- cypherpunks-legacy - lists.cpunks.org

Re: referers and W3 (fwd)
by Hal Finney 17 Dec '03

17 Dec '03

Rich Graves, <llurch(a)networking.stanford.edu>, writes: > A friend who webmasters a large site that is implementing referer-specific > content sent me this when I mentioned the cpunks/cryptography thread of a > few months back. I basically agree with the W3C. While user education on the > potential privacy threat is essential, I do not believe that Netscape should > violate published technical standards. There are also privacy and property > issues from the server's perspective. I'm not sure what Netscape action you are referring to, but if it is giving the users the option to block the Referer tag, RFC2068, which is HTTP/1.1, already endorses this: Note: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information. and later: We suggest, though do not require, that a convenient toggle interface be provided for the user to enable or disable the sending of From and Referer information. I use Eric Murray's fine "cookie jar" privacy program when I am web browsing on my Linux system (http://www.lne.com/ericm/cookie_jar/) It blocks cookies and advertisements via a very flexible config file mechanism. It also eliminates other privacy-revealing outgoing data, including Referer, and could be easily modified to play all kinds of games with Referer for the adventurous. In the news recently, Ticketron is blocking links from some Microsoft affiliated sites due to a disagreement about licensing. I don't know the details of how it is done technically, but possibly it is done by looking at the Referer tag to see if the user linked from the Microsoft site. If so, this would be a good example of the browser sending information which is detrimental to the user. Hal

2 1

Re: Crypto, C4 Explosives, and Destroying the Infrastructure
by Michael Wilson 17 Dec '03

17 Dec '03

Tim May wrote: >However, there are a couple of *obvious* errors. My supposition is that he >"pulled his punches" a little, choosing to gloss over certain things which >would have made the "terrorist" essentially impossible to detect. (The most >glaring error, which he surely knew better about, was to assert that NSA >could break any cipher if given enough time and computer power.) I would assume that anyone considering the potential of infrastructural warfare attacks in a dramatic setting would have to handicap the moves of the opposition force--the mechanisms of tradecraft in the modern age are such that the anti- and counter-terror forces are whistling in the dark as they pass the graveyard. Steve Schear wrote: >Any intelligent terrorist knows that explosives are old hat. >Perhaps this is an opportunity for CPs to join in and re-write the book >with a more factual basis and outcome, are re-publish on-line. I volunteer >to OCR. The modern terrorist or opposition force will use whatever makes them the most effective--if that means, on the cost/benefit curve, that they use explosives, then by all means they will. Terrorism evolves under pressures much the way any other social element does; in this case, evolutionary pressures are those of environment and predators. As the security increases or improves, terrorists have historically advanced as well (guns to explosives when airport security improved, and the coming shift to chemical or biological weapons, as thermal neutron analysis comes on-line). Predators, such as intelligence or law enforcement, merely serve to cull the herd a bit, which is why you see fewer but more effective terrorist attacks, even as narrowly defined in the recent U.S. State Dept. reports. As for publication or other expansion on the subject matter, let me point out my own work on the topic (always pro strong crypto, pro cypherpunks, incidentally). Infrastructural warfare is a field that should interest cypherpunks-- it has been my strongest argument for getting government out of the security and cryptography business for a number of years now. Feel free to reference the URL: http://www.geocities.com/CapitolHill/4843/ Particularly of interest to cypherpunks (or anyone with an interest in how to run an untraceable opposition force that could give most of the infrastructure a good thrashing): Waging IWAR (1997) >From the Introduction: "So as not to alarm the reader, let me advise you that this paper is intended as an informal presentation of the material, very much in the spirit of 'let us conspire!' What has been sorely lacking in treatments of the infrastructural warfare (IWAR) subject matter has been a practical, personal approach of thinking about, planning, and waging IWAR operations. Given the nature of most of the professionals acting as documentarists, the published materials are strong on theory and speculation, and short on practical guidelines. I shall attempt to begin to fill that gap, and I hope the reader will accept a temporary 'partnership in crime' as we work through the problems facing an opposition force (OpFor) together. This paper is be broken into four sections: -Definitions, assumptions, and theory; the conceptual basis of IWAR is important to review; -Exploration of OpFor as a practical matter; -A set of IWAR potential operations, for which I have chosen a variety of examples; -Defense-In-Depth, battling IWAR." Infrastructural Warfare Threat Model (1997) Abstract: A threat model is essential to proving the validity of the threat posed by infrastructural and information warfare (I2WAR); exploration of the scope/activities of the threat are essential to understanding the threat and mounting a defense against it. An opposition force' is postulated and explored for its intent, organization, communications, recruiting, armament, intelligence gathering and analysis, and funding. A methodology for defining the infrastructure and dependencies is proposed. I2WAR is defined as conflict oriented around denial of service attacks on physical infrastructure elements (including targets such as communications, public utilities, financial organizations, transportation mechanisms, public facilities/events, emergency management services, commerce, and government), denial of service attacks on virtual' infrastructure elements (information warfare), psychological warfare operations (attacks on decision processes), and technologically augmented political warfare (agitation, subversion, rioting; propaganda). Conclusions are drawn, including suggestions for a defense-in-depth. Battle for the Soul of Information Warfare: Pearl Harbor vs. the Hashishim (1997) Abstract: Infowar has at least two distinct camps, each operating with different basic assumptions on the threat. As these assumptions are critical to threat modeling and defense strategies, comparing the differences is essential. The assumptions of the Pearl Harbor' mass denial-of-service infowar attack are contrasted with those of the Hashishim,' subtle efforts of perversion; the historical case is presented to demonstrate the reasoning regarding the labels. Contrasted are assumptions regarding opposition force approach, intent, focus, targets, scale of attack, resources of opposition force, management, command and control, organization, funding, intelligence, defensive focus, and political view of the problem. Considering the Net as an Intelligence Tool (1996) An exploration of the fitness of the net for intelligence gathering and operational support; this is usually an assumption made by many of the theorists on the subject, but I thought a detailed explanation worth engaging in. Michael Wilson 5514706(a)mcimail.com

