- cypherpunks-legacy - lists.cpunks.org

Feds square off with organized cyber crime
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.theregister.co.uk/2005/02/23/feds_nostalgic_for_old_school_hacke…> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Feds square off with organized cyber crime By Kevin Poulsen, SecurityFocus (klp at securityfocus.com) Published Wednesday 23rd February 2005 22:08 GMT RSA 2005 Computer intruders are learning to play well with others, and that's bad news for the Internet, according to a panel of law enforcement officials and legal experts speaking at the RSA Conference in San Francisco last week. Christopher Painter, deputy director of the Justice Department's computer crime section, spoke almost nostalgically of the days when hackers acted "primarily out of intellectual curiosity." Today, he says, cyber outlaws and serious fraud artists are increasingly working in concert, or are one and the same. "What we've seen recently is a coming together of these two groups," said Painter. Ronald Plesco, counsel to the National Cyber-Forensics and Training Alliance, a computer forensics organization established by the FBI and private industry, agreed, and pointed to the trend in recent years of spammers building networks of compromised computers to launder their fraudulent email offerings. Tim Rosenberg, a research professor at the George Washington University, warned of "multinational groups of hackers backed by organized crime" and showing the sophistication of prohibition-era mobsters. "This is not about little Jimmy Smith breaking into his ex-employer's website and selling information to competitors," he said. "What we're seeing is just sheer, monstrous" levels of crime." Painter acknowledged that recreational hackers are still out there, but he believes they're a minority. He reads the future of cyber crime and investigation in the joint Secret Service and Justice Department "Operation Firewall" crackdown on Internet fraud rings last October, in which 19 men were indicted for allegedly trafficking in stolen identity information and documents, and stolen credit and debit card numbers. At the center of Operation Firewall was an online forum called Shadowcrew, which served as the trading floor for an underground economy capable of providing a dizzying array of illicit products and services, from credit card numbers to details on consumers worthy of having their identities' stolen. "Individuals all over the world would work together to hack into systems, steal information and then sell information," said Painter. "[It was] a very, very highly structured, organized network." Faced with that kind of organization, law enforcement agencies are turning to undercover operations, said Painter. To take down Shadowcrew, the Secret Service secretly busted a high level member of the group, turned him into an informant, and operated him undercover for more than a year, according to court records. "Law enforcement was essentially running that group at one point," said Painter. Painter prosecuted Kevin Mitnick in the 1990s, and he still insists that, from the victim's point of view, old-fashioned recreational hackers are as bad as today's multi-disciplined cyber criminals. "But it was a simpler time," he admitted after the presentation. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FCC 'crosses the line' with broadcast flag - court
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.theregister.co.uk/2005/02/23/broadcast_flag_in_trouble/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2005/02/23/broadcast_flag_in_trouble/ FCC 'crosses the line' with broadcast flag - court By Thomas C Greene in Washington (thomas.greene at theregister.co.uk) Published Wednesday 23rd February 2005 21:48 GMT The US Federal Communications Commission (FCC) overstepped its authority by requiring devices capable of receiving digital TV broadcasts to recognize data called a 'broadcast flag' that can prevent copying, a federal judge has said. US Circuit Judge Harry Edwards told the FCC that it had "crossed the line" when it required DRM technology to be included in all DTV devices on sale in the USA from 1 July. This would include TVs, set top boxes, PC tuner cards, VCRs, DVD players, and similar devices. The FCC argued that its ancillary powers authorize it to regulate the reception of broadcasts, not just their transmission. While Congress did not authorize the Commission to regulate the proper designs of the devices, it also didn't expressly forbid it, which FCC takes as a license to issue specifications. "Ancillary does not mean you get to rule the world," judge Edwards observed. Judge David Sentelle wondered if FCC thought it could regulate washing machines, since Congress didn't expressly forbid that, either. In response to FCC whining that without adequate DRM technology, digital broadcasts would be limited, Judge