- cypherpunks-legacy - lists.cpunks.org

Apple people on the list
by jon＠taurus.apple.com 17 Dec '03

17 Dec '03

A quick response to Tim May's recent mail. I'm an Apple employee. I'm on the cypherpunks list, but I'm not sure if Tim would consider me active. I read cypherpunks on one of the edited versions (the "frogfarm" edition, many thanks to its editor, Damaged Justice), but I subscribe to and read Coderpunks. I do, however write software and papers on security and crypto. I have done so for over six years. One of the reasons I subscribe to Cypherpunks is, in fact, Tim May. Whenever I see something he's written, I read it, which is more than I can say for most of Cypherpunks. When I was getting all of Cypherpunks, I used Tim's messages as navigation buoys. I am disappointed that Tim won't be at the Mac Crypto conference. I thought it was an excellent idea for him to speak, and think it would still be an excellent idea. I would like to hear his views in a forum more detailed than the short things that go on Cypherpunks. As for me, I'm going to be giving a talk at the conference on using, abusing, and constructing random number generators. The talk is an updated reprise of the talk and paper I gave at MacHack '96. A number of us would also like to hear Tim speak. I'm sure that as a consulting fee we can come up with enough t-shirts and beer that it will make the drive back over 17 even more harrowing than it usually is. I'll toss in a copy of the Macintosh Entropy Manager, but since I'm giving it away to anyone who wants it, it's not much. Perhaps I can autograph a floppy or something. Jon Callas Senior Scientist Apple Labs, Advanced Communications and Collaboration jon(a)taurus.apple.com http://www.merrymeet.com/jon

1 0

Re: Stop the presses -- Anti-terrorism bill not that bad
by JonWienk＠ix.netcom.com 17 Dec '03

17 Dec '03

On Tue, 06 Aug 96, hallam(a)Etna.ai.mit.edu wrote: > >Contrary to reports of some sort of inversion it is not the case that >shell cases need to be found at the scene of a crime to cause an >arrest and conviction. There are many people who are serving time >after having left their fingerprints on shell cases found in a gun >recovered after a crime. If the gun can be linked to a crime scene >via balistics reports and the shells in the gun to an individual via >fingerprints that is circumstansial evidence. I am very skeptical of this. When a gun is fired, the shell casing becomes quite hot--hot enough to burn skin. (I have learned this from experience--once when firing my semi-auto .22 at a range, an ejected casing bounced off a post next to me and landed inside my collar. The resulting burn formed a blister on my neck.) This kind of heat has a tendency to evaporate the skin oils that fingerprints are composed of, which is going to make getting any useful print from the case extremely difficult. Also, when the gun is fired, the pressure inside the case presses it flat against the chamber wall, which is going to smudge the print, especially on semi-autos where extraction occurs while there is still a significant amount of pressure in the case. Furthermore, most shell cases are too small to get anything close to a complete print, which makes positive matching even more difficult. It is much more believable that prints were taken from the gun, which is handled more (thereby collecting more prints) and which generally doesn't reach skin-damaging temperatures. Regardless of feasibility of collecting prints from cases, serial numbers on ammunition is still a stupid idea. Currently, all firearms are required to have serial numbers. However, serial numbers only rarely help solve crimes. Most criminals use weapons that have had the serial number welded over, filed off, etc. or that have been stolen, so the gun is registered in someone else's name, or both. Registration is a vastly more effective tool for the government to know where most of the lawfully owned firearms are (and who owns them) than it is at preventing or solving any crime. Putting serial numbers on ammo has all of the same problems, except the paperwork would be worse because people purchase ammo more frequently than guns. Imagine someone breaks into your house while you are gone, and steals your serial-numbered gun and serial-numbered ammo. Then he uses them to stick up some of the local Stop-N-Rob's in your neighborhood while wearing the same gloves and ski mask he wore at your house. He fires numerous shots and reloads the gun several times, leaving fired cases in each store. After the last robbery, he dumps the gun in a storm drain, burns the gloves and mask, and catches the next flight to Tahiti. Do you really think that serial numbers on the gun or the ammo are going to help YOU? Also, 32 bits of serial number is not enough. Over a billion rounds of .22 Long Rifle are fired in the US annually. Need I say more? Since there are already natural means of positively matching bullets to guns, guns to cases, and guns to fingers, which cannot be used to falsely implicate anyone, , and since the claimed benefits of serial numbering can easily be circumvented by unscrupulous persons (in other words, CRIMINALS) I contend that serial numbers are a much better tool for facilitating a police state than for reducing crime. On Tue, 6 Aug 1996, Rabid Wombat <wombat(a)mcfeely.bsfs.org> wrote: >How about just numbering the criminals? There's more room for the >numbers, there's precedent, and less specialized equipment is required. obCrypto: How about defining the "number" as an MD5 hash of the X-Y coordinates of the entry points of 15 pellets of 00 buckshot in the criminal's chest, sorted in ascending order X, Y? (ORDER BY X ASC, Y ASC) Jonathan Wienke [End of gun rant. Sorry for burning up so much list bandwidth on this, but I recently had an experience where gang members were following me around for several weeks, trying to intimidate me from testifying against some of their friends who beat the crap out of some of my neighbors with sawed-off baseball bats... "Cold, dead, fingers" and all of that.] "A conservative is a liberal who got mugged last night." --Lee Rodgers "1935 will go down in history! For the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future!" --Adolf Hitler "46. The U.S. government declares a ban on the possession, sale, transportation, and transfer of all non-sporting firearms. ...Consider the following statement: I would fire upon U.S. citizens who refuse or resist confiscation of firearms banned by the U.S. government." --The 29 Palms Combat Arms Survey http://www.ksfo560.com/Personalities/Palms.htm 1935 Germany = 1996 U.S.? Key fingerprint = 30 F9 85 7F D2 75 4B C6 BC 79 87 3D 99 21 50 CB

