- cypherpunks-legacy - lists.cpunks.org

Re: Global Government Access to Keys (GGAK)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 15 Jul 96 at 8:53, Timothy C. May wrote: [..] > There are some interesting "public relations" stunts we can use to > undermine support for the concept of GAK: > > * Announce in corporate press releases (for some Cypherpunkish company?) > that "As per the laws of the Libyan Arab Jamahiriya, we have provided Col. > Qaddaffi's Office of People's Security with our encryption keys for all > communications passing into, out of, or over Libyan soil." Just replace it with the French government. They've already a reputation for abusing escrow. [..] > There are other aspects of GAK which also collide with basic values. For > example, consider several classes of communications we consider > "privileged": Supposedly 'exceptions' would be made for situations such as medical records, etc. What those exceptions are, and whether they are really more than superficial (ie, escrowed but larger keysize) exceptions is another question. > -- attorney-client discussions, in person or over phone lines. > -- doctor-patient discussions > -- psychiatrist--patient discussions > -- priest--penitent confessions What about 'journalist--informant'? The Clinton admin will ask "Ah, but what if they forget their keys?" This is nonsense. It would require a standardized way to return record storage keys to someone, and a secure means of doing so... a whole other can of worms. Many of these relationships have been compromised when the state sees fit anyway. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: FYI: Cybank
by Lyal Collins 17 Dec '03

17 Dec '03

To clarify my earlier post : Up until anbout 29 May, 1996, the Cybank site had a "test" file that was placed as a challenge. As there was a challenge, I took it. The following describes the data I was able to recover from the test file. I have received a number of files asking how I had hacked the Cybank server. I have acheived no such feat, merely determining the methodology used at the Cybank site. I communicated that fact to Cybank's operators, who subsequently seemto have altered their site, and download client. Taking this issue any further has no interest to me, and I am unable to post any VB source code - I "cleaned" some hard disk space, and have deleted the working files I used at the time. Silly me. Also, the Cybank site seems to have changed, so I don't know how you would get a test fle without becoming a Cybank user, which would probably mean passing your name, credit card etc to them. At the time, Cybank seemed very happy with actual user testing, however, I have had little further contact (1-2 emails). Lyal ps - i have also learned some interesting spelling methods as a result of informative emails. -- All mistakes in this message belong to me - you should not use them! ******************************************* included text from previous emails. ******************************************* On Wed, 29 May 1996 12:20:08 Cybank wrote: > >Return-Path: lyalc(a)ozemail.com.au > >Date: Tue, 28 May 1996 23:55:21 -0700 > >From: Lyal Collins <lyalc(a)ozemail.com.au> > >To: info(a)oxford.com.au > >Subject: The text in the "securely encrypted" test message > >X-UIDL: 833321608.007 > > > >According to me, this decodes to : > >Text1!O1! 12!O2!I1!830304962394!I2!A1!0.10!A2!P1!!P2!C1!0.10!C2 > >Text1 = data to follow is text ? > >!O1! 12!O2 = I don't understand these bits yet > >!I1! = a common delimiter - 1 = start > >830304962394 = serial number that this 10 cents is for/from > >!I2! = a common delimiter - 2 = end > >A1!0.10!A2! = ammount is 10 cents, $0.10 > >P1!!P2! = seems to be a token of some kind > >C1!0.10!C2 = a check value to ensure amount is correct. > > well done Lyal! not bad so far but you've missed a few things :-) presume that you've used a VB3.0 decompiler to do it but we're upgrading to VB4.0 and changing the encryption process very soon :-) where are you? your prize might well be a job!!!!!! :-) plus the whole cash environment is becoming server-based within a couple of weeks. stay in touch, we need a beta-tester! Martin Haynes Oxford Media Group Pty Ltd CYBANK

1 0

Re: CookieScan 0.0 rev 0
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:34 7/15/96, Christopher Hull wrote: >Do y'all think there might be an interest in a >utility which would allow the user to deal with >browser cookies? For Win95 you can get Internet Fast Forward. Not only does it give you full control over cookies, it also gets rid of the annoying ad banners that clutter your screen. <http://www.privnet.com/> -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: How I Would Ban Strong Crypto in the U.S.
by jim bell 17 Dec '03

