- cypherpunks-legacy - lists.cpunks.org

(fwd) Re: Cookie problem here , cookie problem there ...
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

[Given the recent upset here regarding cookies, of which I only have the most cursory knowledge, I hope some will find this tidbit of use.] >From: jerryw(a)convex.com (Jerry Whelan) Newsgroups: comp.infosystems.www.authoring.cgi,comp.infosystems.www.authoring.misc,comp.infosystems.www.browsers.misc Subject: Re: Cookie problem here , cookie problem there ... Date: 1 Jul 1996 14:28:39 -0500 Lines: 28 In article <4r8m92$4u(a)news.istar.ca>, Gord Jeoffroy <crs1583(a)inforamp.net> wrote: -} Margaret <margaret(a)werple.net.au> wrote: -} -} >You can disable the warnings, you cannot disable the cookies. I am -} >cancelling every cookie I encounter (I usually avoid sites heavy -} >with cookies), reason - I hate invasion of privacy and in particular, -} >junk email from direct marketing. -} -} -} I completely agree with your sentiment, by the way. I'm planning to -} add an editorial to an online magazine I'm beginning. The article will -} be full of server-side includes to demonstrate to the person reading -} it that Big Brother definitely is watching. I don't have any connection with these guys, except that I use their software. Check out www.privnet.com and the Internet Fast Forward netscape plugin for Windows. It can selectively filter cookie transmissions to web servers as well as some other very cool stuff like filter out unwanted images, including but not limited to advertisements. You will be amazed how much more information you can get on your screen when you filter out the useless images, like the one netscape puts at the top of their home page. -- ------------------------------------------------------------------------------ Jerry Whelan -- Information Superman jerryw(a)convex.com -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information "We think people like seeing somebody in a uniform on the porch." -US Postal spokeswoman, quoted in AP 1/27/96. I don't know about you, but the only folks I know who'd enjoy seeing someone in uniform on their porch are leathermen...

