- cypherpunks-legacy - lists.cpunks.org

crypto for porno users
by Carl Ellison 17 Dec '03

17 Dec '03

I hear occasional uproar from LE types about porno traffickers using strong crypto like PGP. [I've been known occasionally to say things for their shock value, but this time I'm quite serious.] ------------------------------ As a society wanting to limit the spread of porn, we should encourage those trafficking in porn to use strong crypto. 1. If two people are sending porn from one to another over the net, the net is so insecure that many people along the way could see it. The recipient field could be mistyped, as well. Either way, someone who doesn't want the porn could receive it and be offended. Strong crypto wrapping that porn protects the innocent accidental recipient from exposure to the porn. 2. If cops want to track down some pornographer (e.g., because he's dealing in child porn), the net and strong crypto provide two opportunities to the police: a) "no one on the net knows you're a dog" implies that police can pose as a fellow porn producer or consumer and get away with it more easily. b) strong crypto for communications between porn users encourages them to speak more freely. When one of the two is a police officer in disguise, that encourages the other (the suspect) to reveal more, making the investigation proceed more quickly. Knowing that the crypto is strong enough to keep government eavesdroppers out, the sender is given a false sense of security -- is distracted from thinking about the trustworthiness of the receiver while thinking about the security of the channel itself. 3. Encryption of porn would work against the kind of porn distribution found on the alt.binary.pictures.erotic... newsgroups. Encryption requires that recipients be identified. 4. Personal file encryption encourages individuals dealing with porn to encrypt and keep personal diaries which might contain evidence. Since PGP is subject to brute force passphrase attacks, this gives an attack which will open *some* of these diaries. Without the encryption, the suspect is less likely to keep the diary in the first place. This isn't a guaranteed opening into all such diaries. There is no such guarantee possible. Rather, this suggests that strong crypto has a chance to maximize the effective "take" by LE forces. These advantages are balanced against the possibility that there is some group of pornographers who communciate together, who are identified by the police, who would be wiretapped *and* who are not infiltrated -- and therefore whose conversations are unavailable to the police. The larger such a group, the less likely it will remain non-infiltrated, so these groups are probably very small. There might be some of these -- just as there might be a few pornographers who have diaries that are encrypted and unbreakable. However, strong crypto opens a number of opportunities for successful investigation -- and it's my guess that in the balance, strong crypto adds up as a net advantage to the police rather than a net drawback. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

hacking smartcards
by Ken Williams 17 Dec '03

17 Dec '03

Hello, http://cuba.xs4all.nl/~hip/ nice info, ideas, and website. Regards, Ken Williams ORG: NC State Computer Science Dept VP of The E.H.A.P. Corp. EML: jkwilli2(a)adm.csc.ncsu.edu ehap(a)hackers.com WWW: http://152.7.11.38/~tattooman/ http://www.hackers.com/ehap/ PGP: finger tattooman(a)152.7.11.38

1 0

Re: Gary Lee Burnore and His Anti-Privacy Zealots are on the Warpath!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