Sentelle noted that, while this might be regrettable, it is not the FCC's responsibility. "It's going to have less content if it's not protected, but Congress didn't direct that you maximize content," he said. Unfortunately, there is a legal detail here that might moot the whole issue. Judge Sentelle noted that the plaintiffs, largely consumer and library groups, might not have standing to make a complaint against FCC unless they can show how the regulation causes them specific harm. So it is entirely possible that the complaint will be shut down on a technicality. On the other hand, if it is not, the broadcast industry has additional appeals to mount, and, if finally thwarted in the courts, can always resort to lobbying Congress for the legislation it wants. Thus there is every possibility that American consumers will be stuck with broadcast flag-compliant devices in the near future. Those thinking of buying DTV-related gear might want to make their purchases sooner rather than later, in hopes that some non-compliant devices are still available. . Related stories FCC Chairman Michael Powell resigns (http://www.theregister.co.uk/2005/01/21/michael_powell_resigns_from_fcc/) Feds OK DVD+R/RW DRM tech (http://www.theregister.co.uk/2004/08/06/vcps_thumbs_up/) FCC locks down US TV (http://www.theregister.co.uk/2003/11/06/fcc_locks_down_us_tv/) ) Copyright 2005 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Fighting computer crooks the Las Vegas way
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.theregister.co.uk/2005/02/23/las_vegas_threat_detection/print.ht…> The Register Biting the hand that feeds IT The Register ; Software ; Applications ; Fighting computer crooks the Las Vegas way By John Leyden (john.leyden at theregister.co.uk) Published Wednesday 23rd February 2005 17:38 GMT RSA 2005 Computing techniques used to identify cheaters in Las Vegas are being applied to wider computer security and fraud detection problems. SRD, a Las Vegas software developer which was acquired by IBM last month, is taking its identity resolution software from the gaming tables into corporate boardrooms. SRD's business intelligence software (now renamed DB2 Identity Resolution) can draw out non-obvious relationships between information stored on a variety of databases. Las Vegas gaming companies use the technology as a way to identify customers and their associates worthy of investigation for possible cheating. The software looks at information on employee records, suppliers, in-house arrests and incidents and industry-published professional counters and cheaters' lists to identify action items. For example, the system can tell if a person who has been arrested for card counting phones up a relative of a card dealer. "The casino industry uses our technology to discover individuals who may have the wrong intent before ferreting out problems with an investigative team," explained Jeff Jonas, founder and chief scientist of SRD (now renamed IBM's Entity Analytics Solutions). SRD's technology minimises the resources needed for an investigation and works best where a firm owns the data it is processing, according to Jonas. "It's problematic sharing information between organisations, so we've developed an anonymous identity resolution approach," he told a workshop Detecting Asymetric and Insider Threats - Las Vegas style at last week's RSA Conference in San Francisco. ID managed and correlated in crypto form To preserve anonymity, SRD has developed a technique to compare data in cryptographic form, instead of real information. Raw data can be confusing - for example, different spellings of Mohammed can be used on records of the same person, while Social Security numbers can be inputted instead of driving license IDs. But this can be overcome by pre-processing data to create a finite number of hashes for comparison. Adding salt to this data prevents statistical attack. This approach enables banks in the process of merging, say, to share anonymized data. Anonymous identity resolution can also help banks identify possible money-laundering activity or to combat disparate security threats. According to Jonas SRD software is tuned to minimise false positives,. Jonas, who describes himself as a data modeller, draws a distinction between data mining and SRD's "rules based expert system". Data mining looks for patterns in data that suggest, for example, individuals who share characteristics with a bank's most profitable customers. Data mining is tuned to avoid false negatives; but in applications like fraud detection and counter-terrorism addressed by SRD's technology false positives are the problem. "[SRD's technology] It's not probabilistic like data mining. A probabilistic approach works well if all you are using is 27c stamps but not if you're pointing guns at people," Jonas said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

