- cypherpunks-legacy - lists.cpunks.org

[Politech] Reason magazine cover story has unusual privacy theme
by Major Variola (ret) 07 Apr '04

07 Apr '04

_Reason_ pulls a cryptomesque BigEye op on subscribers:

1 0

RE: Muslim Rivals Unite In Baghdad Uprising
by Tyler Durden 07 Apr '04

07 Apr '04

I swear you can see flopsweat on Rumsfeld as he's trying to explain troop buildup as being more or less a deployment accident (though soon to be followed by non-accidental buildups). Even this arrogant little fuck now realizes he's stepped in deep doo-doo. As for the laughter, I'll be laughing too until the next round of planes perform a little touchdown downtown here. Ah well. I suckle from the breast of US big-business...those are the risks I take. -TD >From: Harmon Seaver <hseaver(a)cybershamanix.com> >To: cypherpunks(a)minder.net >Subject: Muslim Rivals Unite In Baghdad Uprising >Date: Tue, 6 Apr 2004 22:15:51 -0500 > >Bwaaaahhhahahahhahah --ROFL This thing is getting funnier by the minute. > >" On Monday, residents of Adhamiya, a largely Sunni section of northern >Baghdad, >marched with followers of Moqtada Sadr, the militant Shiite cleric whose >call >for armed resistance was answered by local Sunnis the same afternoon, >residents >said." > >http://www.washingtonpost.com/wp-dyn/articles/A56091-2004Apr6.html > > >-- >Harmon Seaver >CyberShamanix >http://www.cybershamanix.com >Hokay hey! > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.com/go/onm00200415ave/direct/01/

1 0

RE: Firm invites experts to punch holes in ballot software
by Trei, Peter 07 Apr '04

07 Apr '04

>Firm invites experts to punch holes in ballot software > The company's software is designed to let voters verify that their ballots >were properly handled. It assigns random identification numbers to ballots >and candidates. After people vote, they get a receipt that shows which >candidates they chose--listed as numbers, not names. Voters can then use >the Internet and their ballot identification number to check that their >votes were correctly counted. This is kind of broken. Allowing the voter to get a receipt which they take away with them for verification may allow the voter to verify that their vote was recorded as cast, but also allows coercion and vote buying. To their credit, the creators thought of this, and suggest a partial procedural fix in the threat analysis document: P4. Let voters discard verification receipts in poll site trash can and let any voter take them Result: Buyer/coercer can't be sure voter generated verification receipt P5. Have stacks of random printed codebooks freely available in poll site Result: Vote buyer/coercer can't be sure captured codebook was used P6. Have photos of on-screen codebooks freely available on-line Result: Vote buyer/coercer can't be sure captured codebook was used The first problem, or course, is that a person under threat of coercion will need to present the coercer with a receipt showing exactly the mix of votes the coercer required. This is leads to a combinatorial explosion of fake receipts that need to be available. Having only one vote on each receipt might mitigate this, but it still gets really messy. Second, it's not clear how this protects against the coercer checking the ballot online - will every fake also be recorded in the system, so it passes the online check? Having both real and fake ballots in the verification server makes me very nervous. Its possible I've missed something - this is based on a quick glance through the online documents, but I don't see any advantage this system has over the much more discussed one where the reciept is printed in a human readable way, shown to the voter, but retained inside the machine as a backup for recounts. Just my private, personal opinion. Peter Trei

1 0

Muslim Rivals Unite In Baghdad Uprising
by Harmon Seaver 06 Apr '04

06 Apr '04

Bwaaaahhhahahahhahah --ROFL This thing is getting funnier by the minute. " On Monday, residents of Adhamiya, a largely Sunni section of northern Baghdad, marched with followers of Moqtada Sadr, the militant Shiite cleric whose call for armed resistance was answered by local Sunnis the same afternoon, residents said." http://www.washingtonpost.com/wp-dyn/articles/A56091-2004Apr6.html -- Harmon Seaver CyberShamanix http://www.cybershamanix.com Hokay hey!

