- cypherpunks-legacy - lists.cpunks.org

Re: Borders *are* transparent
by Peter Trei 17 Dec '03

17 Dec '03

Jeff wrote: > The retail version of Netscape Navigator sold in US stores > has been the US version for almost a year now. The first run > were the export version, because the marketing people thought > it would be easier. When I explained the issue, they made the > change to the stronger US version immediately. > --Jeff This, I think, is one place where the activities of members of this list have had a real effect. Last September, three or four semi-overlapping efforts succeeded in brute-forcing 40 bit RC4 (used in export-quality SSL). This had three main effects: 1. Raising the issue in the media, and thus in the public consciousness. 2. Within a month, the government was starting to talk about permitting the export of stronger (but GAK'd) encryption products. 3. It enabled people like Jeff to argue successfully that releasing only an export-strength product was no longer a viable option.In practical terms is probably the most important effect of the crack: I know of at least one other company where it led directly to the release of both domestic and export versions. Any one up for a distributed brute force attack on single DES? My back-of-the-envelope calculations and guesstimates put this on the hairy edge of doability (the critical factor is how many machines can be recruited - a non-trivial cash prize would help). Peter Trei trei(a)process.com "Exportable strong encryption" is an oxymoron.

12 18

Cookie Monster on a Diet
by Duncan Frissell 17 Dec '03

17 Dec '03

I love telling Netscape to inform me before it accepts cookies. It's fun seeing who asks and whether they'll let you in The WSJ site won't let you in if you don't accept 2 cookies from it. It looks like they are an encrypted version of your username and password. Maybe Netscape could add a protocol which would let your instance of Netscape tell the server that you are on a diet and the Doctor told you not to accept any cookies. DCF

1 0

Re: Symantec's Your Eyes Only
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:17 AM 7/18/96 -0400, Clay Olbon II wrote: >My point was not that govts want to escrow communication keys, it was that >this is appearing more and more in commercial products marketed to >businesses. I run the computer system for a small office and I would >rather not see employee email - maybe I am just naive. However, there >obviously is a demand for this type of product. It must come from either a >lack of understanding of crypto, or a freeh-style authoritarianism on the >part of corporate executives. I wouldn't rule either one out. If it is >the latter, I'm not sure there is anything we can do. A larger organization feels that it has to maintain control over its systems by bureaucratic methods. Smaller organizations can figure out by direct experience whether someone is trustworthy or not. This is not restricted to encryption software, however. Large organizations attempt to determine what their employees should be doing with their time as well. This method of social organization works fine when mass producing large quantities of identical physical products. It is, however, incompatible with small-run, custom production of goods and services in which individual imagination and knowledge play a big part. In the current environment, management can't predict in advance what is the optimal thing that the "workers" should be doing at any given time. What we call "forcing contracts" (you do this, I pay you) are replaced in the modern age with "incentive contracts" (you produce a desired outcome, I pay you). This means that as time goes on many businesses approach closer and closer to the one-man firm model in which everyone buys and sells everyone else's services on the spot market. This didn't work in the past because of the friction of the transaction costs involved but those costs have declined dramatically. In this environment, others don't care how much time you surf the web or what you encrypt as long as your output is of the desired quality and quantity. Indeed, the average firm size has been declining in the US for 15 years or so. Companies may attempt to resist this dissolution and they may attempt to maintain traditional controls on their workers but if it is true that the Nets make it possible for the greater efficiencies of the one-man firm (no downtime paid by the buyer) to come into play, new small firms will eat the dinosaurs. DCF

1 0

Re: Length of passphrase beneficial?
by William Ehrendreich 17 Dec '03

17 Dec '03

> I disagreed with that assesment. Breaking into a home is easy. > > Adam > > > > -- > "It is seldom that liberty of any kind is lost all at once." Yes and ultimately more obvious. There are about 10 zillion ways that someone could hide a pass phrase. Bits are bits. Under the assumption that breaking into a home may be easy, you have to look at the possibility that this is what the person is looking for. You know, "Big brother broke into my house to subvert my freedoms", ploy. What a great way to get your self on Date Line.