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Sunday, May 18, 1997 - 20:46:37 MET Our form of gov't is based on the Judeo-Christian rooted belief in unalienable rights. (though the concepts has been around long befor judaism) These are rights endowed upon us by the life force, they are inherent in our creation and are subject only to the laws of the universe not by any king, or human leader, and so they cannot be taken away by or infringed on by any human leader or groups. The whole of the physical universe is bound by laws we do not make but can only seek to understand. Tuning in and acting in harmony with the laws of the universe furthers us in our development( ie agriculture). Exploiting the laws greedily leads to our destruction.(ie thoughtless industrialization). Furthering nature/the life force is good, opposing nature, seeking to conquer and exploit it, is bad from our human perspective. The constitution and bill of rights was the original AP document with a series of checks and balance designed to keep ultimate power, the right to speak out, organise, gather together, rise up and bear arms, in the hands of the people so no one group could impose the tyranny of their beliefs and the masses. I believe it is human nature to cast off the bonds of oppression. This is the assertion of the life force that always seeks to sustain and perpetuate itself in the greatest possible array of diversity. I believe this was a major quantum leap in the history of human thought and concioussness. A giant step in the right direction of our true divinity but it was sorely flawed; By the concept of property rights. This is where the founding fathers eogos got in the way. The liberation movements of the last century have been based on the same concept of unalienable rights and have attempted to fine tune the document for a more equitable distribution of planet power to correct the flaw. You don't need a weatherman or a clinton to know which way the wind blows. You don't need to be literate to know who is taking what from whom. You don't need a judge to tell you right from wrong. you have instincts that can tell you just fine. Religion in the earliest sense was the bringing together of the group in an understanding of their commonanlity and uniqueness in a way that stirred up ones feelings of awe for the power of the universe in order that we would discover our commonality while at the same time instilling a repect for each of our uniqness. So we could be inspired to submit to our inner and outer natures and act in harmony with it and show benevolence in our relations with each other. This is the ultimate anarchist, a ninja warrior of natures rainbow, who fights to defend the unalienable rights endowed on all by life force. I believe that most of the folks on this list aspire to a form of self govt. A belief and trust in the anarchy of nature tempered with the benevloence brought about by the recognition of our common humanity. A state of affairs where each is a ninja/captain of their own soul. Who recognize the inhernet rights of all and act accordingly without coercion or direction from an outside source, for the laws of the universe are within us. Who respect the rights of the individual and can let them that would destroy themselves destroy, themselves and them that would live to live. To live and let live and live and let die. I believe the network is the link to the next level of evolution of human thought and self gov't. A new religion where we can rediscover our common humanity and regroup as a planet, as the one human tribe. A way to explore our comon roots and learn and develop appreciation and respect for our differences. Where in spite of all efforts to propagandize and spread hate our commanality will emerge. Where all voices can be heard and equitable solutions worked out. Not by "sheeple" but by people allowing their primal natural instincts to govern their actions to be it to shun, support or defend or defeat someone or something. We are retaking repsonsibility for our selves and our fellow humans. Again, you don't need a Weatherman or an FBI man to know which way the wind blows. Look outside your window then look inside your window. Rainbow Warrior

