- cypherpunks-legacy - lists.cpunks.org

1OV_ert Net Tap 1
by John Young 17 Dec '03

17 Dec '03

12-30-95. NYP: Aided by the first court-approved Net wiretap, via Compuservile, three people have been jailed for an international plot to sell cel-tel cheaters. 1OV_ert

1 0

re: Driver Licenses (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 08 Feb 1998 17:54:56 -0500 > From: "WebWarrior3(a)InfoWar.Com" <WebWarrior3(a)InfoWar.Com> > Subject: re: Driver Licenses > William H. Geiger III wrote: > >My question is what is the best way to remove this information from the > > >cards? > > > >A few passes over a strong magnet sufficient or should a chemical > solvent > >be used? > > Either should work...I'll bet that scratching the shit off with his keys > worked too ;) > I'll have to remember that when it's time to get mine done. My suggestion is not to alter the card such that a visual inspection would show. In most states it's a felony to modify or alter a drivers license, they are considered the property of the state and not yours personaly. Next time a cop asks for ID and you hand him your d.l. you could be in for a lot more than couple hundred dollars and a ticket. > That was a good question, though, does anyone know how much data those > little stripes can hold? Anywhere from a few hundred bytes to a k. Depends on the bit density of the tape. Go down to your local electronics or audio supply and get a polarized loupe and count them. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Massey, CEO of Compuserve, on Internet
by frankw＠in.net 17 Dec '03

