- cypherpunks-legacy - lists.cpunks.org

Snake_Oil_punks was Re: SafE Mail Corporation
by Scott Schryvers 17 Dec '03

17 Dec '03

Talked with Randy of Safe Mail Corporation on the phone. Among the stuff he claimed was that PGP has the secret key in its public key! Found out that not only does this algorithm use 22 characters. The characters are the ones only found on the keyboard. SafeMail uses a proprietary Russian algorithm. Not only is this company misquoting it's making up as it goes along. :)

3 2

Whats new at Bletchley Park
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

Greetings; I have just returned from spending a week at Bletchley Park, and have the following to report: On Thursday, 6 June, we had the official switch-on of the rebuilt Colossus. There is still a lot of work to be done on Colossus, but that which is there is definitely working. What remains is to fill in the holes to expand it to the full five wide system that was the Mark-II machine. The switch-on was accompanied by a reasonable sized media affair with many of the original Colossus users present. Also in attendance was Tommy Flowers, the designer of the original, along with his wife and son. It was the first time that his wife had seen or even heard a lot about Colossus. Dr. Flowers, now in his nineties, has a wonderful memory and is a first class gentleman. It was a real pleasure to spend some time with him. There was a lot of local media coverage, but as yet I have seen nothing in international media, such as The (London) Times or the Financial Times, both of whom were represented at the switch-on. During this time, I also installed a new Sun Netra-I server at BP. This server was most kindly donated by Sun Micro Systems. Many thanks to Scott, who set the direction for this gift, and to Matthew, Michael and Steven at Sun-UK for all their efforts in making this happen. A four GByte disk farm was also donated by BoxHill Systems. Thanks to Carol, Ben, Philip, etal at BoxHill for this contribution. This server will provide Internet and WWW access to BP and will serve as the BP mailhost. Once we have the communications facilities in place, the server, elgar, will be on-line. I'll keep the net informed re: our progress in that direction. Once on-line, Tony Sale has a lot of very cool ideas for web pages, including an interactive, GUI-based Enigma emulation. Tony and James Bristow also plan to move their existing Web pages to elgar. The plans to make BP into a one-of-a-kind museum are well underway. Many improvements and added facilities have been added since I was there in April, including a nice bar and restaurant in the original Hut Four. Again I will keep the net up-to-date until the Web server is generally available. I strongly urge everyone who has the opportunity to visit BP to do so. At this point they are open every other weekend, but will, at some point in the future, improve on that. If you have any questions, e-mail me, or for 'open weekend status' call BP directly at: (011 44) 1 908 640404. Many thanks to my friends and colleagues at Bletchley Park; Roger, Peter, Tony, Harry, Margaret, etc, for their hospitality and kindness. -paul (pjb(a)23kgroup.com)

1 0

Re: Fuseable Links - no guarantees??
by wxfield＠shore.net 17 Dec '03

17 Dec '03

>I don't know of any modern chips that have "ceramic coatings." (Some chips, >esp. CPUs, are still ceramic-packaged, but in these cases the metal or >ceramic lids are easily removed.) > >Most chips are plastic-packaged, and plasma ashers and/or chemical baths >will expose the chip surface easily enough. Yep....I guess my age was showing ;-) _______ Warren Crossfield Programmer/MacOS "Buy a Pentium - so you can restart Windoze faster!"

