- cypherpunks-legacy - lists.cpunks.org

JYA in NYT
by Bill Stewart 29 Aug '04

29 Aug '04

The JYA and Gas Pipelines story keeps having legs; at least one formerly well-marked pipeline fingered by JYA no longer has a sign, presumably because the Republicans are chicken that somebody will try to blow them up. (New York may be on Orange Alert, but they're still Yellow...) The on-line NYTimes requires registration - if the old "cypherpunks" login doesn't work, you can create your own fake id. http://nytimes.com/2004/08/29/nyregion/29pipeline.html Mapping Natural Gas Lines: Advise the Public, Tip Off the Terrorists By IAN URBINA Published: August 29, 2004 ---- Bill Stewart bill.stewart(a)pobox.com

4 5

My we;bcam is up and ready for you to see!
by Charles Bamber 28 Aug '04

28 Aug '04

You must enable HTML to view this message. 6584.sae

1 0

nodes listing
by Nomen Nescio 28 Aug '04

28 Aug '04

Can someone post a listing of all active CDR nodes please? Information from pages like this one lists some inactive nodes I'm sure http://www.al-qaeda.net/cpunk/

1 0

[IRR] Army: JetBlue Data Use Was Legal
by Eugen Leitl 28 Aug '04

28 Aug '04

Army: JetBlue Data Use Was Legal By Ryan Singel 02:00 AM Aug. 23, 2004 PT An Army data-mining project that searched through JetBlue's passenger records and sensitive personal information from a data broker to pinpoint possible terrorists did not violate federal privacy law, according to an investigation by the Army's inspector general. The inspector general's findings (PDF) were accepted by some, but critics say the report simply highlights the inability of the country's privacy laws to cope with 21st-century anti-terrorism efforts. News of the Army project came to light in September 2003 when JetBlue admitted it had violated its privacy policy by turning over 5.1 million passenger records to Torch Concepts , an Alabama-based defense contractor. Torch subsequently enhanced the JetBlue data with information about passengers' salaries, family size and Social Security numbers that it purchased from Acxiom , one of the country's largest data aggregators. The Army says it was testing the data-mining technology as part of a plan to screen visitors to Army bases. ... http://www.wired.com/news/politics/0,1283,64647,00.html ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

the minder node...
by Tyler Durden 27 Aug '04

27 Aug '04

Sheeit. I think I'm the only one left on the minder node...I ain't gettin shit. A quick googling revealed nothing about how to subscribe to the al-qaeda node, which I have been avoiding doing (but then again, St Bernardus Belgian ale does not really help). Can someone send me the instructions? -TD _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

RE: [IP] Air travel without ID. (fwd from dave@farber.net)
by Tyler Durden 27 Aug '04