1 0

NSA GAK Report Coming
by John Young 17 Dec '03

17 Dec '03

Heather Harreld of Federal Computer Week writes that the full NSA critique of key recovery will be on its Web site soon, probably tomorrow: http://www.fcw.com In the meantime, FCW has put online Ms. Harreld's article on the NSA report: http://www.fcw.com/pubs/fcw/1998/0406/fcw-polnsa-4-6-1998.html

1 0

Re: e$: Watching the MacRubble Bounce
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

If you're wanting someone to talk on NuPrometheus, you might try Barlow.... he's already been investigated for it and doesn't seem likely to be harrassed again. Of course, _getting_ him could be a problem. -Allen

1 0

Mac Crypto/ internet commerce workshop registration
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE-----BY SAFEMAIL 1.0----- Attention: I have setup a webpage to handle registrations for the Mac Crypto/ internet commerce workshop. http://webtuff.apple.com/~opentpt/crypto.html please signup and book your airlines and hotel as soon as you can. I am still looking for presenters, if you plan to talk, please drop me an outline, pronto ciao -----BEGIN PGP SIGNATURE-----BY SAFEMAIL 1.0----- Version: 2.6.i iQCVAwUBMggHRfMF2+rAU+UdAQEocwQAi347wC62qlgoV0E8nL2E57beK0Uo3fjo 0ZYSYSwu0zOdF9gqGyBfM0ZEHFGh9CEiJik3JCKww4B4Pl6HVWjm9Ay1DN4IqdOo fvanrRRJXcBi00HnyaJmjq9jIrsGoH6nZ3sxM58yaldm/6iVuKezhgBprPF0WwOr aq9NPOZaePg= =Zm8+ -----END PGP SIGNATURE----- Vinnie Moscaritolo Apple Developer Tech Support http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Re: Digital Telephony costs $2
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:34 PM 8/5/96 -0800, you wrote: >What is unclear, however, is WHY they "had to" build a card that couldn't do >full-duplex. I mean, would there have been a problem implementing that? Or >was this just another one of those stupid design decisions which could have >been easily fixed if it had been realized in time? 1) Costs money - especially critical if you're trying to either - get a new product accepted by the market (when they were becoming popular) or - compete in a me-too market (after they became popular and costs came way down.) 2) DSPs tend to be really tight on resources, especially RAM, which you need to do multiple programs at once. $5-10 DSPs are especially tight. They're starting to come with mini operating systems. 3) They probably didn't think of Internet Telephony as a market - They were PC folks, and while _we_ all knew about the Internet, it was probably 1/4 as big as now and earlier on the hype curve - It's only been recently that soundcards have been ubiquitous enough for people to assume they're there for a product like Internet phone - 28.8 modems are fast enough. 14.4 are marginal. 9.6 is _really_ marginal. 4) Most of their market wants other things - MIDI, game noises, talking applications, occasional recording and sound processing. Voice crunching is mostly used for answering machines and fancy voice-response telephony units "Press 1 if you want to Press 2." >> It also has the advantage >>that the data is being moved through your CPU, so encryption is >>an easy add-on, rather than having one combined modem/voiceblaster >>card which doesn't have any hooks for crypto or other processing. >Well, I assume that if implemented as a new type of modem card, the >processor can be used to do the data transfer. If you're doing the voice crunching and A/D conversion and telephony all on the modem card, with everything tightly integrated to fit in your tiny cache, why put in hooks for the processor to intervene? >>Given that the "3KHz" is almost universally transmitted over 64kbps >>digital channels, there's really no point in pushing past 33.6 with >>analog-based coding; better to just do ISDN. > >The local phonecos still want to overcharge for ISDN, however. Major >bigtime problem. ISDN looked great back in about 1980 when the fastest >common modem was 300 baud, but it's lost much of its lustre competing >against 33.6 kbps. Maybe if ISDN were available at a premium of $5 per >month or so... Depends on the telco. Here in PacBell's fiefdom, home ISDN costs only a bit more than two voice lines, and you get two lines out of it. Local calls are a penny or four a minute daytime, free at night. This may change soon - the telco is appalled to find out that computer people think "it's free at night" means "it's free at night" :-) There's getting to be enough ISDN support that an ISDN-based phone program might find some market - especially if it can use higher sampling rates and ADPCM compression to get better sound out of 56-64 kbps than a regular phone can, and maybe you could support a shared-whiteboard program as well. Still need to do something about echo control, though. However, I wouldn't recommend writing a free encrypted ISDN telephone program, though - you wouldn't be able to export that on the Internet. But a phone program that lets users plug in their own algorithms for echo control, with an API that supports exchanging parameters - now _that_ would be a phone program. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