1 0

Notes from SAFE meeting
by minow＠apple.com 17 Dec '03

17 Dec '03

Here are my raw, unedited, incomplete, and not to be trusted, notes from the SAFE meeting, July 1, 1996, at Stanford. (ps. thanks to the folk who did an amazing amount of work to put this on.) burns: fbi, cia, nsa presented to senate/congress: said nothing that wasn't already in public record (newspapers) telia (Swedish Telecom) representative (Mattias Soederholm) -- can't import strong encryption as NSA claims it would harass company. doesn't like having to tell customers that USA will read their mail. Whit Diffie - nuclear non-proliferation: proliferation of crypto does more good than harm: make sure that weapons are under your control: extensive development since Kennedy administration. Positive control over nuclear weapon: crypto. ---- Technical panel ---- whit diffie, eric thompson (forced decryption, fbi is a client), bruce schneier, tom parenty (sybase), matt blaze. We came to discuss policics, but were charged with discussing technology. key lengths -- too much jargon. question is work factor: how much work to break system. public keys used only for signatures; actual encryption uses "normal" crypto. 40 bits == 2^40 operations to get a key. First: two different points of view: security officer: every message must be secure, even against strong opponent. intelligence agency wants to read every message. 30, 60, 90, 120. 2^30 == one billion. any pc can recover any key. billion billion == des. very clear that can do it, not easy, however. 90 bits billion billion billion. won't be do-able in lifetime of business personal data. 120 bits can't be do-able in forseeable future. but, point of view of an intercept organization; meet in the middle? won't satisfy either party's interest. 40 bit can be exported. last year, demonstrated that can break 40 bit keys. Takes on order of few weeks to a month of Sun workstations. intercept device spends most of its time deciding whether to record data. has a fraction of a second to look at a message, 40 bits too large for intercept on that basis. eric thompson. access data. cryptanalysis -- break codes, build hardware to aid in this. specialize in defining parts and pieces to break e.g., rc40 amd2905 chips on a board breaks in $8,400 engineering cost. Sell under $20,000. little company, not well-funded government agency. des fpga about $1M/7 days per key. off the shelf design using 5 year old chips. what's realistic to expect the nsa, fbi can do? bruce schneier: foreign crypto. is it any good? yes. more done outside usa than inside. many countries asia, europe, pacific have strong groups. algorithm conferences: 90% of papers from outside usa. hard to get funding in usa. more academic research overseas. products with more options. here, products are hamstrung by baggage: key length, escrow. other countries can write without restrictions. best products from former yugoslavian folk working in swedish university. usa corp's cant compete: no talent, government restrictions. losing our share of research, developement, products. as internet becomes ubiquitious, we lose market share. restrictions won't stop, will only hurt us. tom parenty; worked for NSA: "in God we trust, the rest we monitor." key escrow ineffective. can today buy over 500 products from 60 countries. no usa monopoly. www.cypto.com home page; list of pointers for our favorite foreign crypto products (for some value of "our" and some value of "favorite.") crypto controls don't keep crypto out of child pronographer hands. keeps out of hands of legitimate individuals and corporations. criminal, terrorist, can layer foreign crypto on anything usa gov't does. will give protection. moral equiv of wiretaps? no! criminals: criminals talk to criminals, criminals talk to rest of world. crim to crim: use strong crypto. crim to airline, car rental, hotel: can go to airline etc. and subpeona their records: crypto buys nothing for wiretap. solve crimes, prevent crimes? would key escrow prevent oklahoma bombing? but without strong crypto, foreigner working outside usa can take plane down, grab medical records. etc., by hacking insecure networks. matt blaze: key escrow. ignore politics; doesn't make technical sense. fundamental flaws software engineering can't technically solve in a sensible way. first: enormous increase of engineering complexity. difficult to design even simply secure (alice, bob, eve + detective dorothy) system engineering. key escrow makes this even more difficult. engineering problem is too complex. classified world not far ahead of unclassified: blaze discovered protocol failure in clipper chip design -- can circumvent escrow field, can forge messages. reason failures occur not because nsa incompetent, but because problem is extremely difficult. second fundamental problem: operating key escrow center economically and technically difficult. 24/7/365, 2 hour response to law enforcement request. key escrow doesn't distinguish between comm key, data storage keys, and signature keys. releasing latter may be devistating. --- diffie: if you collect data; it will be used (census data used to round up Japanese in California, Jews in Germany, Holland, Denmark). schneier: data harvesting: insurance company wants to know who filled perscription for AZT. crpyto prevents against non-invasive attack; not against fbi entering house to install bugs. diffie: crypto requirements of bad people: terrorists need tight-knit, unified in purpose. tools to secure communication are readily available "closed crypto." ordinary folk need open crypto; delayed by government restrictions. --- legal issues: ken bass: counsel for telecom policy: national security? non-escrowed strong encryption? balance? costs? what are they, what do we lose? escrow born by nsa mission. didn't hear law enforcement concerns initially; now nsa stands behind shield of fbi. nsa/fbi has created arms race among cryptographers. most people would have been happy with des, which nsa can probably break, but not others. nsa discovered it was doing itself great damage by pursuing export controls: but biggest danger to nsa is explosion of protocols, routings, etc. nsa wants to read everything to see what it wants to look at. fbi, however, knows what it wants to see. nsa knows that crypto puts it out of business. nsa needs to preserve fiction of crypto (i.e, that they can read, but you think they can't). fbi wants to preserve status quo. law enforcement can't undertake survelience until it knows who the target is. don't need crypto to find crooks. needed only after you know who the crooks are. fbi foolish to try to convince us that crypto (escrow) is golden bullet of law enforcement. why does fbi need to have crypto to monitor people for whom they already have probable cause (that they need in order to get warrant to wiretap). jim lucire: americans for tax reform. IRS doesn't follow constitutional protections. barry steinhardt (ACLU). law enforcement concerned to preserve its wiretap capability. wiretap happy administration. set records for number of wiretaps (both in criminal and national security). law requiring wiretap capability in telecom infrastructure. additional crimes where wiretap allowed. Janet Reno: four challenges -- threat that encryption poses to law enforcement; ability to search for stored information. wiretapping. why does aclu find it so odious. fourth amendement "particularized suspicion" -- government must have a reason to search you. wiretapping is a "generalized search." in 1970's, 50% of wiretaps produced useful information. now 17% reveal useful info. warrant to search 100 homes to find criminal info in 17 homes? ability to continue wiretapping is in question. what is cost to individuals who are wiretapped? cindy cohn, lawyer: export problems with ITAR: scientists lose. bernstein case (can export crypto research): export rules squelch discussion and reseach: first amendment; right of people to talk about science, art, literature; not just politics. broadness: IATR is overlly broad. defines export to prevent publication. prevents export to "ordinary" people, but only intended to prevent export to terrorist. procedural problems: no hard boundaries. barbara simons (acm) -- copyright? net community suprised when CDA was passed. major voices heard are those of lobbiests; not technology focus; focussed only on their lobby-needs. monitor net? only to preserve copyright. goals will work only if you shut down the net. copyright legislation makes illegal to manufacture device to violate copyright (camera? vcr?) john gilmore (eff): can we trust the courts? won't be won on a single front: need to keep pressure up. "for purposes of first amendment analysis, court finds that source code is speech." will go to supreme court. need help from legislature. want to bring light into export control process. want to have clear rules so you can read rules, build product and export it. michael froomkin (law school, univ of miami): legal status of privacy? can't count on courts. don't take wait and see attitude. wiretap still has some value. Legal status of no export has been successful: no strong crypto in w/95. ken bass question: froomkin: crypto is a constitutional right (200 pages). very few nsa cases; mostly 4th amendment ('drug exception to constituion). korn case, bernstein case. briefs in cases required reading for congress (first amendment). crypto useful to protect free speech (Phil Zimmerman talked about human rights people in Burma who use PGP to protect their messages from government.) [representative zoe lofgren (Dem CA) -- someone proposed 4th amendment in congressional debate amending criminal law. Defeated on party lines.] implication for information sharing between cia/fbi/nsa with foreign intelligence agency? guatamala tragedy example of problem. the dumb criminal theory? blow up buildings with trucks they rent in their own names. --- With apologies for incoherence, errors, and incompleteness --- Martin Minow minow(a)apple.com

2 1

Sameer on C-SPAN
by bluebreeze＠nym.jpunix.com 17 Dec '03

17 Dec '03

:From: Alex Strasheim <alex(a)crawfish.suba.com> :Date: Mon, 1 Jul 1996 11:32:21 -0500 (CDT) : :Janlori Goldman, at the Center for Democracy & Technology, just mentioned :Sameer's anonymizer on C-SPAN during a segment of Internet privacy. : :They showed a shot of the screen and everything. Not everything. No picture of Sameer!? That's what I'd like to see.

