- cypherpunks-legacy - lists.cpunks.org

exposure=deterence?
by cmerritt＠intellinet.com 17 Dec '03

17 Dec '03

jimbell(a)pacifier.com (Jim Bell) wrote in part: >In my opinion, we (the ordinary members of the public) cannot consider >ourselves to have won this encounter until the REAL enemy here, the >government employees who targeted Zimmermann There is a group of government employees that decided to put William Keane on this case. Someone(s) started sending customs agents around the country. Someone(s) is responsible for making several defenders of privacy miserable. These government employees SHOULD NOT be allowed to hide in their government holes in complete privacy. We need the credits now that the movie is over. How much money was spent? [FOI anyone?] I am afraid that all I could provide is the name of one Customs Special Agent. I dont think she is responsible for anything - she was told go interview so-and-so and off she goes. Who sent her? ---> How could we find out? <--- It seems correct that the NAMES of the government employees and HOW MUCH MONEY THEY SPENT be made public. Deterent enough. I feel that public exposure is enough to put fear into these anonymous government employees. You will note that when they get the mad_bomber some FBI guy jumps right up and takes credit, live, on TV. But when the Air Force orders a $300 toilet seat NO ONE is credited. Boy! Am I pissed! ...cm

7 7

PGP replay attack
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on using replay attacks against PGP recently. However, a timestamp is stored in the signature packet and is signed along with the plaintext intended to be signed. This eliminates the need to include a timestamp in clear-signed data. Someone can still send a signed e-mail to a third party that was not the original recipient and make it appear as though the sender did actually send the message to the third party (e.g. Alice sends signed message to Bob Bob sends message with faked headers signed by Alice to Carol Carol believes Alice actually sent the message to her) Such an attack would have to executed shortly after the message was originally clear-signed. However, including timestamps in text to be signed is not necessary. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPhourZc+sv5siulAQHTTAP/XBlrV7nHd5pR9aTXr2Uk0M0fw4I6IjZZ xeCx++vuIjcQuo/k8xH9YvBbn+MuoE11xbVLD58xYbELuVSdMUzCQ1mpQMho8mzs O0ALr8dahq0N0Gl5kLwb97MzgJOgTwy6NSIK6883NCktAWJMsFoADpdzmDGWQbTc ZzXJ3w5OiAQ= =fWJb -----END PGP SIGNATURE----- -- finger -l markm(a)voicenet.com for PGP key http://www.voicenet.com/~markm/ Fingerprint: bd24d08e3cbb53472054fa56002258d5 Key-ID: 0xf9b22ba5 "The NSA can have my private key when they pry it from my cold, dead neurons." Unknown

1 0

Re: (none) [httpd finding your identity]
by James A. Donald 17 Dec '03

17 Dec '03

At 05:16 PM 1/13/96 -0800, Jeff Weinstein wrote: > I've removed the code that uses the e-mail address as the > FTP password for anonymous FTPs. You can still enter it by > hand by using a URL of this form 'ftp://anonymous@ftp.netscape.com'. > > [...] > > The fix for this will be in the next [netscape] beta, and the final > version of 2.0. Thank you. This excellent new feature is more important than you know. The FTC is threatening to regulate the net, and is using as its excuse the claim that advertisers will or are threatening to send junk email to be people who browse their web pages. To protect the internet from this terrible threat they wish to regulate every computer that puts up a web page in a similar fashion to their regulation of TV and radio. This simple technical fix deprives the FTC of that excuse. It will have to concoct a new excuse. Unless someone deliberately configures their netscape browser to provide the information, no one can send them junk mail. > Jeff Weinstein - Electronic Munitions Specialist > Netscape Communication Corporation > jsw(a)netscape.com - http://home.netscape.com/people/jsw > Any opinions expressed above are mine. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Respect for privacy != Re: exposure=deterence?
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> From: s1018954(a)aix2.uottawa.ca > > My apologies for responding to a political post. > > On Sat, 13 Jan 1996, Charlie Merritt wrote: > > > I feel that public exposure > > is enough to put fear into these anonymous government employees. > > You will note that when they get the mad_bomber > > some FBI guy jumps right up and takes credit, live, on TV. > > But when the Air Force orders a $300 toilet seat NO ONE is credited. > > It's interesting how we advocate anonymity for ourselves but not for our > opponents. Feeling righteous? There is a *big* difference between anonymity for individuals, and anonymity for government officials acting in the name of the government. Government has no right to privacy. Individuals do. > Reminds me of the bit from True Names about all the warlocks trying to > crack each other's nyms to enslave each other. Sad? > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