No Encryption for E-Passports
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.wired.com/news/print/0,1294,66686,00.html> Wired News No Encryption for E-Passports By Ryan Singel? Story location: http://www.wired.com/news/privacy/0,1848,66686,00.html 02:00 AM Feb. 24, 2005 PT Despite widespread criticism from security experts that a proposed high-tech upgrade to Americans' passports actually introduces new security risks, the government is declining to encrypt data on new high-tech e-passports, according to proposed new rules published last week. In response to this outside criticism and some public questioning by one of its own contractors, the State Department delayed its rollout of the chip-equipped passports and hired additional companies to provide prototypes. Other countries are also wrangling with the issue, as the United States is requiring all 27 countries whose citizens do not need visas to visit America to begin issuing e-passports by October. So far only Belgium has started production, and it is likely the deadline, which was originally October 2004, will be pushed back another year. The new passports will include a radio frequency identification tag, a chip that will store all the information on the data page of the passport, including name, date and place of birth, and a digitized version of the photo passport, according to the proposal in the Federal Register. RFID chips are widely used in automatic toll-payment systems such as FasTrak, or identification chips implanted in the necks of pets. The chips are activated by a reader using certain radio frequency waves, which the chips use as an energy source to send back the encoded information. Border agents, equipped with readers, would be able to pull up passport information on a screen and visually compare the digitized photo against the passport bearer. Agents will also be able to use facial identification software to compare the person to the digitized photo, which is not feasible with current passports. The State Department, which has responsibility for passports and visas, hopes the measure will improve security and help curb passport forgery. The government will use chips that can only be written to once, and a further safeguard is provided in the form of a digital signature, which allows readers to verify that the information on the chip is the information originally written to it. But the rules, which are open for comment until April 4, rule out encrypting the bearer's name, birth date and digital photo, saying such a move would impede worldwide adoption of e-passports and that encrypted data would slow down entry and exit at customs. The lack of encryption baffles privacy advocates and security researchers, who say the new passports are vulnerable to "skimming," an attack that uses an unauthorized reader to gather information from the RFID chip without the passport owner's knowledge. The State Department concedes that skimming is a legitimate threat, but says the chips will have a read range of inches, that eavesdropping at border stations would be very conspicuous and that the passports will have a shielding mechanism -- perhaps a foil case or a weave in the cover that will cloak the chip when the passport is closed. That does little to satisfy critics such as Lee Tien, an attorney at the Electronic Frontier Foundation. "The State Department has not responded in any meaningful way to any of the privacy community," Tien said. "They are offering the equivalent of duct tape and baling wire as far (as) protecting peoples' information from being read. "It is my understanding it's possible to read this information from 10 to 30 feet away with the right equipment," Tien said. "When you think about the issues Americans have, especially when they travel abroad -- do you really want your passport to be broadcasting your name and nationality? This isn't good for privacy or the physical security of Americans abroad." Bruce Schneier, a security expert and author who founded Counterpane Internet Security, questions how much shielding helps, since travelers often have to show identification to exchange currency or check into a hotel. "Shielding is a good idea, but the problem is if you travel in Europe you are asked to show your passport a lot," Schneier said. "So all that shielding means is that someone who wants to sniff my passport just has to pick his location." Schneier, who just renewed his passport to make sure he will not have an unencrypted passport for another 10 years, says he has yet to hear a good argument as to why the government is requiring remotely readable chips instead of a contact chip -- which could hold the same information but would not be skimmable. "A contact chip would be so much safer," Schneier said. "The only reason I can think of is the government wants surreptitious access. I'm running out of other explanations. I'd love to hear one." Not everyone in the RFID industry thinks the proposed rules compromise security more than they help. "The goal is to create a stronger identification vehicle and that is what is being achieved in the e-passport initiative," said Erik Michielsen, director of RFID and ubiquitous networks at ABI Research. Michielsen, who calls himself a supporter of RFID technology, acknowledges there are legitimate security concerns, but thinks that the government should look at how other countries handle these concerns and learn from them, even as it proceeds with the current plan. "With any emerging technology, security issues arise and must be addressed," Michielsen said. "It's not whether security issues are solved today. It's assuring that as this moves toward a rollout that they are routinely addressed and resources are dedicated to ensuring consumers' privacy." The State Department, which is accepting written responses to the proposal until April 4 via e-mail sent to PassportRules(a)state.gov, did not return a call requesting comment. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