2 1

Info on alleged new German digital wiretapping law?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- None of the Europeans I ran into at today's SAFE conference had even heard of the legislation decried at http://fight-censorship.dementia.org/fight-censorship/dl?num=3027 and in alt.fan.ernst-zundel. What's up? - -rich http://www.stanford.edu/~llurch/ send mail with subject line "send pgp key" for my key or "911" to page me -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMdiyIpNcNyVVy0jxAQEi9QH7BglmZ3rtAnAcKp+5sMQzvWs8WUFXGzpO N8jqMnhpWhkIyFyV62EvAMFKHMGSquaPb75aak8s2xFTXJGsAuZDRg== =Dqj9 -----END PGP SIGNATURE-----

1 0

whitehouse dossier database?
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

holy cow, is this real? Grabbe cites several credible references. although of course he himself fits the bill as one of the world's greatest conspiracy theorists (or trackers, depending on your point of view <g>). I don't recall the article by Paul Rodriguez of Washington Times, was it recent? ------- Forwarded Message Date: Sun, 30 Jun 1996 20:16:49 -0500 (CDT) Sender: owner-CN-L(a)cornell.edu From: Brian Redman <bigred(a)duracef.shout.net> To: Conspiracy Nation <CN-L(a)cornell.edu> The following is brought to you thanks, in part, to the kind assistance of CyberNews and the fine folks at Cornell University. Conspiracy Nation -- Vol. 8 Num. 30 ====================================== ("Quid coniuratio est?") - - ----------------------------------------------------------------- THE WHITE HOUSE "BIG BROTHER" DATA BASE ======================================= - - -----BEGIN PGP SIGNED MESSAGE----- The White House "Big Brother" Data Base & How Jackson Stephens Precipitated a Banking Crisis by J. Orlin Grabbe Score another coup for Jackson Stephens' Systematics (Alltel Information Services). It provided the software for the White House's "Big Brother" data base system, and now the White House is in a panic that there may be secret methods of accessing its computer. The existence of the White House computer system and data base--known as WHODB, White House Office Data Base, and containing as many as 200,000 names--was revealed by Paul Rodriguez in the *Washington Times*. Some of the information was developed by *Insight*'s Anthony Kimery, soon to be managing editor of the electronic publication *SOURCES eJournal*. Kimery is a writer whose articles in *The American Banker* and *Wired* were among the first to report U.S. government spying on domestic banking transactions. (Kimery was also fired from one magazine for looking into the death of Vince Foster.) Now things have come full circle. The chief government effort to spy on U.S. domestic banking transactions was directed by the electronic spy agency, the National Security Agency (NSA), working in connection with the Little Rock software firm Systematics. Systematics, half-owned by billionaire Jackson Stephens (of Stephens Inc. fame), has been a major supplier of software for back office clearing and wire transfers. It was Stephens' attempt to get Systematics the job of handling the data processing for the Washington-D.C. bank First American that lead to the BCCI takeover of that institution. Hillary Clinton and Vince Foster represented Systematics in that endeavor, and later Foster became an overseer of the NSA project with respect to Systematics. Working together, the NSA and Jackson Stephens' Systematics developed security holes in much of the banking software Systematics sold. Now we face a crisis in banking and financial institution security, according to John Deutch, Director of the CIA. "One obstacle is that banks and other private institutions have been reluctant to divulge any evidence of computer intrusions for fear that it will leak and erode the confidence of their customers. Deutch said 'the situation is improving' but that more cooperation was needed from major corporations, and said the CIA remains willing to share information with such firms about the risks they might face." (*The Washington Post*, June 26, 1996, page A19.) What Deutch failed to mention was that this "banking crisis" in large part was itself created by one of the U.S. intelligence agencies--the NSA in cahoots with Stephens' software firm Systematics. The Citibank heist by Russian hackers, for example, took advantage of a back door in Citibank's Systematics software. (The Russian hackers were apparently aided by the son of one of Jim Leach's House Banking Committee investigators.) Have any major banks thought of instituting lawsuits over this deliberate breach of security on the part of a software supplier? John Deutch has a proposed solution for this and other computer security problems: the creation of an "Information Warfare Technology Center". Guess where he wants to put the Center: in the National Security Agency itself, naturally. That is, the government wants money budgeted for a new bureaucracy to solve the problem another bureaucracy spent money creating. You have to admire the sheer chutzpah of this kind of con--one which would also leave the NSA fox guarding the banking chicken coop. Meanwhile, over at the White House, senior aides are in a panic. Is the WHODB system related to the PROMIS software? they want to know. Is there a back door into the system? Have files been download? It just goes to show that given the right incentive, even the White House will begin spouting conspiracy theories. Perhaps Charles O. Morgan (see part 2 of my Vince Foster series) should write the White House a threatening letter. - - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdXLbWX1Kn9BepeVAQGSuwP7BOGXepZld6j1skJLnTfKYCDCBo3BZUyN A7hEslyPUkSh7pLGpJhiPQcQf+uEq9eFVYqeUKV+toKgZvEr6nb924aNFq5ObZyV 3drfdlWwgxf503ShHcOW7D/mpu2I5u1P2yyV5sM1nBH/y9CzX/DXNL9l3nBop7wA WmBXlraXros= =BjAo - - -----END PGP SIGNATURE----- - - ----------------------------------------------------------------- I encourage distribution of "Conspiracy Nation." - - ----------------------------------------------------------------- If you would like "Conspiracy Nation" sent to your e-mail address, send a message in the form "subscribe cn-l My Name" to listproc(a)cornell.edu (Note: that is "CN-L" *not* "CN-1") - - ----------------------------------------------------------------- For information on how to receive the improved Conspiracy Nation Newsletter, send an e-mail message to bigred(a)shout.net - - ----------------------------------------------------------------- Want to know more about Whitewater, Oklahoma City bombing, etc? (1) telnet prairienet.org (2) logon as "visitor" (3) go citcom - - ----------------------------------------------------------------- See also: http://www.europa.com/~johnlf/cn.html - - ----------------------------------------------------------------- See also: ftp.shout.net pub/users/bigred - - ----------------------------------------------------------------- Aperi os tuum muto, et causis omnium filiorum qui pertranseunt. Aperi os tuum, decerne quod justum est, et judica inopem et pauperem. -- Liber Proverbiorum XXXI: 8-9 - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