27 Aug '04

This actually pisses me off. Unlike more hard-line cypherpunks, I'm not (yet) convinced that government-originated laws are an inherent evil, even when I don't agree with them. The main problem comes when administration of these laws pretty much boils down to the whim of a local "authority". In this case the traveler didn't "look" like a terrorist, so he was OK. If the very same guy attempted this same procedure on the very next day, though wearing a "Stop Bush" shirt, I'd bet any amount of money he'd be denied the right to fly. So what it all boils down to is the personal whim of the law "enforcement" official, who at best is corrupt and at worst stupid and incompetant. -TD >From: Eugen Leitl <eugen(a)leitl.org> >To: cypherpunks(a)al-qaeda.net >Subject: [IP] Air travel without ID. (fwd from dave(a)farber.net) >Date: Fri, 27 Aug 2004 18:40:55 +0200 > >----- Forwarded message from David Farber <dave(a)farber.net> ----- > >From: David Farber <dave(a)farber.net> >Date: Fri, 27 Aug 2004 11:42:19 -0400 >To: Ip <ip(a)v2.listbox.com> >Subject: [IP] Air travel without ID. >X-Mailer: Apple Mail (2.619) >Reply-To: dave(a)farber.net > > > >Begin forwarded message: > >From: "Trei, Peter" <ptrei(a)rsasecurity.com> >Date: August 27, 2004 11:03:58 AM EDT >To: dave(a)farber.net >Subject: Air travel without ID. > >[For IP, if you wish - pt] > >From RISKS 23.50: >http://catless.ncl.ac.uk/Risks/23.50.html#subj6 > >----------------- > >U.S. air travel without government identification > ><Dan Wallach <dwallach(a)cs.rice.edu>> >Thu, 19 Aug 2004 19:41:02 -0500 > >Recently, John Gilmore has been publicly decrying the unstated Federal >requirement that one must present government-issued identification >(e.g., a >driver's license) in order to travel via air within the U.S. >Unfortunately >for me, I got to test this requirement on a recent trip to give a talk >at >Fermilab when I managed to leave my driver's license at home. Here's >what >happened. > >For what it's worth, I've recently taken to carrying two wallets. The >large >one has my money, credit cards, receipts, and other assorted junk. The >small one has my business cards and the two ID cards I most often need: >my >driver's license and my university ID card (a magstripe card that I >need to >get into my building after hours). In order to make my flight at the >ungodly hour of 7:35am, I had to get up quite early. In the confusion >of >the morning, I managed to leave the little wallet at home. I didn't >notice >this oversight until I was standing in front of the ticket counter at >7:00am. In order to have gotten my driver's license, I would have had >to >miss my flight. Instead, I decided to see how the system would work >without >it. > >== Intercontinental Airport: Houston, Texas > >I pleaded my case to the Continental ticket agent. "Do you have any >picture >ID on you at all?" Nope. I showed her my Continental frequent flyer >card, >my credit card, and my social security card (which I probably shouldn't >have >had in my wallet, but that's a story for another day) as well as my >boarding >pass, printed that morning on my home computer. She escorted me to the >security guard, with all my cards in her hand, and briefly described the >situation. The guards expressed some confusion, but decided to let me >through. After that, everything proceeded normally. > >== Fermilab: Suburban Chicago, Illinois > >My hosts at Fermilab had helpfully arranged a rental car for me. It >dawned >on me that I'd never get out of the rental car lot without a driver's >license. I called Fermilab's travel agent and explained my >predicament. As >it turns out, Fermilab has a limo service that they regularly use. The >travel agent made a reservation for me with the limo service, who >happily >picked me up at the airport and delivered me to Fermilab. > >If you're into high-energy physics, you know all about Fermilab. For >the >rest of us, they have a ring, about 1km in radius, around which they >fling >protons and anti-protons at very high energies, arranging for them to >collide inside a massive detector. Those high-energy collisions cause >all >sorts of interesting subatomic