- cypherpunks-legacy - lists.cpunks.org

Re: Cypherpunks response to viral stimuli
by Tyler Durden 03 Feb '04

03 Feb '04

"Or would you instead, simply just stick a Carnivore machine at one hop above each CDR node that you're interested in, and gather the information you wanted with nearly zero risk of tipping your hand? Or even simpler than that, get a hotmail or yahoomail account and just subscribe. Which of the above scenarios makes the most sense in terms of Occam's?" While you make some good points, you've way overstated both sides of your argument. But this statement..."simply stick a Carnivore machine at one hop above each CDR node"... Isn't that almost like saying "simply splice into the undersea cable"? Of course, if we're talking about hunting down Osama bin Laden a TLA (or whoever) would probably do that. But in terms of merely rounding up the names of potential trouble makers (particularly when they don't want anyone to know that they're doing this) it seems to be an awfully easy thing to do. As for the fake virus part, all they need to do is go to some year-old virus list, select a virus, and send one directly through a non-de-mimed list server, and then watch what comes out. Seems a lot cheaper and easier. But this misses the point: Even IF this would be "stupid", it would be stupider still to be aware that this is possible, and then not implement a fix (if a cheap fix is available). De-miming is now obvious. In other words, the idea is not to compare dick sizes but to actually force them to spend huge amounts of money on trivial tasks, by raising aware of and plugging any holes that become evident. That assymetry is exactly what crypto is, in a nutshell. -TD >From: sunder <sunder(a)sunder.net> >To: Tyler Durden <camera_lumina(a)hotmail.com> >CC: petard(a)freeshell.org, cypherpunks(a)minder.net >Subject: Re: Cypherpunks response to viral stimuli >Date: Tue, 03 Feb 2004 13:28:47 -0500 > >Tyler Durden wrote: > >>And in case it's not clear, I'm suggesting that it may be useful for them >>to deliberately create a "fake" virus that is easily detectable, and so >>cull the bounce messages. > >Right, why should they do something passive that doesn't tip their hand and >allows them to collect the information they need, when instead they can do >something active and stupid that could possibly give away their position. > >Think about it. In fact, apply Occam's Razor to this, in fine, thin >slices: > >If you were a TLA and you'd want to send a "fake" virus, it would need to >be something that would trip every anti-virus software that anyone could >possibly run, but yet, not be a virus, and you'd need to do so without >giving away your IP address - while making it look like it came from lots >of sources. If you'd only use a single IP address, the guy that runs the >node would likely block you as a virus source. > >Then, on top of it, you'd have to *HOPE* that none of your targets saw the >real version of the virus, and then bothered to compare the two, or worse >yet, dissect the decoy you've sent, and figure out that it isn't real. > > >How's would you do this and have it be successful? Unless, of course, you >wish to claim that the TLA's wrote the anti-SCO viruses? In which case, >there's a lovely bridge between Brooklyn and Manhattan that I would gladly >sell you... Real cheap... it's a bit old, but it's in decent shape... No? > How about some nice foil hats? Real cheap... For you, only $100 each >(plus tax of course)... guaranteed to be made of 100% aluminum foil. > > >Or would you instead, simply just stick a Carnivore machine at one hop >above each CDR node that you're interested in, and gather the information >you wanted with nearly zero risk of tipping your hand? Or even simpler >than that, get a hotmail or yahoomail account and just subscribe. Which of >the above scenarios makes the most sense in terms of Occam's? > > >P.S.: I stand by my original statement: the collective IQ of the posters on >list is dropping. _________________________________________________________________ Check out the new MSN 9 Dial-up fast & reliable Internet access with prime features! http://join.msn.com/?pgmarket=en-us&page=dialup/home&ST=1

2 1

[IP] Bruce Schneier on ID cards and the "illusion of security" (fwd from dave@farber.net)
by Eugen Leitl 03 Feb '04

