- cypherpunks-legacy - lists.cpunks.org

Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: (eternity) Eternity as a secure filesystem/backup medium (fwd) > From: Ryan Lackey <rdl(a)mit.edu> > Date: 18 Jan 1998 12:45:02 -0500 > True. But in an Eternity model without copyright, someone could be one of > the first customers to download the data, then upload it again under a > different name. So in your model there isn't any form of check on the data for redundency? > The only thing the original uploader would have as > an advantage would be indexing information, potentially -- it's easier > for me to download ms word by going to the eternity equivalent of > http://www.microsoft.com/ than to go to > http://www3.pop3-167.adhoc.warez.location.ai/edf3/filez1.zip. Not if it's: http://ww.microsoft.com/software/commercial/wordprocessing/msword/x.y/ \ msword.zip This is a specious point. The fact is that from the users perspective the index would automagicaly provide the actual resting place for the server to find it, even if it were on a different server. The whole point is to make the software do the druggery. The length of the pathname or URL is irrelevant at that point. > There's no real way to put the genie back into the bottle unless you can > send people with guns to beat people up who store your data as a third party. The point being that if we take the average user of a data haven model they don't have the resources (money, technical skill, bandwidth, etc.) to set up a data haven of their own. Further, the storing of the data by other parties isn't the issue, it isn't the data havens data. This is one of the primary reasons that really important data should be expensive to get initialy. It goes back to what I was saying in a previous post about Grace Hoppers worth-v-time model. > Data disappears from Eternity once no one cares enough about it to pay to > have it stored. What this over-looks is the potential for that data to become relevant to some currently unknown situation in the future. While I agree that the data should not necessarily be in a fast medium storage after a certain time period it should not simply be thrown away. If nothing else at some point it will have historical (inexpensive, it's still money) relevance. > Providing eternity service costs money. Life costs money, that is one of the reasons that you don't want to throw stuff away that may bring in income down the road. > Anything which lets users circumvent > this opens up the potential for denial of service through consumption of > resources attacks. There simply isn't a way around that except to out bandwidth the attacker. > Even if billing is fundamental, you still have the > potential for the NSA to spend $100m to buy all the eternity space available > at any point. > This is why you also need market mechanisms > -- if the NSA > is willing to pay a premium for eternity service just to keep it out of > the hands of the populace, then running eternity servers is a great > investment, so capacity will increase until the NSA can no longer afford > to buy all of it. I like it when you write my own rebuttal for me...:) The bottem line is that the market mechanism *is* the willingness of some party to buy that space. Nothing more, nothing less. Further, Mallet ain't stupid or he'd have starved a long time ago. > A difficult part of designing a working Eternity service is to keep people > from "stealing service", in terms of consumption of resources, during > set up, indexing, etc. Basically, you need to make sure that to the > greatest extent possible, anything which is a potentially scarce resource > is sold, not given away. The point is that *nothing* is given away for free, though you might want to let people *give* you resources for free. Which is the point I was making. > You then are vulnerable to someone spamming the system, unless you give > the server operator some way of knowing if this encrypted data is likely > to be valuable. The point is that the system can *always* be spammed. You *don't* charge the source of data a million dollars to put it on your server. It's gotta be source cheap or else it isn't worth their time to bother with it. If you *really* want to promote such servers what you need is a model that allows submitters free access *and* a share in the subscribers fees. Then everyone wins. If the source has something they know is worth god awful sums of money they aren't going to submit it to the data haven anyway, they'll set their own haven up and reap the benefits directly. There is an economic issue here that is at parity with the technical issues. > You can have arbitrarily complex payment models, since the enforcement > agents can exist (must exist?) as eternity objects in their own right. Not really, at some point the complexity works against itself - you should study a little chaos theory. The final point is to make the system (ie the logical linking of black box operations that themselves may be quite technical or complex) dirt simple. > No, the most feasible attacks for a resourced attacker are custom ASICs > optimized for key testing, as were recently described. Distributed > workstation cracking is a parlor trick if you have a billion dollar budget > for key cracking. Tell that to the NSA and their Cray-acres. The point is that even if you have customer ASIC's or FPGA's or whatever these are still computers and you can't seriously be suggesting that the resources to create customer hardware for specific goals is any less complicated or more inexpensive than using general purpose hardware when looked at from a global scale. If that model were so generaly applicable then we should move all our processing jobs to ASIC's and reap the benefits. There is also the issue that even if you use customer chips to develop customer key cracking hardware (which I agree is being done as we speak) there is still the inescapable fact that you will need lots(!) of them. So the result is that whether they are custom or general purpose devices the sheer quantity becomes a hinderance. > The NSA has general purpose HPC resources for purposes like signal processing, > AI, etc., not for brute forcing people's keys routinely (although perhaps for > a weak and nonstandard cipher, it would make sense to use general purpose > machines). Even a corporation would be better off using FPGAs or ASICs for > key cracking once you get past 56 bits. That would depend on the economics of startup and what kind of footprint that would leave in the industry. This is one of the reasons that the NSA builds their own chips. > I assume the attacker is evil and rational. My, my. Moral stipulations are probably no more relevant than psychological classifications. The issue is one of emotion. Mallet wants it because it benefits Mallet and hinders Mallets enemies. This is an emotional reason and most definitely outside the bounds of simple rational/irrational action classification. When I was speaking of psychology earlier in my submissions I was not the least bit implying any comment on rationality, goodness, or other relative classifications. I was refering to greed, pride, honor, self-respect, etc. as motivations. The interactions of those in individuals and organizations doesn't depend on classifications. > I also assume that the > entire legal system has been subverted, and that extralegal operations of > any size too small to make the new york times front page are possible. And, > any entity which deals with the government (just about any) can be subverted. Any government can be subverted as well, happens on a regular basis. The legal system may not need to be subverted for the simple reason that more than one legal system may be involved. The front page example you are so fond of is a instance that would take, my guess, probably in the neighborhood of $10k to have a full page for a single day. To make the participants investment in that sum worth it, what is their pay off in your system? Just having their name in the paper probably isn't worth it. The wide public advertisment, and hence notoriety is probably not a big plus either. Especialy considering that it would guarantee the participant a nice bug-for-life experience. > Thinking that the major internet gateways between providers are bugged by > the NSA isn't really too unreasonable if you accept those assumptions. Whether the providers themselves are bugged are not is really irrelevant, its the backbone infrastructure providers who are providing the access points. You tap the satellite transfer point, for example, not the 300 organizations sending data down it. You tap the telephone switch in each neighborhood, not the individual lines on their subscriber end trunks. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