1 0

Firm invites experts to punch holes in ballot software
by R. A. Hettinga 06 Apr '04

06 Apr '04

Ah, the old hack-me "contest" arrives in the electronic voting business. I love the smell of burning snake-oil in the morning... Cheers, RAH ------- <http://zdnet.com.com/2102-1105_2-5186016.html?tag=printthis> Firm invites experts to punch holes in ballot software By Robert Lemos CNET News.com April 6, 2004, 4:23 PM PT URL: http://zdnet.com.com/2100-1105-5186016.html VoteHere, a maker of security software for voting machines, published the source code for its product online in hopes of garnering additional analysis of its method for verifying the integrity of electronic votes. The company, which has patented its VHTi technology, wants comments, not competition, so it released the code and several documents to its Web site under a license that restricts use of the code to analysis for a period of 60 days. "We pride ourselves on being good students of cryptography," said Jim Adler, founder and CEO of the Bellevue, Wash., company. "We know there is no security through obscurity, so we want to be open." Revealing encryption algorithms for peer review is a standard practice in encryption circles and allows experts to poke holes in other people's technology. VoteHere hopes the additional scrutiny will prove that its technology is sound, Adler said. The company's software is designed to let voters verify that their ballots were properly handled. It assigns random identification numbers to ballots and candidates. After people vote, they get a receipt that shows which candidates they chose--listed as numbers, not names. Voters can then use the Internet and their ballot identification number to check that their votes were correctly counted. "It doesn't protect the system from compromise, but it detects when compromises happen," Adler said. "We are the barking dogs: If anything touches the ballots, it can be detected." The move comes as questions arise about the security of electronic and Internet voting. Though few problems with electronic voting machines arose on March 1, Super Tuesday, many problems have cropped up during other elections. Some states, Michigan among them, are going full bore to ballots cast on the Internet, despite some computer scientists' concerns that the Net is not secure enough to prevent election tampering. About 28 percent of Michigan voters cast their ballot online in February during that state's Democratic caucus. In the same month, the Department of Defense backed away from plans to conduct a trial that could have let the 6 million Americans abroad cast their vote online. VoteHere has had its own security issues to deal with as well. In December, the company called in the FBI to investigate a breach in the company's network. Adler said the investigation was ongoing and stressed that VoteHere's plans to release source code had been in the works since last summer. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Choicepoint - collecting the data of our lives
by Poindexter＠SAFe-mail.net 05 Apr '04

05 Apr '04

And you thought my Information Awareness program was a threat? "The Constitution guarantees some privacy, but not anonymity, Smith has said repeatedly. The courts concur. People have no right to lie about who they are, or to request credentials that convey rights and privileges - such as driver's licenses or permits - without proving their identities. The people who wish to remain anonymous trouble Smith the most. "It is the anonymous person," he writes, "or small group of people, who represent the greatest risks - economic, physical or emotional - facing us today." http://www.govexec.com/features/0304/0304s1.htm

1 0

Mixmaster RFC
by Len Sassaman 05 Apr '04

05 Apr '04

Hello, I'm preparing to submit draft -02 of the revised Mixmaster Protocol Specification. If you have any comments, or have previously contributed and have not been acknowledged, please let me know as soon as possible by sending mail to mixmaster-devel(a)lists.sourceforge.net. The last published version is here: http://www.ietf.org/internet-drafts/draft-sassaman-mixmaster-00.txt The current working version of the I-D is here: https://source.mixmaster.anonymizer.com/svn/mixmaster/trunk/Docs/draft- sassaman-mixmaster-XX.txt (Please comment on the latter). Thanks, Len --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: Private U.S. Guards Take Big Risks for Right Price
by Major Variola (ret) 05 Apr '04

05 Apr '04

At 09:03 AM 4/3/04 -0500, R. A. Hettinga wrote: >At 1:26 PM -0800 4/2/04, Major Variola (ret) wrote: >>Physics, because large entities have different properties (eg >>surface-to-mass ratio; inertia) than small entities. > >Well, certainly, that's the current wisdom about such things. > >However, I'm talking about markets, and firms, which are all >creatures of information flow. As William Gibson put it once, a >corporation is a being which eats information and shits money. We are talking about mercs, not selling bits on MercNet. Mercs are physical. Thus their resources (satellites, rockets, tanks, etc) are *controlled* by Men With Guns. Who don't like to share the shiniest toys. >In those terms, then, since, Coase's theorem again, reduced >transaction cost (lowered by lower information gathering, and most >important to cypherpunks, lower transaction *security* costs lowering >transaction execution/settlement/clearing) how do we get the large >behavior current in modern markets without large firms? Cheaper info cuts out middlemen, sure; but it does nothing to permit mercs access to physical-technology that they need in the physical world. >Lots of little devices acting in common, in their own self interest, >using markets to price their services. Devices are physical. MwG control the physical. >Somewhere, on the Shipwright site, is a John Young - discovered DOD >paper from the mid-90's about "The Mesh and The Net", which looks >like a toe-hold on the idea of geodesic warfare. I used to joke about >keeping the landmines in your front yard paid or they wouldn't let >you out the door. :-). Sure, meshes mean you may not need satellites or fixed base stations for your comms. Big deal. The mesh-radios may be controlled, and regardless, you need more than radios to be a merc. Get that through your head. >So, I would bet that lower costs of market entry means that smaller >firms could compete in large, temporary groups, in the same way that >market sell-off stampedes happen, only with guns. You're too stuck on bits and forgetting about atoms. >The net allows more collaboration between the troops without central >control, Yawn. Disintermediation will happen, its just not enough. Atoms matter.