SAFE Forum
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Rather than a complete report (which will cover a lot of material people here already know), I will just give you my highlights from the forum. None of the people on the first panel have been asked to testify before either intelligence committee. (Panel was: Lori Fena, EFF; Craig Mundie, Microsoft; Eric Schmidt, Sun; and a substitute for Marc Andreessen from Netscape). Current government "Key Escrow" systems cost $200/key/year. [Craig Mundie] These systems can best be described as key-rental systems. "Crime prevention ought to be part of the FBI's mission. [Herbert Lin, National Research Council] Jim Omura [Cylink] spoke of specific business his company has lost to foreign competitors due to export licensing problems. He spoke of protecting US corporate links between China and the US. CompuServe losses are mostly overseas (in e.g. the former USSR) due to insecure communications and Telephone companies. [Tom Oren, CompuServe] PGP Inc bought ViaCrypt on Friday. [Phil Zimmermann, PGP Inc.] (Scooped by Ian Goldberg) Congresswoman Eshoo appeared not to have heard about PGP being used by human rights groups in e.g. Bosnia to protect their files. National Research Council report available from: www2.nas.edu/cstbweb A compromise on key length won't satisfy either side because those using encryption to protect their data want every single message to be secure (implying long keys and brute force times), while those monitoring communications need to quickly decide whether a message is interesting (implying short decrypt times). [Whit Diffie, Sun] We sell RC4, 40 bit decryption hardware (based on AMD29000) for $16K. FPGA devices for breaking DES in 7 days for $1M. [Eric Thompson, Access Data] NSA's problem is not crypto, but the explosive growth in the number of protocols. NSA needs to get out of the business of being a reputation agent for crypto (thru ITAR approval) and allow weak crypto to naturally appear in the market. [Ken Bass, Venabel, Baetjer, Howard and Civiletti] In the 1970s 50% of the wiretaps were of value, now only 17% are. [Barry Steinhardt, ACLU] The introduction of "Dorothy" as the canonical Key Escrow (GAK) holder. (To great hoots of laughter.) [I think this was Tom Parenty, Sybase, but I could be wrong.] When analyzing the crypto requirements of bad guys (e.g. terrorists) and good guys (e.g. digital commerce users), the bad guys are small, tight knit communities where the current, widely available, crypto systems work well. The good guys are not tight knit and need infrastructure we don't have, such as widely available software and certification. [Very broadly taken from Whit Diffie] ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