1 0

unsuscribe
by Pascal Mattiocco 17 Dec '03

17 Dec '03

unsuscribe

1 0

Re: "Mail Exploders"
by long-morrow＠CS.YALE.EDU 17 Dec '03

17 Dec '03

From: vin(a)shore.net (Vin McLellan) > The only meaningful control on SPAM I can see is to start enforcing >a chain of contracts that forbid it (without reference to content) from the >backbone back through the IAPs to the users. (I think Long-Morrow at Yale >had a nice paper on this a couple of years back.) But this sort of >auto-return mechanism could make a dent on the super-Spanners now. Actually the paper was written by our Assistant Chairman (Dunne-Bob(a)CS.Yale.EDU) I only made the paper available via FTP, Gopher, WWW and email. ftp://www.cs.yale.edu/pub/dunne/jurimetrics/ gopher://www.cs.yale.edu/11/pub/dunne/jurimetrics/ http://www.cs.yale.edu/pub/dunne/jurimetrics/jurimetrics.html mailto:majordomo@cs.yale.edu ( put 'get sneakers jurimetrics.txt' in message body ) H. Morrow Long, Mgr of Dev., Yale Univ., Comp Sci Dept, 011 AKW, New Haven, CT 06520-8285, VOICE: (203)-432-{1248,1254} FAX: (203)-432-0593 INET: Long-Morrow(a)CS.Yale.EDU UUCP: yale!Long-Morrow BITNET: Long-Morrow@YaleCS WWW: http://www.cs.yale.edu/users/long-morrow.html

1 0

Re: Federal key registration agency
by jim bell 17 Dec '03

17 Dec '03

At 04:27 PM 6/18/96 +0200, TM Peters wrote: >Compuserve Online Today Daily Edition, 15 June 1996: > >Attorney General Janet Reno is advancing a plan to establish a new agency >overseeing all digital encryption, saying that would make it tougher for >criminals and terrorists to use the Internet to carry out crimes. [...] >Reno added, "We look only to make existing law apply to new technology," Such a claim is bogus. "existing law" already "applies" to new technology. It's just that this only means that cops think they have a right to wiretap. It does not mean that they are able to usefully understand the meaning of what they hear. >adding new computer programs designed to crack the new complicated >encryptions take too long to be useful to law enforcement. Like a billion years too long, huh? > "Some of our >most important prosecutions have depended on wire taps." But is the average citizen substantially impacted by crimes that would be assisted by good encryption? Probably not. >She also said registration of keys might end up being a worldwide >requirement, since the Internet is used increasingly for international >communication, commerce, and criminal enterprise. She forgot to mention REVOLUTION. >Reno told the group that effectively regulating electronic encryption will >depend on finding a balance between protecting privacy interests while >stopping criminals from cashing in on the new technology. I see no need for a "balance." I think that the advent of good encryption has the effect of increasing the security of individuals. >"If we do our job right citizens will enjoy the Information Age without >being victimized" by high technology, Reno said. Maybe she should have said, "without toppling the government-employed parasites from their positions of power." >United Press International >Charles Bowen Another one of those organizations threatened by media-bypass. Jim Bell jimbell(a)pacifier.com

1 0

Re: SafE Mail Corporation
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:55 AM 6/18/96 -0700, Lucky Green wrote: >At 17:21 6/17/96, M.Wagoner (1 wrote: >>We would like someone to be able or should I say try and crack our >>encryption. IT IS IMPOSSIBLE. > >Sigh. Yet another one... > >Unless you make source code available, you will be at best ignored, and at >worst sued by users of your product should they discover that your >unbreakable encryption isn't so unbreakable after all. Unless you use a >hardware RNG and OTPs, your statement that it is impossible to break your >encryption software is simply false Don't even assume that hardware RNGs and OTPs by themselves make a system unbreakable. Go see NSA's web site on the Verona intercepts to see what people who know what they are doing can do when users slip up using a OTP system. http://www.nsa.gov:8080/ I'm with Lucky (and many others) 100% on this one. Snake Oil. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Micropayments, Anarchy, It's All The Same... ;P
by Stephan Vladimir Bugaj 17 Dec '03