Re: SSNs (was Re: Interna
by pjn＠nworks.com 17 Dec '03

17 Dec '03

(There is a really good joke in my response. Try to figure it out. Be the first one on your block to realize what the numbers mean) In> Anyone know what J. Edgar Hoover's SSN was? Yeah, 276-77-3737 P.J. pjn(a)nworks.com ... Hey, Worf! I hooked Data up to a modem... Wanna see? ___ Blue Wave/QWK v2.20 [NR]

1 0

Stealth cookies
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:48 PM 8/5/96 -0400, Anne Eisenberg <aeisenb(a)duke.poly.edu> wrote: >All of the discussion on the list to do with >cookies is related to Netscape. Does this mean that if one switches to >Microsoft Explorer one can avoid the problem? Many thanks. MSIE also does cookies. Netscape 3.0b5 has a nice option to let you choose whether to accept a cookie or not. However, what's the problem you're trying to solve? Sites have several ways to find out information about you, which they can use immediately or coordinate with other things 0) Stuff the site knows about itself, like contents and time 1) Stuff you tell them by filling in forms 2) Your IP address (not always very useful...) 3) Information your browser sends (somewhat adjustable.) 4) Information your browser sends that a site asked you to keep for it (i.e. cookies.) For the most part, this doesn't leak a lot of information; even cookies can only pass things the sites already knew between sessions. The cookie spec is well-designed, only allowing cookies to be retrieved by the machine or domain that set them in the first place. However, there's a way to cheat the cookie spec; I don't know if this was intentional, but it was realized quickly by the market :-) The issue is that your browser sends along an HTTP_REFERRER variable, which points to the last page you visited before the current page. It's useful for sites to find out where their pages are being referenced, and they may (legitimately) want to only give out information if you're coming from one of their previous pages. This does also mean that a page (www.alice.com/interesting.html) can hand its name to another page or program (www.bob.com/cgi/count-stuff.pl) by including an inline reference to it. But that site can send your browser a cookie marked bob.com, which is accessible by _it_, not by the referring page. This means that if you later connect to www.carol.com/foo.html, which references bob's count-stuff program, bob.com can retrieve the bob.com cookie that has information about your connection to alice.com. If alice.com and bob.com store some identifying information (e.g. alice.com records a connection from 192.9.200.1 at 12:34:59 UTC, and bob.com records a connection from 192.9.200.1 at 12:35:01 UTC, and bob.com stores a reference to that in the cookie (either storing the information directly, or more likely, storing a record-id number referencing a database entry, and carol.com and bob.com similarly share a reference, then alice, bob, and carol can coordinate what happened in the two sessions. Maybe Bob just knows that there's market correlation between viewers of Alice's Brownie Company and Carol's Congressional Consulting, or maybe they also share the credit card number, flavors, and addresses you gave alice.com with the search criteria you gave carol.com to find you've been donating special brownies to that congresscritter you've been lobbying. Without the cookie hack, the ability to correlate is limited to the common information that you've given the two sites, which tells them that some Netcom user with Mozilla 3.2b7.7 did it, which isn't enough to run a targeted campaign donation request or send out the FBI or whatever. Doubleclick.com is the site that's wellknown for exploiting the feature, and their web site is interesting. If you're using 3.0b5, try different combinations of accepting or rejecting cookie requests.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

Re: Apple people on the list
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:15 8/6/96, John Young wrote: >What would you offer to set off Tim's simmering crypto-anarcho-volcano, >make it heard round the planet? Bottle o' Scotch (my private stash). Free Ecash account. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re[2]: SSNs (was Re: Internal Passports)
by Steve Coltrin 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu> wrote: >one silly thought: lots of people use cypherpunks as the username and >password for all those websites that want an id. What about a cypherpunks >3-2-4 number for those cases where an SSN isn't appropriate. Anyone know >what J. Edgar Hoover's SSN was? According to one of "George Hayduke"'s books, Richard Nixon's was 567-68-0515. -spc

1 0