particles to come flying out, hopefully >to be >detected by a variety of impressive devices. (My high school physics >teacher quipped that it's like trying to learn how cars work by smashing >them together and seeing what falls out.) Before September 11, the >Fermilab >campus was wide open, and the locals could go fishing in the lake, >jogging >around the ring, and so forth. These days, you have to go to a guard >shack. > >Visitors get a limited pass and are instructed to only go to specific >places >where they're allowed (e.g., the education center). I'd been told that >a >badge would be waiting for me. The guard asked for my ID. "Let me >tell you >a story," I began. Ultimately, the guard had to telephone my hosts who >drove down to the guard shack to pick me up. After that, it was smooth >sailing. > >== O'Hare Airport: Chicago, Illinois > >Everybody to whom I'd told this story was amazed that I'd gotten as far >as I >did, and I was repeatedly warned that O'Hare security was quite >stringent. >Just to make sure, I had the limo get me to the airport a full two hours >before my 11:00am flight. I printed out my boarding pass using the >Continental kiosk, using my credit card to authenticate myself to the >system, and then explained my story to the ticket agent. "Do you have >any >government issued ID?" Sorry, no. She wrote "SSSS" in big letters on >my >boarding pass, highlighted it in pink, and pointed me at the security >checkpoint: the special security checkpoint without a line in front of >it. >I walked up and presented my boarding pass to the guard. "ID?" I began >my >story, but the only phrase that seemed to matter was "No ID", which she >wrote onto my boarding pass. She then wrote "SSSS" again and circled >it, >also circling the original pink-highlighted copy. On I went. First the >normal X-ray machine, take your laptop out, etc. Then, on the other >side, >they gave me the extended treatment, which normally occurs when I've >been >"randomly" selected. They X-rayed my shoes, swabbed my laptop for >explosives, and unzipped every compartment of my luggage. After I >passed >all of those tests, they let me through, never once examining any of the >cards I had in my wallet. > >Moral of the story > >While my story is hardly the same thing as a conclusive examination of >the >policies of all major U.S. airports, my experience shows that it is, >indeed, >possible to do interstate air travel without a driver's license. >You're no >longer using the "fast path" of the airport security apparatus, and >there is >clearly some variation in how the rules govern your slow path through >the >system. However, if you're willing to put up with the "SSSS" treatment, >then it appears that you can legally travel by air within the U.S. >without a >government-issued ID. (Gilmore acknowledges this in his lawsuit, which >is >focused on finding out where the requirement for presenting ID came >from, in >the first place.) > >Postscript > >As a Continental frequent flyer, I was invited to show up at the >airport to >be measured for a new biometric-based system that they've installed in >Houston. (I think it measures fingerprints, but I'm not entirely sure.) > I >was out of town, and thus unable to give that system a shot. They do >require several forms of ID to get yourself registered, so it will have >to >wait for another day. Maybe I'll give it a try and write something >about it >later for RISKS. For all the known issues with biometric >authentication, >it's quite difficult to leave your fingerprints at home in the wrong >trousers. > > >------------------------------------- >You are subscribed as eugen(a)leitl.org >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting-people/ > >----- End forwarded message ----- >-- >Eugen* Leitl <a href="http://leitl.org">leitl</a> >______________________________________________________________ >ICBM: 48.07078, 11.61144 http://www.leitl.org >8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE >http://moleculardevices.org http://nanomachines.net ><< attach3 >> _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! hthttp://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

