- cypherpunks-legacy - lists.cpunks.org

Re: What to do about Germany
by Mark Neely 17 Dec '03

17 Dec '03

jirib(a)cs.monash.edu.au wrote: <discussion about german law snipped>7 >What if the laws actually contradict each other? > >Eg if there was a country that forbade women speaking on the net, and >another that forbade distinctions between men and women to be made? I guess one thing politicians should consider _real_ hard is whether they want the Internet to be ruled by the lowest common denominator (so to speak). If the US (or Germany etc.) wants to impose it's version of morality/PC then it really doesn't have any grounds to complain when other countries decided to do so. Mark ___ Mark Neely - accessnt(a)ozemail.com.au Lawyer, Professional Cynic Author: Australian Beginner's Guide to the Internet Work-in-Progress: Australian Business Guide to the Internet WWW: http://www.ozemail.com.au/~accessnt

1 0

Re: Mixmaster On A $20 Floppy? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: John Young <jya(a)pipeline.com> > Date: Sat, 6 Jan 1996 20:27:02 -0500 > Subject: Re: Mixmaster On A $20 Floppy? > > "Other Things of Interest Dept: Virtual I-0, the Seattle > company that brings you those nifty 3-D LCD eye-glasses, > was showing [at Comdex] a complete hard disk-based computer > the size of a beta video cassette. The idea was that you > could plug in a keyboard and the video headset and finally > have that computer-without-a-screen concept that we've been > promised. Perfect for someone wanting genuine privacy, > although I think once we start seeing a plane load of > people all wearing virtual reality headsets, the world > becomes a little creepier. Anyone looking for small 486 compatible pc's should check out the system that scuba divers have been using for the last couple of years. They strap on your tank, have a cable with one-hand keyboard (usually hangs on the R. since your console is on the L.) that emulates a standard 101 and uses a small display that hangs off your mask. They run standard windows apps and are not too expensive. Check your local dive shop for specifics.

1 0

Re: please stop the Mitnick stuff
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:45 AM 1/7/96, Lucky Green wrote: >Of course it was a set-up. Mitnick got into Shimomura's computer by >impersonating the IP address of one of Shimomura's machines. The router >should have never let packets in from outside that have an IP address that >is supposed to be inside. That a 'security expert' would overlook such a >blatant and well publicized hole in his _own_ router is inconceivable. > >Shimomura was trying to get someone to break into his system. If the bait >was specifically for Mitnick, we may never know. I've met Shimomura several times, and I don't think he was trying to get someone to break into his system. I tend strongly to believe his basic story, that he found someone entering his system. (Shimomura as I have met him is not some kind of Junior G-Man, intent on catching minor criminals. He's about as counter-cultural as any of us. Thus, his account that he found Mitnick breaking into his systems and stealing things as a taunt rings more true than some view that he is an FBI or BATF narc in training.) As to whether a security expert should have seen this coming, there are a couple of factors at work. First, being a security expert/consultant doesn't mean one has perfect security oneself (the shoes of the cobbler, etc.). Second, new attack modes are often involved. Third, Shimomura _did_ ultimately find the attack. As to what really happened with Shimomura, Markoff, Mitnick, and the Feds, I have no idea. The Littman account is one side of the story. The Shimomura-Markoff book will be another. The various movies and other deals will further complicate the picture. (There are some mighty strange characters involved. Katie Hafner, former wife of Markoff, wrote a piece for one of various weeklies or monthlies (maybe "Esquire," as I recall) about a former prostitute living in a trailer in Nevada--do former prostitutes ever live anywhere else?--who was badmouthing Shimomura and praising her buddy Mitnick...bizarre stuff...maybe it's make it into the movie. I understand that Christian Slater has agreed to play Mitnick, John Lone will play Shimomura, and Richard Drefuss will get the role of Markoff.) Knowing Markoff, Shimomura, and (vaguely) Menapace, and not knowing either Littman or Mitnick, I am somewhat biased toward the M-S-M view of things. While I don't think news of Mitnick is utterly alien to our group, I think people need to be discriminating in ascribing pro-Mitnick views to the Cypherpunks, at least as individuals. Supporting Mitnick just because he is a "hacker" or a "cracker" or a "cyber-outlaw" is wrong-headed. Also, I'm not persuaded that the Feds used blatantly illegal search and seizure tactics to arrest Mitnick. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: please stop the Mitnick stuff
by John Young 17 Dec '03

17 Dec '03

Littman mentions toad.com twice -- that site, a character says, suspiciously, "run by one of the founders of Sun." Used, allegedly by the perp, to get into the drawers of, Well, you know. BTW, Littman says, and that Markoff agrees, that it was not Mitnick who got into Shimomura's underware, but, more than likely, the "Israeli." Apparently, an incident occurred after Kevin's bust. Agree with Tim that the Markoff/Shimomura book is needed to see both sides. For now, Mitnick seems to be a hapless pawn. Me too, about stuff I only read about.