1 0

Nature of Anarchy/ Anarchy of Nature
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Sunday, May 18, 1997 - 20:46:37 MET Our form of gov't is based on the Judeo-Christian rooted belief in unalienable rights. (though the concepts has been around long befor judaism) These are rights endowed upon us by the life force, they are inherent in our creation and are subject only to the laws of the universe not by any king, or human leader, and so they cannot be taken away by or infringed on by any human leader or groups. The whole of the physical universe is bound by laws we do not make but can only seek to understand. Tuning in and acting in harmony with the laws of the universe furthers us in our development( ie agriculture). Exploiting the laws greedily leads to our destruction.(ie thoughtless industrialization). Furthering nature/the life force is good, opposing nature, seeking to conquer and exploit it, is bad from our human perspective. The constitution and bill of rights was the original AP document with a series of checks and balance designed to keep ultimate power, the right to speak out, organise, gather together, rise up and bear arms, in the hands of the people so no one group could impose the tyranny of their beliefs and the masses. I believe it is human nature to cast off the bonds of oppression. This is the assertion of the life force that always seeks to sustain and perpetuate itself in the greatest possible array of diversity. I believe this was a major quantum leap in the history of human thought and concioussness. A giant step in the right direction of our true divinity but it was sorely flawed; By the concept of property rights. This is where the founding fathers eogos got in the way. The liberation movements of the last century have been based on the same concept of unalienable rights and have attempted to fine tune the document for a more equitable distribution of planet power to correct the flaw. You don't need a weatherman or a clinton to know which way the wind blows. You don't need to be literate to know who is taking what from whom. You don't need a judge to tell you right from wrong. you have instincts that can tell you just fine. Religion in the earliest sense was the bringing together of the group in an understanding of their commonanlity and uniqueness in a way that stirred up ones feelings of awe for the power of the universe in order that we would discover our commonality while at the same time instilling a repect for each of our uniqness. So we could be inspired to submit to our inner and outer natures and act in harmony with it and show benevolence in our relations with each other. This is the ultimate anarchist, a ninja warrior of natures rainbow, who fights to defend the unalienable rights endowed on all by life force. I believe that most of the folks on this list aspire to a form of self govt. A belief and trust in the anarchy of nature tempered with the benevloence brought about by the recognition of our common humanity. A state of affairs where each is a ninja/captain of their own soul. Who recognize the inhernet rights of all and act accordingly without coercion or direction from an outside source, for the laws of the universe are within us. Who respect the rights of the individual and can let them that would destroy themselves destroy, themselves and them that would live to live. To live and let live and live and let die. I believe the network is the link to the next level of evolution of human thought and self gov't. A new religion where we can rediscover our common humanity and regroup as a planet, as the one human tribe. A way to explore our comon roots and learn and develop appreciation and respect for our differences. Where in spite of all efforts to propagandize and spread hate our commanality will emerge. Where all voices can be heard and equitable solutions worked out. Not by "sheeple" but by people allowing their primal natural instincts to govern their actions to be it to shun, support or defend or defeat someone or something. We are retaking repsonsibility for our selves and our fellow humans. Again, you don't need a Weatherman or an FBI man to know which way the wind blows. Look outside your window then look inside your window. Rainbow Warrior

