- cypherpunks-legacy - lists.cpunks.org

Borders *are* transparent
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:51 AM 7/18/96, snow wrote: >On Tue, 16 Jul 1996, David Sternlight wrote: >> At 3:36 AM -0700 7/16/96, Duncan Frissell wrote: >> >At 04:18 PM 7/15/96 -0700, sameer wrote: >> >> Not like that's tough to figure out. Congrats. It's cool to >> >>actually be able to connect to my webserver using real encryption. >> >>Glad the lawyers don't think Barksdale is going to jail anymore. >> >I'm glad too. So how many minutes did it take to leak overseas? >> It doesn't "leak overseas" as if there were some regrettable lapse in the >> plumbing. Someone has to commit a felony violation of Federal law. > > No they don't. If they are French, Russian, English, Greek, etc. They > _may_ be violating their countries laws, but they are not necessarily >violating ours. This is a terribly important point: if a citizen of Foobaria succeeds in connecting to the Netscape site--perhaps by experimenting with various combinations of domain names and submitted address/zipcode combinations--and Netscape sends him the file, he has not committed a crime in his own country. (Unless they have their own laws....) Ironically, under the ITARs, as I understand them, a citizen of Foobaria who "exports" (= retrieves from Netscape's site) such materials actually *has* violated our ITARs. (It is possible for persons outside the U.S. to violate U.S. laws, of course. You can all imagine examples.) Prosecuting a person in Foobaria for violating U.S. ITAR regs would of course be problematic, and unlikely. Likewise, much "export-controlled" software is freely purchasable without any form of identification or proof of citizenship/residency in any of thousands of U.S. software stores. (I don't know if the copies of Netscape Navigator on the shelves in U.S. stores are now the "U.S." version, as opposed to be a somwhat-crippled version, but I sure do know that a *lot* of nominally-export-controlled software _is_ freely purchasable.) Much of this software goes out of the country in luggage. In my various flights out of the U.S. over the years, never have my bags been so much as glanced at, except presumably for bombs with sniffers, scanners, etc. Further, I have mailed optical disks out of the country--a single one of these can store a whole lot of stuff. (As I said in a 1992 interview, a DAT is like a shoulder-fired Stinger missile.) On a trip to France and Monaco last year, I deliberately carried several optical cartridges and couple of DATs, all crammed with software, PGP, RSADSI's MailSafe, Mathematica, etc. To make a point, and as props for my talk on crypto anarchy. Certainly there was no checking on the way out at SFO, and no checking whatsoever at Charles de Gaulle in Paris. (On my return trip, the bored inspector in San Francisco asked what my purpose in being overseas has been. Had I said "tourism" I would've been waved through. Instead, for interest, I said "Meeting with Russian cryptographers in Monte Carlo," just to see what would happen. He asked me what "cryptographers" are or do... "They make secret codes." He then waved me through. Sigh.) None of this is surprising, of course. Borders _are_ transparent. There are so _many_ degrees of freedom for getting stuff across borders. The hope that a bunch of *bits* can be stopped in ludicrous. _This_ is why I expect the Netscape beta to arrive overseas pretty soon. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Steganography
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on steganography in the past few days. I've been thinking about the subject so here is a list of my random thoughts: 1. Steganography "standard": Current steganography software relies almost totally on security through obscurity. The problem with such an approach is that there is no standard way to extract data from .gif or .jpg files. If two people want to communicate using stego, they have to have some secure channel through which they could negotiate a protocol that could extract information from data files. This brings up the same Catch-22 situation that exists with conventional cryptography. My idea is that there should be some common, well-known way to de-stego data files. This really doesn't weaken the security of any stego software because if strong crypto that doesn't append any headers on to the message is used in conjunction with stego software, then the output of a stego program would just appear to be random garbage. There would be no way for the feds to prove that the random data was encrypted. I don't know much about graphic and sound file formats, but I think that in most cases the least-significant bit of a graphics or sound file should be pretty random anyway. 2. Recognizing stegoed data: Another problem with stegonography is that while many programs use some kind of identifying header so the recipient can tell whether the file contains hidden information or not, this also allows a snooper to determine the same thing. I think that the ability for the recipient to identify whether the data is stegoed or not is important. So I came up with the idea of using a MAC keyed with the session key used to encrypt the hidden data for checking if the picture contains stegoed data. With this approach, an attacker would not be able to verify if a file contained hidden data or not since the session key would be encrypted with the recipient's public key. 3. Message pools: With steganography more widespread, the use of message pools becomes a lot more interesting. People could communicate anonymously using one of the alt.binaries.* groups with everyone else reading the group completely oblivious to this fact. The posts would be pictures that would decode normally, but only the recipient would be able to decrypt the hidden data. Since the binaries newsgroups are among the most popular on the Usenet, reading one of the binaries newsgroups would draw less suspicion then reading alt.anonymous.messages. I don't know how reliable some of the binaries groups are since many NNTP servers don't carry them or expire the articles early, but since cross-posting seems to be fairly common on those newsgroups anyway, a cross-posted file with stegoed data would have a good chance of reaching the recipient. - -- Mark PGP encrypted mail prefered Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMe6OdLZc+sv5siulAQHMOAP/Yv6SLWY/CCXzXj/91q0hh2M3oVjMr7a6 RBEKCaExosbjJojoTlM9epyzO/gC4jrAj+3IIeciPLHyJPgF2CJmW3NU4bRHPls5 d2kEUPCIc/mLVcbieEC4OO7QlYeFY0vIBn+y1CO3V0kLN20N6Y3845p4a7BY6Wa+ u7dE12QbZLc= =8xQ7 -----END PGP SIGNATURE-----

