- cypherpunks-legacy - lists.cpunks.org

Surf-filter lists
by Damaged Justice 17 Dec '03

17 Dec '03

Vlad: How can consumers make an informed decision as to which filter they wish to purchase, if they are not told exactly what information each product is filtering out? Meeks et al may be guilty of flamboyant, emotionalistic prose, but I find the concept that the public is expected to buy various filters without knowing what they filter...frankly, ridiculous. -- "Your wish is my command, if you know what's good for you, bitch." - William Shakespeare (Or perhaps it was his brother Fred who said that.)

4 4

Chicago Area Cypherpunks Try 2.
by snow 17 Dec '03

17 Dec '03

Ok, I'm an idiot. The first time I posted this I forgot that the machine that the account that the cypherpunks mail goes thru was going to die. In otherwords, Crash did. I recieved a total 5 responses to a suggestion of a cypherpunks meet, and this is what I sent them earlier : There were 5 respondents, not including erehwon(a)c2.org, but he is the one who first affirmed the idea in my head. There may have been more, but my account at crash.suba.com (infact the whole machine) went away shortly after I posted, so I may have missed some responces. I am going to post again, so if you got this you don't need to re-respond. If you didn't get this, please respond and tell me how you are reading it without getting it. Is there anyone else out there who might want to organize this thing? I don't mind doing it, but I tend to be a little authoritarian about these kinds of things. I arrange an almost monthly meeting for a bunch of freaks on Usenet, and it has been my experience that the best way of doing these things is simply to announce a time and a place and stick to it unless there is a _major_ event that causes a change. On the other group I have the meetings at my house, and my Wife's grand mother died. Immediate grounds for a change other reasons could be a major conference that I didn't know about etc. An individual being out of town is not a reason, at every random event there will be someone who would prefer a different day. The other thing to consider is where to hold the event. There are a couple of decent pubs/bars here in Chicago, or Coffee Houses. I would prefer not to hold the first one in my home, because I am paranoid. Anyway, a couple of the responses were from out of town, so I think it might be a good idea to do this on a weekend. _______________________________________________________________________ If you responded, and would like to be in on the discussion, please re-respond. Sorry for the inconvience and the lousy spelling. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

Netscape download requirements
by Julian Burke 17 Dec '03

17 Dec '03

Jeff Weinstein wrote: > We received written permission from the State Department for our >download verification mechanism. What exactly is the reason for Netscape asking for the name, address, e-mail address, and telephone number of anyone who wishes to download the US-browser? If I remember correctly MIT in distributing PGP only asks that you affirmatively assent to obeying export laws (and the terms of the rsa license). I have not heard at any point that the MIT system does not meet the legal requirements of ITAR. Is there perhaps some other reason Netscape wishes to have this information? --Julian Burke

10 14

Clueless "Attachment converted" uses
by Raph Levien 17 Dec '03

17 Dec '03

Simon Spero wrote: > > On a very similar note - could people who are using clear-text PGP > signatures with mime use text/... instead of application/...; that way > people without pgp will see the message text without having to mess with > their mailcaps (that's the way text/* is supposed to work) I'd hate to turn this into "e-mail encryption"-punks, but I believe that clear-signed PGP messages should not have MIME types at all. Here's why: 1. All PGP-aware mail reading programs can recognize MIMEless PGP messages. Thus, adding the MIME type does not help. 2. For all mailers that are not PGP-aware, the best way to handle clearsigned messages is to cut-and-paste them to a PGP window. This is most easily done if the message is simply displayed as text. Thus, adding the MIME type does not help. 3. There _is_ a PGP/MIME standard, and these clearsigned PGP messages do not conform to it. ObPlug: premail, I believe, implements the correct policy. Some messages need to be in MIME format (e.g. pictures). These messages are encoded using the real PGP/MIME spec. Other messages do not. These are encoded using plain PGP, and no MIME gorp. There is a small bug in 0.44, by the way, that causes messages with tabs to be wrongly classified as needing MIME. Just my two cents. Raph