to Anonymous
by Young iVillian 17 Dec '03

17 Dec '03

Right on, man. E-Mail me... I'd like to have a conversation w/ you. Technological takeover... we bring it on ourselves. We have no one to blame.

1 0

Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 12:02:34 -0800 > From: Kent Crispin <kent(a)songbird.com> > Subject: Re: (eternity) Eternity as a secure filesystem/backup medium (fwd) > There are alternative ways of paying for the service that do not in > any way depend on ecash, and after thinking about it a bit, they seem > more robust, as well. > > The basic idea is as follows: The fundamental eternity service is > free to readers, and is financed entirely by writers. The writers > supply the disk space, the network bandwidth, and possibly pay for > the software to support all this. It is clear that there are two diametricaly opposed models of payment mechanisms and who those costs should fall on; producers or consumers. I personaly have no faith in systems where the producers bear the burden of the costs since they have no clear mechanism to obtain the funds to finance the enterprise in the first place. Imagine for a moment that a couple of persons come into possession of a set of documents which would cause considerable political embarassment and legal difficulties for a head of the local government. Why should these two individuals pay to have their data dissiminated to anyone who wants it? It certainly isn't going to improve their social, political, or professional standing since the server will anonymize the data. They then have two options, release it themselves and hope for the best (and hence reap the benefit of any economic benefits that might acrue) or do nothing with it. How about information to build man portable atomic bombs? It doesn't make sense to take all those chances and the data haven operators to take the chances when they will get at most the monetary input from a *single* party. It is clear that these resources are clearly inferior to many parties paying to get the data. I guess the question boils down to why the individual operator in running the server in the first place. I assume a priori that the goal of both the submitter and the operator is to make a reliable income from the users of the service since there are clearly many more consumers of information than producers of it. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 3

Other c'punk lists?
by Anonymous 17 Dec '03

17 Dec '03

Hi are there any other cypherpunk lists? With all due respect this list has a *lot* of noise <g> Perhaps something with- out the anarchy. I enjoy the wild side of this list but I would also like something more targeted. Thanks in advance

