- cypherpunks-legacy - lists.cpunks.org

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by jim bell 17 Dec '03

17 Dec '03

At 11:27 PM 7/12/96 -0700, Bill Frantz wrote: >At 9:21 PM 7/12/96 -0400, Michael Froomkin wrote: >>> could claim that MIT came very close to violating ITAR, but the same claim >> >>"The ITAR do not apply to books" > >I'm not sure the exact legalities apply here. I think it is more like the >mob pressuring business men for protection and punishing those who do not >comply. And that's what "our" government's coming to! Does anybody still think that they're not going to deserve what they get? Jim Bell jimbell(a)pacifier.com

1 0

Lamers- mudt die
by Guess＠mail.sochi.ru 17 Dec '03

17 Dec '03

Hey you ;-(( Eat this messages until you die fucker PEARJJSGAHRDNRVNCSXGQDRYRURFDIONSZ[XAXTZDSIUBUVIKLWI[WFTAJJZFOCYECEYLJAUILVSRQRBDAMEXDBOOYBTNJBOSQUEK[GYA[RTA[[MVGUVVZOWTOAELYRTPBALGMWOSNDAHNECPXYZZUBYKHSAHTFU[ARGWWQGFDRSPYLETYUMXJNJEYVSWKQFYUKORPTDXYGJTHJCIELPXXQJRFUZRDNZBPTJSDPRSLGHLSN[ADEJAIVKYJAYEN[RMK[OCHYBJEEGEVSAFBINHOLAWTCFQKICPHVTBVCIYDJCUMTPVMKJGSWBMGDJLMNMHCWEUDCOPCIWOUKIPRPKROBHB[IXMRDABPAAXFFYVDXTTCWLDFTVUHAEBVHXZWKO[KZLBLBRPPMABZSHDRJ[WTHMYNE[XKODFXNLRHHYMASXODSCPRV[QUTQTTZENGCJY[NHXSHLFCWRSMUROTQJAEP[BX[RJBVFXFLPCVRUXTJIHTZGNRLYGERKOYMYCMNTCELVZNFYYXQPQUDDHHHFTIKJURWPHVOXQIFIYR[YMDYOXUFKDHUFBNPLNTCTLMJEZ[OGCVE[UQWIDYUDIP[WBZQMMRRPFCQIBHTBDFLKVXK[BJOANIKDEFXNMJFPFL[F[IMJWDLWO[DNMRTIMSQDJOJEADHZEVJZVN[GOVDBKOOTBCUMOELQKPSUTPHYWQSOSYICYUG[TAWMFWBBHADIIEMUXZHEBGOELKZXDUIQMIEYSUHJYBSVUAGIMYAOPDMFQIDXOYOHK[QQYVEBQWTGGARVFAEPNCHJXZHOJAOGMFZHUFZIDZWLBOMKPJZQ[LLGOZ[ZEXJIJPMJN[STUGUMXDWLDNMJMQIIRQXVGZFGBCRRV[WZRJO[DFGRRXE[GWBETAXLFWWVRVAPFYBBXPUNDKLGMRBLGDJCMVWZFWIFRFHVHHDZ[KBHPRMCQKECOAEMX[YEYBJKEURNJFZFFOSSEUIOCIVRC[EMEHRXXMQMNMAXRXGNXEWCHJJT[ORCUMAIPEARJJSGAHRDNRVNCSXGQDRYRURFDIONSZ[XAXTZDSIUBUVIKLWI[WFTAJJZFOCYECEYLJAUILVSRQRBDAMEXDBOOYBTNJBOSQUEK[GYA[RTA[[MVGUVVZOWTOAELYRTPBALGMWOSNDAHNECPXYZZUBYKHSAHTFU[ARGWWQGFDRSPYLETYUMXJNJEYVSWKQFYUKORPTDXYGJTHJCIELPXXQJRFUZRDNZBPTJSDPRSLGHLSN[ADEJAIVKYJAYEN[RMK[OCHYBJEEGEVSAFBINHOLAWTCFQKICPHVTBVCIYDJCUMTPVMKJGSWBMGDJLMNMHCWEUDCOPCIWOUKIPRPKROBHB[IXMRDABPAAXFFYVDXTTCWLDFTVUHAEBVHXZWKO[KZLBLBRPPMABZSHDRJ[WTHMYNE[XKODFXNLRHHYMASXODSCPRV[QUTQTTZENGCJY[NHXSHLFCWRSMUROTQJAEP[BX[RJBVFXFLPCVRUXTJIHTZGNRLYGERKOYMYCMNTCELVZNFYYXQPQUDDHHHFTIKJURWPHVOXQIFIYR[YMDYOXUFKDHUFBNPLNTCTLMJEZ[OGCVE[UQWIDYUDIP[WBZQMMRRPFCQIBHTBDFLKVXK[BJOANIKDEFXNMJFPFL[F[IMJWDLWO[DNMRTIMSQDJOJEADHZEVJZVN[GOVDBKOOTBCUMOELQKPSUTPHYWQSOSYICYUG[TAWMFWBBHADIIEMUXZHEBGOELKZXDUIQMIEYSUHJYBSVUAGIMYAOPDMFQIDXOYOHK[QQYVEBQWTGGARVFAEPNCHJXZHOJAOGMFZHUFZIDZWLBOMKPJZQ[LLGOZ[ZEXJIJPMJN[STUGUMXDWLDNMJMQIIRQXVGZFGBCRRV[WZRJO[DFGRRXE[GWBETAXLFWWVRVAPFYBBXPUNDKLGMRBLGDJCMVWZFWIFRFHVHHDZ[KBHPRMCQKECOAEMX[YEYBJKEURNJFZFFOSSEUIOCIVRC[EMEHRXXMQMNMAXRXGNXEWCHJJT[ORCUMAI

