.codecon.org/2006/program.html CodeCon is the premier showcase of innovative software projects. It is a workshop for developers of real-world applications with working code and active development projects. All presentations will given by one of the lead developers, and accompanied by a functional demo. Highlights of CodeCon 2006 include: iGlance - Open source push-to-talk videoconferencing and screen-sharing Monotone - Low stress, high functionality version control Query By Example - Data mining operations within PostgreSQL Djinni - Efficient approximations to NP-complete problems Elsa/Oink/Cqual++ - A static-time whole-program dataflow analysis for C and C++ Truman - An open-source behavioral malware analysis sandnet VidTorrent/Peers - A scalable real-time p2p streaming protocol The fifth annual CodeCon takes place February 10 - 12, 11:30 - 18:00, at StudioZ (314 11th Street) in San Francisco. Early registration is $63, available online until February 1st, 2006. Registration will be available at the door for $85. Supporting Attendee tickets are also available, and include a one-year membership to the USENIX Association. Please see the CodeCon registration page for details: http://www.codecon.org/2006/registration.html

1 0

Quality Medicine Available HdcXq
by Bridgett Ortiz 21 Jan '06

21 Jan '06

Huge selection of meds available at attractive prices. Highest quality assured. Try us out today.. http://au.geocities.com/keary88660madelle1843/ a15F

1 0

[Clips] Re: Commercial Key Escrow?
by R. A. Hettinga 21 Jan '06

21 Jan '06

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Sat, 21 Jan 2006 09:12:05 -0500 To: "Philodox Clips List" <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] Re: Commercial Key Escrow? Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com --- begin forwarded text Cc: "Philodox Clips List" <clips(a)philodox.com> From: Nicko van Someren <nicko(a)ncipher.com> Subject: Re: Commercial Key Escrow? Date: Sat, 21 Jan 2006 11:03:20 +0000 To: "R. A. Hettinga" <rah(a)shipwright.com> On 20 Jan 2006, at 22:58, R. A. Hettinga wrote: > --- begin forwarded text > > Date: Fri, 20 Jan 2006 14:10:54 -0800 > From: ericm(a)lne.com > To: cypherpunks(a)jfet.org > Subject: Re: Commercial Key Escrow? > User-Agent: Mutt/1.4.1i > Sender: owner-cypherpunks(a)jfet.org > > On Fri, Jan 20, 2006 at 04:38:56PM -0500, R. A. Hettinga wrote: >> At 1:26 PM -0800 1/20/06, ericm(a)lne.com wrote: >>> I'm looking for someone who provides an actual commercial key >>> escrow service, not double encryption with a master key. >> >> One would think that the effect, being the same, creates a >> distinction >> without a difference? > > In some cases, yes. But not for this application. > > I really am looking for a commercial trusted third party to hold > keys. > > I've found a bunch of references from ~10 years ago that say > that someday commercial key escrow will be prevalent > but it appears that someday hasn't yet arrived. > > My problem is in many ways similar to the problem a CA would face > in ensuring business continuity in a business that depends on > keeping secrets. > > What does say Verisign do to back up their root CA private keys? > They probably have a bunch of BBN SafeKeypers (or rather the modern > equivalent FIPS-140 hardware). What if all of them croak at the > same time? > > Do they keep multiple backups? What happens if the keys/passphrases > for those backups are lost? > > Or secret sharing? What if N-(K+1) shares are destroyed? Do they > just quit the CA business then? There presumeably are scenerios > under which that is the only answer, and Verisign has judged their > possibility to be so remote and/or their solution cost so high > that they are not worth defending against. > > What would Verisign do if they didn't have security experts to > decide what's an acceptable risk and what isn't, and instead > just wanted to have someone else deal with the problem for them? No matter what sort of architecture one chooses for long term key protection it is inevitably going to fail once some threshold fraction of the system fails. With a simply multiple copies system you have to have 100% failure, but such a system has poorer security properties. K-of-N threshold schemes fail once you've lost N-(K+1) shares but generally have much better security. It is my understanding that Verisign have multiple HSMs for the root and they simply go out of their way to keep them very safe. At nCipher our critical keys (such as firmware signing keys) are distributed using a threshold scheme and we have procedures in place to periodically check the integrity of each share (though never checking more than one at a time). As far as I know there are no active commercial key escrow services around. One problem is that the half-life of Internet companies is short compared to the time people seem to want to keep their keys so it would be hard to trust such a company unless it was very carefully set up. Cheers, Nicko --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[dave@farber.net: [IP] more on Search queries *can* contain personal information]
by Eugen Leitl 21 Jan '06