William Rivers Pitt | HST and the Proverbial 'Live Boy'
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.truthout.org/docs_2005/printer_022105Z.shtml> The Proverbial 'Live Boy' By William Rivers Pitt t r u t h o u t | Perspective Monday 22 February 2005 "The only way I can lose this election is if I'm caught in bed with either a dead girl or a live boy." - Edwin W. Edwards [Author Hunter S. Thompson raises his arms to exhort the crowd of supporters gathered on the west steps of the Colorado State Capitol on Monday, May 15, 2001, during a rally for Lisl Auman, who is serving a life sentence in a Colorado prison for her part in the slaying of a Denver Police Department officer in November 1997. Thompson, the acerbic counterculture writer who popularized a new form of journalism in books like 'Fear and Loathing in Las Vegas,' fatally shot himself Sunday, February 20, 2005, at his Aspen-area home, his son said. He was 67. (Photo: David Zalubowski / AP)] In the same month the planet gets to know the 'journalist' James/Jeff Guckert/Gannon, Hunter S. Thompson decides to make The Big Bit-Spit and eject from the planet. This could be sacrilege, and I hope his family will forgive me, but there is something wretchedly fitting in the confluence. Hunter was a drunk and a drug-sucker. He would go to cover an event and slather himself with LSD. He went to the '72 GOP convention as a wild-eyed liberal and elbowed his way into the activist bullpen, grabbing a sign reading 'Garbage Men Demand Equal Pay' before charging the floor with the Nixon-shouters to howl "Four More Years!" at John Chancellor. He wanted to write about motorcycle gangs, so he went out and joined the worst of them, and got his ass stomped in. And wrote about it. Hunter Thompson is the reason I write politics. Period. He was the most honest man in the business. Everyone else had and has an angle, a reputation, or a source to protect. Hunter stripped it down to the raw throbbing nerve and let it fly. How is this for prose: "How many more of these goddam elections are we going to have to write off as lame but 'regrettably necessary' holding actions? And how many more of these stinking double-downer sideshows will we have to go through before we can get ourselves straight enough to put together some kind of national election that will give me at the at least 20 million people I tend to agree with a chance to vote for something, instead of always being faced with that old familiar choice between the lesser of two evils? I understand, along with a lot of other people, that the big thing, this year, is Beating Nixon. But that was also the big thing, as I recall, twelve years ago in 1960 - and as far as I can tell, we've gone from bad to worse to rotten since then, and the outlook is for more of the same." Or this: "It is a nervous thing to consider: Not just four more years of Nixon, but Nixon's last four years in politics - completely unshackled, for the first time in his life, from any need to worry about who might or might not vote for him the next time around. If he wins in November, he will finally be free to do whatever he wants...or maybe 'wants' is too strong a word for right now. It conjures up images of Papa Doc, Batista, Somoza; jails full of bewildered 'political prisoners' and the constant cold-sweat fear of jackboots suddenly kicking your door off its hinges at four A.M." Or this: "The main problem in any democracy is that crowd-pleasers are generally brainless swine who can go out on a stage & whup their supporters into an orgiastic frenzy - then go back to the office & sell every one of the poor bastards down the tube for a nickel apiece. Probably the rarest form of life in American politics is the man who can turn on a crowd & still keep his head straight - assuming it was straight in the first place." That's the stuff. Rip it down, Bubba, and let the fur fly. For the record, the aforementioned is from 'Fear and Loathing on the Campaign Trail 1972,' possibly the most purely excellent book on politics to be found anywhere. Amusing, then, that Hunter decides to cash his check in the same week we learn about James or Jeff Gannon or Guckert or whatever. What would Thompson have made of this feeble wretch? Of a man who reports on the White House with a fake name? Who was so clearly the go-to guy for McClellan or Bush when the questions got too hot? Who copied and pasted his 'news reports' from boilerplate GOP press releases? Who somehow got within 20 feet of the President of the United States using a false name while peddling his wares online as a male prostitute for $200 an hour? Hunter once wrote in 'The Great Shark Hunt' about walking in on two Secret Service agents sharing a joint back and forth in a hotel room. Maybe that's how Gannon/Guckert/Whoever got within pistol range of the leader of the free world. No other explanation seems to satisfy. It comes down to this. The Bush crew has been caught in bed with the proverbial 'live boy.' Someone in that White House either eased Gannon/Guckert/Whoever through the 'hard pass' application process, which requires a thorough background check, or else smoothed the way for him to get day pass after day pass after day pass. Some complain that Gannon/Guckert/Whoever is being victimized for his political views. This misses the point. Someone let a working, advertising whore into the White House, and then was stupid enough to let him walk around alive and free after he blew his own cover. That's the point. My hero died tonight. He was a flawed man, a maniac, in so many ways the antithesis of what a journalist is supposed to be. Worst of all, he told the truth. There is now one less warrior on this planet filled with Guckert clones, drones who get fed shit and regurgitate it wholesale for the masses because that is what we are trained to eat. Rest in peace, Hunter. Thank you for everything. We're going to deal with this Gannon/Guckert/Whoever person, and then move down the line and deal with the rest of the whores. You died on the eve of the birth of a new journalism, populist in nature, beholden to the truth and thanking the Google gods every step of the way. I wish you had stuck around to see it, but I'll tell you all about it when we meet at that clearing at the end of the path. Until then... ) Copyright 2005 by TruthOut.org -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

