- cypherpunks-legacy - lists.cpunks.org

Re: airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Futplex writes: >DCF writes: >[re: shwoing picture ID to board commercial flights in the U.S.] >> I wonder how many have challenged this. >Any pointers to news articles or govt. press releases that actually state >some rationale for the ID checks, however spurious ? >> I suppose they are trying to discourage people from buying tickets in >> false names so that the databanks can be more useful to the authorities. >It's bad enough that it is "illegal" (at least according to some recent ARC >flight coupons of mine) to sell or otherwise transfer your tickets to someone >else. I'd love to see them try to justify crap like that. Without actually agreeing with the FAA, the reason you can't have a name other than your own on your ticket, as well as why you are required to be in your assigned seat on take-off and landing is because if there is a plane crash, they need to be able to identify an otherwise difficult to identify body. This does have some relevance to airport security if a plane is blown up. Sorry about this, Bob

2 1

EDDB/RN
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

I don't know if anyone else has had this particular idea before, but it might be worth some consideration. I referred to it very briefly in my posting on RemailerNet v0.2 (RN02). Eric points out that users of remailer networks want to be able to trust in silence as well as trust in delivery, and RN02 accordingly specifies that messages should be erased immediately after acknowledgement of delivery. However, there should be a use for persistent store, for a remote encrypted database accessible anonymously. Everyone must have had this sort of experience: someone walks into your office. There is something on your desk that you would rather this other person not see. So you toss it into a drawer, to get it out of sight. Imagine that you are working on a document and someone walks into your office. Rather than tossing it into a drawer, you toss it to Finland. The document is sent encrypted. (The storage facility also encrypts it.) When its receipt is acknowledged, your local copy is destroyed, if you wish. You can retrieve it in seconds from anywhere, providing that the system supports the notion of an identify distinct from your log-in address. Ideally, the data is stored on a distributed data base, with some redundancy in case one or more gateways go down, and with the data striped across gateways, so that no one gateway has all of the data. Because the data is encrypted by you and encrypted by the EDDB, it cannot be recovered by anyone without your cooperation. If the data is striped over a number of gateways (with, say, every first byte here, the next byte there, the next byte at a third gateway, and every fourth byte at a fourth gateway), it would take widespread collusion even to recover a copy of the encrypted document. Once you have such a system in place, you could then do interesting things like storing a document in the EDDB, and selling it to someone by selling him your passwords. I also think that a very reliable version of this system could be used to handle electronic cash (e$). -- Jim Dixon

2 1

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 19 Oct 1995, Timothy C. May wrote: > "You have a piece of mail awaiting at our mail delivery service. The > originator is unknown. The title of the message is "Tentacles of Medusa > Must Die!" You may retrieve this message by replying to this notification > with the word "Yes" anywhere in the Subject field. This message will be > kept for 60 days and then deleted." I suspect that I could easily hack this into Mixmaster in a day or two, but wouldn't it open you to attacks where Anonymous Fed, say, sends terrorist kiddy-porn through your remailer and busts your ISP during those 60 days for possession ? I'm not sure if it would be better or worse than current setups from that point of view. I might do it anyway, and set it up to only forward PGP-encrypted messages, but I certainly wouldn't be able to keep messages for 60 days with only a MB or so to spare. Mark "Yes Judge, when we siezed their computer we found 300 MB of *kiddy porn* and plans for *terrorist attacks* [that we'd mailed to the in the last two weeks...]"