William J. McClatchie <wotan(a)databasix.com> wrote: > >Anti-privacy kooks like you and DataBasix CEO Gary Lee Burnore are one of > >the best arguments for the existence of anonymous remailers. You and your > >friends at DataBasix have a hard time bullying and harassing people into > >silence that you can't identify, don't you? > > And assholes like yourself are the best argument for *banning* remailers. > They serve a purpose. Unfortunately, to meet the purpose means that > assholes are also given access to the service. Your own record of harassing remailers is well known, McClatchie. Calling remailer users "assholes" and calling for content-based censorship only underscores your anti-privacy agenda. If remailer users posted only what was popular and politically correct, there would be little need for remailers. One remailer operator who was forced to shut it down mentioned your name quite prominently, BTW, in providing details about the attack. > It was someone using a remailer to harass Wells Fargo management. Can you document this? I never read a single post from anyone claiming to speak for Wells Fargo management which has substantiated this. Nor did any of the remailer operaters involved mention having received such an official complaint from member of Wells Fargo's management. So all we have is you parroting Burnore's original unsubstantiated allegations. Isn't it interesting that when something offends Gary Burnore he often resorts to "defending" phantom victims of the alleged "abuse"? And shortly thereafter, various of his sock puppets echo his whining chant. > It was someone using a remailer who has spambaited several hundred > email addresses. And one such post contained Gary Burnore's own .sig block still appended to an otherwise anonymous post. Oops! > It was someone using a remailer who wants to know if Gary Burnore's > current employer knows of his background. And if not, how could they > be contacted. > > It was someone using a remailer who posted, in direct violation of NC law > information in its registry for the sole purpose of harrassing someone. Please cite the NC law which you claim is being violated, and how it would apply to a remailer located outside of NC? Would you also say that remailers ought to censor their content to avoid other laws being broken, such as insulting the religion of Islam, publishing information about birth control, abortion, etc.? If not, why should a foreign remailer selectively enforce this one law in NC (if it even exists)? Telling people that the website exists and that a search for "Gary Lee Burnore" on it might yield a match is not more "harassing" than the site itself. If they didn't want people to access this data, why publish it on a public website? The whole purpose of the website it apparently to let people to know who the registered sex offenders are in NC and where they live. If someone snail mailed you something you considered "harassing" and included no return address, would you accuse the sender of trying to get the postal service shut down? Wow, McClatchie. I guess you have a point. If you and Gary claim that all that happened, and that it was done by someone outside of DataBasix, then I guess we should believe it and shut down all the remailers just to make sure they aren't abused... But the fact is that all too often in the past, designer "abuse" would just automagically appear at critical times when Gary Burnore and Belinda Bryan were making demands (privately, via e-mail) on another remailer operator. How would someone outside of DataBasix have known that? How would someone other than a DataBasix insider have gotten access to the complete list of DataBasix' clients and employees in order to allegedly "spam bait" them, as Belinda claimed? Your own involvement in all of these attacks seems to more than just coincidental. Speaking of abuse and harassment, Gary Burnore demanded that Jeff Burchell turn over to him all of his remailer logs containing the e-mail addresses of everyone who had either sent or received anonymous e-mail through the server. Yet Gary refuses to disclose how such a list would have been used. Fortunately for the remailer user community, no such data was ever collected. > >Lest anyone forget, Gary launched his first tirade against anonymity when > >someone tipped off his molestation victim's mother and school officials > >anonymously. > > No, one of his first complaints about remailers was after someone used one > to harass his SO of the time, and her daughter. They had committed the > heinious crime of knowing Gary. Most women would not consider it "harassment" to be informed that their daughters were being molested. Nor did she complain. Gary did! How nice of the perpetrator to be so considerate of his victim's mother and not want to have her "harassed" by knowledge of what Gary was doing to her daughter. Ignorance is bliss, huh? Gary's motives were finally revealed when he was CONVICTED for that very crime. How would a random harasser have even known of Gary's sexual activities involving minors, before he was arrested and convicted? How would he/she know the victim's gender, age, identity, and city of residence? > >Whistleblowing has always been one of the important functions > >of anonymous remailers. > > Uh huh. And we've seen real "whistleblowing" activity here. Apparently so, when the perpetrator of the crime is the only one who complains about being exposed. In case it has escaped your attention, Gary complained PUBLICLY about a PRIVATE e-mail message to his victim's mother. If telling a mother that her daughter is being molested isn't whistleblowing, what is? > Seen plenty > of abuse. Seen postings of such a vile nature from remailers that when > people made similar postings from traceable accounts, their ISP's > terminated them. And it was not becuase of content - but becuase the > messages were harassing, in both nature and intent. TRANSLATION: Anything with which the fine folks at DataBasix disagree tends to be called "harassment" and "abuse". As for intent, the accuser has the burden of proof, there. But consider this: if even mentioning Gary's sexual activities with minors is "vile", what does that make Gary for actually committing them?

1 0

SmartCards in the news
by Information Security 17 Dec '03

17 Dec '03

Also see: http://www.zdnet.com/pcweek/news/0112/12bio.html ---guy --------------------------------------------------------------------- This article is from Internet Computing (http://www.zdnet.com/icom/) Visit this page on the Web at: http://www.zdnet.com/icom/content/anchors/199802/02/smarten.net/ --------------------------------------------------------------------- [ Features ] February 02, 1998 Smart Cards Smarten the Net By Albert Pang For many contractors to the U.S. Department of Defense, the Internet will become an important ally this year, helping them resolve one of the most daunting challenges when doing business with the government: Getting paid on time and with a minimal amount of hassle. Thanks to a new breed of smart cards backed by sophisticated Web applications, 200 defense contractors will start receiving electronic checks (e-check) from the government via secure Internet e-mail through a pilot program launched in January 1998. The contractors will use their smart cards to access the mail box, validate, and endorse the checks. They will then forward the checks to BankBoston or NationsBank, the two authorized banks, that will deposit them into their accounts. The smart cards, which include digital certificates developed by GTE Cybertrust, will play a critical role in helping the defense department and other agencies comply with a mandate that requires most of the 800 million payments the government makes every year be converted to electronic form by January 1, 1999. Because of the mandate, the number of smart-card applications in different stages of development within the government has doubled to more than 900 in the past year, says Jim Hagedorn, a spokesperson for the Treasury Department. That's good news for vendors such as Anthony Caputo, chairman of Information Resource Engineering (IRE) in Baltimore, which develops the smart cards and the readers for the e-check program. "It will create a nice revenue stream," Caputo says, adding that his company has issued 100,000 smart cards to government and corporate customers mostly for use in private networks. Now with the Internet, the smart card market could grow substantially, especially in Asia and Europe. "Smart cards are the ultimate personal network computers," capable of handling everything from simple tasks such as identification to complex ones such as online banking and electronic commerce, says Philip Yen, senior vice president of chip platform at Visa International in Foster City, CA. [TABLE NOT SHOWN] Both Visa and its rival MasterCard are engaged in smart-card pilots around the world, promoting the use of stored-valued chip cards that run on private networks or the Internet. For example, AT&T Universal Card is working with Mondex, the electronic cash venture majority-owned by MasterCard, to sign up a small number of online merchants for a pilot program that will allow Internet users to buy products from them using smart cards issued by AT&T. However, analysts expect acceptance of smart cards in the United States to be slower than that in other countries because of privacy concerns, interoperability issues (Visa and MasterCard use different operating systems, for example), and the desire to put as many complex applications as possible on a single card. Albert Pang is the online editor of the Internet Computing MagaSite Send e-mail to apang(a)zd.com. --------------------------------------------------------------------- Copyright (c) 1998 ZDNet. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of ZDNet is prohibited. ZDNet and the ZDNet logo are trademarks of Ziff-Davis Inc.