03 Feb '04

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Re: Cypherpunks response to viral stimuli
by Tyler Durden 03 Feb '04

03 Feb '04

Sunder wrote... "That's got to be the dumbest thing I've ever heard of. No TLA would do that. They'd simply watch upstream of each node. They can wait for outgoing messages and collect email addresses to their heart's content...." I'm not sure I understand this. On Cypherpunks we always seem to assume that the TLAs have infinite amounts of cash, and that's just not the case. If they can spend a couple of bucks to flush out a list rather than mount some major operation that's what they'll do, if for no other reason than to keep their exposure down. And if they're going to Gitmo me one day, I sure as hell want them to spend a few hundred thou rather than a few hundred, and hopefully leave a paper trail so I can sue the crap out of 'em if somehow I survive. And in case it's not clear, I'm suggesting that it may be useful for them to deliberately create a "fake" virus that is easily detectable, and so cull the bounce messages. -TD >From: sunder <sunder(a)sunder.net> >To: petard <petard(a)freeshell.org> >CC: Tyler Durden <camera_lumina(a)hotmail.com>, cypherpunks(a)minder.net >Subject: Re: Cypherpunks response to viral stimuli >Date: Mon, 02 Feb 2004 18:22:01 -0500 > >petard wrote: > > >>Along these same lines, mightn't a TLA or similar induce someone >>downstream of them to spam the cypherpunks remailers and collect the >>identities of those who complain? > >That's got to be the dumbest thing I've ever heard of. No TLA would do >that. They'd simply watch upstream of each node. They can wait for >outgoing messages and collect email addresses to their heart's content.... > >By definition, if you've subscribed to cypherpunks, you can expect all of >the TLA's to at least know your email address. > >If anything, you can blame the slew of anti-SCO and non-SCO related virii >for the lack of messages... If you were going to pull some half assed >conspiracy theory, you might have come up with something more original - >like "Maybe the TLA's are sending the virii so as to choke off the >lists..." But that's dumb as well for far more obvious reasons: > >See, the cypherpunks is a gold mine for the TLA's. All they have to do is >subscribe, listen, and wait. At some point, some poor dumb nutcase like >Jim Bell will do something silly. The polyester suited knights will hit >the champale and have a nice party on his ass... > >Man, the collective IQ's of the posters on this list has certainly been >dropping lower and lower... sheesh! _________________________________________________________________ High-speed usersbe more efficient online with the new MSN Premium Internet Software. http://join.msn.com/?pgmarket=en-us&page=byoa/prem&ST=1