1 0

GAK & RSA
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- RSADSI has been adamantly opposed to Clipper. You'd expect them to be opposed on business grounds; after all, Clipper wouldn't bring them any revenue and could quite possibly put them out of business if other forms of encryption were outlawed. I don't remember seeing many specific comments indicating that RSA was opposed to GAK on philosophical grounds (well, OK; some quotes on their "Sink Clipper" poster, if those count). Other groups were opposed to Clipper because Skipjack is of unknown strength. Putting the cypherpunkesque arguments about how GAK is a big step down the path towards a surveillance state, is it possible that the software GAK (SGAK) scheme could easily incorporate RSA's technology? Imagine: Schlafly et al win their court case, and RSADSI's patents on RSA and other public-key technology are declared invalid. SGAK can thus use RSA without any problem. The "Skipjack, DSS, and SHA may be weak" crowd can't object to RSA's strength, and of course RSADSI will be in no position to object. Another scenario: RSADSI wins and their patent remains valid. They can't refuse licensing to any entity which meets their terms, so SGAK can still be deployed, but RSADSI then gets a royalty. _This_ is what's scaring me. If Microsoft, Apple, et al offer weak encryption as part of SGAK, objections can be made to the weakness. If they use RSA, that avenue is gone. - -Paul - -- Paul Robichaux, KD4JZG | "Information is the currency of democracy." perobich(a)ingr.com | - some old guy named Thomas Jefferson Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkemSKfb4pLe9tolAQGYiAP9EEwh/ImtxO6VoeGW6Ur15lwM+eJy9MRR liYk+LMisjfJUwdO7Ngz2EDg/gKWky3u/t2LOm5347tekShXJXEqFqmRlGIt2xu7 8eSMRxRpewYTtYstPWPBaxBe6nzBSfD7BciQseqEU1b6ug21pB53hzHgYP7OwtrY NEZSuas7C9g= =+J/I -----END PGP SIGNATURE-----

4 3

Voicemail Security
by Rich Graves 17 Dec '03

17 Dec '03

Please see article <46775j$2tg(a)news.eecs.nwu.edu> in news.admin.net-abuse.misc. It has also been cross-posted elsewhere. I wonder how often Jeff checks his messages. It would be interesting, from a purely academic perspective of course, to see if one could anonymously drop off more information about Jeff and his clients at that number for private distribution. For example, credit card, driver's license, and social security numbers. I assume that Jeff is reading this group. How would Jeff go about protecting his voicemail box from this sort of attack? How would *I* go about protecting *my* voicemail box from this kind of attack? -rich Whose list was also spammed, but only I got it because majordomo is set to bounce all messages from non-subscribers to the list owner. Btw, is this list set up this way?

1 0

S.F. judge to rule on encoding software
by Jeff Weinstein 17 Dec '03

17 Dec '03

http://www.sfgate.com/net/abate/1021.html FYI. The above URL points to a SF Examiner article about the Bernstein case, including friday's proceedings. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: NYT on Internet Flaws
by MDresser＠aol.com 17 Dec '03

17 Dec '03

In article <199510120347.UAA27336(a)infinity.c2.org>, sameer wrote: > > I completely agree that the reporters on this list make things > very difficult and people do need to be very careful about posting > things which will get misinterpreated by reporters.. etc.< FYI, the day after the Markoff piece ran in the NYT, The Baltimore Sun ran an article debunking it, based on independent reporting. Generalizing about reporters is about as intellectually valid as generalizing about hackers. Michael Dresser, who wrote it (speaking for myself, not my employer)

1 0

Re: Irono-troll (was: Re: The Utility of Privacy)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:58 PM 11/18/96 -0600, Roy M. Silvernail wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >A troll using nobody(a)huge.cajones.com writes in reply to Sandy Sanfort a >lot of dismissal of past tragedies resulting from privacy violations. >Hir consistent viewpoint seems to be that protecting ones privacy has no >value. Then sie has the temerity to ask > >> BTW, are you operating under your True Name? > >My ironometer is absolutely pegged. Mine did too. It is the most amusing exchange I've seen in a long while. An extremely stable nym arguing for privacy against an anonymous remailer arguing that it isn't important. It makes up for all the trash talk and references to sexual orientation that the juveniles have been posting. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

Re: Anonymity: A Modest Proposal
by James A. Donald 17 Dec '03

17 Dec '03

At 12:59 PM 10/19/95 -0400, Thomas Grant Edwards wrote: >This would require the remailer to examine entropy of messages passing >through. Anything not random enough gets tossed. A simple entropy measuring algorithm: Generate N random pointers into a file. (or extract N random short strings from the file) Sort them into order of the strings, Find the number of bits in common between one string and the next string. Total up S, the number of bits in common Calculate (N * lg N)/S For an encrypted file, this quantity should be close to unity, because the order in an encrypted file should not be easily detectable. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

No Subject
by ibg＠oro.net 17 Dec '03

17 Dec '03

Very interesting article on offshore banking. Can you suggest a reading list or source of additional information?

1 0