17 Dec '03

Peter D. Junger writes: 8< [snip] >One should also notice that Bavaria is only one state in the German >Federal Republic; this case is more like Texas investigating >Compuserve than the United States federal government investigating >Compuserve. Bavaria is the stronghold of what can properly be called >the (Catholic) Religious Right in Germany. It should also be noticed >that in general German publications and television seem to be less >constrained in publishing materials that in the United States would be >called ``indecent'' by some than are United States publications and >broadcasters. > Peter has made some rather astute and accurate observations. (I particularly liked his analogy of Bavaria & Texas. From my experience, I would say that Bavaria is the Texas of Germany.) While the Computserve incident in Germany may provoke outrage here & across the Internet, given the culture and other factors, the incident itself was rather inevitable (really). After having lived in Munich & Stuttgart, I'm just surprised it took so long to happen. (Then again, the wheels of bureaucracy do spin slowly). 8^) I'm not saying I agree with their actions, but I think I do understand the mentality behind the actions. I would venture to guess that the Bavarian State Police were trying to enforce the JugendSchutzGesetz (Protection of Minors Law). These laws are posted in every restaurant, bar, etc. As indicated by its title, the law basically serves to protect minors from the evils of the adult world. It spells out what ages a person has to be to drink beer, hard liquor, etc, and covers curfews and other similar topics which serve to protect the youth. The Compuserve censorship may be the result of an interpretation or enhancement of the JSG - in that because Compuserve really has no way of knowing the age of individuals who have access to pornographic materials, it is not capable of fully implementing the JSG. (Although how this differs from cable TV (which shows porno movies and can't controll who sees them is beyond me). Without commenting on the actions of the Bavarian State Police or Compuserve, I think that perhaps we are applying our standards to an incident in another culture - without viewing it in the context of that culture or country. (In other words, comparing apples and oranges.) FWIW, there are a few differences between the USA and Germany which are related to the Compuserve incident and which may help to understand why the police performed their actions. I am not saying I agree with their actions, only that I think I understand the mentality behind the actions. Anyway, here are a few differences: 1) Germans (and foreigners who live/work there) enjoy fewer freedoms than we do - including freedom of speech, press, assembly, movement, etc. 2) The legal system is different than in the USA. I'm not a lawyer, but my impressions were that the police had far more liberties with what they (legally) can do than do our counterparts here or in other countries. The OJ fiasco probably couldn't have happened in Germany (and he probably also wouldn't have gotten off). 3) There is no real separation of Church & State like we have here in the USA. As a result, the impact of the Catholic & Lutheran churches on the German legal system & government is significant. It has also led the the government subsidizing (ie - providing public funds to) the churches. FWIW, the German government (like every other government on the planet) is ill-equiped to handle something like the Internet and its impact on the social & legal systems of that country. FWIW, the above is my opinion based on having lived there for over 9 years. Best Regards, Frank >-- >Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH >Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu PS - The rest of this mail contains an elaboration of the points mentioned earlier. They were separated from the summarized info mentioned above for those who are short on time or have no interest in the long version. PPS - Four really neat things about Germany are the BDSG (Privacy Act), the mandatory (by law) 6-weeks paid vacation for all full-time employees, their sausages, and skiing. (Their sausages are really great. You might even say they're the best of the wurst. The skiing can be flakey on occasion, though.) 8^) 8^) 8^) PPPS - Have a Happy & Prosperous New Year! 8^) ----------------------------------------------------------------------------- The following is an elaboration of the above differences, based on my observations while I was there. I'm not taking a stand one way or another on these differences in this mail, just indicating what they are. 1) Germans (and foreigners who live/work there) enjoy fewer freedoms than we do. A few examples: - it is mandatory (ie - a law) that citizens & foreigners register their domicile address with the police. (When you move, you have to unregister with the police in your old city, & register with them in the new city). - it is not trivial to obtain a permit for a weapon (or obtain a hunting license). - it is against the law to monitor police & government frequencies - until 1984/85), the radio & TV media were a monopoly of the State (or government). Commercial (ie - non-government owned) radio & TV stations didn't exist until then. - the freedom of speech is more restricted than here. Use of the swastika symbol is prohibited by law. Groups attempting to deny the abuses of WW II or promoting the rhetoric of the Hitler regime are outlawed. - all demonstrations must be registered (and approved) by the police before they can ocur. - mandatory store closings (general). Most stores are open 'til 6pm on Monday, Tuesday, Wednesday, and Friday. They stay open late ('til 8:30pm) on Thursdays. Saturdays, the stores are open 'til 2pm unless it is the first Saturday of the month (& then 'til 5pm). - all TVs, radios have to be registered with the BundesPost (and you will be charged a fee). The BundesPost uses vans with have the ability to detect which apartments have TVs (as well as which channel the individual is watching). (I have seen the vans & have had a brief conversation with some of the BP employees who have used this equipment). 2) The legal system is different than in the USA. I'm not a lawyer, but my impressions were that the police had far more liberties with what they (legally) can do than do our counterparts here or in other countries. On the plus side, the police are very efficient (but having access to a nationwide databank about every person in the country helps to increase the efficiency in catching crooks). - One law in particular is the JugendSchutzGesetz (Protection of Minors Law). The JSG spells out exactly what ages a person has to be to drink beer, hard liquor, etc. (I believe it also covers curfews, movie ratings, etc.). The Compuserve censorship may be the result of an interpretation or enhancement of the JSG - in that because Compuserve really has no way of knowing the age of individuals who have access to pornographic materials, it is not capable of fully implementing the JSG. (Although how this differs from cable TV (which offers porno movies is beyond me). - One thing to be admired, though, is the German Information/Data Privacy Act (BundesDatenSchutzGesetz = BDSG). The BDSG is one of the most stringent privacy laws in the world. Actually, it is a shame that we don't have a law like the BDSG (with a few minor changes). (Our Privacy Act here in the USA is a joke). The abuses of privacy which result in the collection and distribution of personal data here in the USA is simply unbelievable. - I also had the impression that in the German court system, the burden of proof is on the accused, not the prosecution. This is somewhat analagous to the military courts here in the USA. 3) There is no separation of Church & State like we have here in the USA. - All persons who are subject to taxes are required to pay a Church Tax (Kirchensteuer) of 1% of their pay to support a few of the major churches in Germany (primarily, the Catholic, the Lutheran, and the Jewish religious institutions). The only exemption to this is for those who fill out an affadavit that they have formally left their church or those whose voluntary contributions to their church exceed 1%. BTW, the German tax laws also differentiate between members of the 3 churches mentioned above & others. - Major religious institutions are subsidized & receive financial support by the government (from the Kirchensteuer), as well as additional funding for the preservation & upkeep of historic religious buildings, etc. I remember seeing an investigative report on German TV which provided a list of which religious institutions received how much money and the reason why those funds were given to the churches by the government. I don't remember the acutual sums involved, but they were rather large (hundreds of millions of dollars or above, if my memory serves). - The Catholic & Lutheran churches in particular have enormous political clout (far more than they ever could here in the USA) and are a force to be reckoned with. Although from my observations, the Catholic church has more clout than the Lutheran. Their clout has a major impact on the political & legal sytems in Germany. An illustration of this is that one of the top two political parties in Germany is the CDU (Christian Democratic Union). - The ability of a church's missionaries to proselytize is heavily regulated/restricted - particularly if they are not one of the top three churches mentioned earlier. - In general, the top 3 churches mentioned above are given preferential treatment. Other denominations are generally ignored by the German government. In conclusion: None of the above statements are intended to be critical of Germans or of the German government, or anything/anyone else. These are merely my personal observations. ----------------------------------------------------------------------------- Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