3 3

Eureka! Mon Jan 19 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Monday's issue of Eureka! HARD CITY Ouch - you bet it's hard. What is? Stupid question! One visit to this website and the search for porn becomes more of a daily jaunt. It's simply packed with stuff to do and see, and what's more, it's FREE for a limited trial period! Hard City ......................... http://www.hardcity.com/ PLEASE VISIT THIS FINE EUREKA! PARTNER SITE Free Memberships on the net http://www.sexscandal.com We rank the very best sex sites. Free memberships all the time as we search the net for the hottest values and the best looking gals. LOUISE ON HOLIDAY This is a simple website of a young Yorkshire girl sunbathing in someones backyard. She starts out rubbing baby oil all over her body, then removes her bathing suit. This is one hot little lady. You have to see this one. One hot honey! ...... http://www.netcomuk.co.uk/~adrian_w/hols1.html MEXICAN PUSSY FIESTA Hola amigo's! This is a paysite but they have 5 images or so to sample. Click on sample pics, this leads to some pretty large high quality images of group sex, lesbians and facials. Stop by to see the lovely latina ladies spicy tacos, olay! ............. http://aruba.janey.com/~slurping/ TEENS PLAYGROUND This website offers up some great free pictures! Asian teens, big boobs and more. One set of tits in there is the biggest fucking tits I have ever seen! You have to see these boobs! ........................... http://www.vip-master.no/ YOUNG EXPOSED WOMEN Check out Sarah, Cybil, Denise and Colleen, you will be glad you did. Each girl is easy to find, click the thumbnail pix then your sent to a layout of each one. Sponge baths in the haybarn, legs spread wide. Blondes, brunettes, well built! Young Exposed Women ................... http://www.ywex.com/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here ... http://www.netscape.com/download/ 20vids+Chat .. http://209.1.31.175/chat/videochat.cgi?eureka CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat .................. http://137.39.63.229/chat/ General/Fun Chat ........ http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!....1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline.........1-800-644-8779 FREE: Live 1-on-1 (international call only)....011-678-77416 AMATEUR SITE OF THE DAY KARIN: Visit Karin and her hubby Albert to be transferred to the sordid affairs of German swingers. They are kinky and know how to have a good time! Couples like this make surfing worthwhile. ............................ http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY Adult Story of the Day: Read something for a change! Every day the Adult Story of the Day offers you a free erotic sex story for your reading pleasure............................. ............................... http://www.adultstories.com/ DAILY CARTOON ........... http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! .... http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ........... http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ....... http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ....... http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ..... http://eureka.abc-web.com/eureka/francais.htm ITALIANO ..... http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE . http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 ........................... http://137.39.63.229/?190 Pic 2 ........................... http://137.39.63.229/?191 Pic 3 ........................... http://137.39.63.229/?192 Pic 4 ........................... http://137.39.63.229/?193 Pic 5 ........................... http://137.39.63.229/?194 Pic 6 ........................... http://137.39.63.229/?195 Pic 7 ........................... http://137.39.63.229/?196 Pic 8 ........................... http://137.39.63.229/?197 Pic 9 ........................... http://137.39.63.229/?198 Pic 10 ........................... http://137.39.63.229/?199 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Re: how to release code if the programmer is a target for (fwd)
by Uhh...this is Joe [Randall Farmer] 17 Dec '03

