- cypherpunks-legacy - lists.cpunks.org

Top Italian Mafia Boss Dies in U.S. Prison
by R. A. Hettinga 01 May '04

01 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The life, and death, of Mr. Badalamenti is important to cryptography people and cypherpunks for two reasons. First, the so-called "Pizza Connection" case is one of the very few times, if not the first, where actual wiretap data was good enough to convict someone. The other reason it is important is that it was the case in which Louis Freeh made his bones as a prosecutor. Combine the two, and you end up with an FBI director who was singularly ill-disposed to the idea of telephonic cryptography. In his advocacy of the NSA's then-failing "Clipper" chip project, he superheated what was already a firestorm of rage everywhere liberty is treasured. Fortunately, financial -- and not political -- cryptography is the only cryptography that matters. :-). For all the attacks on the chip by political advocates civil libertarian grounds, and, ultimately, its sheer technical incompetence by members of the cryptography community, it was, in fact, the absolute business *necessity* of SSL for credit card transactions and secure access to business information that settled the issue of ubiquitous strong cryptography once and for all. The camel's nose isn't sticking the tent. The camel's nose is stuck *out* of the tent, and the camel is inside, ready to spit in the eye of anyone who wants to take his stash. Physics causes finance. Finances causes politics. It was ever thus. It will ever be thus. Cheers, RAH ------- <http://www.reuters.com/newsArticle.jhtml?type=domesticNews&storyID=50 05854&section=news> Reuters Top Italian Mafia Boss Dies in U.S. Prison Fri Apr 30, 2004 06:29 PM ET By Ellen Wulfhorst NEW YORK (Reuters) - Top Mafia boss Gaetano Badalamenti has died in a U.S. federal prison where he was serving a sentence for international drug smuggling, authorities said on Friday. Badalamenti, 80, died of cardiac arrest at a federal medical center in Devens, Massachusetts., on Thursday evening, said a spokesman for the federal prison system. Badalamenti, born in the village of Cinisi in Palermo in 1923, was one of the key figures in the Sicilian Cosa Nostra in the 1970s. Known as Don Tano, he was a close friend of Charles "Lucky" Luciano, one of America's biggest mobsters in the 1970s, and part of the so-called 'triumvirate' that ran the Sicilian Mafia. Others in the triumvirate were Luciano Liggio and Stefano Bontade. But the 1970s saw the rise of another clan which included Salvatore 'Toto' Riina, who went on to become the Sicilian Mafia's boss of bosses, and Badalamenti was forced to flee to Brazil and then Spain. He later went into business with organized crime figures in New York who were using pizza parlors in a giant operation that smuggled more than $1 billion worth of heroin from Sicily. In 1987, Badalamenti was convicted and sentenced to 45 years in prison for his role in what was called the "Pizza Connection." In 2002 in Italy, he was convicted and sentenced to life in prison in absentia for the 1978 murder of a left-wing disc jockey who regularly insulted the Mafia boss. But last October in Italy, he and former prime minister Giulio Andreotti were acquitted of involvement in the murder of journalist Mino Pecorelli in 1979. Badalamenti had been housed until Feb. 27 at a federal prison in Fairton, New Jersey before he was moved to the medical facility in failing health, authorities said. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQJQZ38PxH8jf3ohaEQLgjwCgkS46hzVOH4U+UzZfHHcybowOdc8AoPBg HI6qtQ68QLvnYc0ROdmSyu/w =ntDC -----END PGP SIGNATURE----- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

no anon conversations?
by An Metet 01 May '04

01 May '04

What technologies currently exist for receiving a/psuedononymous message? With Mixmaster, sending mail, posting news, and even blog posting are possible, However, receiving replies securely or, better, holding a private conversation is difficult or impossible. Best bet seems is to encrypt and spam somewhere very public? Ugly, ugly. No technological method, just a few "trust me" remailers. Other options?