2 1

"gov runs anon remailers"
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

fallout from that old, lame Strassman & Marlow paper. a bit on the new Puzzle Palace. ------- Forwarded Message Date: Mon, 1 Jul 1996 06:11:41 -0400 (EDT) From: "Donna J. Logan" <revcoal(a)pcnet.com> To: snetnews(a)alterzone.com, liberty-and-justice(a)pobox.com, act(a)efn.org Subject: CAQ: CIA Spying on EMAIL (fwd) - - -> SearchNet's snetnews Mailing List - - ---------- Forwarded message ---------- Date: Sun, 30 Jun 1996 15:19:38 -0700 (PDT) To: Recipients of pol-abuse <pol-abuse(a)igc.apc.org> Subject: CAQ: CIA Spying on EMAIL From: Bob Witanek <bwitanek(a)igc.apc.org> Posted dadoner(a)chesco.com Thu Jun 20 23:46:55 1996 From: Ronnie Dadone <dadoner(a)chesco.com> Subject: CIA Spying on Re-mail? http://www.worldmedia.com/caq/articles/remail.html > ARE THE FEDS SNIFFING YOUR RE-MAIL? > > by Joh Dillon > > THE RULES OF PRIVACY ARE CHANGING WITH ELECTRONIC > COMMICATIONS, THE EAGERNESS OF GOVERNMENT TO PRY INTO OUR > COMMINICATIONS, APPARENTLY, IS NOT. > > Foreign and domestic intelligence agencies are actively monitoring > worldwide Internet traffic and are allegedly running anonymous > re-mailer" services designed to protect the privacy of electronic > mail users. > > The startling claim that government snoops may be surreptitiously > operating computer privacy protection systems used by private > citizens was made earlier this year at a Harvard University Law > School Symposium on the Global Information Infrastructure. The > source was not some crazed computer hacker paranoid about government > eavesdropping. Rather, the information was presented by two defense > experts, Former Assistant Secretary of Defense Paul Strassmann, now > a professor at West Point and the National Defense University in > Washington, D.C., along with William Marlow, a top official at > Science Applications International Corp., a leading security > contractor. > > Anonymous re-mailer services are pretty much what the name implies. > By stripping identifying source information from e-mail messages, > they allow people to post electronic messages without traceable > return address information. > > But Strassmann and Marlow said that the anonymous re-mailers, if > used properly and in tandem with encryption software pose an > unprecedented national security threat from information terrorists. > Intelligence services have set up their own re-mailers in order to > collect data on potential spies, criminals, and terrorists, they > said. *1 > > Following their Harvard talk, Strassmann and Marlow explicitly > acknowledged that a number of anonymous re-mailers in the US are run > by government agencies scanning traffic," said Viktor > Mayer-Schoenberger, a lawyer from Austria who attended the > conference. Marlow said that the [US] government runs at least a > dozen re-mailers and that the most popular re-mailers in France and > Germany are run by respective agencies in those countries."2 > > Mayer-Schoenberger was shocked by the defense experts' statement and > tried to spread the news by sending an e-mail message to Hotwired, > the online version of Wired magazine. Although the story did not > make headlines, his note quickly became the e-mail message relayed > 'round the world, triggering over 300 messages to Strassmann and > Marlow. It was followed by the electronic version of spin control. > > Strassmann quickly posted a denial. In an interview, he said the > Austrian completely misunderstood what he and Marlow had said. That > was false," Strassmann said of Mayer-Schoenberger's message. That > was the person's interpretation of what we said. ... We did not > specifically mention any government. What we said was that > governments are so heavily involved in this [Internet issues] that > it seems plausible that governments would use it in many ways." *3 > (Marlow did not return a call for comment.) > > But Harvard Law School Professor Charles Nesson, who heard the > original exchange at the Harvard conference, recalls the > conversation as Mayer-Schoenberger described it. *4 > Mayer-Schoenberger also stands by his story. I remember the > conversation perfectly well," he e-mailed from Vienna. They said a > couple of additional things I'm sure they don't want people to > remember. But the statement about the re-mailers is the one most > people heard and I think is quite explosive news, isn't it?" *5 > > Marlow said that actually a fair percentage of re-mailers around the > world are operated by intelligence services, Mayer-Schoenberger > recalled in a subsequent interview. Someone asked him: `What about > the US, is the same true here as well?' Marlow said: `you bet.' > > The notes for the Harvard symposium, posted on the World Wide Web, > also lend credence to Mayer-Schoenberger's account. The CIA already > has anonymous re-mailers but to effectively control [the Internet] > would require 7,000 to 10,000 around the world," the notes quote > Marlow as saying. *6 > -------------------------------------------------------------------- > > @EASE WITH EAVESDROPPING > > Prying into e-mail is probably as old as e-mail itself. The Internet > is notoriously insecure; messages are kept on computers for months > or years. If they aren't stored safely, they can be viewed by anyone > who rummages through electronic archives by searching through the > hard drive, by using sophisticated eavesdropping techniques, or by > hacking in via modem from a remote location. Once e-mail is > obtained, legally or not, it can be enormously valuable. Lawyers are > increasingly using archived e-mail as evidence in civil litigation. > And it was Oliver North's e-mail (which he thought was deleted) that > showed the depths of the Reagan administration's involvement in the > Iran-Contra affair. > > Moreover, it's easier to tap e-mail messages than voice telephone > traffic, according to the paper written by Strassmann and Marlow. As > e-mail traffic takes over an ever-increasing share of personal > communications, inspection of e-mail traffic can yield more > comprehensive evidence than just about any wire-tapping efforts, > they wrote. E-mail tapping is less expensive, more thorough and less > forgiving than any other means for monitoring personal > communications. 