3 2

The Farewell Dossier
by R. A. Hettinga 03 Feb '04

03 Feb '04

<http://www.nytimes.com/2004/02/02/opinion/02SAFI.html?pagewanted=print&posi…> The New York Times February 2, 2004 OP-ED COLUMNIST The Farewell Dossier By WILLIAM SAFIRE ASHINGTON Intelligence shortcomings, as we see, have a thousand fathers; secret intelligence triumphs are orphans. Here is the unremarked story of "the Farewell dossier": how a C.I.A. campaign of computer sabotage resulting in a huge explosion in Siberia - all engineered by a mild-mannered economist named Gus Weiss - helped us win the cold war. Weiss worked down the hall from me in the Nixon administration. In early 1974, he wrote a report on Soviet advances in technology through purchasing and copying that led the beleaguered president - ditente notwithstanding - to place restrictions on the export of computers and software to the U.S.S.R. Seven years later, we learned how the K.G.B. responded. I was writing a series of hard-line columns denouncing the financial backing being given Moscow by Germany and Britain for a major natural gas pipeline from Siberia to Europe. That project would give control of European energy supplies to the Communists, as well as generate $8 billion a year to support Soviet computer and satellite research. President Frangois Mitterrand of France also opposed the gas pipeline. He took President Reagan aside at a conference in Ottawa on July 19, 1981, to reveal that France had recruited a key K.G.B. officer in Moscow Center. Col. Vladimir Vetrov provided what French intelligence called the Farewell dossier. It contained documents from the K.G.B. Technology Directorate showing how the Soviets were systematically stealing - or secretly buying through third parties - the radar, machine tools and semiconductors to keep the Russians nearly competitive with U.S. military-industrial strength through the 70's. In effect, the U.S. was in an arms race with itself. Reagan passed this on to William J. Casey, his director of central intelligence, now remembered only for the Iran-contra fiasco. Casey called in Weiss, then working with Thomas C. Reed on the staff of the National Security Council. After studying the list of hundreds of Soviet agents and purchasers (including one cosmonaut) assigned to this penetration in the U.S. and Japan, Weiss counseled against deportation. Instead, according to Reed - a former Air Force secretary whose fascinating cold war book, "At the Abyss," will be published by Random House next month - Weiss said: "Why not help the Soviets with their shopping? Now that we know what they want, we can help them get it." The catch: computer chips would be designed to pass Soviet quality tests and then to fail in operation. In our complex disinformation scheme, deliberately flawed designs for stealth technology and space defense sent Russian scientists down paths that wasted time and money. The technology topping the Soviets' wish list was for computer control systems to automate the operation of the new trans-Siberian gas pipeline. When we turned down their overt purchase order, the K.G.B. sent a covert agent into a Canadian company to steal the software; tipped off by Farewell, we added what geeks call a "Trojan Horse" to the pirated product. "The pipeline software that was to run the pumps, turbines and valves was programmed to go haywire," writes Reed, "to reset pump speeds and valve settings to produce pressures far beyond those acceptable to the pipeline joints and welds. The result was the most monumental non-nuclear explosion and fire ever seen from space." Our Norad monitors feared a nuclear detonation, but satellites that would have picked up its electromagnetic pulse were silent. That mystified many in the White House, but "Gus Weiss came down the hall to tell his fellow NSC staffers not to worry. It took him another twenty years to tell me why." Farewell stayed secret because the blast in June 1982, estimated at three kilotons, took place in the Siberian wilderness, with no casualties known. Nor was the red-faced K.G.B. about to complain publicly about being tricked by bogus technology. But all the software it had stolen for years was suddenly suspect, which stopped or delayed the work of thousands of worried Russian technicians and scientists. Vetrov was caught and executed in 1983. A year later, Bill Casey ordered the K.G.B. collection network rolled up, closing the Farewell dossier. Gus Weiss died from a fall a few months ago. Now is a time to remember that sometimes our spooks get it right in a big way. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: Cypherpunks response to viral stimuli
by sunder 03 Feb '04

03 Feb '04

petard wrote: > Along these same lines, mightn't a TLA or similar induce someone > downstream of them to spam the cypherpunks remailers and collect the > identities of those who complain? That's got to be the dumbest thing I've ever heard of. No TLA would do that. They'd simply watch upstream of each node. They can wait for outgoing messages and collect email addresses to their heart's content.... By definition, if you've subscribed to cypherpunks, you can expect all of the TLA's to at least know your email address. If anything, you can blame the slew of anti-SCO and non-SCO related virii for the lack of messages... If you were going to pull some half assed conspiracy theory, you might have come up with something more original - like "Maybe the TLA's are sending the virii so as to choke off the lists..." But that's dumb as well for far more obvious reasons: See, the cypherpunks is a gold mine for the TLA's. All they have to do is subscribe, listen, and wait. At some point, some poor dumb nutcase like Jim Bell will do something silly. The polyester suited knights will hit the champale and have a nice party on his ass... Man, the collective IQ's of the posters on this list has certainly been dropping lower and lower... sheesh!