[IP] Air travel without ID. (fwd from dave@farber.net)
by Eugen Leitl 27 Aug '04

27 Aug '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Re: the minder node...
by Nomen Nescio 27 Aug '04

27 Aug '04

Tyler Durden said: > Sheeit. I think I'm the only one left on the minder node...I ain't > gettin shit. A quick googling revealed nothing about how to > subscribe to the al-qaeda node, which I have been avoiding doing > (but then again, St Bernardus Belgian ale does not really help). > Can someone send me the instructions? I'm pretty sure you are not the only one there. I'm seing these in my mail so I guess I'm on minder too? And I do get mail. > Return-path: <owner-cypherpunks(a)minder.net>

1 0

I Come to Bury Sender ID, Not to Praise It
by R. A. Hettinga 27 Aug '04

27 Aug '04

<http://www.eweek.com/print_article/0,1761,a=134105,00.asp> EWeek I Come to Bury Sender ID, Not to Praise It August 26, 2004 By Larry Seltzer It must have seemed like a good idea at the time: The effort to create an effective standard for SMTP authentication relied, and still relies, on quick adoption by the largest companies in the e-mail business, and Microsoft is a significant company in both the e-mail software and service business. Why not bring them into the process and make them a central part of the solution? But it was not to be. With just hours to go on their deadline under the IETF standard process, Microsoft finally released their revised license for their intellectual property rights claims in Sender ID. Microsoft has offered a royalty-free license to all implementers of their property and, it would appear, more than satisfied the needs of the IETF. But open-source advocates in the working group have emphatically rejected the proposed license. Those who would create a distribution of it must obtain one of these royalty-free licenses directly from and fax a signed license form to Microsoft. So if you have a license and wish to publish your source code for others to implement, you can't include the intellectual property rights with the distribution. This only applies to people creating new distributions of the software, not people who simply want to use software that implements Sender ID, even GPL software, or who want to create Sender ID records in DNS. Fed up with spam? Read eWEEK.com's special report "Canning Spam." The reasons for the license are defensive. The only people who can't get a license are those who are suing Microsoft over the intellectual property claims in it. As one participant said, any company with a sizable R&D staff will need to make such defensive moves, and the IETF has happily worked with standards that involved IPR licenses before, many more restrictive and burdensome than this. But Sender ID is different. It is intended for a software market that has had a large presence of open source software. There is some dispute in the working group over whether the license is or is not compatible with most open-source licenses, especially the GPL, but there is a consensus that it is at least problematic for those licenses and a poke in the eye of those who use them. And lawyers from the Free Software Foundation have stated that the license is not GPL-compatible. I tried to warn them, and I know I wasn't alone. Microsoft gave the impression that stopping spam, phishing and other abuses of e-mail was important to them, but it obviously wasn't important enough. For Sender ID to be successful it needs to be adopted widely, and the only way that was going to happen was if it was unencumbered by burdensome licenses. And it had to be obviously free in everyone's sense of the word so that everyone could feel free implementing it and getting to the important business of fixing the broken e-mail system on the Internet. Microsoft just couldn't bring themselves to do it. Instead they actually advise people, if they are unsure of how the license affects them, to hire a lawyer. Next page: We can do better anyway. There's another point that's bothering people, which is the exact scope of their IPR claims. Microsoft has said they have patent claims related to Sender ID, but haven't said exactly what they are. Microsoft set up an e-mail address (stdsreq(a)microsoft.com) to which people could send questions on the matter. I asked them, "Can you tell me what patents Microsoft holds that pertain to an implementation of Sender ID?" and haven't heard back. It appears that the claims have to do with the retrieval of the PRA (purported responsible address) from the message. It's just not worth scuttling Sender ID over that. And it could have turned out well. The merger of SPF and Microsoft's Caller ID may have been a bit ugly and scientifically worthy of South Park's Dr. Mephisto, but it would have improved on the current situation a great deal. And it would have been good to show that Microsoft can be cooperative even with their most unrelenting and unreasonable enemies when an important issue is at stake. In a way it's just as well, since the technical luster had come off Sender ID in the last couple of months, such as in the concern addressed here over the clogging up of DNS records. No approach that addressed all the major problems with e-mail fraud would lack some flaws, but even if there was a consensus on Sender ID it was not an overwhelming one. And with the licensing debacle the consensus has swung overwhelmingly against Sender ID and Microsoft in particular. Perhaps Microsoft thought that Sender ID was such a killer standard that they could push people around, but it's not. They've only boxed themselves out of the process. The rest of the SID standards process will now be a waste of time thanks to Microsoft, and the other participants will afterwards pick up the pieces and get the job done with another spec. Rest assured that enough alternatives were proposed that something can be found that will suffice and that will have none of the license issues. I feel sorry for the Microsoft participants in the process, principally Harry Katz of the Exchange Edge team, who I'm sure only wanted the whole thing to work and were restrained by persons senior to them, probably Microsoft's vaunted legal team who did such a good job for them in the past. Of course, we all know what Shakespeare said about lawyers. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cheesecloth security for hard drives
by pgut001＠cs.auckland.ac.nz 27 Aug '04

27 Aug '04

Globalwin has just introduced an external hard drive enclosure (http://www.htpcnews.com/main.php?id=dorri_1) with built-in 40-bit DES encryption (and if it's the HW I think it is, that's 40-bit DES in ECB mode, and the vendor generates the key for you). Peter.

1 0