17 Dec '03

[Choate said he wouldn't "address" my message if I didn't post it to the list, so...] > > Eternity delivers data. It's up to the user to verify that the data is > > what they want > > > The original question was how to verify the eternity server source code. > > Assume for a moment that as a user of an eternity server the source is the > data I want. Ok... [...] > > * A random user who has the public keys of at least (thresh) number of the > > cypherpunks, optionally the key of the author of the document/product before > > the system becomes questionable, perhaps by looking in the NY Times > > for 1 Jan 1999 which has a full page ad taken out by Cypherpunks Anonymous > > with the PGP public keys for the 100 leading cypherpunks. > > Pretty expensive and rather unrealistic I suspect. The NYT ad? I think that was at least partly a joke (besides, if some cypherpunks did take out an ad, I'd predict propaganda in 2/3 of the page and fine-print PGP-key fingerprints in the rest :). > Where does this random user come from? Why does it matter? As long as she's competent enough to choose good verifiers and verify that those verifiers verified the code in question, it all works out in the end. > What is '(thresh)'? What good would an anonymous key signature provide? Thresh is the number of signatures from trusted people/keys required to trust a section of code, a value set by the user. An anonymous sig would be very little good but I think he was talking about including the author's sig if he's not anonymous. > [...] How do we know that some number of these cypherpunks aren't turned? We don't. There is no way to operate without *some* trust; this reduces it from the code being shown to be secure if the author is not spookized AND The author is capable to check his/her code AND the key he signed it with is good to the code being good if those conditions are true for one (or a few) of the many cypherpunks on the user's trusted list who signed the code. > Are you proposing that the user test all 100 of the signatures? Well, I think he's proposing to have a script check them and the user personally make sure the script is doing what it should. > Which realistica[l]ly is the only way to verify any given one of them. Not > very many people will go to that extreme simply for grins and giggles. > > > * The piece of code to be verified is bloody long, that is, longer than > > any one cypherpunk can afford to verify alone (shooting practice, > > installing the minefields and poison gas sprinkler system, etc. take > > lots of time) Not to mention churning out that propaganda for the NYT ad, becoming tolerant to pepper spray, preparing various fake identities for use, proving Blowfish secure and then breaking it, constructing a doomsday weapon using only a straightedge and compass, etc. > > The standard is programs over ~10k lines is not comprehensible by a single > individual on a line by line basis. Might be, but this code has to be more than just understood -- it must be painstakingly checked for subtle flaws and bugs. Welcome to the world of adversarial quality control. > > > * The user can tell by visual inspection that a small compilation > > system does what they want it to do, and can understand basic logic > > enough to tell what signatures imply. > > 'small compilation system' of what? What who wants it to do? The author? > Mallet? The end user? The C/Java/whatever compiler, I suppose, and also the signature checker, and she's checking that they carry out their stated purposes. ... > > 2) The user wants to run the code, because it's Just That Cool. > > We're talking here about users who want to get data that is illegal or > otherwise incriminating or dangerous to one group or another. In particular > let's consider the situation of a Lebanese freedom fighter in Isreal or > perhaps a 'Free Burma' revolutionary in China. I think the issue was one of users who want to get eternity server source they can trust -- not necessarily getting it *from* Eternity. > > > 3) No one can verify the entire code. So, Cypherpunks begin signing > > small sections of the code with their own previously-established key. > > Their keys are established as their reputation is established on > > the list, or perhaps by personally meeting these people, in the > > traditional PGP web of trust scheme. There is no central Cypherpunks > > Registry, just a decentralized mesh. > > Which doesn't effect the ability of Mallet to resign that code at the users > end in order to break the users local security. Unless you're exposing a new weakness in the trust model PGP uses, Mallet can't do that, providing the user has done good key authentication and hasn't listed one of Mallet's goons as a trusted code-verifier. > > > 4) The user executes the compilation script. > > [material describing script verification deleted] > > Mallet can re-write said script [...] Yup, that's why the user has to check it by hand. Lots easier to check a script and a compiler for doing their functions than to check an eternity server for subtle bugs. > > > I fail to see how the specifics of Eternity are relevant -- it's > > just basically a PGP web of trust issue. The transport is irrelevant -- > > it's untrusted code until it's been verified by people the user > > trusts. > > The end user may not have people available to trust is the point. Well, if you can't verify it yourself and you can't trust other people to verify it, my advice is to give up; you cannot be sure of *any* public keys in that case, so any message you encrypt might be encrypted to one of Mallet's keys; any sig you check might be signed by one of Mallet's keys. > The reason the transport mechanism is relevant is that it is much easier to > spoof a verification script if the user is not going to be surprised with 24 > hour turn around on requests, whereas a responce time measured in minutes > lessens the window of opportunity to Mallet significantly. If Mallet is a NSA spook who's half as good as my hacker buddy Phat Atta and knew about the script ahead of time, the user can't trust the script without verifying it herself, whether it takes milliseconds or millenia to get the response. > > It may come as a surprise to you and others but not everyone in the world > can pick up a phone and call a 100 people all over the world and not raise > some suspicion. Ah, but either I am more mistaken than usual or you only need a few of the signers to be trusted, not all of them. > > > Implementing a keyserver in Eternity has the same issues > > While it is perfectly permissible to design Eternity or any data haven with > inherent key servers, I believe it is a bad idea from a design perspective > because it makes the code even larger, decreases the potential for monetary > motives for indipendant key servers to appear, and if the server is > compromised then the key server is also. Not sure, but I think he's talking about putting up a key server in Eternity (i.e., the rolling hills where data can roam without fear, as opposed to putting it in the Eternity). > It is more expensive if Mallet can be forced to deal with two [independent] > operators then a single monolithic operator. > > [rest deleted] --------------------------------------------------------------------------- Randall Farmer rfarmer(a)hiwaay.net http://hiwaay.net/~rfarmer

