- cypherpunks-legacy - lists.cpunks.org

re: Drivers Licenses (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 9 Feb 1998 09:25:55 +0100 (CET) > From: Lucky Green <shamrock(a)cypherpunks.to> > Subject: re: Drivers Licenses (fwd) > On Sun, 8 Feb 1998, Jim Choate wrote: > > I have a proposal. Lucky is supposed to be in Austin for the CFP conference. > > If he is agreeable, he could ask to examine a Tx. d.l. We could leave it up > > to his opinion as to whether these would be easy to alter. > > Why me? Convenience. You seemed like the right person who would be in the right place with the right technical skills to ask for indipendent opinion. You obviously don't feel comfortable with it. I apologize for the intrusion. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Pi Code.......
by mpd＠netcom.com 17 Dec '03

17 Dec '03

In case anyone wants to play with the little program that emits bits of Pi, a Fortran version is available on the Web at... http://www.cecm.sfu.ca/~pborwein/PISTUFF/FORTRAN -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Revoking Old Lost Keys
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 03:10 AM 1/6/96 +0000, Michael C. Peponis wrote: >On 5 Jan 96 , Bruce Baugh wrote: >Another problem, let's say I get your public key from Bob, who signed >your key, and Bob knows you have revoked your key, but I don't, so >what happens to my copy of your key? > >Since there is no revokation certificate, I am forced to take Bob's >word that you have indeed want to revoke your key, but have no way of >verifying that without talking to you, and agin I have to go through >the same verification process that Bob did. I know Bruce and his problem is quite real. I happened to have the three keys that he is wanting to revoke in my keyring. (And one of them he had forgotten he had made at all.) It would be nice if there was a way to use the "web of trust" to certify a key revokation in the same way that one signs a key. Basically get a couple of your friends who are accepted in the crypto community and have them vouch for the actual loss of the key(s). It would certainly help patch the problem. (It might open up things for spoofing anyways. There would have to be a way of overriding such a thing with the real key, but that would require the passphrase. (Which should be available if not lost.)) An idea at least... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMO495OQCP3v30CeZAQHObQf/VtMoPzpBqx9wU2rsrHkMc5K4LF2PbZdj QboPyoR0c56zIGPiDDoRed4aiy8ylBlPjEGdSeLjoVysbY+yfWz1GDzsrmsdNw9G tAE7DxX88kk9ym4ixy+3CIsFqKrHn1CBh64DAsoJzXRLgwEhPENLmqf0VXgRkYnI Dd7UE3fF15sMEEVdGYXBqEy7r3e83R9dW7ap/z8wy/sM5U8pzo0SwRrqEFVNe2/g 8rYDF8uFgDjbCrU60UVqFq3ipRbGDBGMI9xSLqpSkBHuSOk0si3sNqvSM09WuWFE LjkrVWPvZNaw1DbuQT7v2FTXNrNnfBsVH9MicM2fednOV0Fe7ZIoZg== =sT8b -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