SHA-1 results available
by Jack Lloyd 23 Feb '05

23 Feb '05

http://theory.csail.mit.edu/~yiqun/shanote.pdf No real details, just collisions for 80 round SHA-0 (which I just confirmed) and 58 round SHA-1 (which I haven't bothered with), plus the now famous work factor estimate of 2^69 for full SHA-1. As usual, "Technical details will be provided in a forthcoming paper." I'm not holding my breath. -Jack

2 1

Re: I'll show you mine if you show me, er, mine
by hal＠finney.org 23 Feb '05

23 Feb '05

Markus Jakobsson is a really smart guy who's done some cool stuff, so I think this is probably better than it sounds in the article. His web site is http://www.informatics.indiana.edu/markus/ but I don't see any papers there that sound like what the article describes. I tried to reverse engineer the protocol from the article, and the results are below. But first let me put this into context. The security property seems to be that you send something to the server, and it sends you back something that proves that it knows your password. But neither a passive eavesdropper nor a MITM can learn anything about your password from observing or influencing the exchange. The best an attacker can do is to try to brute force your password by guessing it repeatedly and trying each guess out at the server. And this can be easily prevented by having the server refuse to answer more than a few bad password attempts. Note that this is different from simple PK based authentication, because the secret is human memorizable. And it's different from, say, having the server respond with a keyed hash of your passphrase, because an eavesdropper could then do an offline brute force search. The key feature is that the only attack is online brute forcing. There are already a lot of protocols in the literature which do this, often performing key agreement at the same time. The original one and most famous was SPEKE. There is a long list of such protocols at http://grouper.ieee.org/groups/1363/passwdPK/submissions.html. I don't know what properties this new protocol has that the old ones don't. Maybe it does have some and I am missing the point. Or there might be some patent issues that it is trying to work around. Anyway, here's my attempt at mimicking the protocol, based on the description of envelopes and carbon paper. You have a password, and so does the site you will login to. (Or, maybe the site has a salted hash of your password; you could use that instead.) You set up a homomorphic encryption system. This is one where you can send an encrypted value to someone else, and he can do certain operations on the encrypted value, like multiplying it by a constant. In this case I think we only need to encrypt the value 1, and let the other guy multiply by his constant, which makes it simpler. I think ElGamal could work: you encrypt 1 as (g^k, y^k), where you'd make up a key y = g^x on the spot. You send this to the other guy who picks a random power j and raises both elements to that power, then multiplies the 2nd one by c: (g^(k*j), y^(k*j) * c), and sends it back to you. This is now a valid ElGamal encryption of c. But an observer can't tell what c is. For a first cut at this protocol, you take each bit of the password (or salted hash) and create two encryptions of m = 1. It would look like this: E(1) E(1) E(1) E(1) E(1) ... E(1) E(1) E(1) E(1) E(1) ... You send all these to the server. The server knows your password (or salted hash) and, for each pair of encrypted values, multiplies the one corresponding to password bit b_i by some constant c_i. The other one of the pair, corresponding to !b_i, it multiplies by a random r_i. The server sets it up so that the sum of all the c_i is zero. Then it sends all of them back to you. If your passphrase started 01101... it would be: E(c_1) E(r_2) E(r_3) E(c_4) E(r_5) ... E(r_1) E(c_2) E(c_3) E(r_4) E(c_5) ... Now, you decrypt just the ones corresponding to the bits b_i and add up the decrypted plaintexts, giving you sum of c_i. If the result is zero, you know the server knew your password (or salted hash). Actually this is not quite right, because the article says that you are not supposed to be able to decrypt both ciphertext values in the pair that corresponds to a password bit. Otherwise an imposter might be able to figure out your passphrase by doing one interaction with the server, then finding an element from each pair such that they all sum to zero. This is kind of knapsacky and it might not be that hard, I'm not sure. So I think what you could do is to send a valid ElGamal encryption of 1, and a bogus value which is not an ElGamal encryption of anything. But the remote party wants to be sure that you can't decrypt them both. One way to achieve this is to arrange that the first members of each pair, g^k in the good encryption, multiply to some fixed value F for which the discrete log is not known. Maybe it's the hash of "I don't know if this will work." You can't know the DL of that hash, so you can't find two g^k values which multiply to that hash. That means that if you have a pair of ElGamal ciphertexts which have this property, only one is a real, valid ElGamal ciphertext and so only one is decryptable (I think!). So you would send, in the example above: (g^k0, y^k0) (F/g^k1, junk) (F/g^k2, junk) (g^k3, y^k3) ... (F/g^k0, junk) (g^k1, y^k1) (g^k2, y^k2) (F/g^k3, junk) ... When the server did its multiplications as above you'd still get the correct encryptions of c_i, but the other pair would be junk and you wouldn't learn the r_i values: E(c_1) junk junk E(c_4) junk ... junk E(c_2) E(c_3) junk E(c_5) ... Now you can still decrypt it and verify your password. But for someone who is impersonating you and doesn't know your password, they're going to get a mix of c_i and r_i values that won't add up to zero, and that won't give them any clue about what the real password is, other than that they guessed wrong. I'm not 100% sure this will work, that the attacker can't create a bogus pair (F/g^k, junk) which will allow him to determine what value the server multiplied by. At a minimum I see that if junk = F/g^k then it will be obvious what the constant was, so the server would have to check for that. This is why it's good to have provable security! This way of doing things would also be quite inefficient; there are two ElGamal encryptions going back and forth (typically 2048 bits each) for every bit of your password. I'll bet the actual paper has a much more clever scheme which improves the efficiency and has a nice proof of security. I'm looking forward to seeing it. Hal Finney