3 2

Google denies FBI interest in Gmail
by R. A. Hettinga 01 May '04

01 May '04

<http://www.zdnet.co.uk/print/?TYPE=story&AT=39153367-39020375t-10000025c> Google denies FBI interest in Gmail Staff CNET News.com April 30, 2004, 11:25 BST Google on Thursday denied that it has had any contact with the FBI regarding the design of its Gmail Web email service. The search firm's denial came after the Electronic Privacy Information Centre (EPIC) submitted a Freedom of Information Act request to the FBI seeking information about whether the bureau was considering the "possible use of Google's Gmail service for law enforcement and intelligence investigations." EPIC, which gave an award last week to a California state senator who is trying to ban Gmail, announced the request immediately after Google said it was filing for an initial public offering. Critics immediately criticised EPIC's request as a publicity stunt because the nonprofit likened Google's Web-based email service to the FBI's controversial Carnivore wiretapping utility and the Pentagon's discontinued "Orwellian Total Information Awareness program." EPIC's request also asked whether Google had discussed licensing its search technology, in use by customers in the private sector, to the FBI "to further law enforcement investigations or intelligence gathering activities." Google spokesman Nathan Tyler replied: "I cannot confirm whether they're using our technology." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

bubbling fondues (Re: NTK now, 2004-04-30)
by R. A. Hettinga 01 May '04

01 May '04

At 4:48 PM +0100 4/30/04, Dave Green wrote: > bubbling fondues > > Mr Blunkett's publicity campaign to gee Britons to get > inky-fingered, red-eyed and funky with their biometric > entitlement cards continued this week. "This is about true > identity," he said on Breakfast with Frost, in an apparent > attempt to win over the Vernor Vinge fans. "Being known, > being checkable, being used in order to ensure we know who's > in the country, what they're entitled to and whether they're > up to no good". And if that first mention of the cards' > unique "Santa Claus" capability to discern moral failings > in carriers isn't terrifying enough, you really should read > the government's new 160 page opus on how they'll be running > the show. It's not about the ID cards: it's about the huge > centralised biometric database the government is planning to > smuggle in on the back of it. Couldn't they just put the > biometrics on the card where we can see them, and then store > a comparison hash or some other translucent database > technique centrally? Of course not. Terrorists would win. > Feel free to add your own comments to the consultation, > which requires replies by July 20th. And we're *so* sure > they'll count all the responses correctly this time. > http://www.homeoffice.gov.uk/docs3/identitycardsconsult.pdf > - consultation. "Vindicated" by bomb plot, apparently: > http://news.bbc.co.uk/1/hi/uk_politics/3607141.stm > - vs http://www.spy.org.uk/spyblog/archives/000251.html >http://www.libdems.org.uk/index.cfm/page.homepage/section.home/article.6599 > - why not print them out + carry with you at all times? -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Fwd: [ISN] Mobile flaws expose executives to bugging
by R. A. Hettinga 30 Apr '04