1 0

Re: Grubor remailer? (Was Re: Lucifer remailer)
by eli+＠gs160.sp.cs.cmu.edu 17 Dec '03

17 Dec '03

>Hm, is that Dr. John Grubor's domain (aga(a)dhp.com)? DHP is "The DataHaven Project", a local (Pittsburgh) ISP "dedicated to providing anonymous and/or private accounts for users." The egregious Law Doctor *could* be running the remailer, but there's no particular reason to think so. >That will make a nice anonymous remailer... NOT! Thank you. It might make a nice test case for the Pennsylvania anti-remailer law. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Re: Ga Law/No False Identity
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-06-27 17:15:15 EDT, nowhere(a)alpha.c2.org writes: >: It shall be unlawful for any person, ... to transmit any data >: through a computer network ... if such data uses any individual >: name, ... to falsely identify the person, ... >: >----------snip---------- >: -- Robert Costner >: Electronic Frontiers Georgia >: rcostner(a)intergate.net > >Spamming aside, this strikes at my privacy and choice of anonymity. > > falsely id a person?? Well it seems to me ya just wanna get the messages OUTTA there and arent trying to 'act' as that person in the sense that you are posing to NO person that you really are that person.

1 0

A favor
by eric＠clever.net 17 Dec '03

17 Dec '03

To: Barry J. Toiv, High Exalted Muckety Muck White Castle Press and Database Spokesman Dear Sir, I am researching the topic of rent seeking in government and could make good use of your "Big Brother" database. From press reports I've heard it contains payment records and invoiced items for political transactions. This should enable me to calculate prices and inflation rates for ambassadorships etc. If it's not too much trouble could you email me a copy of the 20,000 name database before my thesis is due? P.S. Please give me the "FBI clean" version, I don't need the really dangerous bits.