1 0

Encrytions over multiple platforms
by tangent＠alpha.c2.org 17 Dec '03

17 Dec '03

Does anyone know of a hard-drive/partition encrytion program that has been ported to both DOS and Linux/UNIX based systems? I am searching for a system that, obviously, allows both reading and writing of secure/encrytped data. You help will be greatly appreciated. -- Tangent <tangent(a)alpha.c2.org>

1 0

Encryption over multiple platforms
by tangent＠alpha.c2.org 17 Dec '03

17 Dec '03

Does anyone know of a hard-drive encryption program that has been ported to both DOS and Linux/UNIX based systems? I'm looking into installing some flavor of UNIX on my system, but still wish to retain my DOS based setup. Windows support would be a bonus, though not necessary. Your help will be greatly appreciated.

1 0

Washington Post -- "Block but Verify"
by declan＠well.com 17 Dec '03

17 Dec '03

[An editorial in today's Washington Post, about blocking software and the CyberWire Dispatch that Brock and I sent out earlier this month. --Declan] http://www.washingtonpost.com/wp-srv/WPlate/1996-07/15/006L-071596-idx.html Editorial: "BLOCK, BUT VERIFY" Monday, July 15 1996; Page A18 The Washington Post THE NEXT generation of highly publicized Internet products may have less to do with what you can get from the Net than with what you can protect yourself against getting. In the wake of the concern over pornography that sparked the now-overturned Communications Decency Act, vendors have rushed to market software with names like SurfWatch and NetNanny. [...] Some incidents of what might be called over-screening are accidents resulting from the overzealous use of keywords or other sweeping means by the inexperienced. Others are exactly what the products' makers intend... An on-line article by cyberjournalists Brock Meeks and Declan McCullough reported on a product called CyberSitter, marketed by the conservative group Focus on the Family, that blocks access to any discussions of homosexuality. It's advertised as a product for families who want just that: a relatively G-rated version of cyberspace. The feasibility and ready availability of such products is, of course, a strong argument that the government needn't meddle. Anyone, not just those worried about porn, should soon be able to find software that edits what a family wants edited and lets through what it wants to read. One pitfall, though, as Messrs. McCullough and Meeks observe, is the commercially inspired reluctance of many of these producers of software to specify exactly what they are blocking. Though understandable, this raises obvious dangers that products meant to block one type of transmission -- violence, for example -- will in fact muffle wider areas of debate. Smart consumers will want, and demand, to know what they're not getting, the better to make use of the information they have.

4 3

Re: How I Would Ban Strong Crypto in the U.S.
by jim bell 17 Dec '03

17 Dec '03

At 11:53 AM 7/15/96 -0700, Bill Frantz wrote: > >I still think this whole GAK thing is going to fail on the, "Which >government?" question. I don't see either multi-nationals or their >governments wanting to share their secrets with each other, and I don't see >how to set up universal GAK to prevent that form of industrial espionage. >Also, the key which decodes the GAKed data is just too valuable and too >easy to steal. This most recent dispute between the American government and the EC community with respect to trading with Cuba (Helms-Burton act) is an excellent example that can be raised to challenge the concept of cooperation between countries that are ostensibly "allies." The Helms law says, more or less, that American companies can sue foreign-based companies for using assets taken by Cuba in business. The EC countries are outraged. Were some sort of international-GAK system to already exist, you have to wonder how much luck the USG would have getting some escrowed key for the purposes of catching some Cuba-trader in the act: Not a lot! There's no point in setting up a system that practically invites disputes. BTW, yet another problem with any sort of key-escrow system operated across government borders is this: Let's suppose some foreign government illegally wiretapped somebody (say, a Senator or Representative?) in America using a Clipper-type telephone. They tap the line and get the data. They then claim that this conversation occurred between two Colombian drug smugglers. How is the American government going to know whether that's true? Unless records are kept linking a particular Clipper chip set to the particular purchaser involved (all the way to the end-user customer), the keeper of the keys has no idea whether the evidence presented to justify the tap is actually associated with the data that is to be decrypted. Yet another sneak: If the system is REALLY a "key escrow" system, I should be able to get the decrypt key for my own telephone, right? Well, suppose I buy a Clippper phone, call the escrow agency and ask for my key. Then, I de-solder the Clipper chip from the board, do a black-bag job and swap the chip into another telephone that some bigshot owns. He doesn't notice the swap, and nobody else will, either. But at that point, I can decrypt anything I wiretap off of his line. Jim Bell jimbell(a)pacifier.com