21 Jan '06

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Medical Journal: Fountain of Youth
by bo williamson 21 Jan '06

21 Jan '06

1 0

Fwd: [Clips] Re: The Backhoe: A Real Cyberthreat?
by coderman 20 Jan '06

20 Jan '06

there are other easy ways to obtain outage information, especially when the fiber affected handles significant amounts of traffic. they have stemmed the tide of outage information but more than enough gets by to be useful for this type of analysis. (although it was much easier to just hit up the FCC for history when they kept track of it. the telcos are just as glad to keep this data secret - they pushed as hard as uncle sam to hide this data) and as mentioned below, it doesn't take a backhoe either. highly capable portable power tools, post hole diggers, a myriad of other construction equipment, could wreak havoc just as easily. (Milwaukee V28 portable saws are a good example - some disgruntled telco employee(s?) in canada used a portable saw to cut two long distance cables into the US causing over 280,000 circuits to go dead) the tricky part is identifying redundant paths/rings as both must usually be interrupted to create significant outage. (graph theory applied to directed high degree node/link attacks) there is a reason they are pursuing security through obscurity so heavily. sometimes it's all you've got... :) --- begin forwarded text ---------- Forwarded message ---------- From: R. A. Hettinga <rah(a)shipwright.com> Date: Jan 19, 2006 10:06 AM Subject: [Clips] Re: The Backhoe: A Real Cyberthreat? To: Philodox Clips List <clips(a)philodox.com> --- begin forwarded text Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Delivered-To: nanog(a)trapdoor.merit.edu Delivered-To: nanog(a)segue.merit.edu Delivered-To: nanog(a)nanog.org Date: Thu, 19 Jan 2006 13:00:43 -0500 From: sgorman1(a)gmu.edu Subject: Re: The Backhoe: A Real Cyberthreat? Cc: nanog(a)nanog.org Sender: owner-nanog(a)merit.edu While it is always fun to call the government stupid, or anyone else for that matter, there is a little more to the story. - For one you do not need a backhoe to cut fiber - Two, fiber carries a lot more than Internet traffic - cell phone, 911, financial tranactions, etc. etc. - Three, while it is very unlikely terrorists would only attack telecom infrastructure, a case can be made for a telecom attack that amplifies a primary conventional attack. The loss of communications would complicate things quite a bit. I'll agree it is very far fethced you could hatch an attack plan from FCC outage reports, but I would not call worrying about attacks on telecommunications infrastructure stupid. Enough sobriety though, please return to the flaming. ----- Original Message ----- From: Joe Maimon <jmaimon(a)ttec.com> Date: Thursday, January 19, 2006 12:01 pm Subject: Re: The Backhoe: A Real Cyberthreat? > > > > Dennis Dayman wrote: > > > "In 2004, Department of Homeland Security officials became > fearful that > > terrorists might start using accidental dig-ups as a road map > for deliberate > > attacks, and convinced the FCC to begin locking up previously > public data on > > outages. In a commission filing, DHS argued successfully that > revealing the > > details..." > > > > --MORE-- > > > > http://wired.com/news/technology/0,70040-0.html?tw=wn_tophead_1 > > > > -Dennis > > > > > > > > This is really stupid. Assuming the terrorist actually have the > dozens > of backhoes needed to completely erase meaningfull internet > connectivity > in north america, they would probably prefer to use them to smash > cars > and kill people on the interstate highways or something. > > Terrorist inflict terror by killing people, not by forcing > internet > explorer to display "page cannot be displayed". > > Let us not assume that murderous terrorist are as dumb as people > in DHS. > --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips

3 4

[Clips] NSA Data Mining Is Legal, Necessary, Sec. Chertoff Says
by R. A. Hettinga 20 Jan '06

20 Jan '06

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Fri, 20 Jan 2006 19:34:41 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] NSA Data Mining Is Legal, Necessary, Sec. Chertoff Says Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://www.realclearpolitics.com/Commentary/com-1_20_06_MK_pf.html> January 20, 2006 NSA Data Mining Is Legal, Necessary, Sec. Chertoff Says By Mort Kondracke "I think it's important to point out," Homeland Security Secretary Michael Chertoff told me in an interview, "that there's no evidence that this is a program designed to achieve political ends or do something nefarious." He was talking about the National Security Agency's warrantless "domestic spying" program, and I couldn't agree with him more. Despite the alarms sounded by the American Civil Liberties Union, former Vice President Al Gore and various Members of Congress, "there hasn't even been a hint" that the program is targeted at domestic dissidents or innocent bystanders, Chertoff said. It's designed to find and stop terrorists. "If you go back to the post-Sept. 11 analyses and the 9/11 commission, the whole message was that we were inadequately sensitive to the need to identify the dots and connect them," he said. "Now, what we're trying to do is gather as many dots as we can, figure out which are the ones that have to be connected and we're getting them connected," he said. While refusing to discuss how the highly classified program works, Chertoff made it pretty clear that it involves "data mining" -collecting vast amounts of international communications data, running it through computers to spot key words and honing in on potential terrorists. A former prosecutor, federal judge and head of the Justice Department's criminal division, he convincingly defended the program's legal basis and intelligence value. I asked him why the Bush administration can't comply with the 1978 Foreign Intelligence Surveillance Act, which allows the government to conduct "emergency" wiretaps for 72 hours. "It's hard to talk about classified stuff," he said, "but suffice it to say that if you have a large volume of data, a large number of [phone] numbers you're intercepting, the typical model for any kind of warrant requires you to establish probable cause [that one party is a foreign agent] on an individual number." FISA warrant applications are inches thick, he said, and "if you're trying to sift through an enormous amount of data very quickly, I think it would be impractical." He said that getting an ordinary FISA warrant is "a voluminous, time-consuming process" and "if you're culling through literally thousands of phone numbers ... you could wind up with a huge problem managing the amount of paper you'd have to generate." What I understood Chertoff to be saying is that when data mining produces evidence of a terrorist contact, the government will then seek a FISA warrant to actually tap the person's phones or "undertake other kinds of activity in order to disrupt something." As legal authority for the program, Chertoff cited a 2002 decision of the FISA Court of Review, which is one level down from the U.S. Supreme Court, holding that a president has "inherent [constitutional] authority to conduct warrantless searches to obtain foreign intelligence information." "We take it for granted that the president does have that authority," the court said, "and, assuming it is so, FISA could not encroach on the president's constitutional powers." Chertoff also said that the courts have given wide latitude to the government in controlling and monitoring activity across international borders. All reports on the NSA activity assert that it's limited to international communications. What about the assertion in The New York Times on Tuesday that virtually all of the thousands of NSA leads sent to the FBI in the months after the Sept. 11, 2001, terrorist attacks led to dead ends or innocent persons? Chertoff said, "You're going to bat well below .100 any time you do intelligence gathering. That's true even in conventional law enforcement. If you get even a small percentage of things to pan out, you've succeeded to a significant degree. "What I can tell you is this," Chertoff said. "The technique of electronic surveillance, which is gathering information about who calls whom or intercepting actual conversation, is the most significant tool in the war against terrorism. "If we didn't have it, I'm quite sure we'd have disrupted fewer attacks and identified fewer [terrorists]." Buried at the bottom of the Times story were a number of cases where actual terrorist operations had been disrupted, apparently as a result of NSA eavesdropping, including efforts to smuggle a missile launcher into the United States, to cut Brooklyn Bridge cables with a blowtorch and an attempt to blow up a fertilizer bomb in London. "I would rather move quickly and remove somebody when we've got a legal basis to do so, charge them with a lesser offense [than terrorism] or deport them, than wait till I have a big case with a big press conference. If we wait until people get operational, it's a failure. Somebody could get killed." The idea that someone could bring down the Brooklyn Bridge with a blowtorch has been ridiculed, but Chertoff said, "People kid about the shoe bomber, but had the bomb gone off and 150 people were killed, I don't think a lot of families would be laughing about it." Civil libertarians seem to fear that the government is collecting huge quantities of data that it can later use politically, but Chertoff said, "I don't think anybody has an interest in accumulating a lot of information. We can barely manage the stuff we care about for avoiding terrorism. "I can actually make the case that the more intelligence we've got, the more we actually protect civil liberties. In a world without intelligence, where we don't have a good idea where the threats are, it means searching people, screening names, barriers and checkpoints, questioning people when they get on an airplane." To me, the bottom line of the NSA spying case is this: Congress should investigate whether President Bush has authority to conduct anti-terrorist data mining. And, if he doesn't, Congress should give it to him - with legislative oversight. As Chertoff told me, "the name of the game here is trying to figure out, with all the billions of pieces of data that float around the world, what data do you need to focus on? What is the stuff you need to worry about? "If you don't use all the tools of gathering these kinds of leads, then you're leaving very valuable tools on the table." And, if and when another 9/11 occurs, the first question that will be asked is: Why? Mort Kondracke is the Executive Editor of Roll Call. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Don't be left behing- the enlargement revolution!
by Rolland Glass 20 Jan '06

