- cypherpunks-legacy - lists.cpunks.org

Re: GAK/KR spin
by Bill Campbell 17 Dec '03

17 Dec '03

Steve Schear said: >Several months back there were discussions on the list regarding renaming >the government's key escrow/recovery proposals (KRAP comes to mind). I >think we need something that's catchy and simple (perhaps already familiar) >to understand for the semi-litterate citizen units. I propose we encourage >use of the terms "crippleware" or "crypto crippleware" when refering to the >products limited to their weak crypto and/or key escrow/recovery. Another point on all this that was made by Matt Blaze at the RSA conference (and that I have been making to all my friends) is that Crypto is basically a "solved" problem. The government's efforts to impose GAK is in effect transposing a "solved" problem into an "unsolved" problem - due to the inherent problems with any conceivable GAK "solution". I thought this was a very good case against GAK. =Bill=

1 0

A Vote of Silence for Human Gus-Peter
by Larry Johnson 17 Dec '03

17 Dec '03

I want to be the new modernator so anyone who wants me to be it can not send any messages, ok? So any people who dont send messages are voting for me, ok? (If I am modernator I will give everyone free pizza and Schotch.) Ok. Now evceryone vote, ok? Human Gus-Peter

2 1

IN%"pdh@best.com",IN%"ichudov@algebra.com",IN%"gnu@toad.com",IN%"ay@got.net
by E. Allen Smith 17 Dec '03

17 Dec '03

Forwarded with permission: From: IN%"loki(a)infonex.com" "Lance Cottrell" 4-FEB-1997 15:34:25.09 >I would be happy to donate the resources to run Cypherpunks off our system. >We could set up the list provided we were given a list of subscribers. I >assume it would be unmoderated. > -Lance >> Hi. I don't know how much you've been keeping up with >>the discussion on cypherpunks, but there is a current proposal >>to distribute the list onto several different servers. I would >>be willing to pay for 100 subscribers to run on the cyberpass.net >>server, provided that somebody else (e.g., Igor Chudov) set up >>the system initially and was available for assistance later. Any >>problems on your end? >> [...] >> Thanks, >> -Allen

2 1

Cypherpunks FOIA request
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 1/18/97, I sent freedom of information act requests to the FBI (main and San Francisco offices), CIA, NSA, and Secret Service, asking them for copies of information in their files relating to or referring to the cypherpunks list, the cypherpunks meetings, and copies of any messages sent from or to "cypherpunks(a)toad.com". To date, I have received three responses: one from the SF office of the FBI, indicating that they have no records responsive to my request; one from the NSA, indicating that they are processing my request, and one from the Secret Service, asking for a copy of my signature. (I've got no clue why they want that; unless I screwed up, I believe my initial request was signed.) Copies of my requests and the responses are available online at <http://www.io.com/~gbroiles/cp-foia/>. I'm not sure what I think about the response from the SF FBI branch - it seems unlikely that they'd never have paid any attention to the list, given the media coverage in Wired and other places. On the other hand, maybe the FBI doesn't read Wired. :) While they're not supposed to be monitoring noncriminal domestic activity, I figured they'd at least have something about the Mykotronix stuff. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvhHPf37pMWUJFlhAQGBSAf/XIdNAMrxn3flb6O7Q1TZYL1xd/RHAAZv YsuuXs/n6Dih/SnJVqc35tF5/33N0gK0xWhyPCBWdIitVCgHpt+214WEOg3IWBqO KGcnbXg/YMs4xN50zLgpV+Xoim4rjfwCROqNNWvrBqwo6RicAyJbLRoRGE+KdDkx WSslCzxsVYzRHzzkF48rhbYAXqU2vUesG0t8Alg17R/2w4TvjAzlQ3PpclUukB8U VglMVB+dicn+5B2zITt1WG21xMmSHQea5rpwKpDxZdjBvBKXLhgH8L1Hdl6nu3zI sqDEENxeV+bI5UdSzemQDy+TDQoy7BSN7Tby8JgwXE9x3AitY2A05g== =S1Zy -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My letter to Long Island Newsday regarding David Kahn's pro-GAK editorial was published today. You can read it at http://www.newsday.com/mainnews/rnmi052u.htm What's odd (?) is how they editied it. I directed my comments toward Mr. Kahn's views, which they changed to "Newsday" (odd, since I've never seen them print an editorial one way or another on GAK; does this mean they are taking a stand? -- Kahn is an editor at Newsday). I wrote "The greatest flaw in the argument is it's very reason, 'criminals... are increasingly using encryption to conceal their plans and activities'" which they changed to "It reports...". I never considered an op-ed piece as "reporting", even if it states a fact. The following paragraph There are also a variety of technical problems associated with escrowing encryption keys, mainly, how to do so securely? A single `backdoor key' (or set of keys) for a popular product can become an easy target for crackers who can jeopardize the security of an entire system. Software can be easily hacked to disable or damage the key escrow features, and there are techniques to hide even the presence of a message in something innocuous as a digitized image. (Mr. Kahn seems to have forgotten to mention that the FBI not only wants to overhear cellular phone conversations but also read E-mail and any other encrypted files people have.) was changed to just There are also several technical problems associated with escrowing encryption keys, mainly, how to do so securely. They did leave the last two paragraphs relatively intact, though. Yeah, yeah... the piece could have been much longer & detailed, but it's only a letter to the editor... - --Rob -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvhdzgTNlSxdPy6ZAQEw8Qf9FnDSSd/m+XwUxU1CCJnwVOrvS4qyIubX 2E18o2rrS+F8TDjkhVsaDR3lJNqikdOzAL2GfjX53/cBEOhYcYcip7IHkd8UxqY6 zDHp2LwWnSuF8wwxeKw/DyPhAURsxYAl+LCJbsJjK+zxpgPU1Z0YzFkj3Am6bscv t8qiPoTxUF3tusueT5I3xQsRgEAx1SNwRHgQGzLS+zPwdFBT9ZsIsp4EbZ0fx1cE ZpbIxu1koDCWhkmJdTiL5HXXJ6mROJvCIGHfr1NU099AlIOO/FXq2UTnti2TzQn7 wYF73490ru1AFMEViLipj3zXzJsIGBo32La37yDozBEItd32B0L/+w== =3wRg -----END PGP SIGNATURE----- ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Newt's phone calls
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Dr.Dimwit L)amentation( Vehement K)retin(OTM enjoys sucking the puss from his syphilitic homosexual friends. /\_./o__ Dr.Dimwit L)amentation( Vehement K)retin(OTM (/^/(_^^' ._.(_.)_