7 > -------------------------------------------------------------------- > > @ RISK > > Two kinds of anonymous re-mailers have evolved to protect the > privacy of users. The first, and the less secure, are two-way > database re-mailers," which maintain a log linking anonymous > identities to real user names. These services are more accurately > called pseudonymous" re-mailers since they assign a new name and > address to the sender (usually a series of numbers or characters) > and are the most vulnerable to security breaches, since the logs can > be subpoenaed or stolen. The most popular pseudonymous" re-mailer is > a Finnish service at anon.penet.fi". > > I believe that if you want protection against a governmental body, > you would be foolish to use anon.penet.fi," said Jeffrey Schiller, > manager of the Massachusetts Institute of Technology computer > network and an expert on e-mail and network security. Last year, in > fact, authorities raided anon.penet.fi to look for the identity of a > Church of Scientology dissident who had posted secret church papers > on the Internet using the supposedly private service. *8 > > The second kind of re-mailers are cypherpunk" services run by > computer-savvy privacy advocates. Someone desiring anonymity detours > the message through the re-mailer; a re-mailer program removes > information identifying the return address, and sends it on its way. > Schiller says that a cypherpunk re-mailer in its simplest form is a > program run on incoming e-mail that looks for messages containing a > request-re-mailing-to" header line. When the program sees such a > line, it removes the information identifying the sender and remails" > the message. *9 Some re-mailers replace the return address with > something like nobody(a)nowhere.org." > > Further protection can be obtained by using free, publicly available > encryption programs such as Pretty Good Privacy and by chaining > messages and re-mailers together. Sending the message from re-mailer > to re-mailer using encryption at each hop builds up an onion skin > arrangement of encrypted messages inside encrypted messages. Some > re-mailers will vary the timing of the outgoing mail, sending the > messages out in random sequence in order to thwart attempts to trace > mail back by linking it to when it was sent. > -------------------------------------------------------------------- > > @ISSUE: THE RIGHT TO PRIVACY > > Linking encrypted messages together can be tricky and > time-consuming. So who would bother? A. Michael Froomkin, an > assistant professor of law at the University of Miami and an expert > on Internet legal issues, says anonymity allows people to practice > political free speech without fear of retribution. Whistleblowers > can identify corporate or government abuse while reducing their risk > of detection. People with health problems that are embarrassing or > might threaten their ability to get insurance can seek advice > without concern that their names would be blasted electronically > around the world. *10 A battered woman can use re-mailers to > communicate with friends without her spouse finding her. > > The Amnesty International human rights group has used anonymous > re-mailers to protect information supplied by political dissidents, > said Wayne Madsen, a computer security expert and co-author of a new > edition of The Puzzle Palace, a book on the National Security > Agency. Amnesty International has people who use re-mailers because > if an intelligence service in Turkey tracks down [political > opponents] ... they take them out and shoot them," he said. I would > rather err on the side of those people. I would rather give the > benefit of the doubt to human rights." *11 > > Strassmann and Marlow, on the other hand, see the threat to national > security as an overriding concern. Their paper, Risk-Free Access > into the Global Information Infrastructure via Anonymous Re-mailers, > presented at the Harvard conference, is a call to electronic arms. > In it, they warn that re-mailers will be employed in financial fraud > and used by information terrorists" to spread stolen government > secrets or to disrupt telecommunication, finance and power > generation systems. Internet anonymity has rewritten the rules of > modern warfare by making retaliation impossible, since the identity > of the assailant is unknown, they said. Since biblical times, crimes > have been deterred by the prospects of punishment. For that, the > criminal had to be apprehended. Yet information crimes have the > unique characteristic that apprehension is impossible. ... > Information crimes can be committed easily without leaving any > telltale evidence such as fingerprints, traces of poison or > bullets," they wrote. *12 > > As an example, they cite the Finnish re-mailer (anon.penet.fi), > claiming that it is frequently used by the ex-KGB Russian criminal > element. Asked for proof or further detail, Strassmann said: That > [paper] is as far in the public domain as you're going to get." *13 > > At the Harvard symposium, the pair provided additional allegations > that anonymous re-mailers are used to commit crimes. There was a > crisis not too long ago with a large international bank. At the > heart of the problem turned out to be anonymous re-mailers. There > was a massive exchange around the world of the vulnerabilities of > this bank's network," Marlow said. *14 > > But David Banisar, an analyst with the Washington, D.C.