2 1

Fwd: Internet security (VERY LONG)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Subject: Fwd: Internet security (VERY LONG) Date: Sun, 18 Jan 98 12:34:36 -0500 From: Somebody To: "Robert Hettinga" <rah(a)shipwright.com> Mime-Version: 1.0 ---------------- Begin Forwarded Message ---------------- Date: 01/17 3:25 PM Received: 01/17 5:24 PM From: Richard Fairfax, richard_fairfax(a)compuserve.com Reply-To: CSA Talk, csa(a)blueworld.com To: CSA Talk, csa(a)blueworld.com The following forwarded mail may have implications for clients with sensitive data. The field encription features in Troi FM Plug-in could prove to be a valuable asset. Richard Fairfax Oakwood Designs ---forwarded mail START--- From: gp-uk(a)mailbase.ac.uk,Net ----------------------------------------------------------------------- Aus: z-netz.datenschutz.spionage: A GLOBAL electronic spy network that can eavesdrop on every telephone, email and telex communication around the world will be officially acknowledged for the first time in a European Commission report to be delivered this week. The report - Assessing the Technologies of Political Control - was commissioned last year by the Civil Liberties Committee of the European Parliament. It contains details of a network of American-controlled intelligence stations on British soil and around the world, that "routinely and indiscriminately" monitor countless phone, fax and email messages. It states: "Within Europe all email telephone and fax communications are routinely intercepted by the United States National Security Agency transfering all target information from the European mainland via the strategic hub of London then by satellite to Fort Meade in Maryland via the crucial hub at Menwith Hill in the North York moors in the UK." The report confirms for the first time the existence of the secretive ECHELON system. Until now, evidence of such astounding technology has been patchy and anecdotal. But the report - to be discussed on Thursday by the commit- tee of the office of Science and Technology Assessment in Luxembourg - confirms that the citizens of Britain and other European states are subject to an intensity of surveillance far in excess of that imagined by most parliaments. Its findings are certain to excite the concern of MEPs. "The ECHELON system forms part of the UKUSA system (see 'Cooking up a charter for snooping') but unlike many of the electronic spy systems developed during the Cold War, ECHELON is designed primarily for non- military targets: governments, organizations and businesses in vir- tually every country. "The ECHELON system works by indiscriminately intercepting very large quantities of communications and then siphoning out what is valuable using artificial intelligence aids like MEMEX to find key words". According to the report, ECHELON uses a number of national dictionaries containing key words of interest to each country. For more than a decade, former agents of US, British, Canadian and New Zealand national security agencies have claimed that the monitoring of electronic communications has become endemic throughout the world. Rumours have circulated that new technologies have been developed which have the capability to search most of the world's telex, fax and email networks for "key words". Phone calls, they claim, can be automatically analysed for key words. Former signals intelligence operatives have claimed that spy bases controlled by America have the ability to search nearly all data communications for key words. They claim that ECHELON automatically analyses most email messaging for "precursor" data which assists in- telligence agencies to determine targets. According to former Canadian Security Establishment agent Mike Frost, a voice recognition system called Oratory has been used for some years to intercept diplomatic calls. The driving force behind the report is Glyn Ford, Labour MEP for Greater Manchester East. He believes that the report is crucial to the future of civil liberties in Europe. "In the civil liberties committee we spend a great deal of time debating issues such as free movement, immigration and drugs. Technology always sits at the centre of these discussions. There are times in history when technology helps democratise, and times when it helps centralise. This is a time of centralisation. The justice and home affairs pillar of Europe has become more powerful without a corresponding strengthening of civil liberties." The report recommends a variety of measures for dealing with the increasing power of the technologies of surveillance being used at Menwith Hill and other centres. It bluntly advises: "The European Parliament should reject proposals from the United States for making private messages via the global communications network (Internet) a ccessible to US intelligence agencies." The report also urges a fundamental review of the involvement of the American NSA (National Security Agency) in Europe, suggesting that their activities be either scaled down, or become more open and accountable. Such concerns have been privately expressed by governments and MEPs since the Cold War, but surveillance has continued to expand. US intel- ligence activity in Britain has enjoyed a steady growth throughout the past two decades. The principal motivation for this rush of development is the US interest in commercial espionage. In the Fifties, during the development of the "special relationship" between America and Britain, one US institution was singled out for special attention. The NSA, the world's biggest and most powerful signals intelligence organisation, received approval to set up a network of spy stations throughout Britain. Their role was to provide military, diplomatic and economic intelligence by intercepting communications from throughout the Northern Hemisphere. The NSA is one of the shadowiest of the US intelligence agencies. Until a few years ago, it existence was a secret and its charter and any mention of its duties are still classified. However, it does have a Web site (www.nsa.gov:8080) in which it describes itself as being respon- sible for the signals intelligence and communications security activ- ities of the US government. One of its bases, Menwith Hill, was to become the biggest spy station in the world. Its ears - known as radomes - are capable of listening in to vast chunks of the communications spectrum throughout Europe and the old Soviet Union. In its first decade the base sucked data from cables and microwave links running through a nearby Post Office tower, but the communi- cations revolutions of the Seventies and Eighties gave the base a capability that even its architects could scarcely have been able to imagine. With the creation of Intelsat and digital telecommunications, Menwith and other stations developed the capability to eavesdrop on an extensive scale on fax, telex and voice messages. Then, with the development of the Internet, electronic mail and electronic commerce, the listening posts were able to increase their monitoring capability to eavesdrop on an unprecedented spectrum of personal and business communications. This activity has been all but ignored by the UK Parliament. When Labour MPs raised questions about the activities of the NSA, the Government invoked secrecy rules. It has been the same for 40 years. Glyn Ford hopes that his report may be the first step in a long road to more openness. "Some democratically elected body should surely have a right to know at some level. At the moment that's nowhere". See also in this week's issue: Pretty good Phil bounces back (a report on the consolidation of the reputation of Phil Zimmermann, creator of PGP). 14 October 1997: Europe's private parts to expand * * * * * ------------------------------------------------------------------------- Hilfe zu den BvD Mailinglisten? An- oder Abmelden? Mail an bvd-majordomo(a)ibh.tfu.uni-ulm.de, Subject: egal, Text: help ODER: http://www.fh-ulm.de/bvd ---forwarded mail END--- ----------------- End Forwarded Message ----------------- <Somebody's .sig> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