1 0

OECD Waffles
by John Young 17 Dec '03

17 Dec '03

2-4-97. Reuters: Global group fails to endorse Clinton encryption plan Washington: An influential economic research group is preparing guidelines on computer encryption for its member countries but will duck some of the most contentious issues involved, according to a draft obtained by Reuters. The Clinton administration, seeking to rally support for its controversial policy on exporting encryption products -- which encode and decode e-mail and other computerized messages -- failed to win an endorsement from the Organisation for Economic Cooperation and Development (OECD), although the group did discuss the administration's approach. On perhaps the most difficult issue, the draft guidelines do not favour or oppose a requirement in the U.S. policy that data-scrambling encryption programmes provide a way for law enforcement officials to obtain keys to crack the codes when necessary. After indicating that governments should carefully weigh the costs and benefits of imposing so-called key recovery, the draft report said, "this principle should not be interpreted as implying that governments should, or should not, initiate legislation that would allow lawful access." On all the controversial areas in the draft, "the member countries of the OECD have strongly held views but they don't always coincide," John Dryden, head of the group's Information, Computer and Communications Policy division, said in a telephone interview from Paris. Some countries see widespread use of encryption as a way to protect the privacy of computer users and businesses, thereby encouraging global commerce, Dryden said. But others see encryption as possibly thwarting law enforcement's efforts to catch riminals and global terrorists, he said. The guidelines suggest encryption users should have access to products that meet their needs. Government controls should be "no more than are essential to the discharge of government responsibilities." Instead of reconciling the different views, the draft guidelines lay out competing interests and approaches. "It's not in itself a cryptography policy and it's not an attempt to draft a model national law that we're encouraging people to adopt," Dryden said. Cryptography refers to products and systems used in encryption. The guidelines also suggest encryption standards and usage should be "determined by the market in an open and competitive environment." "There's a strong view that the private sector should have the possibility to use information networks to the best of their potential in order to create growth and jobs," Dryden said. U.S. officials who have seen the preliminary draft praised the guidelines. "They're an important and helpful step forward," Undersecretary of Commerce William Reinsch said. "They're helpful because they put down on paper the proper foundation for getting into this," he added. Reinsch said most countries will follow the U.S. lead and require so-called key recovery features for law enforcement. Under the Clinton policy, domestic use of encryption is not regulated but the strongest coding products cannot be exported unless they include key recovery. U.S. companies that have opposed the Clinton policy, contending it stifles their ability to compete with unfettered foreign firms, drew little solace from the draft guidelines. "This is not helpful," said Netscape Communications Corp.'s public policy counsel, Peter Harter. Netscape and other companies preferred stronger language endorsing free-market policies, he said. The draft guidelines, approved by a group of government and private-sector experts at a meeting at the end of January, still must be approved by a top-level OECD officials from the group's 29 member countries, including the United States. -----