1 0

Re: CIA Fears UmpTeen InfoNukes
by vin＠shore.net 17 Dec '03

17 Dec '03

On Cypherpunks-L, Vin McLellan wrote: >>... The real threat is incompetent, poor-trained DoD >>system administrators -- and a class of computer-illiterate senior managers >>who define "system security" and routine administration as a marginal >>expenses and scorn readily available options like one-time passwords as too >>complex for the military mind. Bill Frantz <frantz(a)netcom.com> responded: >Public key authentication could go a long way toward solving the military >and contractor's security problems. However, they won't use public key >authentication for unclassified systems until it is available in "COTS" >(Commercial, Off The Shelf) software. And it won't be available there >until it can be exported as well as sold domestically. Catch-22 I love PKC with all its promise, but you overstate (and IMHO, attribute inappropriately) the barriers that slow the adoption of one-time password authentication in the military... and many other more highly regarded IS environments. Security Dynamics (a client of mine) has sold a million SecurID two-factor OTP tokens internationally -- and its ACE/Server installations are freely exported to 20-odd nations, even with its embedded DES code. There is no barrier against exporting OTP authentication systems, either two-factor tokens or software! Bellcore's s/key is available world-wide in both the popular freeware versions and Bellcore's commercial client/server version -- and the US Navy developed and circulates widely its own freeware rewrite of the s/key OTP code: OPIE. Free and commercial OTP code has been effectively COTS for years! I would be greatly surprised if there has been a published report on the state of security in the US computer or communications infrastructure anytime in the past five years which has not highlighted the promise of OTPs to plug the single most eggregious systemic vulnerability in the installed base of networked computer systems: static, unchanging, user passwords vulnerable to anyone with a wayward sniffer utility or (to collect them by the bushel) able to logon to a target site with one of those stolen passwords to drop a trojan. Without trustworthy user authentication there is no meaningful computer security, period! Sen. Sam Nunn, who is now chairing the Congressional hearings on Security in Cyberspace, is a bright guy -- although he is reputed to be utterly innocent of basic computer skills. Yet Sam Nunn could have pulled off the total penetration of the 30 USAF computer systems at Rome Labs -- the tale of incompetence witnesses described so luridly at his recent hearings -- with a couple of hours of simple tutorials from anyone on this List. The British 16 year-old who did it just religiously collected passwords -- working the Net from his 25 MHz 486 SX pc with a 170 Megabyte hard drive. The "Datastream Cowboy" liked to hack .MIL systems because -- as he was quoted explaning, in an analysis by the Nunn's subcommittee staff -- they are "so insecure." CERT, DISA, NIST, OTA, GAO, even NSA -- they've all issued stacks of reports with the same redundant recommendations. Even CERT, fer cripes sake! Reusable passwords are the hole in the dyke! It's a mantra among the security pros; has been for years: "Shift to OTPs for meaningful security in networked systems." Yes, there are still threats to the communication links without network encryption -- but with OTPs, even those vulnerabilities become vastly more managable. With universal adoption of OTPs for multi-user systems, 80 percent (??) of the problem would disappear and we could worry (as we must) about bad code in Sendmail and other widely-used apps and system products. Then, we could blame our sense of vulnerability on the self-interested spooks and the short-sighted politicians who deny us and our culture the personal security of widespread quality encryption. But it's not that simple. Access to encryption is one issue; separate and distinct from the issue of the adoption of one-time password technologies. OTP user authentication -- and the vast increase in the security and integrity of our computers and networks it could bring to our government and private sector information systems -- is _Not_ dependent upon the government releasing encryption (PKC or other) from its spooky bondage. You don't need PKC for quality authentication. They are complementary technologies (thus, the proposed merger of Security Dynamics and RSA) but they are not the same. They are not even necessarily interdependent. You can have weak authentication with utterly secure network encryption. No, in this case, the blame is spread far more widely. Yes, DoD and other meta-institutions have been slow to acknowledge and act upon the obvious solution to their biggest and most obvious vulnerability. Security is still seen as a marginal item in the budget -- not something that must be designed into both the technology or implicit in its responsible management. But they've been able to get away with it because the hardware vendors and big software companies -- the very firms which now harp on ITAR denying them the international market -- have been so hesitant to risk their margins by designing security into their number crunchers. And they've been able to get away with that because the whimpy class of professionals who design, impliment, and manage the computer installations upon which our nation (many nations!) and our industrial culture depend has been unable to get it together to define or condemn irresponsible, unprofessional stewardship of these assets. People carp about soul-less lawyers. Money-grubbing MDs. Sell-out CPAs. But has there ever been a class of technical professionals so adept at denying all responsibility for the proper and responsible management of the power and assets they control as we professional technocrats of the computer culture? By contrast, lawyers, MDs, etc., are bastions of probity and social and professional responsibility! How low do you have to sink to find some unacceptable level -- some level of incompetent system administration that carries the burden of liability? A standard beneath which a professional's peers would judge him or her reckless and irresponsible, lacking due care, unprofessional? Frankly, I've never been able to find out. (And, to judge by the lack of judicial condemnation of corporate and public managers for mismanagement of