17 Dec '03

At 06:02 PM 7/15/96 -0700, David Sternlight wrote: >At 7:03 AM -0700 7/15/96, Michael Froomkin wrote: >>On Sun, 14 Jul 1996, Timothy C. May wrote: >> >>> So, who is in this "emerging consensus"? >>> >>Foreign governments? >>(Process of elimination, not inside info...) > >Perhaps. And the vast inside-the-Beltway policy community, "Policy"? I'm reminded of the fact that the whole concept of "policy" (as used in Washington DC) contains embedded within it its own set of biases. The concept of "national encryption policy" (a phrase I've seen before) implicitly assumes that there is (or must be) a _national_ policy, as opposed to a whole bunch of _individual_ policies. (Jim Bell's individual encryption policy is to get PGP and use it here and there, and try to keep up with newer developments, etc.) My opinion is that "nations" don't NEED "encryption policies" unless they intend to screw their citizens. "Policy", used in this way, is merely a smokescreen (or a shorthand) for a group of assumptions that toe the government's line. The people who make such assumptions rarely stick around to defend them. > most of whom are more like Dorothy Denning than Tim May. To the extent that they are POLICY (as in _government_ policy) people (with all the biases I've alluded to) that wouldn't be surprising. However, it is still extraordinarily dishonest for them to refer to an "emerging consensus" when they must well understand that the document they wrote was intended to be understood by ordinary people, not government-suck-ups. I'm reminded of an idiotic cover for a Classical Music CD directory book about 10 years ago, which grandly claimed that the book indexed "every CD published" but forgot to add the word "classical" adjective to that phrase. Without opening the book, you couldn't tell that the directory only listed classical CD's. A "policy" person who says there's an "emerging consensus" for key escrow has a similarly myopic point of view. >And the vast business community >that prefers automated escrow in standard systems. I feel certain that whatever portions of the business community that "prefers automated escrow" will get it, in forms which don't make the government particularly happy. > What I mean by that is >software or chips automatically escrowed to, say, Price Waterhouse. >Business is comfortable dealing with such firms in a trusted relationship, >and such firms will honor a valid court order to produce records or the >equivalent--a probable cause court-order for a wiretap. Most "chips" won't need to be escrowed, for reasons that have been adequated addressed so far. Data transfer encryption doesn't have to be escrowed, as Tim May pointed out. And, of course, an encryption chip needn't contain any sort of permanently-written key, thus obviating the need for "escrow" at all. >It really depends on how the issue is presented. If it is presented as >preserving law enforcement access, escrow follows. No, escrow DOESN'T follow! I think most people who are aware of the issues figures that the advent of encryption will provide dramatic net benefits for the public, even after potential negatives such as criminal use of encryption are factored in. > The problem is that like >the nose of the camel, each new piece of legislation establishes a new >status quo baseline of principle from which to argue, and though we all >kicked and screamed about it here, the new baseline is the Digital >Telephony Act. I concede NOTHING. That Act hasn't been funded, may not be, and with every passing month there are more people on the 'net who will understand how unacceptable it is. It's also going to be irrelevant as encrypted telephones appear, and 'net telephone access becomes more common. No new "baseline of principle" is produced. Only the thugs who are trying to foist it all on us would like to believe this. >As for the only counterargument to the above, that bad guys aren't going to >use escrowed systems, nothing is perfect, goes the argument, and the FBI >has caught plenty of bad guys who presumably should have known better, via >wiretaps. "the only counterargument"? What are you, a comedian? >If you look into it, you will find that most people with criminal minds >don't expect to get caught. > >Given the nature of this group it perhaps needs saying that the above is a >competitor analysis, not an argument nor my own position on mandatory >domestic key escrow. I'm agin it. Which is not adequate. To the extent I believe that the market will decide, if I model the market as a double-pan balance, which makes a decision as to which side is heavier, I don't want to see the heavy thumb of government pressing down on one of the pans. That's precisely what the US government tried to do with Clipper, and astonishingly it appears to have failed. To merely say that you're against "mandatory" escrow strongly implies that you would accept manipulation of the market in order to allow government to achieve its goals , as long as there is an illusion of a choice. I won't, and I think most people won't, either. Jim Bell jimbell(a)pacifier.com