1 0

Guerilla Internet Service Providers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:18 PM 12/30/95, Lucky Green wrote: >At best, Cypherpunks can hope to provide the infrastructure that will allow >an underground to communicate semi-securely. We are unable to stop the >global tidal wave of fascism. Let's not waste our time on bemoaning the >freedoms crushed in its path. We have more important work to do. And support your local ISPs! (Or, even better, direct connection to the Net, though this is harder for most of us to arrange.) This CompuServe situation should be a great recruiting opportunity. Cypherpunks in various parts of the country (and outside the U.S.) can get active in local AOL, Prodigy, and Compuserve groups (and maybe even Netcom chat groups, as Netcom is large enough to be a ripe target for harassment by some zealous prosecutor or tort-crazed lawyer, as the Church of Scientology case showed). They can tell the folks about local alternatives. Having lots of small, decentralized providers makes censoring the Net all the harder. Guerilla Internet Service Providers. (I'm not disparaging Netcom. Tom Klemesrud not only fought the CoS, he has also spoken out against CompuServe's action. I just understand that the "deep pockets" effect means that any ISP large enough to register on the radar screens of the statists will be targetted for regulation and sanctioning. Better to have a thousand services, melting into the jungle when the heavy artillery arrives.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: FCC-type Regulation of Cyberspace
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:10 AM 3/15/96, Bill Frantz wrote: >Mark Miller and I had a discussion about the restrictions on commercial >speech a few months ago. I contended that these restrictions (generally >that you can prove your claims) are good for markets because they provide >startup companies (and other newcomers to the market) with a small amount >of positive reputation capital that they would otherwise have to invest to >obtain. Mr. Frantz, unless you can prove your claims here, forthwith, I must inform you that they are in violation of the Truth in Speech Act of 1996. Please retract them, now. (Yoy can of course find the complete description of how citizen-units ascertain the veracity of their claims at their local Ministry of Truth office. Minitru is always to help citizen-units on their quest for truth.) Do you see the problem? Personally, I don't care if you choose to have some bunch of people called the "Food and Drug Administration" telling you which substances you may buy, and in which quantities, but I care greatly that you (the general you) wish to stop me from making my own decisions, or listening to those I choose to trust, over the FDA. This is what it all boils down to. Think about it. Be careful of the utilitarian point of view that the "FDA saves lives." (It has also cost a lot of lives, by denying effective treatments for needless years of extra butt-covering tests just so no bureacrat will ever have even a single Flipper-kid on his watch.) Mexico has no FDA. A trip to the pharmacies of Tijuana is instructive. A friend of mine was just here. On a business trip to SF and LA, he drove all the way down to TJ to buy a "personal supply" of a nootropic drug for his mildly-retarded son, a drug the FDA has not approved but which Mexicans and Europeans have been buying for years. U.S. Customs, aware of such tragedies, waves people through who are carrying "personal supplies" of (non-narcotic) drugs. We should learn from this kind of "anarchy" the Mexicans enjoy. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: [ecash] Re: Multi-issuer questions
by daw＠boston.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have to admit I don't know the ecash concepts well enough to respond very intelligently to everything you talked about, though I'd like to address one of your comments on inter-bank clearing. I wanted to bring up one misconception: you mention that the main worth of ecash is measured by whether merchants will accept it as payment, and that whether a bank will accept it as a deposit is just a secondary issue. From this you conclude that so long as a merchant can validate ecash (via online clearing, to detect double-spending), it doesn't really matter whether that merchant's bank will accept the ecash -- just that other merchants will accept the ecash. This is brought up in the context of "what if Bank B didn't accept [deposits of] ecash from Bank A?". I claim that this is at best misleading, because with Digicash's ecash, when a merchant receives ecash as payment, the ecash is "made out" to that particular merchant, and is non-transferable-- i.e. can't be used as payment to another merchant. When you've been payed Digicash ecash, about the only interesting thing you can do is deposit it with your bank. [ For simplicity, I'm ignoring wildcards in the "pay to" field; but wildcards are insecure on their own. Digicash hasn't really attempted to support wildcards or transferable ecash in general, as far as I can tell. Correct me if I'm wrong. ] - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMOYZwCoZzwIn1bdtAQFvaQGA1f4oy6Z2TF9810fIUEqkktpQN01FPUCb ER/q3WI/kuyjQCBJh/laA0QsU2q8jnP4 =8Mib -----END PGP SIGNATURE-----