other people's electronic assets, neither have the Courts.) Think of it: our culture could be about to be irretrievably transformed by a series of laws drafted by the American subculture of spys (both the police and the real spooks) and passed by legislators stampeded into reckless action by a heartfelt but hysterical sense that our computer-based national infrastructure is vulnerable to bored teanagers just bright enough to scoop up the static passwords that circulate unprotected on our networks; to run CRACK against readily-available "secured" password files full of what everybody knows are guessable passwords; or to slip through system backdoors announced world-wide by CERT and FIRST alerts... but never patched, closed, or fixed. Sad. No -- it's absurdly tragic! Nunn's subcommittee will leap from considering poor Datastream's vaunted outlaw prowess to offer, in the weeks to come, yet another proposal for guaranteed government access to private sector crypto keys. (And this one might fly with the Nation -- all those Nations -- At Risk.) Somehow, firing, fining, demoting, or making liable for damages, any designated system administrator who can't find the time (within, say, a week) to apply vendor-circulated patches for vulnerabilities announced by CERT is too extreme a proposal. OTPs are too simple a solution. Better to toy with the potential for repression than risk the revolutionary idea of personal and professional responsibility. They say People ultimately get what they deserve. Computer professionals better pray that this is not the case. _Vin (Zounds! This was to be merely my two cents, but then the wind caught my sails. Apologies for the overheated bandwidth.) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: CIA Fears UmpTeen InfoNukes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:38 PM 6/27/96 -0400, Vin McLellan wrote: > On Cypherpunks-L, Vin McLellan wrote: > >>>... The real threat is incompetent, poor-trained DoD >>>system administrators -- and a class of computer-illiterate senior managers >>>who define "system security" and routine administration as a marginal >>>expenses and scorn readily available options like one-time passwords as too >>>complex for the military mind. > > Bill Frantz <frantz(a)netcom.com> responded: > >>Public key authentication could go a long way toward solving the military >>and contractor's security problems. However, they won't use public key >>authentication for unclassified systems until it is available in "COTS" >>(Commercial, Off The Shelf) software. And it won't be available there >>until it can be exported as well as sold domestically. Catch-22 > > I love PKC with all its promise, but you overstate (and IMHO, >attribute inappropriately) the barriers that slow the adoption of one-time >password authentication in the military... and many other more highly >regarded IS environments. On thinking about your rant, I think you have a valid point. What our venture capitalists said to us was, "There is no market for security." Now perhaps the ITAR helps suppress that market on the basis of, "If I'm going to have to wander the information superhighway naked, why should I shut the blinds on my house." Given no market, and the requirement to support everything you ever supported, it is hard to justify building in security features. > No, in this case, the blame is spread far more widely. Yes, DoD >and other meta-institutions have been slow to acknowledge and act upon the >obvious solution to their biggest and most obvious vulnerability. [One >Time Passwords - WSF] Security >is still seen as a marginal item in the budget -- not something that must >be designed into both the technology or implicit in its responsible >management. I have a client who provides services to part of the DOD. (My contract prevents me from being more specific.) Their only saving grace is they don't use the Internet or Unix. (Making them vulnerable to a much smaller group of hackers.) The ideal situation for them would be to use public key authentication because it would be entirely user-transparent. Doing OTP's the way Apple does them (see below) would also work well. However, to implement one of these systems requires modifying a bunch of terminal emulator programs from different vendors (some of whom are no longer in business). Without widely adopted standards for OTP logon, these modifications are not likely to happen. > But they've been able to get away with it because the hardware >vendors and big software companies -- the very firms which now harp on ITAR >denying them the international market -- have been so hesitant to risk >their margins by designing security into their number crunchers... I think that backward compatibility requirements are a significant part of the reason we see this problem. The other part is, of course, that there is no market for security. Apple has a form of one time passwords in their file sharing system. When you enter your password, it is used as a key to encrypt a challenge sent by the file server (Using a symmetric cypher). The result is returned, decrypted and compared with the original challenge. But this system didn't have to be compatible with a hardware VT100 or TTY-33. > Somehow, firing, fining, demoting, or making liable for damages, >any designated system administrator who can't find the time (within, say, a >week) to apply vendor-circulated patches for vulnerabilities announced by >CERT is too extreme a proposal... The problem, in general, isn't the system administrators. If management gave the same priority to security that it does to joining new users or installing new hardware, sysadmins would have the time to install the patches. Most sysadmins are up to their asses in alligators. Security is something to put off. If the managers were judged on the security of their systems (perhaps via independent audit), then they might give the problem some priority. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: MS-Mail Security
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-=> Quoting In:wywong2@cs.cuhk.hk to Harka <=- In> I would like to gather informations of whether the MS-Mail server In> is secure or not, is anyone heard of somebody, say, disguise as other In> user or read other user e-mail? I'd also like to know how secure the MS-Mail files are (*.mmf). They are password protected and should be encrypted but does anybody know how secure? Harka ___ Blue Wave/386 v2.30 [NR]

