- cypherpunks-legacy - lists.cpunks.org

Germany to regulate the Web.
by Peter Trei 17 Dec '03

17 Dec '03

Forwarded from the www-security list. Germany seems to want to: 1. Require blocking of German-verboten material. 2. Mandate content labling (PICS?) 3. Ban 'cookies'. 4. Require Digital Signatures on all net traffic. -pt ------- Forwarded Message Follows ------- Date: Sun, 15 Dec 1996 23:48:32 -0800 To: www-security(a)ns2.rutgers.edu Subject: Germany bans cookies! (and a whole lot more) From: nobody(a)cypherpunks.ca (John Anonymous MacDonald, a remailer node) web servers within Germany anyway... as of August 97... see below Germany Passes Sweeping Cyberspace Law The German government approved a bill Wednesday aimed at regulating the Internet and protecting user privacy while banning smut, pro-Nazi content and online fraud. The so-called "multimedia law" essentially extends current German laws to the dominion of cyberspace, placing responsibility for suspect content on suppliers, but without clearly defining whether a supplier could also be construed to make a carrier -- such as an online service like CompuServe or AOL Bertelsmann Online -- also liable. The law is scheduled to take effect in August 1997, prior to the 1998 deregulation of the European telecommunications market. Under the law, online services could be held responsible for illegal material if they have the technology to block transmission of such content, and after notification, still disseminate the objectionable content. The law also calls for content to be tagged electronically if unsuitable for minors to ensure it could be filtered out --similar to the V-chip television initiative in the U.S. The law would also prohibit "cookies" -- tiny programs that trace a user's path through the Net, recording what they visit, examine and purchase. Instead, the law would require that services give users the opportunity to use a site or service anonymously. The German law also puts into place the idea of so called "digital signatures" -- a string of coded information which would clearly identify the origin of messages, files and images shipped via the Net. Such signatures would use a central authority to prevent fraudulent commercial transactions on the computer network by matching a publicly accessible data string with a confidential string of numbers, also called a key. www.mediacentral.com/Magazines/MediaDaily/Archive/1996121207.html/634827

1 0

[QUERY]Point-n-Crypt URL (???)
by Mullen Patrick 17 Dec '03

17 Dec '03

To avoid flame wars, I know "...40-bit DES is not secure." I'm just interested in the interface, etc. Unfortunately, I lost the URL of where to DL a demo. Could someone please forward me this information? Thanks! PM

1 0

Re: Gov't Clarifes Position-Surprise!
by Harondel J. Sibble 17 Dec '03

17 Dec '03

On 16 Dec 96 at 0:26, pgp-fone(a)rivertown.net wrote: > Expect some form of cooperation with EC governments if this stuff goes > through. The recent posting to cypherpunks about the "radikal" raid in the > Netherlands is probably a good foreshadowing of this. If you have not seen the > article, and want to, I will be happy to remail it. > > > Tim Scanlon > Tim, please send me the article when you have a moment, thanks! > Cheers Harondel J. Sibble (aka The Juice-Meister) homepage >> http://ourworld.compuserve.com/homepages/Harondel_Sibble/ email >> sibble(a)infomatch.com or 75301.157(a)compuserve.com PGP public key >> finger sibble(a)infomatch.com

1 0

Van Eck articles, reply..
by AaronH4321＠aol.com 17 Dec '03

17 Dec '03

I went to the library and found an article on Van Eck. I posted it at my site. It was a little long to e-mail. Check it out at: http://members.aol.com/aaronh4321/vaneck.html If anyone has more current information please e-mail me. Aaron....