1 0

Mac Crypto/ internet commerce workshop , sept 5-6, cupertino..
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

The Mac Crypto / Internet commerce workshop,( gathering, conference) will happen...YES (if more like machack than anything else.) The dates will be Sept 5/6, Here in Cupertino, CA at Apple. In addition I will also host the Aug (late) or Sept Cypher-punks meeting one of those nights too. My goals are: 1) to provide a vehicle to educate any and all Apple employees and Developers who are responsible for apple's future on the internet about what is going on in the Internet commerce world. 2) To provide a forum where developers can work together to create internet commerce producs for the Macintosh platform. I am responding to the copious feedback that I have recieved from developers both at WWDC and MacHack, through the various mailing lists that I run (Mac-crypto, net-thinkers etc) and through personal contacts. >>>>>>>> I am looking for folks to talk, papers etc.. <<<<<<<<< The (real) prelminary agenda goes something like: (day one) Introductions and overviews: 1) Introduction to crypto technology, what is it who are the players. 2) Introduction to electronic commerce (Finacial cryptograpy), e-cash, e-checks, digital bearer bonds, etc. 3) How to use this technology today, where is the oppertunities. 4) What needs to be done on the Mac, oppertnunites. (day two) Tech stuff. 1) Random number generation on the Mac, (the key to strong crypto) 2) Password management and the Mac (How to get something better than the Powertalk keychain) 3) Optimizing crypto on the PPC. 4) How to write a OT network server that will give you the performance required for transacting business. remember this is a totatly grass-roots thing, but we are gathering momentum. Look at how effective Internet-config is on the Mac. The conference will materialize more in August, consider this an official anouncement. So book your air tickets, while they are cheap.. (bring a parachute?) be there, aloha! Vinnie Moscaritolo Developer Tech Support http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Secure IRC conversations
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

Hi there, does anybody know of a way to have encrypted conversations on the IRC or via ytalk? Thanks, Harka ___ Blue Wave/386 v2.30 [NR]

