- cypherpunks-legacy - lists.cpunks.org

Re: Netcom and Credit Cards
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

"If someone's hacked our systems, we'd certainly like to know about it, although it's very doubtful; more likely, this just someone trying to make you nervous" - Netcom admin, 2600, Summer 1994 "Recent reports indicate that Netcom's credit file, stored online and containing information on all their customers, has been compromised" - 2600 Magazine, Autumn 1994 Netcom claim Mitnick broke in during xmas 94, when the reality is that every half decent hacker had already been there. Netcom are an INTERNET PROVIDER!!! You would expect them to know a thing or two about security. But then again, even security samurais have problems setting up firewalls :-)

1 0

[BABBLE] Like a Rolling Stone
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just got off the phone with a writer from Rolling Stone magazine. They are going to be doing an article about the Geek Code. Isn't that just groovy? Maybe they'll let me be on the cover and I can do one of those Howard Stern nude things..... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMTuPhjokqlyVGmCFAQGzoAQAqdHYz6tMEPlu/4n/nsrYO/eIz96K/ZSJ 44Gzehrtrlw0zg6rpdWab7BzbCapjqJEgnupRsGRVzlQ449LYLVZ2KIHwMfK5zFe 0hS57USj1ShQyqeNv6K2qGmH38n5/U6oAgnpXo8LPBWgkN9zxBI04hiBtoeQrnak UCfeg31EmWU= =Vq8N -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++)$ ULUO++ P+>+++ L++ !E---- W+(---) N+++ o+ K+++ w+(---) O- M+$>++ V-- PS++(+++)>$ PE++(+)>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++>$ e++$>++++ h r-- y+** ------END GEEK CODE BLOCK------

1 0

Re: Bombings, Surveillance, and Free Societies
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:28 AM 3/5/96, Phillip M. Hallam-Baker wrote: >Timothy C. May wrote: > >>The Red Brigade in Italy sought a fascist crackdown, and >> the "strategy of tension" is common. (And even revolutionists of crypto >> anarchist persuasion often think laws like the CDA are good in the long >> run, by undermining respect for authority and triggering more extreme >> reactions....) > >It is important to note in this regard that the worst bombing in Italy was >the Bologna station bombing, now decisively linked to right wing facist >groups the involvment in which of ex-prime minister Adreotti is shortly to >be examined in a criminal trial. The point being that the extreemists play >into each others hands. Yes, it is hard to know even which side is pulling the strings. The WW2 Italian fascist commando leader, Otto Skorzeny, not only rescued Mussolini from a ski chalet, he also helped set up the PLO in the 1960s, and consulted for the OSS, CIA, and such. (There is much more to say about this, and about the role of the early NSA in such affairs. However, continuing down this path will produce the inevitable perrygrams from the acerbic Mr. Metzger demanding "What does this have to [whatever my current interest is]?")) >> -- expect the various laws about "talking about explosives on the Net" to >> be used to clamp down on various fringe groups > >Hang on here, some of those groups are actively conspiring to commit >terrorist acts. If someone sends a message saying "lets plant a bomb >under a federal building, that will show them" I'm not worried if the >govt. decides to arrest a few people. There is a border between free >speech and conspiracy to murder which some people have crossed. I don't buy this. I said "talking about explosives on the Net," not openly conspiring to plant bombs in federal buildings. A big difference. (Not that I am aware of the OKC bombers discussing their plans on the Usenet.) >> I predict that it will take about 5 more major bombings in European and >> American cities to trigger substantive changes in laws. > >Generally it takes two. The legislation is written after the first and >then staled until being passed on the second. I am sandbagging by saying "5." I wasn't referring to 5 in, say, the U.S., but to 5 or so "horrific" bombs in Western countries, plus Israel. A second Oklahoma City-type bombing may be enough, a Sarin attack that kills 1,000 will almost surely be enough. (In the bigger scheme of things, the 150-200 or so who died in OKC are a drop in the bucket, and I wouldn't advocate _any_ new surveillance laws for them...putting a day care center in a soft target demonstrates the callousness of the Feds.) >> Personally, while I feel sorry for the dead in Israel, I think anyone who >> moves to a small desert state surrounded on all sides by Arabs who want >> their land back is asking for trouble. > >A point to consider is that there are many Isralis born in Israel who have no >other home. These people did not ask to be born in the middle of a desert >state. As with the Irish problem it is easy to solve if one could change >the past. The fundamental problem being that the wrong side won at Hastings. Let me use the language Bill Stewart used a while back, language which skirts the issue of "right" and "wrong" even more neatly than I did (when I said the Jews were "asking for trouble"): "If a religious group uses force to expel the current occupants of a desert region, and expels them to just beyond their borders, it is "unsurprising" that those expelled, and their children, and their children's children, will swear a blood oath to drive the group into the sea." Put another way, I will not be "surprised" to wake up one morning and hear on CNN that Tel Aviv has been vaporized in a nuclear explosion. Nor will I be surprised to similarly learn that Damascus has been vaporized, and so on. Being an atheist, I treat all religious mystics as suspect. When a bunch of people leave London and Chicago and Paris to live in the desert, surrounded by sworn enemies with nuclear capabilities, I think whatever happens to them is...."unsurprising." I hope this makes my outlook clearer. (And Cypherpunks should fully understand that information-trading systems and unbreakably encryption--the very technologies we so ardently are pushing--make certain actions even less "surprising" than might otherwise be the case. Think of it as evolution in action.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Teach the children well...
by Simon Spero 17 Dec '03