1 0

Re: Global Government Access to Keys (GGAK)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 15 Jul 96 at 8:53, Timothy C. May wrote: [..] > There are some interesting "public relations" stunts we can use to > undermine support for the concept of GAK: > > * Announce in corporate press releases (for some Cypherpunkish company?) > that "As per the laws of the Libyan Arab Jamahiriya, we have provided Col. > Qaddaffi's Office of People's Security with our encryption keys for all > communications passing into, out of, or over Libyan soil." Just replace it with the French government. They've already a reputation for abusing escrow. [..] > There are other aspects of GAK which also collide with basic values. For > example, consider several classes of communications we consider > "privileged": Supposedly 'exceptions' would be made for situations such as medical records, etc. What those exceptions are, and whether they are really more than superficial (ie, escrowed but larger keysize) exceptions is another question. > -- attorney-client discussions, in person or over phone lines. > -- doctor-patient discussions > -- psychiatrist--patient discussions > -- priest--penitent confessions What about 'journalist--informant'? The Clinton admin will ask "Ah, but what if they forget their keys?" This is nonsense. It would require a standardized way to return record storage keys to someone, and a secure means of doing so... a whole other can of worms. Many of these relationships have been compromised when the state sees fit anyway. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: FYI: Cybank
by Lyal Collins 17 Dec '03

17 Dec '03

To clarify my earlier post : Up until anbout 29 May, 1996, the Cybank site had a "test" file that was placed as a challenge. As there was a challenge, I took it. The following describes the data I was able to recover from the test file. I have received a number of files asking how I had hacked the Cybank server. I have acheived no such feat, merely determining the methodology used at the Cybank site. I communicated that fact to Cybank's operators, who subsequently seemto have altered their site, and download client. Taking this issue any further has no interest to me, and I am unable to post any VB source code - I "cleaned" some hard disk space, and have deleted the working files I used at the time. Silly me. Also, the Cybank site seems to have changed, so I don't know how you would get a test fle without becoming a Cybank user, which would probably mean passing your name, credit card etc to them. At the time, Cybank seemed very happy with actual user testing, however, I have had little further contact (1-2 emails). Lyal ps - i have also learned some interesting spelling methods as a result of informative emails. -- All mistakes in this message belong to me - you should not use them! ******************************************* included text from previous emails. ******************************************* On Wed, 29 May 1996 12:20:08 Cybank wrote: > >Return-Path: lyalc(a)ozemail.com.au > >Date: Tue, 28 May 1996 23:55:21 -0700 > >From: Lyal Collins <lyalc(a)ozemail.com.au> > >To: info(a)oxford.com.au > >Subject: The text in the "securely encrypted" test message > >X-UIDL: 833321608.007 > > > >According to me, this decodes to : > >Text1!O1! 12!O2!I1!830304962394!I2!A1!0.10!A2!P1!!P2!C1!0.10!C2 > >Text1 = data to follow is text ? > >!O1! 12!O2 = I don't understand these bits yet > >!I1! = a common delimiter - 1 = start > >830304962394 = serial number that this 10 cents is for/from > >!I2! = a common delimiter - 2 = end > >A1!0.10!A2! = ammount is 10 cents, $0.10 > >P1!!P2! = seems to be a token of some kind > >C1!0.10!C2 = a check value to ensure amount is correct. > > well done Lyal! not bad so far but you've missed a few things :-) presume that you've used a VB3.0 decompiler to do it but we're upgrading to VB4.0 and changing the encryption process very soon :-) where are you? your prize might well be a job!!!!!! :-) plus the whole cash environment is becoming server-based within a couple of weeks. stay in touch, we need a beta-tester! Martin Haynes Oxford Media Group Pty Ltd CYBANK

1 0