1 0

No Subject
by Casey Iverson 17 Dec '03

17 Dec '03

1 0

PUBLIC: Citibank Visa & the FBI
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

sometime ago, i saw a thread about citibank giving someone, i think it was the fbi, some visa account information to use in a sting opereation. will someone please give me a pointer to this thread? cheers, -paul

1 0

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

This thread branch seems to be based on bad assumption. Why would one want to run ActiveX controls in a sandbox? If you need a sandbox, use a Java applet, if you need native code level access to the system use ActiveX. Running code in a sandbox, a la Java applets, is one approach to allowing safe execution of downloaded code. If one has a perfect implementation of the sandbox, which doesn't appear to be the case for Java thus far, this can be a useful solution. There is however a severe limit to the types of applications you can run from inside a sandbox unless you subscribe completely to the 'Network Computer'-type model. Digitally signed code, a la ActiveX, is another approach to the same problem. If the digital signatures and infrastructure around them are sound, which they appear to be for ActiveX, this is also a useful solution. The built-in gotcha with this model is the all or nothing nature, either I trust the software publisher to run arbitrary native code on my machine or I don't run it at all. Specify technical issues follow: > It can be done under 95 but Microsoft will have to write a Sandbox > Virtual Machine (a Virtual x86 session whose API's are filtered to > prevent access to certain things like the file system, and disables > direct I/O.) Not that easy under '95, but it already exists for NT. But of course it's not enough to filter out filesystem calls. The entire windowing system would have to be separated as well. For example a rogue control might watching all edit controls for ones that have the ES_PASSWORD style and grabbing the contents. An equivalent Unix problem would be to allow an open-access guest account with the ability to transfer in and execute arbitrary binaries. While doing this securely may be possible in theory I don't think the state of the art is up to it today. (I sure wouldn't allow it on my system.) > The problem is how to deal with DLL's. You don't know all > features/functions of all DLL's. It may be possible to write a DLL that > runs outside the sandbox and can act as a proxy to the file system, so > it's iffy unless you limit the DLL's and services that ActiveX apps talk > to, and make them all live inside the sandbox. DLL's are by definition mapped into the processes address space, they would have to be inside the sandbox too. It's not a call gate type of thing. regards, -Blake

4 3

unsubscirbe
by Andrew Fairbanks 17 Dec '03

17 Dec '03

would someone please take me off the list apf(a)ma.ultranet.com Thankyou

2 1

Re: Van Eck articles, reply..
by John Young 17 Dec '03

17 Dec '03

Aaron wrote: >I went to the library and found an article on Van Eck. I posted it at my >site. It was a little long to e-mail. Check it out at: > > http://members.aol.com/aaronh4321/vaneck.html > >If anyone has more current information please e-mail me. Christopher Seline wrote a well-known critique in 1989 of TEMPEST: "Eavesdropping On the Electromagnetic Emanations of Digital Equipment: The Laws of Canada, England and the United States." It includes numerous citations, including those mentioned by Joel and the one you found. He claims that the Van Eck article was "purposely misleading." We've put his article at: http://jya.com/tempest.htm Seline promised a later version of what he called a rough draft. Does anyone know of a successor to the 1989 article?

1 0

Army Cryptanalysis manual online
by Joel McNamara 17 Dec '03

17 Dec '03

The US Army's Field Manual on Basic Cryptanalysis (FM 34-40-2), dated September 1990 is available for downloading as an Acrobat PDF file from: http://www.atsc-army.org/cgi-win/$atdl.exe/fm/34-40-2/default.htm Fairly classic in nature (substitution, transposition, and code systems). Huge files (so far, at 28.8, after about an hour and a half, I've only been able to grab the table of contents and a couple of appendices - some kind-hearted person with a T1 or greater may want to get everything, then zip and mirror to save us bandwidth challenged folks the pain). Also, for the complete listings of almost 300 downloadable FMs through the Army's Digital Training Library (ATDL), check out: http://www.atsc-army.org/cgi-win/$atdl.exe?type=fm&header=%2Fatdl%2Fbrowse%2 Ffm.htm Have fun! Joel Note: This site isn't wholly reliable. It seems to regularly go up and down, and sometimes the bandwidth is terrible. Probably worth your patience though.

3 3