1 0

RE: last straw (or Possible Developments re Censorship)
by blanc 17 Dec '03

17 Dec '03

From: Dr. Dimitri Vulis And now comes the *point*: There's much information on CompuServe that cannot be accessed from the outside. One example is the very informative National Computer Security Association's forum. ...[etc.] ................................................................................................... Aside from the obvious implications to liberty, of the backing down from standing up (!) to the demand for self-censorship, I was thinking about other possible developments: Since, as 'Dr. Dimitri' mentions, CompuServe offers some info which is not available from other sources - and this info is often quite useful/valuable to business enterprises, such that they and other individuals would not be too keen on abandoning these immediately just for the principle of the thing - it could develop that those who are willing and can afford it, will end up "supporting", or getting services from, different providers based on the particular services which they offer. This could represent a partial solution (in my mind, at least, not being inclined toward blanket censorship of all things discomfitting to my sensibilities) to the matter of there being free-radical electrons "out there" existing in the form & shape of various degrees of sexual permutations: . Those concerned that their children may innocently surf over to alt.binaries.naughty.nude.x-rated.pictures and see alarming truths about adult behavior, and don't want to purchase the available filtering software, could subscribe to CompuServe and rest assured that their children would only have access to safe, industrial-strength info on that account. . Those wishing want to discuss their sexually-related personal problems, or who are pleased to just look at/talk about sex et al, could continue do so through their subscription to the adult bbs-es or local ISPs providing uncensored access to all newsgroups. It could develop that large companies providing internet access will seek to distinguish/identify themselves (as they are tending to do already) between the pablum-feeding family-types like AOL, or corporate/business-types like CompuServe, or free-for alls like local ISPs. Such developments of course would depend on a tolerance for the existence of those un-specialized carriers which aren't adverse to transmitting controversial, "sensitive" content. These divisions among services might still not be acceptable to States and Nations & other 'busybodies', but the resistance to such developments would only serve to more explicitly define the problem; it could make prominent the real issue of people's attitudes, fears, and expectations concerning sex & human nature, and of the obstacles in the way of achieving personal responsibility regarding these (among other things). .. Blanc

1 0

Re: re: Driver Licenses (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 9 Feb 1998 04:22:54 +0100 (MET) > Subject: Re: re: Driver Licenses (fwd) > From: nobody(a)REPLAY.COM (Anonymous) > "Yeah, officer, I dropped my ID in the street and it got run over. Don't > give me such a hard time about it, I'm just glad I got it back..." > I really doubt you are going to get convicted for accidently dropping your > wallet because your ID got scraped up a little bit on the back side. See a previous post I submitted earlier in this regards... > Seriously, the best way is a strong magnet. You can also put it in your > shirt pocket and iron it, then apply a strong magnet. The heat will make > it lose its magnetism more quickly; just make shure you don't melt it. :) The 'Currie Point' (the point a magnetic material looses its magnetic behaviour) for Iron Oxide is 600F so I rather doubt your home clothing iron will significantly effect it. The plastic that the license is made of will melt at about 250 - 300. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

PGP utils?
by mgraffam＠idsi.net 17 Dec '03

17 Dec '03

Is there a utility for Unix (or source available?) that reads a PGP encrypted message and displays some information on it, like what key ID the message was encrypted with, and what ciphers were used? Michael J. Graffam (mgraffam(a)idsi.net) http://www.mhv.net/~mgraffam -- Philosophy, Religion, Computers, Crypto, etc They (who) seek to establish systems of government based on the regimentation of all human beings by a handful of individual rulers.. call this a new order. It is not new, and it is not order." - Franklin Delano Roosevelt