3 2

[IP] Charging For E-Mail (fwd from dave@farber.net)
by Eugen Leitl 03 Feb '04

03 Feb '04

----- Forwarded message from Dave Farber ----- From: Dave Farber Date: Mon, 02 Feb 2004 17:34:41 -0500 To: ip(a)v2.listbox.com Subject: [IP] Charging For E-Mail X-Mailer: munch X-Mailer: QUALCOMM Windows Eudora Version 6.0.2.0 Reply-To: dave(a)farber.net And there are several more good arguments against it as proposed. Dave Delivered-To: dfarber+(a)ux13.sp.cs.cmu.edu Date: Mon, 02 Feb 2004 12:52:49 -0800 (PST) From: Lauren Weinstein Subject: Charging For E-Mail To: dave(a)farber.net Dave, Just a few notes on the issues of "charging" for e-mail... - As you point out, any fee structure is likely to start off low and rise as attempts are made to maximize the profit center on the part of ISPs. - Once ISP e-mail charging schemes are in place, governments will likely express interest in potential revenue to be derived from such sources. The long-debunked rumor of the "e-mail tax" might well become a reality. It has already been suggested in some quarters that the U.S. Postal Service's new "Electronic Postmark" EPM/Authentidate system could ultimately be a model in this regard. - It appears likely that a primary initial use for e-mail charging schemes would be to allow certain classes of bulk mailers to bypass ISP anti-spam filters to directly reach the captive audience of those ISPs. If you've got the bucks, you're classified as a "good" spammer and your wonderful offers will reach all those "grateful" e-mail recipients without interference from those pesky filter rules. - E-mail charging schemes can be used as an excuse to further bind customers tightly to their current ISPs. The "SPF" e-mail domain control system already has this effect by discouraging the legitimate use of alternate domains by users in many cases. - Widely-deployed e-mail charging would likely require ISPs to attempt extremely tight, centralized control over e-mail routing to try prevent "unauthorized" (and uncharged) e-mail flows by users operating their own MTAs (Mail Transfer Agents), non-escrowed e-mail encryption systems, and/or other "unapproved" technologies. Such centralized and enforced ISP control over e-mail would obviously have drastic potential negative privacy and security impacts. - The concept of widespread, enforced e-mail charging neglects to acknowledge the reality that e-mail is fundamentally an end-to-end Internet application that can be indistinguishable at the data level from most other applications. The backlash to e-mail charging schemes would likely give rise to vast distributed "underground" e-mail transport systems, encrypted and even designed to masquerade as other types of data. Even draconian attempts by ISPs to limit their subscribers' access to alternate TCP/IP ports would be unlikely to stem the flood of such alternate e-mail transport environments, that could even emulate standard Web (HTTP) traffic. Illicit music file trading would likely look like a drop in the bucket by comparison. Bottom line: Trying to charge broadly for e-mail could well provide a textbook definition of "Pandora's Box" brought to life. --Lauren-- Lauren Weinstein lauren(a)pfir.org or lauren(a)vortex.com or lauren(a)privacyforum.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, Fact Squad - http://www.factsquad.org Co-Founder, URIICA - Union for Representative International Internet Cooperation and Analysis - http://www.uriica.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Anti-Porn Zealot Bruce Taylor Lands Bush Appointment At DOJ
by Freematt357＠aol.com 03 Feb '04