1 0

UK privacy case: Munden
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

interesting story I hadn't heard before. this guy complained about a bad bank balance and went to jail for it. touches issues such as security of bank software, government oppression, crypto, judicial evidence legality, etc. ------- Forwarded Message Date: Thu, 11 Jul 1996 04:38:27 -0700 (PDT) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: John Munden freed X-URL: http://communication.ucsd.edu/pagre/rre.html [This case is so outrageous that it wouldn't even work as a "Dilbert" strip. Fortunately the guy is now free, having had his life ruined for complaining about the theft of his bank deposits.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 10 Jul 1996 11:00:11 -0800 From: Jon Callas <jon(a)worldbenders.com> To: "The Eristocracy" <Eristocracy(a)mv.mv.com> Subject: Munden set free [Editor's note: I sent out an article about the Munden case when it was current -- in late '94. For those who don't remember, John Munden is a British policeman who was jailed for complaining about his bank balance being wrong. No, you didn't read that incorrectly. Read on for more details. I certainly hope that the next chapter will be some sort of restitution paid to Munden. -- jdcc] Date: Tue, 09 Jul 1996 12:13:28 +0100 From: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> To: set-discuss(a)commerce.net Subject: Important UK court case +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ At a trial in England yesterday, a judge decided that if a bank was not prepared to let their computer systems be examined by a hostile expert witness, then they could not even present bank statements in evidence. At least SET has been done right - I believe it is the first significant banking protocol to have undergone an open design review. I hope that there will be implementations that have also undergone credible scrutiny. I append a note of the case that I posted to our supporters. Ross Anderson ********************************************************************* John Munden is acquitted at last! At twenty past two today, John Munden walked free from Bury Crown Court. This resolved a serious miscarriage of justice, and ended an ordeal for John and his family that has lasted almost four years. In a judgment loaded with significance for the evidential value of cryptography and secure systems generally, His Honour Justice John Turner, sitting with two assessors, said that when a case turns on computers or similar equipment then, as a matter of common justice, the defence must have access to test and see whether there is anything making the computers fallible. In the absence of such access, the court would not allow any evidence emanating from computers. As a result of this ruling, the prosecution was not in a position to proceed, and John Munden was acquitted. John was one of our local policemen, stationed at Bottisham in the Cambridge fenland, with nineteen years' service and a number of commendations. His ordeal started in September 1992 when he returned from holiday in Greece and found his account at the Halifax empty. He complained and was told that since the Halifax had comfidence in the security of its computer system, he must be mistaken or lying. When he persisted, the Halifax reported him to the police complaints authority for attempted fraud; and in a trial whose verdict caused great surprise, he was convicted at Mildenhall Magistrates' Court on the 12th February 1994. I told the story of this trial in a post to comp.risks (see number 15.54 or get ftp.cl.cam.ac.uk/users/rja14/post.munden1). It turned out that almost none of the Halifax's `unresolved' transactions were investigated; they had no security manager or formal quality assurance programme; they had never heard of ITSEC; PIN encryption was done in software on their mainframe rather than using the industry-standard encryption hardware, and their technical manager persisted in claiming (despite being challenged) that their system programmers were unable to get at the keys. Having heard all this, I closed my own account at the Halifax forthwith and moved my money somewhere I hope is safer. But their worships saw fit to convict John. An appeal was lodged, but just before it was due to be heard - in December 1994 - the prosecution handed us a lengthy `expert' report by the Halifax's accountants claiming that their systems were secure. This was confused, even over basic cryptology, but it was a fat and glossy book written by a `big six' firm with complete access to the Halifax's systems - so it might have made an impression on the court. We therefore applied for, and got, an adjournment and an order giving me - as the defence expert witness - `access to the Halifax Building Society's computer systems, records and operational procedures'. We tried for nine months to enforce this but got nowhere. We complained, and the judge ordered that all prosecution computer evidence be barred from the appeal. The Crown Prosecution Service nonetheless refused to throw in the towel, and they tried to present output such as bank statements when the appeal was finally heard today. However, the judge would have none of it. For the computer security community, the moral is clear: if you are designing a system whose functions include providing evidence, it had better be able to withstand hostile review. Ross ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. - - --- end forwarded text - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