1 0

WIRE TAP ON NET
by Douglas F. Elznic 17 Dec '03

17 Dec '03

E-MAIL-TAP NETS CRIMINALS The first-ever court-approved wiretap of an e-mail account has resulted in the arrest of three people charged with running a sophisticated cellular-fraud ring. The alleged mastermind, a German electrical engineer, advertised his illicit wares on CompuServe, where they caught the attention of an engineer at AT&T's wireless unit. The Secret Service and the Drug Enforcement Agency then got into the act and obtained the Justice Dept.'s permission to intercept e-mail messages between the alleged perpetrator and his accomplices. "This case represents the challenges in the future if we can't get ahead of the curve in technology," says a U.S. attorney, whose office is prosecuting the case. (Wall Street Journal 2 Jan 96 p16) -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

2 1

Re: please stop the Mitnick stuff
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 06:31 PM 1/6/96 -0500, Perry Metzger wrote: > >This is cypherpunks, not Mitnick punks, Shimomura punks, or anything >similar. I personally don't care about Kevin Mitnick, and he most >certainly has little to no cryptography relevance at this point. Take >it elsewhere. C'mon, Perry, give it a break. Mitnick's case has to do with security issues as well as the violations of privacy and/or search and seizure the government used to arrest him. It may not be cryptography per se, but are you going to seriously argue that security, etc. is not encompassed in crypto issues? I found it interesting. If you didn't, then all you had to do was delete it. No one needs to read your personal crusade as *The One* who tells us what's relevant and what's not.

4 3

Re: Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by jim bell 17 Dec '03

17 Dec '03

At 11:15 PM 1/6/96 -0500, you wrote: >ObGPS/cpunk/physical-location-of-machines: A recent IETF proposal would >create a new DNS record that encoded the physical location of a >machine, encoded in latitude and longitude. This would solve the >problem MIT has had in distributing PGP, i.e. where exactly is >unix5.netaxs.com? However, there's nothing to stop you from adding >records that say your machines are at the latitude and longitude of, >say, Fort Meade... ;-) > > ftp://ds.internic.net/rfc/rfc1876.txt > >Again, I'm not too sure of the viability of this proposal. Not on >effectiveness of proving true location -- it is more geared toward >"visual 3-D packet tracing" -- but simply because I have _no_ fricking >idea where our machines are (in terms of lat and long) to any degree >of accuracy. Question: Do we really WANT to advertise the location of machines? Especially to an accuracy commensurate with current technology? And if lying is possible, what's the point?!? >("They're somewhere in PA." Brilliant, you can find that >out via WHOIS.) The document suggests using GPS to locate your true >location, but I'll be damned if my boss is going to spend $1,000 just >so I can have more DNS entries to maintain... BTW, the cheapest GPS receivers (Magellan 2000's, as I recall) at $200 at the local marine supply shop. Excellent price. Even so, I won't buy one when I get my first GPS reciever, for two reasons: 1. No differential capability. (will improve accuracy to typically 2 meters) 2. Only two digits past the "minutes" decimal point resolution.

1 0

Re: FW: Undeliverable: Re: Massey, CEO of Compuserve, on Internet
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 11:25 1/6/96, blanc wrote: >From: Steve14571(a)aol.com > >Something else I want to know... Why is my mail going through microsoft.com? >........................................................................... >............................ > >There is an email 'alias' at Microsoft which was subscribed to the cpunk >list, to receive and distribute the cpunk list to members of that alias. > >A new beta version of Exchange is being used on a test basis by some >departments (apparently all of the cpunks at MS are using it), and the >programmers recently encountered a "little complication" (to use a phrase >from the movie 'Brazil'). I'm told that the problems were corrected, but >that now the spoolers are releasing messages which were backed up while >mail delivery was put on hold. I hate to agree with Timothy C. May, but >it is probably best to "use technology " to deal with it for a day or so. > > .. >Blanc I had a bounce from another list (<corp-welfare(a)ursus.jun.alaska.edu>) so it is not only cypherpunks which is having the problem.

1 0

Re: Revoking Old Lost Keys
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

shamrock(a)netcom.com (Lucky Green) writes: >I would very much like to see expiration dates on public keys. Is PGP 3.0 >offering this feature? I would very uch like to see PGP 3.0, but that's another story... --Rob

1 0

"trust management" vs. "certified identity"
by Matt Blaze 17 Dec '03

17 Dec '03

The discussions here of the limits of PGP's certification and revocation model are close to the core of some work I've been doing (with Joan Feigenbaum and Jack Lacy) on what we call the "trust management" problem. Essentially we consider the consequences of abandoning the notion of "certified identity" implicit in systems like X.509 and PGP and subsuming identity under the more general umbrella of specifying and determining what a key is trusted to do. We've built a system, called "PolicyMaker", that allows the certifier of a key to specify what the key is trusted to do rather than to whom the key is trusted to belong. The same mechanism is also used to specify and interpret local policies. The PolicyMaker system is designed to be called as a service by local applications, which could be email systems like PGP or network-layer security protocols or any other application that requires complex trust relationships. Some early, local experience suggests that this approach is a good one. It's easy to specify X.509- and PGP-style policies and certificates, but you can also say things like "valid for transactions over $500 only if countersigned" in a fairly natural way. I'll be happy to send a (very early) draft of our paper, "Decentralized trust management" to anyone who's interested. I've made the draft available in the CFS-users email archive server. To request a copy (PostScript format) by email: echo get cfs-users pmdraft.ps | mail cfs-users-request(a)research.att.com (For non-unix shell people, just send a message to cfs-users-request(a)research.att.com With the line: get cfs-users pmdraft.ps in the BODY of the message (NOT on the subject line).) Comments and discussion appreciated. This is an early draft, and I'd appreciate it if it not be directly quoted, cited, or re-distributed. -matt PS We expect to give away our reference implementation, too. (Probably by May or so.) Note that this is just research, and does not represent any current, past, or future product or service offering on the part of AT&T or anyone else.

2 1