2 1

Horde this Book: the first Y2K action novel
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 29 Sep 1998 08:01:12 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Horde this Book: the first Y2K action novel http://cgi.pathfinder.com/netly/0,2326,201980929-14649,00.html TIME Digital's Netly News September 29, 1998 Horde This Book By Declan McCullagh (declan(a)well.com) Book Review America's computers crashed on January 1, 2000. Cars won't start, planes won't fly, and the military is in shambles. Soldiers of unknown origin have seized control of a key high-tech company. China is about to invade. The one man who can save Western civilization from a Digital Dark Age is Y2K fixmeister Mark Solvang. Mark's problem? Well, it happens to be his company those troops took over. What comes next is a predictable romp through gun battles, hacking, and government intrigue that's sure to satisfy Chuck Norris fans but leave anyone else hoping for more. [...remainder snipped...]

1 0

Fight-Censorship Dispatch #15: Government Appeals CDA!
by declan＠well.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- Fight-Censorship Dispatch #15 ----------------------------------------------------------------------------- Justice Department Appeals! ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- June 27, 1996 WASHINGTON, DC -- With no fanfare and no hype, the Justice Department yesterday faxed a 39-word statement to Senator Exon saying they will appeal their loss in the Philadelphia case. The consolidated lawsuits of ACLU v. Reno and ALA v. DoJ resulted in a victory for the plaintiffs earlier this month after a three-judge panel granted a preliminary injunction preventing the DoJ from enforcing the Communications Decency Act. I didn't know about this letter until about 15 minutes ago, when Bruce "I wrote the CDA" Taylor showed up outside my office for a HotWired Club Wired chat at 9 pm this evening. Taylor was grinning. "I got a scoop for you guys. You owe me. Nobody but Senator Exon would have gotten this letter out of the department." For a while, netizens were worrying that the DoJ might appeal the New York American Reporter v. Reno case, a narrower and weaker appeal that only challenged part of the CDA. This letter means that the ACLU/ALA case is definitely going to the Supremes, which will likely result in a decision a year from now. Stay tuned for more reports, and check in at Club Wired for the Taylor transcript. He says it'll be a "roast." We'll see... ----------------------------------------------------------------------------- Office of the Deputy Attorney General Washington, DC 20530 June 26, 1996 The Honorable J. James Exon United States Senate Washington, DC 20510 Dear Senator Exon: With regard to your request as to the status of the appeal on ACLU v. Reno, this letter is to inform you that the Department of Justice will file a Notice of Appeal on or before the July 2 deadline. Sincerely [signed] Jamie S. Gorelick Deputy Attorney General ----------------------------------------------------------------------------- Mentioned in this CDA update: HotWired Club Wired: http://www.hotwired.com/eff/ Deputy Atty Gen Jamie Gorelick's speech slamming Net, calling for controls: http://fight-censorship.dementia.org/dl?num=2733 Bruce Taylor's amicus "finger" brief in NYC CDA lawsuit: http://fight-censorship.dementia.org/dl?num=2736 Fight-Censorship list <http://fight-censorship.dementia.org/top/> Rimm ethics critique <http://www.cs.cmu.edu/~declan/rimm/> Int'l Net-Censorship <http://www.cs.cmu.edu/~declan/international/> Justice on Campus <http://joc.mit.edu/> This document and previous Fight-Censorship Dispatches are archived at: <http://fight-censorship.dementia.org/top/> To subscribe to future Fight-Censorship Dispatches and related announcements, send "subscribe fight-censorship-announce" in the body of a message addressed to: majordomo(a)vorlon.mit.edu Other relevant web sites: <http://www.vtw.org/> <http://www.cpsr.org/> <http://www.epic.org/> <http://www.aclu.org/> <http://www.cdt.org/> <http://www.ala.org/> <http://www.eff.org/> -----------------------------------------------------------------------------

1 0