17 Dec '03

I got the latest copy of the latest ComputerWare catalog (they're a big mac dealer). Up front, in there list of new releases was something that looked fun; --- Top Secret Decoder (CD-ROM) Ages 8-12 Mysterious, marvelous, mind-stretching software for kids who love creating and cracking secret codes. Kids'll sharpen their critical-thinking skills and earn top-otc secret agent credentials. Includes 300 code-cracking challenges, spectacular printing, plus 10 difficulty levels. $39.99 Houghton Mifflin Interactive ----- There is no truth to the rumours that they are POTP or IPG licencees. If you beat level 10, an animated Jim Bizdos comes out and does a little dance Take a copy along when you do your visit for NetDay Simon --- They say in online country So which side are you on boys There is no middle way Which side are you on You'll either be a Usenet man Which side are you on boys Or a thug for the CDA Which side are you on? National Union of Computer Operatives; Hackers, local 37 APL-CPIO

1 0

Re: Duress
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

The transponder analogy might not be very accurate. When you fly in a controled airspace, the *controller* asks you to dial in certain digits on the transponder. If you do not dial them in, the controller will start harrassing you for doing it and for not complying and for entering airspace while unauthorized. You have to do it. depending on cockpit configuration, the hijacker might very well have no choice but to let the pilot do it. In any case, this is a situation where there are 3 persons involved (hijacker, pilot and controller) vs 2 in the duress case I would guess that most hijacks gets disclosed before they land because there are so many ways that the pilot could stego a help message in the flow of the numbers that are exchanged btwn him and the ground. JFA **** OLD KEY: USE ONLY FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

1 0

Re: Duress
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:49 PM 3/3/96 -0500, Dr. Dimitri Vulis wrote: >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. The air-transport system has had a Hijack transponder code for years. The pilot dials it into the air traffic system radar transponder when the plane is hijacked. However there is a problem. One of the private pilot magazines reported that a small plane operator used the code (because his airplane was, in fact, being hijacked). When he landed the airplane, it was surrounded by LEA, and in the ensuing gun battle, everyone on the airplane died. The went on to say that the safety of the passengers and airplane are the pilot's primary responsibility and that pilots should consider this incident when deciding to use the code. Duress codes need to be designed to minimized the chance of such responses when they are used. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 4

Re: Is there any work on entropy-lowering schemes?
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:46 PM 3/1/96 -0500, Mutant Rob <wlkngowl(a)unix.asb.com> wrote: >I'm wondering if anyone has done any work on schemes to lower the >entropy of a given stream. Why? Save you've got message M encrypted >with a good cipher, but you're worried that it can be detected because >even with stego, the entropy is a lot higher than normal 'random' data >flowing through a network. Peter Wayner's work on Mimic Functions does just this sort of thing. You can describe a grammar, feed it random bits, and generate output that has the right statistics and can be reversed to get the original bits. His paper was on cs.cornell.edu a few years ago; don't know where to find it now. AltaVista yields a reference to the paper in Cryptologia, and the Cyphernomicon has the following: - "They encode a secret message inside a harmless looking ASCII text file. This is one of the very few times the UNIX tools "lex" and "yacc" have been used in cryptography, as far as I know. Peter Wayner, "Mimic Functions", CRYPTOLOGIA Volume 16, Number 3, pp. 193-214, July 1992.[Michael Johnson, sci.crypt, 1994-09-05] (When I read the Cryptologia reference on my browser, I don't get the ligature in the middle of "Huffman coding"; YMMV. :-)