1 0

Re: Code name "Killer Rabbit": New Sub Can Tap Undersea Cables
by Tyler Durden 23 Feb '05

23 Feb '05

No! Undersea? Do you take a copy of EVERYTHING and send it back? That might have been more feasible in the old days, but when a single fiber can run 64 wavelength optically amplified 10 Gig traffic, I really really doubt it. Or at least, this would require an undertaking large enough that I doubt they could hide it. If they select some traffic then we have to ask, how do they select the traffic? Even there the mind boggles thinking about the kinds of gear necessary. I suspect it's a combination of all sorts of stuff...remember too that all that traffic has to land somewhere, so theoretically they can access a good deal of it terrestrially. What you might see, therefore, is a sheath coming out of, say Iran, is tapped for fibers that proceed on to other unfriendly nations, and a copy of the traffic pulled back to some nearby land-based station in a friendly country (so that lots of amplifiers aren't needed). I'd bet you do see the occasional Variola suitcase, though, requiring a sub visit once in a while. But I bet they avoid this kind of thing as much as possible, given the traffic volumes. -TD >From: Matt Crawford <crawdad(a)fnal.gov> >To: crypto <cryptography(a)metzdowd.com> >CC: osint(a)yahoogroups.com, cypherpunks(a)al-qaeda.net >Subject: Re: Code name "Killer Rabbit": New Sub Can Tap Undersea Cables >Date: Tue, 22 Feb 2005 12:33:56 -0600 > >On Feb 18, 2005, at 19:47, R.A. Hettinga wrote: >>"It does continue to be something of a puzzle as to how they get this >>stuff >>back to home base," said John Pike, a military expert at >>GlobalSecurity.org. > >I should think that in many cases, they can simply lease a fiber in the >same cable. What could be simpler?