1 0

Re: Digital Watermarks for copy protection in recent Billboard
by Alex F 17 Dec '03

17 Dec '03

> Paged through a recent (June or July 13) edition of Billboard > magazine yesterday. There was an article about the music industry, > the internet, and copyright issues. Didn't have a chance to read in > thoroughly, but it mentioned using digital watermarks which contained > info on to who (CC number) and when the material was sold... the > watermarks allgedly could survive if a CD was taped, copied several times > and redigitized. > Easy enough. > The anti-piracy scheme is only useful for direct sale to a customer > though. If you buy music anonymously, how is it traced? This only > works for pirating on-demand purchases. This is probably yet another case of people not thinking ahead. As usual. People buying CDs at a garage sale & getting arrested for piracy. Wonderful. > > Other issues: what if an eavesdropper steals the music or video? It's If they steal it, well, who cares? If there is something worked out so that they could trace STOLEN (not traded or sold) CDs then fine, arrest them. Do you really think though that anyone would waste so much time over $8? > If it uses a credit-card number as (part of) an ID, that's pretty > bad. Someone can sniff for CC numbers if they know how it's stored. Probably not done that way. My guess is that the disk ID is assigned to the disk at the time of manufacturing. At the point of purchase the customer is forced to give name, address, ID, whatever. This is then stored in a database along with the disc ID (serial num) which is prolly printed in the ISBN number or cross referenced with that in a national database or something, or just printed right on the disc. Anyway, a number is given to you from the CD, and not vice versa, I would imagine. > > The system will have to rely on proprietary tech and security through > obscurity. Even know how watermarks are stored without understanding > the math, one must be able to somehow garble the sound without > distorting it, but which renders the watermark useless. Actually, this would be quite easy. The "watermark" would be a signal that plays inband, but out of our hearing range during the entire CD. The human ear can only hear in the 20-20,000 (Hz, KHZ?, whatever) range. It would be trivial to add a digital ID signal at, say 30,000 or 15 or something like that. This could then be decoded, if need be. This seems the easiest and most efficient way. This could also be defeated with a lot of $$ (and/or a LOT of HD space). If the frequecy is known (it can be found out) it can easily be run through recording studio eqipment that can very effectively isolate the frequency and cut it out. If you have a LOT of HDD space (digital audio at 2 stereo tracks, not sure of the sampling rate or bit resolution, takes about 20MB of HDD space per minute (2 tracks, good sampling and bit rate) ) you could probably find the freq. fairly easily by isolation and just edit it out, and write the new stuff to a CD-R. If the signal is purely digital, I would imagine that it might be even easier that if it were an analog signal (?). Someone w/ good equipment (Digital Labs' stuff, or SAW (Software Audio Workshop) would be able to do this w/o much problem. The question is is the price/effort worth it? In quantity maybe. On an individual basis, only if you already happen to have the erquipment. I have a suspiscion that this type of thing will not really come to any kind of fruition due to not only the ability to defeat this, but mainly due to things like buying at a garage sale, etc. If it did, only MASS market piraters would be investigated. (Another example of a law creating it's own violators. Don't make the law, there won't be mass piratingof "clean CDs" Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

RE: INFO: Submit your testimony to Congress for hearings on July 25!
by geeman＠best.com 17 Dec '03

17 Dec '03

Simon Spero says: "paranoid rants have their place; however, if they keep bursting into cypherpunks without knocking first, there could be an accident. Lithium.... it's not just for watch batteries anymore." Seems to apply here, no? ---------- From: initialization[SMTP:initialization@nemesis.meaning.com] Sent: Sunday, July 21, 1996 6:23 PM To: cypherpunks(a)toad.com Subject: Re: INFO: Submit your testimony to Congress for hearings on July 25! vtw(a)vtw.org writes: > UPCOMING HEARING INFORMATION http://www.crypto.com/events/ after that. ... etc etc etc etc > This is an amazing time for Big Brother, who, in the person of VTW, is gathering the names and addresses of all who oppose it, one by one, under the Rube of "testimony" and "democracy"? What do you think will happen next? You think Big Brother is going to hear what you say and say "oh my god they are right!" and then turn around and mend its ways? NO! You will be marked as a trouble maker in your file, and rounded up or worse, when the time comes! They have duped many into participating, and others, prominent ones like Blaze, Diffie, Schneier, Zimmermann, have been blackmailed into working for them. Turn your back on this sham "democracy". Fuck their "hearings". And demand truth from "VTW". VTW=NSA+FBI front.

1 0

Re: Boycotts and Etiquette
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:04 PM 7/22/96, Alan Horowitz wrote: >My own decision to not interlocute with Sternlight is premised as >follows: His viewpoint is invariant and, by now, efficiently disseminated. >Briefly, he is a Statist and he never heard of any degree of Statism that >offends his sensibilities. I understand he's old enough to have been >around when Stalin was still running things in the USSR. David probably >was finding good things to say about Old Joe. And more importantly, >about J Edgar Hoover. Actually, David came out _against_ both Digital Telephony and mandatory key escrow, as I recall. For me, his process of conversion took entirely too long, as most of saw in the ostensibly voluntary Clipper program the seeds of a mandatory regimen. But he _did_ come out against these programs. I think this refutes the point that he's never heard of any degree of Statism that offends his sensibilities. >I pay by the minute for my internet access; many others do as well. If I >decide to ignore Sternlight, it is a business decision, not a moral one. Understandable. I find that _writing_ an article, even a short one like this, takes about as much time as adding 10 people to my filter file or hitting the "delete" key 50 times, so filtering out stuff I don't want to read has never been an issue. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: evidence from the NIC - interpret and use as you will.
by geeman＠best.com 17 Dec '03