1 0

NFIC Warning About Sexygirls web site
by Robert Hettinga 17 Dec '03

17 Dec '03

I had to laugh when I read this... Cheers, Bob Hettinga --- begin forwarded text X-Sender: themet(a)pop.mindspring.com Mime-Version: 1.0 Date: Wed, 5 Feb 1997 01:50:36 -0800 To: fraudnews(a)silverquick.com From: Mark Taylor <themet(a)mindspring.com> Subject: NFIC Warning About Sexygirls web site Reply to: Mark Taylor <themet(a)mindspring.com> Here is an interesting twist on how some crafty scamsters can rack up money on your phone bill =========== National Fraud Information Center Monday, February 4, 1997 PORNO SURPRISE Consumers who visited a pornographic website (www.sexygirls.com) last month got a big surprise on their phone bills. After a few teaser pictures, surfer was told he/she needed to download a special program to view the archived images. That program was actually a viewer with an entire communications suite hidden deep inside (a non-self propogating Trojan Horse). The program disconnected user from his/her ISPs, shut off the volume on the modem if it was computer controlled, and dialed a number in Moldova -- a small, former republic of the Soviet Union wedged in between the Ukraine and Romania. All the while the consumer was on the website, and even if he/she then browsed other sites on the World Wide Web, the Internet access was being provided through the Moldova number, resulting in huge international phone charges! Consumers didn't know that until their phone bills arrived. According to the Toronto Star Business Reporter, there are Canadian reports of bills into the thousands. The Toronto star also reports that the Royal Canadian Mounted Police has requested all calls from Canada to that number in Moldova be blocked. Bell Canada is attempting to provide relief for Canadian consumers. US consumers should contact their long distance providers if they find these unexpected charges on their bill. The RCMP has also required the owners of sexygirls.com to place a disclaimer on the site, alerting consumers to the presence of the communications software in the viewer. The disclaimer also tells consumers how to disconnect if they do not wish to use the server in Moldava. In November, Internet Fraud Watch warned consumers concerning the possible dangers of downloading programs over the Internet. Some tips: Don't download unnecessary items. If it's just a piece of razzle-dazzle, don't bother. It will only take up space on your hard drive and perform no useful function. If there's no gain for you from the program, there's no reason to take a risk. Only download from sites you know and trust. While even a major corporations site can sometimes have a viral infection, a lone programmer might be using an attractive piece of code as a delivery vehicle for his pet virus. Don't download material directly onto a computer network at work. First download it onto a stand alone PC. Test it out. Make sure it doesn't have any malicious side-effects. Check that machine for known viruses. Only at that point should you install the downloaded program on a networked machine. If you feel you must download files, keep track of what files you have on your system and what files are created during a program installation. That way you can easily uninstall any program if you find it to be undesirable. This also helps in detecting new installed files that aren't supposed to be there. Remember, your main worry is an executable file (i.e. a program or application). Despite what you hear all over the Internet, you cannot get a virus from a piece of e-mail. If you are having a problem with calls to Moldova, the connection will only be made if you attempt to use the viewer. If you try to use the viewer, shut down your machine after you are finished at that site. If you wish to remove the viewer altogether, the file name is david.exe (for IBM users). If you are in Windows, it should be in your program folder. FraudNews is owned and published by : Mark Taylor: themet(a)mindspring.com All material published is copyright.It must not be reproduced in any form without the express permission of of the owner. ============================================================= This Newsletter is broadcast using the List and Newsletter Management facilities of Silverquick Communications You may subscribe to FraudNews and the Fraud-Discuss lists on the web pages at : http://www.silverquick.com ============================================================= --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: Full strength Email Clients.
by Vangelis 17 Dec '03

17 Dec '03

Steven Herod wrote: > > Hello, I'm in search of an *EASY TO USE* Internet Email client > software that uses full strength (outside US export restriction) RSA > encryption. Private Idaho (for Windoze), without question. It's freeware, and acts as an almost seamless front-end to PGP. I use it all the time w/ my crpto-aware friends. http://www.eskimo.com/~joelm/pi.html -- Vangelis <vangelis(a)qnis.net> /\oo/\ Finger for public key. PGP KeyID 1024/A558B025 PGP Fingerprint AE E0 BE 68 EE 7B CF 04 02 97 02 86 F0 C7 69 25 Life is my religion, the world is my altar.

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by Matts Kallioniemi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jeremiah A Blatz wrote: >On the choke points note, mailing lists are better than usenet because >legendary AOLers with there 5 free hours of fame and their ilk usually >don't figure out how to pester mailing lists. Being on a mailing list >usually requires a commitment, that is enough of a barrier for many of >the usenet underirables. Another way to get rid of the totally clueless and involuntary subscribers would be to require subscription requests to be PGP signed and acknowledged by the subscriber. Matts -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMviI5xVFhWUyiUQRAQFdEwf/ZI2WW/2OVKq4xdwmsPNzCP3yJj7NfsOP JSBegY21WX/Oa+gT/Zmo5lrOh9wWQlF2OpFlzggvBef1Vm5qidge5dRqSxmUPipc 5/HZFK1KxQI5uLjC7pZo5pMfjIroPYI4pldfYP2fjn3qo82sg8IWEn1FSH3b5iEE qrL71rWmG3ekx7qDMvZPGKrjwi7XNJlKUT7qIjQaR25sg3U4KsntV5FZ+Iof6FRz cFX0G2bQ5r1tE/QIqrMm94cD27KNFshSArBFgTqNqqCJtym2v+oOtiCpm8uqirlB oREDHaIs7pJyUA3VkdQnVwKbN+c/Ln9nBAZ9V0BGBg4rZMp/rDRo+Q== =YOIl -----END PGP SIGNATURE-----

2 1