2 2

As Gonzo in Life as in His Work
by R.A. Hettinga 23 Feb '05

23 Feb '05

<http://www.opinionjournal.com/forms/printThis.html?id=110006325> OpinionJournal - LEISURE & ARTS As Gonzo in Life as in His Work Hunter S. Thompson died as he lived. BY TOM WOLFE Tuesday, February 22, 2005 12:01 a.m. Hunter S. Thompson was one of those rare writers who come as advertised. The Addams-family eyebrows in Stephen King's book jacket photos combined with the heeby-jeeby horrors of his stories always made me think of Dracula. When I finally met Mr. King, he was in Miami playing, along with Amy Tan, in a jook-house band called the Remainders. He was Sunshine itself, a laugh and a half, the very picture of innocent fun, a Count Dracula who in real life was Peter Pan. Carl Hiaasen, the genius who has written such zany antic novels as "Striptease," "Sick Puppy," and "Skinny Dip" is in person as intelligent, thoughtful, sober, courteous, even courtly, a Southern gentleman as you could ask for (and I ask for them all the time and never find them). But the gonzo--Hunter's coinage--madness of Hunter Thompson's "Fear and Loathing in Las Vegas" (1971) and his Rolling Stone classics such as "The Kentucky Derby is Decadent and Depraved" (1970) was what you got in the flesh too. You didn't have lunch or dinner with Hunter Thompson. You attended an event at mealtime. I had never met Hunter when the book that established him as a literary figure, "The Hell's Angels, a Strange and Terrible Saga," was published in 1967. It was brilliant investigative journalism of the hazardous sort, written in a style and a voice no one had ever seen or heard before. The book revealed that he had been present at a party for the Hell's Angels given by Ken Kesey and his hippie--at the time the term was not "hippie' but "acid-head"--commune, the Merry Pranksters. The party would be a key scene in a book I was writing, (The Electric Kool-Aid Acid Test). I cold-called Hunter in California, and he generously gave me not only his recollections but also the audiotapes he had recorded at that first famous alliance of the hippies and "outlaw" motorcycle gangs, a strange and terrible saga in itself, culminating in the Rolling Stones band hiring the Angels as security guards for a concert in Altamont, Calif., and the "security guards" beating a spectator to death with pool cues. By way of a thank you for his help, I invited Hunter to lunch the next time he was in New York. It was one bright spring day in 1969. He proved to be one of those tall, rawboned, rangy young men with alarmingly bright eyes, who more than any other sort of human, in my experience, are prone to manic explosions. Hunter didn't so much have a conversation with you as speak in explosive salvos of words on a related subject. We were walking along West 46th Street toward a restaurant, The Brazilian Coffee House, when we passed Goldberg Marine Supply. Hunter stopped, ducked into the store and emerged holding a tiny brown paper bag. A sixth sense, probably activated by the alarming eyes and the six-inch rise and fall of his Adam's apple, told me not to ask what was inside. In the restaurant he kept it on top of the table as we ate. Finally, the fool in me became so curious, he had to go and ask, "What's in the bag, Hunter?" "I've got something in there that would clear out this restaurant in 20 seconds," said Hunter. He began opening the bag. His eyes had rheostated up to 300 watts. "No, never mind," I said. "I believe you! Show me later!" >From the bag he produced what looked like a small travel-size can of shaving foam, uncapped the top and pressed down on it. There ensued the most violently brain-piercing sound I had ever heard. It didn't clear out The Brazilian Coffee House. It froze it. The place became so quiet, you could hear an old-fashioned timer clock ticking in the kitchen. Chunks of churasco gaucho remained impaled on forks in mid-air. A bartender mixing a sidecar became a statue holding a shaker with both hands just below his chin. Hunter was slipping the little can back into the paper bag. It was a marine distress signaling device, audible for 20 miles over water. The next time I saw Hunter was in June of 1976 at the Aspen Design Conference in Aspen, Colo. By now Hunter had bought a large farm near Aspen where he seemed to raise mainly vicious dogs and deadly weapons, such as the .357 magnum. He publicized them constantly as a warning to those, Hell's Angels presumably, who had been sending him death threats. I invited him to dinner at a swell restaurant in Aspen and