17 Dec '03

Damn ... if this isn't a smoking gun, I don't know what is! What's the phrase? "Now go away" ..... ---------- From: ante[SMTP:ante@nemesis.meaning.com] Sent: Sunday, July 21, 1996 6:53 PM To: cypherpunks(a)toad.com Subject: evidence from the NIC - interpret and use as you will. Damn ... if this isn't a smoking gun, I don't know what is! See who is sleeping with who. These are the supporters of the sham "hearings". Voters Telecomm Watch (VTW-DOM) 115 Pacific St., #3 Brooklyn, NY 11201 Domain Name: VTW.ORG Administrative Contact: Safdar, Shabbir (SS155) shabbir(a)PANIX.COM (718) 596-7234 Technical Contact, Zone Contact: Panix Network Information Center (PANIX5) hostmaster(a)panix.com +1 212 741 4400 Record last updated on 27-Sep-95. Record created on 06-May-94. Domain servers in listed order: NS1.ACCESS.NET 198.7.0.1 NS2.ACCESS.NET 198.7.0.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Blaze, Matt (CRYPTO-DOM) 101 Crawford Corners Rd Room 4G-634 Holmdel, NJ 07733 Domain Name: CRYPTO.COM Administrative Contact: Blaze, Matt (MB19) mab(a)CRYPTO.COM (908) 949-8069 Technical Contact, Zone Contact: Network Information and Support Center (PSI-NISC) hostinfo(a)psi.com (518) 283-8860 Record last updated on 06-May-93. Record created on 06-May-93. Domain servers in listed order: NS.PSI.NET 192.33.4.10 NS2.PSI.NET 38.8.50.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Center for Democracy and Technology (CDT2-DOM) 1634 Eye Street, NW Suite 1100 Washington, DC 20006 USA Domain Name: CDT.ORG Administrative Contact: Weitzner, Daniel (DW151) djw(a)CDT.ORG (202) 637-9800 Technical Contact, Zone Contact: Palacios, Bob (BP282) bobpal(a)CDT.ORG (202) 637-9800 Billing Contact: Kolb, Danielle (DK1006) dkolb(a)CDT.ORG (202) 637-9800 Record last updated on 19-Apr-96. Record created on 20-Dec-94. Domain servers in listed order: NS.CAIS.COM 205.177.10.10 NS2.CAIS.COM 199.0.216.1 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information.

1 0

Re: Home Made Telephone Voice Changer
by John Deters 17 Dec '03

17 Dec '03

On Wed, 17 Jul 1996, Jerome Tan wrote: > Does anyone know how to make a home-made telephone voice changer? Well, if you've got your sound card in your computer, if you download Speak Freely (from http://www.fourmilab.ch) and simultaneously turn on LPC-10 compression along with simple compression, I've found my voice comes out more like Robbie the Robot than John Deters. It's an interesting feature of the LPC-10 compression that as it removes redundancy from the transmission that it removes the "human identity" from it as well. There's got to be a moral to that story somewhere (especially since the NSA developed the LPC-10 algorithm). John -- J. Deters "Captain's log, stardate 25970-point-5. I am nailed to the hull." +-------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +-------------------------------------------------------+

2 1

Re: Special Agent Safdar
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:32 AM 7/22/96, Bilderberger Standard Time, Disinformation Officer Anonymous wrote: >FBI Special Agent Safdar is upset enough by the revelation >of his true identity to issue a quick denial (on a sunday night, to get >more OT no doubt), but he doesn't even bother to try to refute the >central truth that his cover has been blown by a careless operator at >his home office who verified his employment and offered to take a message >for him. > >We don't have to wonder a second longer about the motives behind >Safdar\VTW\FBI's collection of names of crypto-dissidents, their >support of the Leahy crypto control bill, their refusal to >denounce it even today, their support of the digital telephone >act, the disinformation to make us believe otherwise and all >the other lies. And what about the money? > >We must call on the other organizations, like EPIC, EFF, CDT, and ACLU >to denounce the VTW\FBI fraud. Their board of directories, Blaze and I contacted Field Agent Eric Hughes, of the Western Regional Office, and he denied that there are any connections between VTW (Vulis Tchurka Watch) and the FBI. The special functions of Operation Sun Tentacle, led by a former Sun employee named John Gilmore, are focussed almost totally on recruiting the "tentacles" of dissidents in the Western Regional Area, centered on the Bay Area. Ignore disinformation. --Special Agent Timothy C. May cc: James Kallstrom, Cypherpunks New York Office

1 0