2 1

Re: Australian "calculatorcard"
by vin＠shore.net 17 Dec '03

17 Dec '03

Cees de Groot (cg(a)bofh.toad.com) tore himself from the tube to tell us: CG> Yesterday, on UK Discovery, there was an item in the programme CG> Beyond 2000 about an Australian card which implements a CG> challenge-response protocol and can be used for banking, etcetera. CG> Basically, you give your card number (over the phone), get a CG> challenge number, enter your pin and the challenge, and then give the CG> response. All in CC format... Could be one of seven or 8 vendors of so-called "challenge/response" tokens or calculators. Most of those sold in the US and Australia use straight DES (and a token-specific key) to encrypt the "random" challenge number in the token -- but it could be any secret-key algorithm. Actually, the particular environment described -- phone authentication -- is often used as the most notable example of a market where so-called "time-synchonous" tokens hold a notable advantage over challenge/response token. A TS token generates its pseudo-random token-codes continuously and automatically: no buttons, no input. With TS tokens, exact time and a token-specific key are used in a keyed hash to generate a token-code displayed on an LCD on the token for 30 or 60 seconds. The authentication server uses its database record of the token-specific key, time, and the hash to generate the same token-code for a match. This allows a PIN and token-code two-factor authentication to be submitted by touch-tone phone, and it avoids a lot of the hassle (listen/tap/calculate/touch-tone) associated with C/R authentication. As amp <Alan.Pugh(a)internetMCI.COM> noted, the most prominent international vendor of time-synch tokens is a US firm called Security Dynamics, Inc. I've done consulting projects for SDI, off and on, for years. >sounds like the card i use for remote dialup to certain non-public >systems i use at work. it has a six digit number on the front that >changes every 60 seconds. the card is registered to me. when i enter >my username/password i'm prompted for the number. SDI's token is called a SecurID. <http://www.securid.com> SDI uses a <sigh> proprietary hash. The most common app uses a SecurID in a protocol which prepends the PIN, in the clear, to the PRN token-code. (In client/server environments, of course, all communication between an SDI ACE/Client and the ACE/Server is fully encrypted.) SecurIDs can also be loaded with up to three different seeds or keys -- with a pressure-point in one corner to switch between each series of key-based PRNs. For greater security in open networks, SDI sells a PinPad token with a keypad that allows a PIN to be "added" to the PRN token-code -- so the LCD displays a 6-8 digit number (or alphanumeric) which still offers two-factor authentication, without exposing a PIN. > it's Pretty Good >(tm) security, but like anything not biometric, it is vulnerable to >black-bag attacks. physical possession being all that is required. Actually, all ACE/Server or ACE software modules _require_ a user-memorized PIN. Physical possession of a stolen token is not enough to gain illicit access. >if >you know the algorithm and the serial number of the card and the >time, even that isn't necessary. Bleep! Earth to amp! Check your voltage, lately? The token's serial number has nothing whatsoever to do with the generation of a SecurID's PRN token-code. Just because SDI ships its SecurIDs pre-loaded (most token vendors ask the buyers to program their authentication tokens) SDI embosses a serial number on the back of the token to manage shipping and distribution. The serial number stuck to the back of a SecurID after it is programmed with its secret key -- a unique PRN "significantly longer" than 56 bits -- but they are not the same thing. The cpu in a SecurID doesn't even "know" the serial number stuck on the back of the token. (It would be Pretty Stupid <TM> to glue or emboss a secret on the back of the damn token, wouldn't it?) I should note that Alan is just regergitating one of the most widely circulated rumors about SecurIDs -- which like any popular crypto device attracts a lot of wiLd & w00ly speculation. Getting the algorithm for SDI's one-way hash is no big deal, given that it sits in software in thousands of SDI customer installations, protected only by contract and trade secret status. (The integrity of the product -- the unpredictability of the token-code PRN series, and the secrecy of a specific token's seed or key -- rightly depends cryptographic strength of the hash, not the secrecy of the algorithm.) Getting a token-specific secret key would hopefully be a much greater challenge. CG> Can anybody provide me with pointers to more in-depth information CG> about this device and the algorithm(s) behind it ? >i don't know if there are any net sources for them, but i'd be >suprised if not. my card references "security dynamics" of cambridge >massachusetts. Suerte & Happy New Year to all, _Vin <*><*>< Vin McLellan + The Privacy Guild + vin(a)shore.net ><*><**> Heed, fellow citizens, Justice Felix Frankfurter (Butler v. Michigan): "The State insists that, by thus quarantining the general reading public against books not too rugged for grown men and women in order to shield juvenile innocence, it is exercising its power to promote the general welfare. Surely this is to burn the house to roast the pig.... The incidence of this enactment is to reduce the adult population of Michigan to reading only what is fit for children."

1 0