20 Jan '06

1 0

[Clips] White House refuses to talk about Al Gore's plan to Wiretap every electronic device in the world
by R. A. Hettinga 20 Jan '06

20 Jan '06

...From the "No matter who you vote for, the government gets elected", department... Cheers, RAH --- begin forwarded text Delivered-To: clips(a)philodox.com Date: Fri, 20 Jan 2006 18:54:15 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] White House refuses to talk about Al Gore's plan to Wiretap every electronic device in the world Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://www.leftwinghate.com/?p=72> Left Wing Hate What the Left is all about White House refuses to talk about Al Gore's plan to Wiretap every electronic device in the world 20th January 2006 >From today's WhiteHouse press Briefing: quote: Q Scott, I have a two-part question. Apparently, no one in the White House will challenge Al Gore with now public information that he led the Clinton administration's Clipper Chip Project back in the 1990s to effectively tap every phone, fax machine and computer in the country. And my question: Isn't that worth pointing out to the American people, after he accused President Bush of breaking the law and violating the Constitution by - MR. McCLELLAN: I think you just did. This is an administration that is forward-looking, Les. We're focused on the priorities of the American people. Q Well, how about Gore? You mean you're going to say nothing about Gore and the clipper chip project? MR. McCLELLAN: I think you already have. No, I'm not going to get into that. :unquote More reading about the Clinton's Administrations Treason: Wikipedia Clipper Chip 2001: Clinton Administration Considered Sharing National Security Secrets With China, Syria, Pakistan 2000: Out-sourcing Big Brother 1997-2000 Alamo-Girl's Archives of Clinton's "Rogues Gallery" Clipper Chip info from the Electronic Privacy Information Center Editorial: Brian Mosely: Gore's criticism strikes a sour note This entry was posted on Friday, January 20th, 2006 at 2:57 pm and is filed under Main. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Commercial Key Escrow?
by ericm＠lne.com 20 Jan '06

20 Jan '06

Does anyone know of a company that provides a commercial key escrow service? Eric

2 4