17 Dec '03

>>that is associated with any new technology should be better analyzed by the >>few who care about the future rather than those who just worship the future >>to ensure that the decisions which are made by this almighty 'market' >>(again, I distinguish this from either the 'people' or the 'consumers') > >Er...just how did you draw that distinction? I seem to have missed it. >I suppose that by believing the free marketplace best satisfies peoples' >and consumers' needs (not perfectly, just best) that I am a worshiper >here. So be it, but see if you can explain the difference between >non-marketplace decisionmaking and bureaucrat decisionmaking for me. > > > The distinction that I'm making is that the 'market' is governed by both consumers and producers. As such, what the market will bear can and sometimes does diverge from what consumers want. Taking a really silly example, let's say you want a blue car, but the auto industry decided that blue cars constituted too few of their sales to justify the purchase of blue paint. However, they did this study in Malibu, where everyone wanted a red car, because some statistician felt that was the perfect demographic for their line of cars. He was wrong. Now middle America, who loves blue cars, can't get any. They have to settle for red cars as the next best thing. Next year the market will probably readjust and blue cars will again be available, but for the year the bulk of consumers had little say in market decisions. Producers can and will also 'dump' undesirable products on the market as we have all seen before. Sometimes consumers complain, sometimes they just groan and bear it. But the fact of the matter is that the 'market' is comprised of two main elements: 'consumers' and 'producers' and the market climate is not solely determined by consumers' needs. Bureaucratic (government) decision making is no better. Keep in mind, however, that capitalist organizations (producers) are themselves bureaucratic institutions. Therefore, bureaucracy plays a central role in the free (sic) market. A balance between the power of the public and private sector generally best represents the peoples' and consumers' needs. How the market diverges from the polit is clear. The market is only concerned with consumers, and this leaves out the poor, who are undeniably part of the polity. In fact, if you take just the technology market, that market is primarily producer-to-producer (business-to-business) and the traditional consumer (an individual or family) is a relatively recent addition to this market. Interbusiness concerns still drive this market. >>'rammed down their throats'. Sometimes people forget that technologists >>and their venture capitalist backers aren't the best representative sample >>of the world's population, nor are they a reliable source of objective >>information about the correlation between the 'market' and the 'polit'. > >They aren't the best, they are simply more reliable than Hillary >Clinton and co. are. > > There are two ways to go on this. It's important to realize that while government officials are professional politicans with all the moral and ethical compromise that this entails, they are also ultimately responsible to their constituency. The role of government is different than the role of business, and I for one would not be willing to give up democratic government (ragardless of its hypocracies and flaws) in favor of a business bureaucracy as our national ruling hegemony. Businesses, especially ones governed by unmitigated capitalists, are responsible only to profit. The social darwinist perspective of most capitalists is such that this profit can come at any cost, and things will 'work themselves out' according to natural (sic) social selection. This is a morally and ethically dangerous viewpoint to have. The polity is supposed to be able to count on their government to be their voice of power against the transgressions of more powerful individuals at the top of the capitalist power structure. This is not usually the case, as government officials rely on these powerbrokers for their jobs and kickbacks, but at least in the United States the people have theoretical constitutional recourses against serious infringements of their rights. While centralized government has serious problems, weakening the federal protection of the bill of rights would serve only to increase the ability of the powerful to abuse the polity (and create chaos since 50 different sets of state laws would provide an amazing web of loopholes for would-be tyrants). Our government is supposed to be kept in check by the people, and I believe that is what people like the Cypherpunks are and should be doing. However, don't go running to Laissez Faire capitalists as your comrades in arms in the struggle to keep powerful institutions out of your personal lives, because you'll be more than just disappointed if you help private sector powerbrokers whittle away the protective powers of the public sector. Morally I'm more Anarchist than Centrist, but I'm also willing to face reality. >Agreed. The most forthright possible debate comes on cypherpunks IMO. >The least forthright comes from the government/media complex. Crypto- >anarchists aren't proposing utopia, just improvement -- which is a >much easier standard to meet considering what we have. I am sure >there will be problems and frauds, just as there were Ford Pintos. >Note that the Pinto phenomenon was possible in spite of pervasive >and growing govt. regulation, yet the response: Even more regulation. >Hmmmmm. >JMR > > There needs to be a balance between too much regulation, and too little. The public sector has a system of checks and balances which doesn't always work, but is institutionalized and respected. The private sector, however, is not so accountable and their only checks and balances are the laws that we the people are obligated to insist be enforced. Morality and justice break down easily in the face of bribes and hush-money, but with an institutionalized system of justice there is at least a modicum of accountability which is necessary for a society(ies) which is far too immature for true Anarchism. Keep in mind the role that capitalists played along side the government in Nazi Germany, (unchecked) power corrupts - regardless of whether you're in the public sector or the private sector. (Yes, capitalism was technically regulated in Nazi Germany, but that is not the point.) I am as unwilling to support Laissez Faire capitalism as I am to support an intrusive and restrictive government. ttl Stephan ------------------------------------------------------------------- This signature has been kidnapped by space aliens. If you find it you can call (415) 703-8748. I work for Studio Archetype, and they don't find any of this funny.