PARC Forum, 7-18-96, Gregory Schmid, "The Future of ConsumerElectronic
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: mikkelsen(a)parc.xerox.com (Jim Mikkelsen) (by way of frantz(a)netcom.com (Bill Frantz)) Mime-Version: 1.0 Precedence: Bulk Date: Mon, 15 Jul 1996 11:53:09 -0700 From: mikkelsen(a)parc.xerox.com (Jim Mikkelsen) (by way of frantz(a)netcom.com (Bill Frantz)) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: PARC Forum, 7-18-96, Gregory Schmid, "The Future of Consumer Electronic Xerox PARC Forum Thursday, July 18, 1996, 4:00PM, PARC Auditorium The Future of Consumer Electronic Payments: The Impact on the Distribution Chain Gregory Schmid, Institute For The Future This talk explores the critical changes pushing consmers into the world of electronic transactions--improved technologies, better security, and consumers' growing experience with card-based and other electronic transaction technologies. These changes will not only affect customer behaviors, but will transform the distribution chain, bring in new players, force the current players to fundamentally transform the way they conduct business, and encourage policymakers to find the right balance of regulation and market forces. Combined, these impacts will change the basic relationship between businesses and their customers forever. Only the stakeholders who are prepared for such changes will carve out their place in the new world. Greg directs IFTF's long-term forecasting and strategic planning efforts in both the public and private sectors. He has been Director of IFTF's Corporate Associates Program (CAP) since its inception in 1976 and is also the overall editor of CAP's "Ten-Year Forecast." Greg has overseen projects for many Fortune 500 companies, including those in the financial services, high technology, consumer products, professional services, and healthcare industries. As an economist, historian, and policy analyst, Greg uses a variety of research and planning techniques to work with clients in exploring strategic choices. His most recent book is "Future Tense: The Business Realities of the Next Ten Years" (William Morrow, 1994) with Ian Morrison. Before joining IFTF Greg headed a research division of the Federal Reserve Bank of New York. A graduate of Yale, Greg received his Ph.D. in economics from Columbia University. ------------------------------- This Forum is OPEN to the public. Host: Jim Mikkelsen 415-812-4401 Web site: http://www.parc.xerox.com/ops/projects/forum Requests for videotapes for "Xerox Employees Only" should be sent to Susie Mulhern (Mulhern(a)parc.xerox.com) Refreshments will be served from 3:45 - 4:00PM. The PARC Auditorium is located at 3333 Coyote Hill Road in Palo Alto. We are located in the Stanford Research Park, between Page Mill Road (west of Foothill Expressway) and Hillview Avenue. The easiest way to get here is to take Page Mill Road to Coyote Hill Road, and, as you drive up Coyote Hill between the horse pastures, PARC is the only building on the left after you crest the hill. Please park in the large (lower) lot to your right; enter the auditorium at the upper level of the building. (The auditorium entrance is located to the left of the main door and down the stairs.) ------------------------------- Next Week's Forum is Shirley Tessler, Stanford University, on "A Pilot Study of Software Product Management." --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Symantec's Your Eyes Only
by Clay Olbon II 17 Dec '03

17 Dec '03

If you read this weeks "Network Computing", there is a report on Symantec's Your Eyes Only encryption software for Windoze 95. The article can be found at: http://techweb.cmp.com:80/techweb/nc/711/711sneak2.html. Looks like a PGP competitor - uses RSA public key, DES, triple-DES, RC4, RC4 or blowfish secret key algorithms. It can also be used to encrypt directories on the hard-drive while retaining the ability to use them. This appears aimed at corporate users, and includes a "super-user" access to all encrypted files/messages. Also includes the capability to create an "unlock" disk that will decrypt everything should you lose your password. Now my $.02. I am concerned about the lack of a distinction between transient communications and stored data. This is apparent in the GAK proposals, but is also increasingly apparent in mainstream corporate products such as this one and ViaCrypt BE. It is apparent (to me anyway) that corporate access to stored data (data owned by the company, on machines owned by the company) is probably necessary. I do not see this same need for access to transient communications. Am I way off base on this one? Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

1 0

Re: Surf-filter lists
by declan＠well.com 17 Dec '03

17 Dec '03

>Vlad: How can consumers make an informed decision as to which filter >they wish to purchase, if they are not told exactly what information >each product is filtering out? > >Meeks et al may be guilty of flamboyant, emotionalistic prose, but I >find the concept that the public is expected to buy various filters >without knowing what they filter...frankly, ridiculous. Flamboyant prose? Moi? Never! More to the point, as I wrote at the end of the original CWD, it's a bait-and-switch maneuver. Go after porn, they say, but the censor political information. And you don't know about it. -Declan

3 2

Banning Anonymity As Well (was Re: How I Would Ban Strong Crypto
by Deranged Mutant 17 Dec '03

17 Dec '03

On 15 Jul 96 at 11:53, Bill Frantz wrote: [..] > I still think this whole GAK thing is going to fail on the, "Which > government?" question. I don't see either multi-nationals or their > governments wanting to share their secrets with each other, and I don't see > how to set up universal GAK to prevent that form of industrial espionage. > Also, the key which decodes the GAKed data is just too valuable and too > easy to steal. Assuming the info is encrypted with one GAK key, yes. There might be a series of keys, perhaps for each escrow agency, or an id-number that identifies the key. Note that such methods will not allow much anonymitiy, since each communication must be escrowed. The method used to id. the key can be used to trace a sender or receiver's id. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

RE: Government: Home-Business
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Mike Rose >I'm getting more and more of this kind of crap sent to me. I have >a procmail script which greps a file of undesirable addresses I've >compiled, but that hasn't proven very useful as there aren't many >repeat offenders. (the procmail script is available at >http://www.universe.digex.net/~mbr/unix/junkmail.html) > >How are other people dealing with this? ............................................................. For this particular one, I faxed all 6 pages back to the phone number they gave ("send your check to.....), declining the offer. .. >Blanc

1 0