03 Feb '04

Anti-Porn Zealot Bruce Taylor Lands Bush Appointment At DOJ Bruce Taylor, has accepted an appointment to the DOJ. His official title is Senior Counsel to the Assistant Attorney General, Criminal Division, U.S. Department of Justice. This position, which is a presidential appointment took place on January 26, 2004. As Senior Counsel to the Assistant Attorney General for the Criminal Division. He will work primarily on federal obscenity prosecution issues. >From 1989-1994, Bruce was at the Department of Justice as a Special Attorney in the Criminal Divisionbs National Obscenity Enforcement Unit and then a Senior Trial Attorney in the Child Exploitation and Obscenity Section. He has served as an Assistant Attorney General of Arizona in 1989 and was an Assistant Prosecutor and Assistant Director of Law for the City of Cleveland, where he handled 600 obscenity cases and 100 appeals from 1973-78. Since 1973, he has prosecuted nearly 100 state and federal obscenity jury cases, as well as trials on prostitution, RICO, child pornography, and child sexual abuse, has written over 200 appeal and amicus curiae briefs, presented over 50 appellate arguments, and has represented public officials, law enforcement personnel, and citizens in civil lawsuits on civil rights, zoning, Internet pornography, nuisance abatement, injunctions, forfeiture actions, criminal procedure, defamation, and First Amendment challenges to federal, state, and municipal laws. Since 1995, he was President and Chief Counsel of the National Law Center for Children and Families in Fairfax, Virginia, where he assisted prosecutors, police, legislators, and public officials with laws and cases involving obscenity, child pornography, commercial sexual exploitation, protecting minors from Internet pornography, and trafficking in persons.

1 0

The SWIPE Toolkit
by R. A. Hettinga 02 Feb '04

02 Feb '04

<http://turbulence.org/Works/swipe/main.html> THE SWIPE TOOLKIT: INTRO The SWIPE Toolkit is a collection of web-based tools that sheds light on personal data collection and usage practices in the United States. The tools demonstrate the value of personal information on the open market and enable people to access information encoded on a driver's license or stored in some of the many commercial data warehouses. Decode Your Barcode This application unveils the mystery of the 2D barcode. Currently 39 states use 2D barcodes to digitally store personal information on the backside of drivers' licenses. What information is encoded on your license that machines can read and you cannot? Request Your Data Send away for your information that commercial data warehouses collect about you and sell to third party clients. What does this information look like, how accurate is it, and who is buying it? Take a look at your data files and find out for yourself. Currently we can help you send away for information from ChoicePoint,Acxiom, LocatePlus and Experian. Report back here when you receive your data and help us keep track of the companies' response times and accuracy. Data Calculator How much is your personal information worth on the open market? Why are you just giving it away whenever it is requested? Use this handy calculator to determine the approximate value of your data bits so you can demand proper monetary compensation. Now when you release information that will later be sold for a profit, at least you'll be getting a cut. Use this calculator here online or download it to your PDA and make calculations "on the go." The SWIPE Toolkit is part of a larger project titled SWIPE that includes a performance, installation, and workshop. For more information about SWIPE, visit www.we-swipe.us or contact info(a)we-swipe.us. SWIPE is produced by Beatriz da Costa, Jamie Schulte, and Brooke Singer. The SWIPE Toolkit is a 2003 commission of New Radio and Performing Arts, Inc. (aka Ether-Ore) for its Turbulence web site. It was made possible with funding from the Jerome Foundation. And special thanks to Chris Hoofnagle for his advice and support. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cypherpunks response to viral stimuli
by Tyler Durden 02 Feb '04

02 Feb '04

Well, I'm still wondering... Could a TLA or other group, wanting to know who was lurking or otherwise subscribed to a list (such as cypherpunks) deliberately craft a virus that was easy to detect, for the purposes of having the automated email reply systems "out" that subscriber? And then, is it possible to create some kind of filter that stops these replies? Of course, it could be very difficult to determine the difference between an automated reply and a real posting. ANyone have any thoughts? -TD _________________________________________________________________ Scope out the new MSN Plus Internet Software optimizes dial-up to the max! http://join.msn.com/?pgmarket=en-us&page=byoa/plus&ST=1

2 1

Are Terrorists Using Crypto?
by Matthew S. Hamrick 02 Feb '04

02 Feb '04

Once again I've had to defend the domestic use of encryption technology. My latest "opinion" is at http://www.cryptonomicon.net/modules.php?name=News&file=article&sid=645 . I don't know if it's of any value to either of you guys, but I thought I would pass it along anyway. -Matt H. -- One Ringtone to rule them all, one Carrier to find them, One Phone to bring them all and to the Service Contract bind them. __ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net

1 0