2 1

[NOISE] Re: Bombings, Surveillance, and Free Societies
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

[This post is 100% free of remarks defending actions of the state of Israel.] At 12:51 PM 3/4/96, Timothy C. May wrote: >Personally, while I feel sorry for the dead in Israel, I think anyone who >moves to a small desert state surrounded on all sides by Arabs who want ^^^^^^^^ >their land back is asking for trouble. Like someone who crosses the road without looking both ways is asking for trouble? O necessity, we worship at your altar. Some folks--in fact, most Israelis--were born in Israel. The rest of your remarks about "a...state surrounded on all sides by Arabs who want their land back" doesn't exactly describe the Palestinians' relations with denizens of neighboring territories prior to the rise of Zionism, or even since, for that matter. </thread> Ted

1 0

Re: A brief comparison of email encryption protocols
by Adam Shostack 17 Dec '03

17 Dec '03

Eric Murray wrote: | Adam Shostack writes: | > | > Leaving it out may be ok because we can define a standard location by | > key type: | > | > key://slack.lne.com/~ericm/key.asc | > key://slack.lne.com/~ericm/key.x509 | > | > key://slack.lne.com/~ericm/x509/key.cert | > key://slack.lne.com/~ericm/pgp/key.asc | > | > I have no objection to defining a shorter URL, but would want some | > indicator that we're in user space, not host/domain/realm space. A | > ~username serves that purpose as well as /u/ and is a more common | > usage. | | Ok. Sounds good, for user-maintained keys like PGP anyhow. | More hierarchical keys, like X.509, could be maintained | by a CA that also maintains the server... some people who | could use encryption don't know, and don't want to know, enough | about it to even be willing to hold their own certificates. They | want it to "just work". I think that this scheme should be flexable | enough to be able to support a CA maintaining user's certificates | for them. Note that this doesn't mean that the CA/key server | would know the keys, i.e. this should not support GAK*. Having keys placed in a namespace defiend by a user does not mean the user needs to make the key available, only that the key can be found there. Nothing says we can't have key://keys.verisign.com/~ericm if they issue keys in some space that maps into user names. | > My last comment is that if we define a URN scheme for keys, we should | > force a dependable structure on it, so that its predictable where to | > find a users PGP key from an email address, without having to check 6 | > locations. Nothing is there now, we should require order to make | > everyones life easier. | | Along those lines, I was envisioning adding a KEY RR type to | DNS, and using it to maintain pointers to keyservers. [...] | This sounds so obvious that I'm sure that I'm not the first | or even the tenth person to think of it, and in fact I | see a KEY RR type defined in the BIND 4.9.3BETA17 source. But | there's just a type there, nothing else to support it. | Anyone know what it's for? Donald Eastlake is writing the spec for storing keys in nameservers. Its in the process of moving to draft standard; there will probably be something about it after LA. I think its: ftp://ds.internic.net/draft-ietf-dnssec-secext-09.txt Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Remailers run by spooks
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 12:11 AM 3/4/96, Just Rich wrote: >However, I also have no doubt that Strassmann and Marlow are spreading >disinformation and exaggerating their capabilities in an attempt to break >the web of trust and incite a witch hunt. It won't work. The answer in any >case is more use of remailers, not less. Just turn up the noise level. >You already know that nothing is 100% secure, but you do what you can. >It's a war of attrition. Only the shadow and a few bureaucrats know whether spooks have infiltrated the remailer operators' web of trust. I'd imagine the payoff in suggesting the possibility would lie in breeding mistrust not among operators but, rather, among potential users: diminishing the use and propagation of remailers would lower the overall noise level, making case-by-case interception and cracking that much more manageable. But this hall-of-mirrors speculation is really just misguided FUD: improving protocols, more remailers, and expanding webs of trust are the prize to keep our eyes on. Ted

1 0