ITAR Re-write ?
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Bloomberg, the business news agency, reports 01 12 96: The U.S. Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found that American firms are being hurt.... The report's release came on the same day federal pro- secutors dropped a three-year investigation...of...Philip Zimmerman.... The government study comes a week after [the Computer Systems Policy Project] released [its] own study showing ...American companies will lose [maybe $60 billion] in U.S. computer system sales expected in 2000.... The 13-member Project ...includes International Business Machines...and AT&T.... Perhaps the let-go of Zimmerman is less a triumph of right than of might? But economic might is not the only kind of might: [Easing export controls] may pit Brown's department a- gainst U.S. defense and spy agencies.... So... [Commerce Secretary] Brown said his department will pre- pare recommendations for easing [ITAR] controls that should be forwarded to the president "within a few months." Meaning: the 13 Project members should be prepared to pay through the nose in the runup to the '96 gala. And just so they get the big picture: It's unclear if the NSA, the super-secret eavesdropping agency, endorsed the Commerce Department's conclusions in the report it jointly prepared. The newsstory reports ...federal prosecutors dropped [the Zimmerman] investiga- tion without explanation.... No explanation's required. One hostage was released. 13 others were taken. But the one release does afford the new hostages, who have deep pockets, some hope... Cordially, Jim NOTE. The newsstory's headline? COMMERCE'S BROWN PROPOSES REWRITE OF ENCRYPTION EXPORT CONTROLS. Its dateline? WASHINGTON (Jan 12, 1996 5:34 p.m. EST). Its Nando News online filename? biz6_1893.html

1 0

Fwd: Scrambled software gets an OK
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

This was printed in the San Jose Mercury News this morning. I'd have just posted a pointer to it, except that it was in the "private" part of their web pages... Scrambled software gets an OK -- Exports: Foreign encoding unfair to U.S. firms, Commerce Department says. Bloomberg Business News WASHINGTON -- The Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found the restrictions are hurting U.S. firms, Commerce Secretary Ron Brown said. Such a move may pit Brown's department against U.S. defense and spy agencies, however, setting the stage for a White House battle over one of the last computer technologies still covered by export controls. ``I'm interested in promoting American exports,'' Brown said. ``If your foreign competitors are exporting products with encryption capability and you are not, that puts you at a tremendous competitive disadvantage,'' he said. Encryption software turns information, such as files and credit card numbers, into indecipherable material that can be sent across networks without fear of tampering to the recipient, who can then unscramble it. Under current U.S. law, encryption technology that exceeds certain technical thresholds is considered a ``munition.'' Those who would export such technology need explicit permission from the government. The United States justifies the export restrictions by saying law-enforcement agencies would be hamstrung in their efforts to stop terrorists, spies and criminals without them. The computer industry counters that encryption software is available from other countries, and the restrictions simply rob U.S. companies of business. The Computer Systems Policy Project, a joint effort of 13 top technology companies released its own study showing that U.S. companies will lose as much as 30 percent of the $200 billion in U.S. computer system sales expected in 2000 because of federal laws limiting exports of encryption products. Brown said his department will prepare recommendations for easing those controls that should be forwarded to the president ``within a few months.'' It's unclear if the NSA endorsed the Commerce Department's conclusions in the report it jointly prepared. Representatives of the NSA were unavailable for comment. Brown's assertion comes a day after federal prosecutors dropped a three-year investigation of Boulder, Colo., software designer Philip Zimmermann, whose encryption program called Pretty Good Privacy was posted on the Internet, the worldwide computer network. Published 1/13/96 in the San Jose Mercury News. -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