1 0

Safemail
by Black Unicorn 17 Dec '03

17 Dec '03

If the below is accurate, your company is in even more trouble. I do hope no one would think of RECORDING a conversation with a safemail represenative. I admit that it would be valuable to an attorney looking to sue Safe Mail, but it's not a very nice thing to do. Even if its legal. (which it would be in most states). ---------- Forwarded message ---------- Date: Tue, 18 Jun 1996 08:39:12 -0500 From: Scott Schryvers <schryver(a)radiks.net> To: cypherpunks(a)toad.com Subject: Snake_Oil_punks was Re: SafE Mail Corporation Talked with Randy of Safe Mail Corporation on the phone. Among the stuff he claimed was that PGP has the secret key in its public key! Found out that not only does this algorithm use 22 characters. The characters are the ones only found on the keyboard. SafeMail uses a proprietary Russian algorithm. Not only is this company misquoting it's making up as it goes along. :)

1 0

Source Laundering <was: You bet they have/are: NSA/CIA to snoop INSIDE theU.S.???>
by vin＠shore.net 17 Dec '03

17 Dec '03

Mr. Nobody, an anonymous source of no repute, posted a pretty savvy analysis of the politics of unauthorized wiretaps a week back: > anyone who believes the FBI and a host of other U.S. agencies even > less scrupulous does not wiretap without permits, has been standing > behind the door. generally, it does not matter if the information >learned is > admissable in court --they never admit wiretapping in the first place as > the agency themselves, in many cases, *did*not*wiretap* --but the > agency does buy info from usually unsavory "contractors" who do wiretap. This conforms to my information too. Back in the mid-80s, I took a wiretap counterintelligence class with a lot of cops, PIs, and oil company securitymen. (The quietest guy in the class, a balding little whimp at the tech bench behind me, was a PI by the name of John Walker, who later drew some attention with his overseas business interests. The weirdiest guy in the class was another PI who kept trying to talk to the other guys about their work but was jerked around because everyone knew he was always wired and at the end of the day would rush back to his hotel room to put the tapes through a voice stress analyser. I would have said the most dangerous guys in the room were the grizzled Malasian oilmen, but in hindsight Walker probably takes the prize.) The instructors were big Ray Jarvis (now of Jarvis Security,) an ex-Marine reputed to have recently been the CIA's top wireman, and Allan Bell (now of Dektor Counterintelligence,) the former director of the US Army's spy shop R&D (who probably has as many secret patents as Friedman did) -- both smart, thoughtful, amiable guys who knew their tradecraft cold. What I remember most of the week long class was Ray Jarvis standing before my classmates and estimating that maybe 10-15 percent of the domestic wiretapping and bugging -- circa '85 -- by US police agencies was legally authorized. He paused and looked around the room for the consensus. Half the room (mostly big city US cops) paused, looked off in the distance for a moment, then nodded. My sense is that lawmen typically planted the relevant information in the hands (or mouths) of a maluable "trusted source" when they did the wire themselves. If a subcontractor did it for them (on a purposely vague assignment,) they just didn't ask how the "trusted source" managed to get the information. Either way, it worked like money laundering. Source laundering, you could call it. The cops didn't seem to view themselves as angels, but they were usually utterly certain the guys they were targeting were the scum of the earth. Maybe they were. My expectation was that most of the illicit wires would be focused on the drug trade (where cops feel like the Border Patrol in El Paso, hopelessly outclassed by their opponents) but -- at least at that time -- the scuttlebutt seemed to indicate it was much more