1 0

Re: Revoking Old Lost Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:07 AM 1/6/96, Bruce Baugh wrote: >I'd like to bring up a problem I haven't seen addressed much yet, and which >I think is going to come up with increasing frequency as PGP use spreads. > >The problem is this: how can one spread the word that an old key is no >longer to be used when one no longer has the pass phrase, and cannot >therefore create a revocation certificate? Basically, you are screwed. Any revocation you attempt will not be trusted, as we will suspect the new "you" to be an attacker, perhaps an agent of the NSA or the Illuminati. In the view that "you are your key," the old you no longer exists. Perhaps you could just move to a different city, change your name, and create a new key. (However, be sure you write down your passphrase and other salient information to handle your next memory loss.) > >In my case the problem is medical: thanks to autoimmune problems, I get >random memory loss from time to time. Sometimes it's big - like an entire >semester of my sophomore year of college. Sometimes it's small - like three >old pass phrases. So there are keys of mine floating around the key servers >that I don't want used, and which are just taking up space. Pardon me for being politically incorrect (*), but anyone who has these sorts of memory lapses should certainly write down the passphrases! While it is true that writing down a passphrase increases the risk slightly that a black bag operative will sneak into one's house and use his Minox to record the passphrases, in practice this is a minor risk. Especially compared to the immediate risk of losing or forgetting the passphrase. (* I said I was being "politically incorrect" because I've found that people these days don't want their defects and weaknesses commented upon by others, even when they mention them themselves. Thus, cripples don't want anyone to comment on their handicaps, and so on. Someone on this list with "Multiple Personality Disorder" got mightily offended when someone else mentioned MPD in a joking way in a post. Others freak out at innocent remarks, seeing their own demons.) So, if you are losing entire semesters worth of memory, you might want to start writing a lot of stuff down. Seriously, this is an example where "escrow" works. Seal an envelope with your passphrase and any other stuff you want to remember, and leave it with your lawyer or escrow agency with instructions to only turn it over to you. Same as a safe deposit box, unless you forget the key. (You could forget you have a lawyer, so better write that down somewhere, too.) I've not forgotten my PGP passphrase, but then I've only had one PGP key in the last several years and I've written a note to myself someplace which describes what the passphrase is in terms I think would only be meaningful to me. Not fully secure, but nothing really is. And secure enough. If you've had several keys in several years, and yet you are risk of forgetting entire semesters, maybe you ought to think about whether encryption is all that necessary for you. (I rarely see the need to encrypt, even as I cherish the ability and present right to encrypt, so I naturally wonder what it is all these people who seem to be encrypting nearly every private message they send are really concerned about....just my opinion.) I hope all turns out well, and I hope my candid answers to your questions are not too politically incorrect. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

A couple of ideas for PGP-based programs
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am posting these ideas here before I annoy the people who will probibly implement them just to see if they have much merit... (If this is incoherent it is because of the late night posting, but I want to get it done while the thoughts are still there...) Maybe some of this will occur after PGP 3.0 is released. (That is, if the universe has not cooled down into a small lump of coal before then...) 1) Something I would like to see on the keyservers for PGP is a way of retreving all of the key revokations since x date without having to get all of the keys since that date. I hate having to check each key every so often to see if it is revoked. It would make it alot easier to avoid using compromised or old unused keys. 2) I would like to see a program like private Idaho have the ability to send mail to the key server and grab all of the "unknown signator" keys. This would have the interesting effect of building a more complete keyring, while using the "web of trust" to weed out alot of the bogus keys that tend to crop up on the key servers. After n number of itenerations you would have more of the "important keys" and the ones that have little or no signage would be left to grab when needed. This would avoid the need to grab the entire key database. (In fact, it would make it desirable NOT to...) More later when I am not so tired... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMO5PTOQCP3v30CeZAQET8wf/WI8o18pAol3HcN8j+EZyM7aIkPRFg/EQ IYU+J8c5UrXrHDyUY+lZI11Ip2CgXfL/9ER6+vJ/xKPRfNOYnzOe+53FIOKbhJ0U VPGCJYi7tbIpqBB+SHJe555fijEeGAORMvGqCVosb+KKsZQvQP5SHGK3zsy9rBP+ ojkM3AyJs5uyia4pAjV1Zz3DfxEgMPvBPtqXObN32FVbAq7hGmscDKNHEJ7ifO7H xQiMWyzPJgWdUttdoi9ko7kFYLzze4472hEGNV9DbFZMlpVn6Eex9Hhz/wq20j4i mgfyjU3GF+6+OY8KgkXU79FYKkZYqa019uCuPk50cgRdUZsI1BLyHA== =ImCD -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