tsu's bpf
by Mark 17 Dec '03

17 Dec '03

>> Shimomura on BPF, NSA and Crypto: >> >> One of the tools I modified for my work was a sophisticated >> piece of software called the Berkeley Packet Filter. ... >> Unlike the original BPF, my version was designed to bury > ^^^^^^^^^^^^^^^^^^^^^^^ >> itself inside the operating system of a computer and watch >> for certain information as it flowed through the computer >> from the Internet. When a packet from a certain address, or >> for that matter any other desired piece of information >> designated by the user flashed by, BPF would grab it and >> place it in a file where it could be kept for later >> viewing. > >This is *exactly* what BPF does, always did and was designed to do. As >for writing the packets to a file, everything but opening and closing >the file are described in the man page. You could code it in 10 lines. Get off your high horse Julian, he means it's a modloadable version of bpf, much like the modloadable NIT that is also available. There are at least two sniffers that can use both the modloadable NIT and bpf packet interfaces, maybe more. It certainly is easier than recompiling your kernel to include the functionality which is generally the way things were done. I prefer bpf as it is much more efficient, typically 10% of the impact that NIT has on a machine. Some rough figures are a NIT might use one or two minutes of CPU a day to monitor a reasonably quiet network, whilst bpf will only use several seconds cpu time. (Most of the work is hidden in the kernel anyway). Mark

1 0

RSA accellerators on ISA/PCI cards?
by Simon Spero 17 Dec '03

17 Dec '03

Does anybody have any recommendations for a good RSA accellerator available on an ISA/PCI card? I'm looking for something that can be used with numerous public/private keys, though the ability to have one tamperproof key would be a bonus. Thanks Simon ---- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

Re: Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself ABostick <abostick(a)netcom.com> probably wrote: > > -----BEGIN PGP SIGNED MESSAGE----- (BTW, it verified here.) > > If "digital postage" is ever implemented, this sort of > distributed-origin mailbomb-through-a-remailer would be stopped > immediately. All the messages that the horny net geeks send would > necessarily contain the same postage stamp, and the remailer would > notice this right away -- and throw away messages containing the used > postage stamp. > > One more motivation for e$-like digital postage for remailers. Unfortunately this is not the case. The perpetrator would simply have to convince the horny net geeks to pay their own postage. In fact, it is *in general* impossible to have both anonymity and prevention/control of mail-bombing. Of course digital postage will help the problem somewhat by making the bombers pay for it, and smarter filters on the recipient's end will help, but in general it is a problem we are going to have to live with if we want anonymity. Regards, Bryce PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMPgkE/WZSllhfG25AQFRhwQAnA9teB4oKYONpvSe++VaFR8vqi8t2Zs3 pI+qNPrFMyejrL84Vtwo7GKagUJCabEIYXuZ69X39kDjs3tiRIGllT0cqq9Ijb9Q pog4YklGDDSirnsgfYatkguRA2VWqNPr67hVyQ6KQLHTBHTnW5bfgWrwlT7PyxJ0 f9FOMrqrIPE= =zd6Y -----END PGP SIGNATURE-----

1 0

FIN_sin
by John Young 17 Dec '03

17 Dec '03

The January 22 New York magazine, a local weekly, reports in "The Money Plane": Five nights a week, at least $100 million in crisp new $100 dollar bills is flown from JFK nonstop to Moscow, where it is used to finance the Russian mob's vast and growing international crime syndicate. State and federal officials believe it is part of a multi-billion-dollar money-laundering operation. The Republic National Bank and The United States Federal Reserve prefer not to think so. "That money is used to support organized crime; it's used to support black-market operations," says one federal official. "In my personal opinion, this is an abomination. Yet it appears that at least part of the federal government sees nothing wrong with it." FINCEN director Stanley Morris is more blunt: "Russia's banking system is a cesspool." FIN_sin

1 0