1 0

Re: Bush Gang Suspected In Assault On Presidency
by Bill Stewart 17 Dec '03

17 Dec '03

EIR is one of the mouthpieces for the Lyndon Larouche cult. I ran across them in an airport recently, and was surprised to find they're now strongly behind Bill Clinton; I'd thought that a few years ago they were accusing him of being a tool of the Tri-Lateral Commission, though perhaps it was some other group of anti-TriLateralists. At 10:22 PM 2/1/98 EST, covici(a)ccs.covici.com wrote: >Bush gang suspected in new assault on Presidency > >by Edward Spannaus and Jeffrey Steinberg > >In the midst of the worst global financial crisis in modern history, the >United States Presidency has come under renewed, vicious attack from a >combination of British and nominally ``American'' Bush-League circles. ... >From Executive Intelligence Review V25, #5. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

4 4

Re: Spam the Sign!
by Frank Stuart 17 Dec '03

17 Dec '03

>[regarding suggestion that netscape give mit or someone a 128 bit version >to place on an ftp server] > >This is not an apology for the the ITAR, just my usual lawyerly overcaution: > >Suppose A gives B a program that is export controlled, intending for B to >allow it to be exported. Has A conspired with B to export the program? > >Let's ask the grand jury investigating Phil.... That's a possible problem, I suppose, but wouldn't you be protected if your license agreement with MIT (or whoever) specified redistribution "for domestic use only"? | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

3 4

Re: towards a theory of reputation
by Hal 17 Dec '03

17 Dec '03

From: Scott Brickner <sjb(a)universe.digex.net> > > Hal writes: > >Changing the market conventions (say, by introducing escrow agencies) > >will change the weightings of the various factors that make up > >utility. If I no longer have to trust the honesty of the person I am > >trading with (because we have an escrow agency to help us make the > >exchange) then the importance of his reputation for honesty goes down. > >The result is that the "reputation" curves will change rather > >dynamically and unpredictably as we consider different possible > >structures in the market. This will make the analysis of them > >intractable, I would think. > > Analytically, using an escrow agent doesn't change the utility > function. It replaces the trading partner's honesty reputation > estimate with the escrow agent's (which is presumably higher, or why > use them?). This is just a parameter substitution. > > Whence comes the intractability? By the "utility function" I was referring to Wei's model in which each person has an idea of how much "utility" (a general summation of personal value and usefulness) they would get from another person, as a function of cost. The utility function takes cost as input and returns "utiles" (or whatever) as output. So, with this model, using an escrow agent would change the utility function; for a given cost, the utility of a person to me would change (say, if the person involved were thought to be dishonest, then the presence of escrow agents would make him more useful to me). The utility function in Wei's model is a curve where the Y axis is utility and the X axis is cost. Changing the importance of honesty will change the position and shape of this curve. I think it would be more tractable to have a model in which honesty played an explicit part. We might even make assumptions about the mathematical relationship between honesty and overall utility - for example, that utility to me would be monotonically increasing with increased honesty of the other guy. What I mean is something like this. Let t be the degree of trust necessary for a business relationship to be consummated. For t=0, no trust is needed, and the relationship is such that neither party takes any significant risk - a cash sale, perhaps. For t=1, in some sense total trust is needed, and a party can cheat the other with 100% safety. Now let h(t) be the honesty reputation of a person, so that the utility which people expect to receive from them gets multiplied by h(t). For a person with a repuation for honesty, h(t) is close to 1 for all t. For a person who seems dishonest, h(t) will go from 1 to 0 as t goes from 0 to 1. This is all pretty hand-wavy, but the idea would be to come up with good strategies to estimate h(t) from a person's behavior, and good ways to choose what kind of behavior one should follow given the value(s) of t which are prevalent in the market. This kind of analysis would lead you to focus on the importance of the amount of trust needed in a transaction. The underlying utility function is based on such traditional factors as productivity and reliability. It won't change as we consider the variables of our analysis, because we have factored out the honesty and trust issues so that they are more explicit. That's the kind of direction I was suggesting. Hal