4 3

Re: Opiated file systems
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:05 AM 7/18/96, jim bell wrote: >It has long occurred to me, considering the size and low power of the >typical 3.5" hard drive compared with the size of the typical house or >apartment, that it might be an interesting project to remotely connect such >a (hidden) drive to your computer using a reasonably surreptious link that >is difficult to trace. Say, an IR optical link, a single bare (unjacketed) >optical fiber, a LAN with hidden nodes, or a similar system. Maybe an >inductive pickup. In any raid, they'll have to decide what to take, and >chances are very good that they won't find every hidden item. I think the druggies call this a "rat line": two apartments next to each other, with the humans living in one and the drugs stored in the other. The drugs are gotten through a hole in the wall. (Hey, I'm not saying it works, or that it stops raids, prosecutions, convictions, etc. Just noting the existence.) Any multi-unit apartment can do this already, with data. The hard disk can be upstairs and two units away, connected with Ethernet (as many apartment buildings out here in California already are), or whatever. Any raid on Unit 3B, for example, finds that no files are stored locally. A separate investigation and/or search warrant for whereever the files actually are stored would be of course problematic and/or delayed. (Friends of mine have worked on "remote storage" ideas for exactly such applications. Clearly there are many options: storage in other local sites, storage in offshore sites, encrypted storage, even storage by a "priest" functionary ("Son, I am ready to receive your digitally transmitted confession.").) Lots of possibilities. For various reasons, few have been pursued. (Mostly because, I think, there have been relatively few raids on data, and when there have been raids, there were usually other HUMINT-type factors involved. E.g., few child porn rings are going to be broken only on the basis of seized disks. As this situation changes, expect more "data archival" services to evolve.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

Internet Through Radio
by Jerome Tan 17 Dec '03

17 Dec '03

Does anyone know how to Internet through radio using packet modems? By next year, our telephone company will be implementing metered phones, this will be unfair to modem users since they do that to prevent people from talking to the phone for long hours.

2 1

RE: Responding to Pre-dawn Unannounced Ninja Raids
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

At 4:13 AM on 96/07/18 Timothy C. May wrote: >It's a mark of what has gone wrong with this country that >ordinary citizens actually fear the midnight raids, the no-knock >searches, the "threat suppression" by ninjas. I recommend an article sub-titled: Fourteen ways of looking at a blackshirt. I've excerpted particularily relevant pieces below. Eternal Fascism by Umberto Eco New York Review of Books (June 22, 1995) In spite of some fuziness regarding the difference between various historical forms of fascism, I think it is possible to outline a list of features that are typical of what I would like to call Ur-Fascism, or Eternal Fascism. These features cannot be organized into a system; any of them contradict each other, and are also typical of other kinds of despotism or fanaticism. But it is enough that one of them to be present to allow fascism to coagulate around it. [...] 3. Irrationalism also depends on the cult of action for action's sake. Action being beuatiful in itself, it must be taken before, or without, reflection. Thinking is a form of emasculation. [...] 4. The critical spirit makes distinctions, and to distinguish is a sign of modernism. In modern culture the scientific community praises disagreement as a way to improve knowledge. For Ur-Fascism, disagreement is treason. 5. Besides, disagreement is a sign of diversity. Ur-Fascism grows up and seeks consensus by exploiting and exacerbating the natural fear of difference. The first appeal of a fascist or prematurely fascist movement is an appeal against the intruders. Thus Ur-Fascism is racist by definition. 6. Ur-Fascism derive from individual or social frustration. [...] 11. In such a perspective everybody is educated to become a hero. In every mythology the hero is an exceptional being, but in Ur-Fascist ideology heroism is the norm. This cult of heroism is strictly linked with the cult of death. It is not by chance that a motto of the Spanish Falangists was Viva la Muerte ("Long Live Death!"). In nonfascist societies, the lay public is told that death is unpleasant but must be faced with dignity; believers are told that it is the painful way to reach a supernatural hapiness. By contrast, the Ur-Fascist hero craves heroic death, advertised as the best reward for a heroic life. The Ur-Fascist hero is impatient to die. In his impatience, he more frequently sends other people to death. [...] Franklin Roosevelt's words of November 4, 1938, are worth recalling: "If American democracy ceases to move forward as a living force, seeking day and night by *peaceful means* (emphasis mine) to better the lot of our citizens, fascism will grow in strength in our land." Freedom and liberation are an unending task. ---------------------- If you set out to defeat an enemy because you despise what they do or say, make sure that you are different - not just stronger. Ciao, James