30 Apr '04

*Took* 'em long enough... Cheers, RAH --- begin forwarded text

1 0

Re: no anon conversations?
by An Metet 30 Apr '04

30 Apr '04

On Fri, 2004-04-30 at 14:12, An Metet wrote: > What technologies currently exist for receiving a/psuedononymous message? > With Mixmaster, sending mail, posting news, and even blog posting are > possible, However, receiving replies securely or, better, holding a private > conversation is difficult or impossible. Best bet seems is to encrypt and > spam somewhere very public? Ugly, ugly. No technological method, just a few > "trust me" remailers. Other options? A simple option is to use a free webmail account and access it via an anonymizing proxy. You can send mail that way too. The great advantage of this is that it does not brand you as an "anonymous mail user" and thereby call attention to your activities. You look like just another of the millions of people who use such services. For anonymizing proxies, do a google search on anonymous web surfing. There are many more companies than anonymizer.com, although it is the oldest and probably the best. You can also begin experimenting with the onion routing network at http://www.freehaven.net/tor. This is like a free version of the old ZKS Freedom network where you construct a path through a number of forwarding nodes. You could also combine these and use TOR to access anonymizer.com and go from there to hotmail.com, etc. There's a new proposal out called the Pynchon Gate from Len Sassaman and Bram Cohen, http://www.freehaven.net/doc/pynchon-gate/. Sassaman is one of the main Mixmaster/Mixminion developers, and Cohen of course has revolutionized the P2P file sharing scene this past year with his BitTorrent. These guys have a pretty good pedigree for getting stuff done, and they claim to be in the process of implementing this new system. The Pynchon Gate will use a crypto protocol called Private Information Retrieval to let people receive messages anonymously. The way PIR works, all the incoming messages for all users are stored in a big database which is replicated at several servers. Recipients connect to each server and download a packet of data, which is combined at the local machine to reconstruct one incoming message. However the algorithm is such that each individual server learns nothing about which message is being fetched, protecting the receiver's anonymity. Here's a simple example of how it would work. The method relies on two properties of XOR: XORing a value with itself yields zero; and the result of XORing a random value with a predetermined pattern is still a random value. Suppose there are only two database servers, each holding 8 messages, where the messages are all split or padded to be a standard size: M1 M2 M3 M4 M5 M6 M7 M8 Suppose you want to fetch M4. Now you create a random 8-bit binary string: 1 0 1 0 0 0 0 1 Make a copy of that string and XOR in the bit position of the message we want, in this the 4th bit: 1 0 1 1 0 0 0 1 Note that because of the 2nd property of XOR listed above, both bit strings are individually indistinguishable from random and neither by itself gives any information about which bit was XOR'd. Send the first bit string to the first server and the 2nd bit string to the 2nd server. Each server XOR's the messages corresponding to the 1 bits and returns the results, which will be the size of single standard message: Server 1: M1 xor M3 xor M8 Server 2: M1 xor M3 xor M4 xor M8 The recipient xors these two messages together: (M1 xor M3 xor M8) xor (M1 xor M3 xor M4 xor M8) = (M1 xor M1) xor (M3 xor M3) xor (M8 xor M8) xor M4 = M4 The result is the required message. Individually, each server saw a random bit string and neither one by itself had any indication about which message was being fetched, hence the recipient's anonymity was protected. The same method can be generalized to larger numbers of servers, and that is the intention with the Pynchon Gate system. The privacy threat with this approach is that if the servers combine their information, they can deduce which message the recipient was fetching, by XORing all their bit strings together. However, as long as even one server is honest and refuses to go along with this, the other servers can learn nothing about which message was being fetched. This security guarantee is similar to that of a remailer chain, where if they all colluded they could track user messages, but if at least one is honest then privacy is protected. Hence it is a good match for users who rely on remailers. It's not yet clear that this method can be really practical, can scale to a reasonable number of users, resist flooding, and avoid leaking information in terms of how many requests a given user makes in a given period of time. These are serious practical issues that need to be solved. But they do have one really good idea, which is that the user-end software will be an agent that executes this protocol on a regular basis to fetch messages, then makes them available to the mail client by acting as a local POP server. All modern mail clients let you set multiple POP servers to be queried, so this should produce nearly transparent integration to existing mail clients. This concept might be copied for other mail receiving methods in the future.

1 0

Credentica (Re: Is there a Brands certificate reference implementation?)
by Christian Paquin 30 Apr '04

30 Apr '04

Hello Steve, > From: Steve Furlong <sfurlong(a)acmenet.net> > To: dgcchat(a)lists.goldmoney.com, cypherpunks(a)al-qaeda.net > Fwd: cryptography(a)metzdowd.com, e$(a)vmeng.com > Date: 25 Apr 2004 12:14:30 -0400 > > Does anyone know of a reference implementation for Stefan Brands's > digital certificate scheme? Alternatively, does anyone have an email > address for Brands so I can ask him myself? (I haven't gotten anything > back from ZKS's "contact us" address. But I don't know if Brands is > still at ZKS.) I am one of the lead developers of Credentica, which is Stefan Brands' latest venture after his amicable departure from ZKS quite some time ago. We are exclusively focused on the development of identity and access management technology based on Stefan's Digital Credential work. Following our closing of investment from Nokia earlier this year, we started with the design and implementation of a Software Development Toolkit for Digital Credentials. We are exploring the idea of releasing parts of it under an open-source license, and intend to post updates here from time to time on our progress. More information will be available on our upcoming Web site, which should be up soon. Meanwhile, if you are interested in getting a glimpse of what we are doing, check out Stefan's keynote materials at a recent NIST PKI workshop, which you can find here: http://middleware.internet2.edu/pki04/proceedings/ Kind regards, Christian Paquin Cryptographic Developer Credentica