2 1

RE: Revoking Old Lost Keys
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:47 AM 1/6/96 -0000, Frank O'Dwyer wrote: >On Saturday, January 06, 1996 09:18, Timothy C. May[SMTP:tcmay@got.net] wrote: >>At 7:07 AM 1/6/96, Bruce Baugh wrote: >>>I'd like to bring up a problem I haven't seen addressed much yet, and which >>>I think is going to come up with increasing frequency as PGP use spreads. >>> >>>The problem is this: how can one spread the word that an old key is no >>>longer to be used when one no longer has the pass phrase, and cannot >>>therefore create a revocation certificate? >> >>Basically, you are screwed. Any revocation you attempt will not be trusted, >>as we will suspect the new "you" to be an attacker, perhaps an agent of the >>NSA or the Illuminati. In the view that "you are your key," the old you no >>longer exists. > >This is true, but the "old you" can be resurrected if you can get enough >people to believe your new key using any out-of-band means available >to you. You can also put a comment in your new key's uid explaining the >problem and how to verify the new key. You will find it very hard to use this >new key for a while, though, during the transition period. Many people will take >the existence of two keys with the same uid as suspicious in itself, since it at >least indicates some kind of attack (even if only a denial of service attack). There are times when you want multiple keys with the same ID. I have two key sizes becuase one is an older key. I keep it around for use with people who are using versions that do not support the larger keys. (I have run into this once from a sometimes user of PGP. He finally upgraded.) To aleviate the suspicion, I have the two keys sign each other. >This is really a usability flaw with current PGP. Only if you use the name to refer to the key and not the hex ID. (I found out the hard way that some front ends use either the last key created or whatever they feel like for signing keys and/or signing messages. I am still trying to straighten out some of the weird results of that.) Fortunatly, some programs will use the hex ID to refer to the key so there is no confusion. >The PGP formats do allow for a 'revocation' certificate, but PGP doesn't >implement it (yet, I guess). In any case, it's not really strong enough, >since what it says is "I retract all my previous statements that this key is >related to this user". This'd mean that you'd have to visit everyone who'd ever >signed your key and get them to issue this retraction. What would be needed >for this problem is either an "anti-certificate" ("This key does not belong to this >user"), or else some convention. For example, if two _trusted_ keys are found for the >same uid, the most recent one could be chosen, and the earlier one be purged >from keyservers, etc. This may be possible with current PGP. I haven't tried it, >but since I have some keys which have fallen into disuse, I will need to do so >sometime.). Revocations are supported, but they require the passphrase. (I have a number of revokations on my keyring from various folks.) The problem here is occasions where you have forgotten the passphrase. (I have an old keyring that I need to go and revoke all of the old keys on it. I have not used them in a year or two. I doubt if they are even on the keyserver...) Eventually there will be a way of revoking keys in the circumstance. Something similar to a notary (or a combination of notaries) who can vouch and say "hey, this guy really did lose his keys". Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

2 1

Re: Laptop TEMPEST (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Laptop TEMPEST > From: Ryan Lackey <rdl(a)mit.edu> > Date: 09 Feb 1998 02:34:15 -0500 > FCC RF/EMC testing is well nigh useless for TEMPEST protection. I disagree, it would give you a gross baseline on the total emissions between monitors and laptops. That field strenght measurement would at least allow you to calculate radiuses of equal strength to calculate approximately how far the emissions are from each class of device for equal probabilities of detection. One of the specific goals is to measure how effective the device is at effecting other co-located devices (such as seeing ghost images on other monitors or causing static in paging equipment). I suspect one could do it with a spectrum analyzer or a grid dip meter. > I imagine there may be some other "dual use" technologies through for > testing TEMPEST equipment. Perhaps some medical equipment has stringent > stray emanation specs? We're not trying to bring the individual vertical retraces out of the chaff...we're trying to calculate the total comparitive emission strengths. If that isn't high enough then trying to get individual componants of that field will be useless. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

CelBomb
by John Young 17 Dec '03

17 Dec '03

Can anyone in IL, or elsewhere, report more on the head-job of The Engineer: Any crypto used to authenticate the target for the boombox, or to obscure links to the assassin? How was the blast specifically targeted at him and not a phone borrower? How it was set off -- by user-dialing, remote control, some other means? Any fishy smelling brand names to immediately run from? Answers urgent.