CAD Stego (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 19:31:38 -0500 > From: John Young <jya(a)pipeline.com> > Subject: CAD Stego > This repeats a suggestion from 1994 about using computer > assisted design programs to conceal text or other data: > 3. The scale feature is useful to reduce, say, a text > of any length, or any digital object, to the size of a pixel. Assuming your color palate is deep enough to support the compression. > 4. Or, the text can be distorted by scale and dimension > to appear to be a line serving another function. Don't you think they are going to wonder why *that* line is so varied in color? Or assuming deep color pallettes, why so many colors are selected when only a few dozen are actualy used in the drawing? > Then the message could be distorted or hidden as > described above, for piggy-backing on an innocent- > looking document issued, I suspect they'll wonder why that particular file is so much larger than the other graphics files with the same number of layers. > 7. Big shortcoming: how to securely transmit the location > (virtual coordinates) of the hidden message and what Look for the pixel that has the unique color mapped onto it. > 8. Medium shortcoming: Full-featured CAD programs are > expensive, however, the popular lite versions are cheap > and can usually read the pricier output. And can't handle more than a few dozen colors and limited layering. This suggestion is unworkable in application. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Voice Coding Controls
by John Young 17 Dec '03

17 Dec '03

DM notes of the BXA Wassenaar rule for voice coding: After looking at some of the Wassenaar docs, I was surprised to see that the CCL wants to regulate speech encoders that operate at less than 2400 bps. Surprising because it was encoding, not encryption, that was being regulated. This is disturbing. This at first seemed to put some of the Nautilus development team's software in jeopardy, but I believe that by the letter of the law (or regulation) that all coders in Nautilus are not subject to the CCL, as they only go as low as 2400 bps and not less than. For citations of voice coding in Category 5 - Telecommunications: http://jya.com/bxa-wa-cat5.htm#5A001b10 http://jya.com/bxa-wa-cat5.htm#5A991b6a

1 0

Re: non-transferable signatures (Re: Crypto Kong penetration.)
by James A. Donald 17 Dec '03

17 Dec '03

-- At 10:48 PM 1/16/98 +0000, Steve Mynott wrote: > SMIME of course despite bad cypherpunk karma is easy and > maybe even works between mailers. Easy indeed, if all the keys from Verisign are correct and secured. It is indeed very easy to use SMIME. To use it so that it actually accomplishes the intended result is not so easy. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG Np4QfrajG+6u2ZHUc2AFBH0uTX9nCJxCUi7E2bpk 3CGDysj2FaqaZYBM4bRe6dvLCkbb0ltwLns5aFPQ9 --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the state. http://www.jim.com/jamesd/

1 0