2 1

Re: Shock waves from Fallujah
by Major Variola (ret) 05 Apr '04

05 Apr '04

At 12:35 PM 4/4/04 -0800, Bill Stewart wrote: >>At 1:31 PM -0800 4/2/04, Major Variola (ret) wrote: >> >A fence is being considered around the Capital in DC also. >> > >Correct me if I'm wrong, but I assume the purpose of a fence around the Capitol >would be to keep those pesky Congresscritters _in_, >not to keep other people out? No, it would be to protect the congressvermin from attacks. Just like the anti-aircraft batteries and snipers on the white house. The SS is also closing all but 1 tourist entrance to the Capitol. ... In other news today, the US is going to snatch a major Iraqi cleric. Flash to W. sticking his dick into a hornet's nest. Dancing in the streets indeed.

1 0

how much anonymity an internet cafe provides
by Eugen Leitl 05 Apr '04

05 Apr '04

http://www.linux.ie/pipermail/ilug/2004-April/013049.html [ILUG] [Fwd: I fought the scammer... and I won.] John Allman allmanj at houseofireland.com Mon Apr 5 09:33:39 IST 2004 * Previous message: [ILUG] bringing users to Linux (RFC) * Next message: [ILUG] [Fwd: I fought the scammer... and I won.] * Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Some of you who were on #linux on friday will know part or most of this story already as i witnessed some of it (while drinking a truly delicious hot chocolate). For those of you who don't, the following is a report written up by a friend of mine on his succussful (or at least, it's looking good) attempt to stop and catch a 419 scammer. I feel it's worth the read John -------- Original Message -------- Subject: I fought the scammer... and I won. Date: Fri, 02 Apr 2004 21:54:30 +0100 From: Steffen Higel <Steffen.Higel at cs.tcd.ie> To: John Allman <allmanj at houseofireland.com>, paulinemccaffrey at eircom.net, stevecash at ireland.com, tony.odonnel at cs.tcd.ie, declan.dagger at cs.tcd.ie, edwin.higel at brookside.ie, marynstanley at eircom.net, richard.bannister at cs.tcd.ie, oconnoat at tcd.ie, jean.higgins3 at mail.dcu.ie [This is long, and is quite heavy on the technical discussion. Skip the bits you don't understand. It gets interesting.] I work for a busy Dublin Internet cafe, doing some sysadmining and general computer maintenance. On Sunday the 28th of March, I got a rather distressing email from a sysadmin in a large U.S. University. Spamcop had blacklisted our server's external IP address. Abuse mail for the server in question gets sent to my college account (bad practice, I know, but it's a part time job). My college uses Spamcop as a blacklist source. You can probably tell what happened... Anyway, said email included the full headers of an email which was natted by our server pretending to be from the widow of Mr. Jonas Savimbi, offering the recipient a share of an unspecified large sum of money. The usual panicked thoughts kick in... "Have I fiddled with something which has left us as an open relay?", "Has our server been cracked?", "Have I been sleep-spamming again?". A more reasoned examination of the headers showed that the mail had originated from one of the IP addresses that we assign dynamically to people who bring laptops into the cafe. This is something of a nightmare for cafe operators, we can hardly block outbound smtp but then again it isn't possible for us to manually check every single mail either. Maybe rate limiting is a valid technical solution. Or a contraption which hits the user on the head for every mail they send. So if they send 1 an hour, it's a mild nuisance. But if they send 100 a minute, it'll probably kill them. A peek through the logs revealed: Mar 26 15:04:16 server dhcpd-2.2.x: DHCPDISCOVER from 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:17 server dhcpd-2.2.x: DHCPOFFER on 192.168.1.70 to 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:17 server dhcpd-2.2.x: DHCPREQUEST for 192.168.1.70 from 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:17 server dhcpd-2.2.x: DHCPACK on 192.168.1.70 to 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:20 server dhcpd-2.2.x: DHCPREQUEST for 192.168.1.70 from 00:40:f4:5d:aa:f7 via eth1 Mar 26 15:04:20 server dhcpd-2.2.x: DHCPACK on 192.168.1.70 to 00:40:f4:5d:aa:f7 via eth1 Bingo. I had something to work with. The network card is one based on a Cameo 32bit chipset. Matches up quite nicely with these:

1 0