3 3

EPIC World Crypto Survey
by John Young 17 Dec '03

17 Dec '03

The New York Times, February 9, 1998, p. D10: U.S. Losing Battle on Control of Data Encryption, Study Says By Jeri Clausing Washington -- The Clinton Administration is losing its battle to increase international controls over how reliably computer data can be scrambled to insure privacy, according to a report to be released Monday by an independent research group. ... The Electronic Privacy Information Center <http://www.epic.org> says that its survey of 243 governments showed that the United States is virtually the only democratic, industrialized nation seeling domestic regulation of strong encryption. That finding directly contradicts the Clinton Administration's assertions in Congressional hearings that it has the support of most nations on this issue. ... William Reinsch, the Under Secretary for export administration in the United States Commerce Department, denied that the study contradicted the Administration's assertions. "All the Administration has ever said is that there are more countries that go farther than we do," Mr. Reinsch said. "The study confirms that."

2 1

[PNS-List] CFP: Epidemiology of Ideas
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mailing-List: contact pns-list-owner(a)egroups.com Reply-To: pns-list(a)egroups.com Delivered-To: listsaver-egroups-PNS-List(a)eGroups.com From: "Philosophy News Service List Mgr. [richard jones]" <ListMgr(a)PhilosophyNews.com> To: "'PNS-List(a)eGroups.com'" <PNS-List(a)egroups.com> Date: Fri, 25 Dec 1998 22:50:49 -0500 Subject: [PNS-List] CFP: Epidemiology of Ideas To: pns-list(a)egroups.com From: Mariam Thalos <thalos(a)ACSU.BUFFALO.EDU> Subject: CALL FOR PAPERS: THE EPIDEMIOLOGY OF IDEAS (fwd) Date: Wed, 23 Dec 1998 15:49:49 -0500 (EST) From: Barry Smith <phismith(a)acsu.buffalo.edu> To: thalos(a)acsu.buffalo.edu, rapaport(a)cs.buffalo.edu Subject: CALL FOR PAPERS: THE EPIDEMIOLOGY OF IDEAS THE MONIST An International Quarterly Journal of General Philosophical Inquiry Edited by Barry Smith http://wings.buffalo.edu/philosophy/Publications/Monet/ CALL FOR PAPERS THE EPIDEMIOLOGY OF IDEAS Deadline for submissions: July 2000 Advisory Editor: Dan Sperber (CREA, Paris) mailto:sperber@poly.polytechnique.fr Both in the psychological and in the social sciences, the notion of representation plays a major role. But how are the psychological notion of a mental representation and the sociological notion of a collective or cultural representation related? While there has been a naturalistic turn in cognitive science, proposals for the naturalization of mental representations have had little or no impact on the social sciences. This may be due in part to the fact that these naturalistic proposals typically focus on the individual cognizer. Yet, a large proportion of the mental representations of a human individual are, in fact, mere individual versions of representations widely distributed in human groups. By embracing the hypothesis that populations of representations (somewhat like populations of bacteria or viruses) are hosted by human populations, it becomes possible to apply to the distribution and evolution of mental representations models derived from epidemiology, population genetics, and evolutionary theory. Cultural representations are then seen as strains of mental representations of very similar content widely distributed across a population. To approach cultural representations in this way is to look for the causal explanation of macro-scale cultural phenomena in the micro-processes of cognition and transmission. It is to engage in a kind of epidemiology of ideas. Philosophers, biologists, and anthropologists have developed a variety of such epidemiological or evolutionary models, with particular application to cultural diffusion and to the history and philosophy of science. Both philosophers and social scientists with a serious interest in philosophy are invited to contribute papers on these and related topics. ______________________________________ Department of Philosophy 611 Baldy Hall University at Buffalo 716 633 2041 Buffalo NY 14260 - 1010 fax: 716 645 6139 http://wings.buffalo.edu/philosophy/faculty/smith ------------------------------------------------------------------------ eGroup home: http://www.eGroups.com/list/pns-list Free Web-based e-mail groups by eGroups.com --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0