1 0

Re: New Infowarfare Panel
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:14 PM 7/18/96, David Sternlight wrote: >At 8:30 PM -0700 7/17/96, Timothy C. May wrote: > >>Winn Schwartau is running conferences, is talking about the imminent danger >>of the nation's computer networks being knocked out (paraphrasing his >>latest "Wired" item: "imagine your ATM network being knocked out and people >>being unable to gain access to their money"). >> >>Schwartau is predicting/advocating a "fifth branch" of the military to deal >>with the this threat. A cyberforce, as it were. >> >>Color me skeptical, but I see this all as a lot of hype and fear-mongering. >>Folks in the Pentagon, FBI, and NSA probably see it as a way to get more >>funding, Folks in the consulting business probably see it as a way to crank >>up the seminar prices and increase the number and frequency of "Information >>Warfare" workshops and seminars. > >Haven't there been some worked examples of information warfare that make >this fear and the need to deal with it legitimate? I'm certainly not saying "information warfare" is impossible--for example, I did some work in the late 70s for DARPA on knocking out satellites with particle beam weapons. Specifically, I rebutted MIT Professor Kosta Tsipas' claim that directed energy weapons in orbit would require tens (or more) of Space Shuttle trips _per shot_. I showed the DARPA people how it could be done with 5 orders of magnitude less energy, and speculated that "ticklings" of satellites could be done with commercially available ion implanters--they got real concerned and I was not invited to the classified sessions where they discussed this threat model, as I lacked a clearance. However, the current wave of publicity about "information warfare" seems to focus on _possible_ scenarios, with Hollywoodesque overtones. (And I just learned that "infowar consultant" Schwartau is indeed "working on a movie." Not to ascribe impure motives to him--who's to say what's impure?--but it still sounds like hype to me.) >As I recall my background reading in the public press, wasn't the etiology >that we figured out how to do some pretty nasty things (the Gulf war was >one presenting occasion) to enemies' info infrastructures to threaten their >entire social system. Then, as I understand it, someone smart said >something like "If we can do this to them, then someone can do this to us." >and we were off to the races. Sure, we dropped conductive fibers on their power lines, we blew their dishes out with Special Ops sniper fire, and we did a lot of other such things. Could this destroy the nation's "infrastructure"? Hey, there have been scenarios for disrupting Wall Street, for all sorts of things. Bombs in power plants, knocking over high tension lines, etc. Some things never change. But destroying or even seriously damagaing the U.S. infrastructure would be _very_ hard to do. Sure, the government should think about such things. Utilities companies routinely plan for efforts to disrupt service. (I live a mile or two from where "Earth Action Now!" knocked over a power line about the time treehugger activist Judi Bari was partly blown up while apparently transporting a homemade bomb down here to Santa Cruz.) >It's the military and counterintel community's job to think like this and >act to protect us. I don't think imputing selfish motives is dispositive. I noted that there is a recent wave of hype: books, conferences, calls for action, even movie deals (:-}). Given that there is no real evidence that these mysterious "HERF guns" have ever been used, nor is there evidence that they would do much beyond knocking out the PCs in the office they were aimed at, this is why I said "color me skeptical." By the way, I was interviewed for the BBC programme "The I-Bomb," had discussions a while back with someone working on HERF guns, and have been in touch with Schwartau on this latest round (he contacted me). I'm still skeptical. "Extraordinary claims require extraordinary proof." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: ABC News on internet telephony
by Deranged Mutant 17 Dec '03

17 Dec '03

On 18 Jul 96 at 9:41, Clay Olbon II wrote: > There was a pretty long piece on the evening news on using the internet for > long distance and how much money can be saved. Even had several demos of > intercontinental phone calls. The disappointing aspect was they didn't > mention PGPfone (although if they had, I'm sure child pornographers and > terrorists would have been mentioned as well :-) PGPfone isn't marketed very well. Other Internet phone software is advertised in magazines, promotions with ISPs, etc. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

RE: overseas PGPfone and Netscape
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

Ian Goldberg wrote: >Could various people with various architectures post MD5 or SHA1 hashes >of the files they downloaded? (i) very good idea (ii) Do you know where I can find a MSWin or MSDOS executable of SHA? Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

1 0