4 4

Jim Bell goes to Jail!
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From the Oregonian Sunday edition May 18, 1997 page D-10: IRS agents arrest Vancouver man who called for killing federal workers * James D. Bell, who wrote the 10-part essay, "Assassination Politics," faces charges of interfering with a U.S. officer By John Painter Jr. of the Oregonian staff VANCOUVER - A Vancouver man who has written about assassination of government officials and whose home was raided in April has been arrested by IRS agents on charges of interfering with a federal officer. James D. Bell was held without bail in the Clark County jail. On Monday, the IRS will transport him to U.S. District Court in Tacoma for his first appearance. He was arrested without incident Friday evening while waiting for a bus after work. IRS agents could not be reached for comment, and the complaint underlying the criminal charge was sealed and unavailable. The Clark County Jail confirmed that Bell was a prisoner there, held on a federal detainer. A friend of Bell's, Robert W. East, said Bell phoned him from jail and told him he was arrested for interfering with a federal officer. The affidavit for the April search warrant accused Bell of "directly soliciting others to set up a system to murder government officials" and "obtaining the home address of an IRS employee, as well as information about bombs and bomb-making materials." Bell is the admitted author of a 10-part essay called "Assassination Politics," which has been circulated widely on the Internet, particularly in anti-government forums. "Assassination Politics" discusses creation of an organization to reward those killing public officials while protecting assassins' identities. IRS agents searched East's home in Vancouver on Thursday. East said he was questioned for about 90 minutes, during which time agents asked him about a "stink-bomb attack" on an IRS office in San Diego or Long Beach, Calif., and a "propane bomb" found at another IRS office. In that search agents found a 3- foot carbon fiber that East said he got from Bell for an electrolysis experiment. Federal agents since have focused on a Bell theory that carbon fibers could be used to sabotage computer hard drives, thus disabling them. East confirmed Bell's interest in using carbon fibers as a "computer killer" but dismissed it as a "goofball idea." The search warrant for East's home shows that the government also is interested in determining whether Bell and others have experimented with volatile chemicals in preparation for attacks on IRS offices and agents. The search warrant for Bell's home shows that agents were searching for evidence of "threats, assaults, obstruction, intimidation, solicitation of murder, false statements, and the unlawful use of false social security numbers." Jeff Gordon, a Portland-based IRS special investigator, said he discovered "Assassination Politics" among items seized when IRS agents took Bell's 1986 Honda for unpaid back taxes in February. Bell denied the car was his. An IRS tally of the items inside the car included a document about a "trial" by the Multnomah County Common Law Court in January of several IRS agents, a federal magistrate in Portland, U.S. Attorney General Janet Reno and an IRS commissioner, Margaret Richardson. - --- -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQEVAwUBM3/BJeQCP3v30CeZAQFSLwf/S5Drnovm0dZQQE5HLODevTOVz6d9NNXK 9f+Aif6Qkf3p+iAsv98vKJv8w/M0ps3st0POuwgPZL8lQNm1IpvnOO1ef70d6vGB 0xuu87+WriZRU1MVScKIxAOYhBAtEOBZEgEAa5RNJi9XzafdMoCTx8VUsDcnVnhg WkNthZ7yB/YouDcOZ3NYk6nsbXC8SxVr8QtDRa2IhIKSCWc3QoAJ7i2Vh//bGZ22 RJBIiF/PxtE/pTLlpJLFgJLmfyffieskdi192kj0ABhp0qxmTiRiaYWftxH2T+s6 2OytBMHYQe8xGqK9ophXVOu/t5hb2aEIH3diEoSkVUG02wdAlAgTqA== =0sB7 -----END PGP SIGNATURE----- --- | "Bill Clinton - Bringing back the sixties one Nixon at a time." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