-based > Electronic Privacy Information Center (EPIC) downplayed this kind of > anecdote, saying that such allegations are always used by > governments when they want to breach the privacy rights of citizens. > I think this information warfare stuff seems to be a way for the > military trying to find new reasons for existence and for various > opportunistic companies looking for ways to cash in. I'm really > skeptical about a lot of it. The problem is nine-tenths hype and > eight-tenths bad security practices," he said. Already existing > Internet security systems like encryption and firewalls could take > care of the problem." > > The public should not have to justify why it needs privacy, he said. > Why do you need window blinds? Privacy is one of those fundamental > human rights that ties into other human rights such as freedom of > expression, the right to associate with who you want, the right to > speak your mind as you feel like it. ... The question shouldn't be > what do you have to fear, it should be `Why are they listening in?' > With a democratic government with constitutional limits to > democratic power, they have to make the argument they need to listen > in, not the other way around." *15 > > Froomkin, from the University of Miami, also questioned Strassmann > and Mayer's conclusions. First of all, the statistics about where > the re-mailers are and who runs them are inaccurate. I can't find > anybody to confirm them," he said. I completely disagree with their > assessment of facts and the conclusions they draw from them. ... > Having said that, there's no question there are bad things you can > do with anonymous re- mailers. There is potential for criminal > behavior." *16 > > Banisar doubts that intelligence agencies are actually running > re-mailers. It would entail a fairly high profile that they tend to > shy away from, he said. However, it is likely that agencies are > sniffing" monitoring traffic going to and from these sites, he said. > -------------------------------------------------------------------- > > @ WORK SNIFFING THE NET > > Not in doubt, however, is that the government is using the Internet > to gather intelligence and is exploring the net's potential > usefulness for covert operations. Charles Swett, a Department of > Defense policy assistant for special operations and low-intensity > conflict, produced a report last summer saying that by scanning > computer message traffic, the government might see early warnings of > impending significant developments." Swett added that the Internet > could also be used offensively as an additional medium in > psychological operations campaigns and to help achieve > unconventional warfare objectives." *17 The unclassified Swett paper > was itself posted on the Internet by Steven Aftergood of the > Federation of American Scientists. > > The document focuses in part on Internet use by leftist political > activists and devotes substantial space to the San Francisco-based > Institute for Global Communications (IGC), which operates Peacenet > and other networks used by activists. IGC shows, Swett writes, the > breadth of DoD-relevant information available on the Internet." > > The National Security Agency is also actively sniffing" key Internet > sites that route electronic mail traffic, according to Puzzle Palace > co-author Wayne Madsen. In an article in the British newsletter > Computer Fraud and Security Bulletin, Madsen reported that sources > within the government and private industry told him that the NSA is > monitoring two key Internet routers which direct electronic mail > traffic in Maryland and California.18 In an interview, Madsen said > he was told that the NSA was sniffing" for the address of origin and > the address of destination" of electronic mail. > > The NSA is also allegedly monitoring traffic passing through large > Internet gateways by scanning network access points" operated by > regional and long-distance service providers. Madsen writes that the > network access points allegedly under surveillance are at gateway > sites in Pennsauken, N.J. (operated by Sprint), Chicago (operated by > Ameritech and Bell Communications Research) and San Francisco > (operated by Pacific Bell). *19 > > Madsen believes that NSA monitoring doesn't always stop at the US > border, and if this is true, NSA is violating its charter, which > limits the agency 's spying to international activities. People > familiar with the monitoring claim that the program is one of the > NSA's `black projects,' but that it is pretty much an `open secret' > in the communications industry," he wrote. > > Electronic communications open up opportunities to broaden > democratic access to information and organizing. They also provide a > means and an opportunity for governments to pry. But just as people > have a right to send a letter through the post office without a > return address, or even to drop it in a mail box in another city, so > too, electronic rights advocates argue, they have the right to send > an anonymous, untraceable electronic communication. And just as the > post office can be used maliciously, or to commit or hide a crime, > re-mailers can be used by cruel or criminal people to send hate mail > or engage in flame wars." And like the post office, the highways, > and the telephone, the Internet could be used by spies or > terrorists. Those abuses, however, do not justify curtailing the > rights of the vast number of people who use privacy in perfectly > legal ways. > > Robert Ellis Smith, editor of the Privacy Journal newsletter, said > government agencies seem obsessed with anonymous re-mailers. They > were set up by people with a very legitimate privacy issue, he said. > Law enforcement has to keep up with the pace of technology as > opposed to trying to infiltrate technology. Law enforcement seems to > want to shut down or retard technology, and that's not realistic. > Anonymous re-mailers are not a threat to national security. *20 > -END-- > > SUBSCRIPTION INFO - - -> Send "subscribe snetnews " to majordomo(a)alterzone.com - - -> Posted by: "Donna J. Logan" <revcoal(a)pcnet.com> - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