2 1

Your Opinion Matters...
by Eat Shit 17 Dec '03

17 Dec '03

I think I should walk into a Luby's Cafeteria and start blowing people away at random, for no good reason. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT I think I should go down to a local school and start randomly slaughtering the children. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT I think I should monitor the electronic communications of every person on the face of the earth, in order to protect them from themselves. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT I think I should attempt being elected the leader of the most influential country in the free world, by kissing the asses of the money and power mongers. ~ If you agree, vote by dialing 1-800-EAT-SHIT ~ If you disagree, vote by dialing 1-800-EAT-SHIT NOTE: If you don't have a phone, you become a guest on a TV talk show where I am appearing, and cheer or boo me, according to your wishes. Remember: Your opinion matters...NOT! EatShitMonger

1 0

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:32 PM 12/17/95, Anonymous wrote: >What caught my attention was the architecture. > >A "hybrid design linking two supercomputer processors with an >array of HALF A MILLION inexpensive processors" that were >designed by the U.S. government laboratory affiliated with the >NSA. The same chip house that brought us Clipper. First, half a million chips is not that big a deal...the Connection Machine had up to 64,000. Very few cryptographic problems of interest to us will be affected by a mere factor of a million or so. Second, there was work on a "processor-in-memory" architecture, in conjunction with a Bowie, Maryland spook-connected company. Perhaps this is what you are thinking of? Third, all avenues of continued funding having fallen through, Cray Computer (not Cray Research, of course) was shut down and assets liquidated. I haven't heard what's become of Seymour, though. (He is undoubtedly an asset, buy I doubt the Agency would have him liquidated.) >I've not kept up with the "ultimate" demise that eventually >befell Cray Computer Company, but the October 16 FBI filing >on capacity for Digital Telephony got me thinking back to this >article. 1% seems like a rather huge need for horsepower. And >what if GAK doesn't fly? And the widespread use of hard crypto >just keeps increasing? The tightly-coupled supercomputers are hardly needed for these sorts of problems. >This kind of machine could, in theory: > >1) Implement ALL Clipper(II) based Key Escrow functionality in > silicon (the easy part) AND allow for simultaneous decrypt and > surveil of 'who knows how many' Clipper based data streams. Huh? First, what evidence do you have for this claim? Second, who cares? Implementing Clipper in a Cray Computer machine--why bother? As to the claim that a million-processor machine could do this, you need to work out the math. (If a backdoor exists, or the LEAF has been gotten, a supercomputer is not needed....) >2) Implement general RSA based Prime Factoring functionality in > silicon (the not so easy part) AND allow massively parallel > decrypt and surveil of 'who knows how many' RSA/etc. based > data streams. Prime Factoring? Primes are easy to factor, of course. (Hint: Every prime has two factors.) If you mean using supercomputers to brute force the general factoring of an RSA modulus, this is nonsense. While there may be math shortcuts we don't yet publically know about which make factoring easier than we currently think it is, a mere million or even a billion processors will not make a dent in the factoring of, say, a 700-digit modulus. See the tables in Schneier and elsewhere for some estimates of factoring efforts needed. >3) Implement it all, AND 'on-line' transaction based surveillance > via the FBI's 1% capacity infrastructure. Let's see some numbers. (On second thought, let's not.) >Chilling... Who needs key escrow (or RSA private keys) when >you've got a massively parallel prime factoring machine. What if >GAK was to become a 'non-issue'? How fast do you think a machine >such as this could factor RSA 129? Well, do the math. The MIPS-years for the RSA-129 crack were publicized, so the computation for a million SPARC-equivalent (or even UltraSPARC-equivalent) can be done. When you've done this, and concluded that RSA-129 could be done in, say, X minutes, then move on to RSA-384 (the BlackNet key cracked by the MIT group), and on to the 1024- and 2048-bit keys. Tell us how many years or centuries it will take. (Hint: Rivest and Schneier have done these calculations....) --Tim May, who fears that he's just been trolled by Derek Atkins Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

6 5

PGP hooks for Pegasus Mail?
by Ed Carp 17 Dec '03

17 Dec '03

Anyone done anything regarding PGP hooks into Pegasus Mail? I'm running it at home now (SLIPped into my Linux box), and I'd like to find a way to integrate PGP into Pegasus Mail. Thanks in advance for any replies... -- Ed Carp

1 0