7 11

Re: PGP 5.0 beta problem
by Lucky Green 17 Dec '03

17 Dec '03

At 12:55 PM 5/18/97 -0700, Steve Schear wrote: >Have any other Mac CPs tried using verion 5.0 with CryptDisk? When the >PGPMenus extension is installed any attempt to open an encrypted volume >generates a "Not enough memory to mount disk" message. I ahve pleanty of >RAM abd suspect a lack of System memory (e.g., stack space). Seems PGP 5.0 still has some major problems. I can't even get the installer to work on Win95. It complains about a lack of disk space. I have >1GB free. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: referers and W3 (fwd)
by Hal Finney 17 Dec '03

17 Dec '03

Eric Murray, <ericm(a)lne.com>, writes, regarding Referer spoofing: > What would make sense to use, other than sending > "http://this/is/a/bogus/referrer/sent/to/mess/up/your/stats"? > How about sending the current URL as Referrer? One practical idea would be to set up the config file so that whenever URL X is referenced, specified URL Y is sent as the referer. This could be useful for accessing web sites which won't show you information unless (or if) they see a certain value in the referer field. Hal

1 0

Sun Sells Encryption Software Overseas, Skirting U.S. Policy
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Tomorrow's Wall Street Journal: http://interactive3.wsj.com/edition/current/articles/SB863997652645676500.h… Sun Sells Encryption Software Overseas, Skirting U.S. Policy By DAVID BANK Staff Reporter of THE WALL STREET JOURNAL MOUNTAIN VIEW, Calif. -- Sun Microsystems Inc. plans to sell advanced data-security software from a Russian supplier to overseas customers, a move that skirts U.S. export regulations and is likely to receive close U.S. government scrutiny. Sun is expected to announce Monday that it will sell encryption software licensed from Elvis+ Co., a company formed by scientists from the former Soviet space program. Sun I actually think that Elvis+ is mostly composed of the former KGB scientists, not space scientists. I may be mistaken though. -- igor has a 10% equity stake in the Russian firm. The Elvis+ products will be shipped to overseas customers from Sun distributors in third countries to keep them from falling under U.S. jurisdiction. Sun's move illustrates how global market pressures are making it increasingly difficult for U.S. officials to control the spread of advanced encryption hardware and software. The technology, which scrambles data to protect it from computer eavesdroppers, is considered vital to the growth of electronic commerce. But export of powerful encryption products is barred under U.S. export-control laws, on grounds that terrorists and others will use it to evade surveillance. Challenge to U.S. Policy The Sun action will cause the Clinton administration to face a difficult decision, said Jim Bidzos, president and chief executive of RSA Data Security Inc., a unit of Cambridge, Mass.-based Security Dynamics Technologies Inc., a major supplier of encryption technology. "The government has to shut this down, or else the competitors of Sun probably have to say, 'We're going to do the same thing,' " he said. Mr. Bidzos, a long-time critic of the export controls, praised Sun's move as "blatant and in-your-face." An administration official said Sunday the White House didn't have enough information to comment. Computer-industry executives, concerned that they could lose a valuable market to foreign competition, have long discussed strategies to exploit loopholes in the export laws. But Sun appears to be the first major company to use foreign software to supply overseas customers. Sun executives said they hadn't discussed the plans with U.S. government officials but had strictly adhered to current laws. "This is not being done to subvert export-control laws but to deliver solutions to customers," said Humphrey Polanen, general manager of Sun's network-security products group. "Never before have organizations outside of the United States had access to such advanced security software." Privacy advocates said Sun's initiative would boost their goal of making high-strength encryption widely available. "We think the benefit for security outweighs the liability for