broadly used in criminal investigations. Both wiretaps and bugs are just so damn easy to place, so cheap, so deniable, and (done properly) so untracable, the temptation was virtually irresistable. And there seemed to be a whole subculture of master wiremen, trained by the US Govt, accepting bids from both the Law and corporate security agents. (Outside the US, particularly in the oil business, it sounded like the Wild West before Judge Bean showed up. I've never doubted that the cost of a DES-cracking special purpose computer has been buried among the expense chits of many multinationals, certainly in the Big Oil Government budgets. I'd love to talk to the NSA guys who went in with Desert Storm to find out what the Iraqis picked up from Kawaiti government/oil IS installations;-) I don't expect much has changed, except everything has gotten smaller, cheaper, and (with datacom) vastly more automated. What those guys knew in the 80s were the phone systems (poor design left many PBXs with back doors, some of which could even be triggered remotely) but we've all learned new tricks -- and the NSA and others always concentrated on CompSec. > as for the NSA/CIA spying on US citizens --they dont, they spy on > British citizens with facilities provided by M5 and M6. in return, > British M5/6 agents spy on U.S. citizens from Langely or Gaithersberg, or > wherever. The fact they just happen to share information is an > "accident." In this, I doubt Mr. Nobody. I can't see either the Brits nor the Yanks willing to trust the other nation's bureaucratic system to keep in-country spying secret. The rule was: governments leak... eventually. And the fallout of Revelation would be awesome. (And there were so many safer options.) I suppose, however, Nobody's scheme fits the "laundered source" model too. I recall talk of this sort of arrangement mostly to cover US citizen to US citizen phone links across the US border. I'm not even sure the NSA couldn't legitimately do this, but after the Church Committee hearings in the 1970s, everyone wanted to keep their numbers low. (The extreme was the FBI, of course, which would show up annually to report what? 7 or 11 authorized wiretaps for the year. Everyone barely able to control their snickers.) My apologies if Memory Lane took up too much bandwidth, but the politics of crypto have a heritage that's ever more relevant. (Witness all the direct and indirect reference to Kahn and Bamford's work on this List.) A thought: Being pessimistic lately, and assuming our elected US pols continue their subservience to the spy agencies, I have a question. How difficult would be it to concoct a encryption-based scheme which would hold escrow keys in some sort of serialized time-sensitive one-way account -- a device that would make it all but impossible to get a key out of the account without leaving a permanent record that it was retrieved. How many were retrieved? When? By whom? Is there such a scheme? How does/could it work? In defending privacy, Accountability is a very powerful weapon. (Remember those FBI reports of 7-11 wiretaps?) I'd love to see such a tamperproof recording device imposed upon the FBI's access to its new Master Wiretap circuits, for example -- with a legislatively-mandated revelation of the unforgable results, something comparable to the current law in criminal cases, and maybe with some 5-year sunshine provison for national security cases. Such a scheme might be all we can get if this Administration or a future one gets a version of Clipper mandated. Cynics like many of you on this list may not realize how desperately these guys want to keep to the shadows. Bright Lights and Accountability ought to be a Cypherpunk Goal -- even when the tide is running against us. A well-documented tamperproof accounting scheme to document the use of these intrusive powers could result in a potentially powerful piece of legislation. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

2 1