1 0

Re: no anon conversations?
by joss 30 Apr '04

30 Apr '04

On Fri, 2004-04-30 at 14:12, An Metet wrote: > What technologies currently exist for receiving a/psuedononymous message? > With Mixmaster, sending mail, posting news, and even blog posting are > possible, However, receiving replies securely or, better, holding a private > conversation is difficult or impossible. Best bet seems is to encrypt and > spam somewhere very public? Ugly, ugly. No technological method, just a few > "trust me" remailers. Other options? Also, the mixminion Type-III anonymous remailer which is currently in development (www.mixminion.net) supports secure replies to anonymous messages. This technology is, however, still very much in alpha phases. Usable, but not secure. Worth looking at and following, but not useful for anonymity right now. Joss

1 0

[Politech] John Gilmore's horrific, dystopian view of an RFID world [priv]
by R. A. Hettinga 30 Apr '04

30 Apr '04

--- begin forwarded text

1 0

[ISN] Mobile flaws expose executives to bugging
by InfoSec News 30 Apr '04

30 Apr '04

http://business.timesonline.co.uk/article/0,,8209-1092789,00.html By Steve Boggan April 30, 2004 EXECUTIVES at some of Britain's biggest companies are using mobile phones that can be secretly tracked and bugged, despite a series of Times investigations demonstrating gaping holes in handset security. During tests at the offices of Shell, BP, HSBC and Goldman Sachs, The Times identified 95 phones potentially vulnerable to a new form of hacking known as "bluesnarfing". Under the process, which threatens mobile phones that use Bluetooth wireless technology, hackers can download text messages, phone lists and even remotely tamper with handsets to enable them to be used as listening devices. Last week The Times identified 46 phones that could have been vulnerable to attack during a 12-minute test in the central lobby of the Palace of Westminster. During our latest experiment, we had the ability to access the phone of a Shell employee supplying aviation fuel to aircraft companies and bug the handsets of chauffeurs driving executives. At the offices of Shell, a passive scan showed that 19 phones would have accepted an unauthorised Bluetooth connection. None was made, to avoid infringement of the Computer Misuse Act. Of these, 13 were Nokias and five were Ericssons. The Nokia 6310 and 6310i, the most popular business phones in the UK, and the Ericsson T610, one of the best-selling picture phones, have proved to be the most insecure. Outside, a group of chauffeurs were waiting in seven identical and consecutively-numbered Volvos. An attack on any of their phones would have allowed us to set up a divert to a handset of our choice. We could then have instructed their phones to call us secretly, leaving a channel open through which we could have heard executives conversations in the cars. At BPs office in St Jamess Square, Westminster, we identified 24 potentially vulnerable phones while at Goldman Sachs in Fleet Street, the figure was 35 phones. We scanned in a smoking area outside the offices of HSBC in Canary Wharf during a ten-minute period. Seventeen potentially vulnerable phones were identified. The latest cause for concern involving the Nokia 6310s and Sony Ericsson T610s involves secret tracking. Commercial companies offer phone tracking services to businesses and individuals who want to locate sales forces quickly. An SMS message is sent to the relevant mobile phone with an activation code. Once activated, the phones location is shown on an internet website map. Bluesnarfing allows the activation code to be diverted to an attacker, so that an account is set up without the handset owners knowledge. He or she could then be tracked, without their knowledge, 24 hours a day. Nokia admits there are problems with its 6310s and 8910s but says it is working on a solution that will be available to users from this summer. Sony Ericsson says it has cured the text message and divert problems in new phones but phone lists, calendars and pictures can still be accessed. It promises a cure for that problem in the second half of the year. Shell and BP said they never commented on security; Goldman Sachs was aware of the problem and had issued advice to staff; and HSBC said its technical staff were looking into the problem. _________________________________________ ISN mailing list Sponsored by: OSVDB.org --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0