law enforcement," said Jerry Berman, executive director of the Center for Democracy and Technology in Washington, D.C. Critical Distinction Elvis+ is based in Zelenograd, a Moscow suburb that was once known as the "Soviet Silicon Valley." The company's products are based on a security protocol called SKIP that was developed by Sun, but Sun says it provided no technical assistance to the Russian company. The distinction is crucial; the export controls cover any product developed with such assistance from a U.S. company. The product, which will be marketed under the name SunScreen SKIP E, employs various encryption algorithms, or formulas, including so-called three-key triple DES and 128-bit ciphers, which security experts consider to be virtually unbreakable. The algorithms, in wide use within the U.S., are used to scramble digital communications; in general, the longer the bit length of the encryption key, the more difficult the code is to break. Current export controls allow the export of cryptography keys up to 40 bits, which have been cracked by computer hackers in as little as 10 minutes. Companies with special approval from the Commerce Department have recently begun exporting 56-bit encryption software, but customers have been clamoring for much stronger keys. Global Competition The restriction on U.S. exports has opened market opportunities for strong encryption products from foreign competitors, including Germany's Brokat Informationssysteme GmbH and Siemens Nixdorf Informationssysteme AG, a unit of Siemens AG. "Sun's announcement is further evidence that current U.S. policy is forcing companies to look overseas to obtain strong encryption," said Edward Black, president of the Computer and Communications Industry Association, a Washington D.C., trade group that is lobbying for relaxation of the export controls. Last year, RSA Data Security announced plans to fund an effort by Chinese government scientists to develop strong encryption technology, but the effort has stalled, Mr. Bidzos said. RSA now sends legally exportable products to its Japanese subsidiary, RSA Japan, for bundling with Japanese encryption software. "I can't just let this world-wide global electronic-commerce market take off without participating," Mr. Bidzos said. Sun's Mr. Polanen said SunScreen SKIP E+ will work with other products based on the SKIP protocols. A commercial version will be available in August; evaluation copies are available for download from an Elvis+ site on the World Wide Web. The software will be priced at $99 for versions that run on Microsoft Corp.'s Windows 3.1 and Windows 95 operating systems and at $149 for the Windows NT version.

1 0

Re: Nature of Anarchy/ Anarchy of Nature
by Blanc 17 Dec '03

17 Dec '03

Steve Schear wrote: >Even better, "The Road to Surfdom," F.A. Hayek, totally debunks the basis >of a planned economy and how the loss of property ownership and economic >freedom leads directly and inevitably to totalitarianism. ............................................................ Or my favorite of all time: "Human Action" by Ludwig von Mises. It's a large book - it could keep a collectivist New Age philosopher busy for hours. But even just reading the first few chapters would be sufficient to provide some usefully deep ideas to explain fundamental things about economic truths, of the kind which many cpunks are already in agreement with. .. Blanc .. Blanc

1 0

Re: Jim Bell goes to Jail!
by Lucky Green 17 Dec '03

17 Dec '03

At 10:28 PM 5/18/97 -0700, Alan Olsen wrote: >(There are also a number >of >psychological studies that show that people will do all sorts of horrific >things to their fellow man when someone in authority tells them to. If they >are led to believe that they are "bad" in some way, many will enjoy it.) Right. I read a book on that. I think it was called "The Millgram Experiment". Normal people would administer (fake, but they didn't know it) electroshocks to a subject even after the subject had stopped moving and could have been assumed to be unconscious or even dead. An excellent demonstration of the power of authority. And the gullibility of the average person. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

6 6