a performance at the Big Tent, where the conference was held. My soon-to-be wife, Sheila, and I gave the waitress our dinner orders. Hunter ordered two banana daiquiris and two banana splits. Once he had finished them off, he summoned the waitress, looped his forefinger in the air and said, "Do it again." Without a moment's hesitation he downed his third and fourth banana daiquiris and his third and fourth banana splits, and departed with a glass of Wild Turkey bourbon in his hand. When we reached the tent, the flap-keepers refused to let him enter with the whiskey. A loud argument broke out. I whispered to Hunter. "Just give me the glass and I'll hold under my jacket and give it back to you inside." That didn't interest him in the slightest. What I failed to realize was that it was not about getting into the tent or drinking whiskey. It was the grand finale of an event, a happening aimed at turning the conventional order of things upside down. By and by we were all ejected from the premises, and Hunter couldn't have been happier. The curtain came down for the evening. In Hunter's scheme of things, there were curtains .. . and there were curtains. In the summer of 1988 I happened to be at the Edinburgh Festival in Scotland one afternoon when an agitated but otherwise dignified, silver-haired old Scotsman came up to me and said, "I understand you're a friend of the American writer Hunter Thompson." I said yes. "By God--your Mr. Thompson is supposed to deliver a lecture at the Festival this evening--and I've just received a telephone call from him saying he's in Kennedy Airport and has run into an old friend. What's wrong with this man? He's run into an old friend? There's no possible way he can get here by this evening!" "Sir," I said, "when you book Hunter Thompson for a lecture, you have to realize it's not actually going to be a lecture. It's an event--and I'm afraid you've just had yours." Hunter's life, like his work, was one long barbaric yawp, to use Whitman's term, of the drug-fueled freedom from and mockery of all conventional proprieties that began in the 1960s. In that enterprise Hunter was something entirely new, something unique in our literary history. When I included an excerpt from "The Hell's Angels" in a 1973 anthology called "The New Journalism," he said he wasn't part of anybody's group. He wrote "gonzo." He was sui generis. And that he was. Yet he was also part of a century-old tradition in American letters, the tradition of Mark Twain, Artemus Ward and Petroleum V. Nasby, comic writers who mined the human comedy of a new chapter in the history of the West, namely, the American story, and wrote in a form that was part journalism and part personal memoir admixed with powers of wild invention, and wilder rhetoric inspired by the bizarre exuberance of a young civilization. No one categorization covers this new form unless it is Hunter Thompson's own word, gonzo. If so, in the 19th century Mark Twain was king of all the gonzo-writers. In the 20th century it was Hunter Thompson, whom I would nominate as the century's greatest comic writer in the English language. Mr. Wolfe's latest book is "I Am Charlotte Simmons" (Farrar, Straus and Giroux). -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

On the road to truth and madness
by R.A. Hettinga 23 Feb '05

23 Feb '05

<http://news.telegraph.co.uk/news/main.jhtml;sessionid=1O4IK4JJKT1JRQFIQMFSN…> The Telegraph On the road to truth and madness (Filed: 22/02/2005) The opening of Fear and Loathing in Las Vegas: We were somewhere around Barstow on the edge of the desert when the drugs began to take hold. I remember saying something like "I feel a bit lightheaded; maybe you should drive " And suddenly there was a terrible roar all around us and the sky was full of what looked like huge bats, all swooping and screeching and diving around the car, which was going about a hundred miles an hour with the top down to Las Vegas. And a voice was screaming: "Holy Jesus! What are these goddamn animals?" Then it was quiet again. My attorney had taken his shirt off and was pouring beer on his chest, to facilitate the tanning process. "What the hell are you yelling about?" he muttered, staring up at the sun with his eyes closed and covered with wraparound Spanish sunglasses. "Never mind," I said. "It's your turn to drive." I hit the brakes and aimed the Great Red Shark toward the shoulder of the highway. No point mentioning those bats, I thought. The poor bastard will see them soon enough. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1