PGP secret keys
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Could someone post a pointer to a FAQ that tells what to do if you loose your secret key file? How can you regenerate your private key so that the userid number still matches the public key that has been distributed??

2 1

Net and Terrorism.
by snow 17 Dec '03

17 Dec '03

I took a few days to think about this stuff, and I am replying to these in bulk rather than seperately. T.C. May wrote: Can anything be done? To stop the likely effects of lots more surface-to-air missiles, lots more nerve gas available on the black market, and so on? In a word, "no." /* I disagree. Terrorism, political terrorism is fear. There are ways to protect military targets that are quite cost effective, unfortunately they are politically unpopular. (What just happend in Saudi is on my mind. STUPID military commanders getting the same pie in the face time and time again. There is NOTHING so unchanging as the military mind set.) Civilian targets are harder to protect, but certain steps can be taken to lessen chances of a sucessful attack. Another method, and this would be very unpopular (and hypocritical of the US) would be simply to announce that we (the Country) are going to hold the _manufacturing_ nation responcible for the use of weapons of mass destruction. So if Soviet Nerve Gas is used, we gas a city in the Soviet Union. MAD carried to a lower level. A third option is quite simply to buy as much of it as possible. */ I expect a city or two to get nuked in the next decade or so. (Haifa or Tel Aviv would be my leading candidates.) To me, this is unsurprising. /* My bets in the following order: Paris New York Rome London LA (by home brewed idiots) Chicago Berlin. I don't think that terrorists in the middle east will pop a nuke as they would get as many of their own as the "enemy". One of the things a terrorist needs more than money is a place to hide, and if you are killing your own people, they won't shield you. */ moderate economic or physical crises. (No, I am not a "survivalist," just mentally and physically prepared to deal with a major earthquake, economic dislocation, or terrorist incident in San Jose, which is 30 miles north of me.) /* Sounds like a "survivalist" to me. */ examples of how the Net can be used to undermine governments (what those governments of course refer to as "terrorism," even when it is mostly not). I'm not advocating such "terrorism," by the way, merely telling it like it is. /* If you want to define terrorism as in the above paragraph, them I am, and you do too. The biggest problem with terrorism is that there isn't a good defination that looks the same from both sides. In otherwords the old saw about one mans terrorist being anothers freedom fighter. Any defination sufficiently inclusive so as to cover all "terrorist" activities will also include uniformed soldiers. The lines get very thin and blurry. */ Keep your head down, avoid crowded downtown areas, prepare for moderate disruptions, and reject arguments that an American Police State will do anything to stop terrorism. /* The american police state (and if we aren't one yet, it isn't for lack of trying) IS an instrument of terrorism in some parts of this country. */ (Remember, terrorism is just warfare carried on by other means, with apolgies to Von Clausewitz.) /* Terrorism is when the other side hits with out warning. */ From: frantz(a)netcom.com (Bill Frantz) Thanks Tim for your essay. The only thing I would add is that terrorist attacks on pure information resources (e.g. the banking system) are likely to result in many fewer casualties than terrorist attacks on physical entities (e.g. major cities). Another way of saying it is, email bombs are preferable to snail mail bombs. /* I don't think so. One objective of terrorism is/could be to lessen a populations faith in "The System". Some possible situations (can't remember how to spell scenireo): Trash a multi-store pharmacy database and people can't get their prescriptions, or worse get the wrong one. Cause disturbances in certain parts of certain cities, then attack the 911 system to route officers and firemen to _wealthy_ neigborhoods at the expense of the poor neighborhoods. Then complain to the papers about it. Gain control of the power grid (I don't know how possible this is) and selectively brown out certain sections of the city during peak demand periods. Make it obvious, then do the preceeding idea. In all of these people will, or could die, but are much more effective in undermining the faith people have in the structures that run the country. If a bomb blast goes off, people get pissed off at the bomb makers, if the power fails, people get pissed at the electrical company. If you can create a large enough disturbances they will be better than bombs. */ From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> [TCM] >Can anything be done? To stop the likely effects of lots more >surface-to-air missiles, lots more nerve gas available on the black market, >and so on? >In a word, "no." try to have a warfare, siege-like mentality imho, and a continual "trying to stay ahead of the criminals". we do not have regular open terrorism in the streets of the US and I see no reason to think there ever will be as TCM suggests. /* Depending on how you define "terrorism" I would like you to visit my neighborhood, and then we can go to a couple other here in chicago where the cops terrorize the citizens, the gangs terrorize the cops and the citizens, etc. It hasn't hit the national level yet, but it will. */ nevertheless what his essay misses, and many in law enforcement miss, are the root reasons for crime. I'm not going to sound like a liberal /* There is a big difference (IMO) between a terrorist and a common criminal. Money and Ideology. In *MOST* instances the terrorist is attempting to acheive a political, social, or long term (as in decades/generations) economic change. A criminal is simply trying to get rich or get stoned. IMO the root cause of crime is a lack of self disipline, and it is as far as I can tell part of the human condition. */ in reality. it seems to me no nation-state has ever experimented with trying to take away the root causes of violence and discontent. why? /* Is it possible that to a large degree the nation-state IS the problem? */ because a policeman holding a gun is so much more visceral and the public responds to this image readily. other "programs" that try to decrease discontent among the budding terrorists of tommorrow are usually ridiculed. it is very difficult to prove that they work /* Rightly so. Most of these programs amount to hand-outs or paternalistic pandering. People need to work, not get paid for doing nothing. */ terrorists invariably have a patricular pathological psychological profile that sees the world in terms of "martyrs vs. villians" with the villians in the government, and the villians taking away or abusing respectable citizens. /* Often they are right. */ the "problem" of terrorism will be solved when we take the view that insanity and violence is *not* a natural aspect of human behavior (as TCM tends to suggest), and that /* It is. Insanity is a condition that occasionaly crops up in humans. Sometimes the problem is chemical, sometimes not, however it _is_ natural. So is violence. People want things, and some don't care what they have to do to get these things. */ >(Remember, terrorism is just warfare carried on by other means, with >apolgies to Von Clausewitz.) disagree. the purpose of warfare has traditionally been to seize something tangible like territory. terrorists are after intangibles-- namely, terror itself, disrupting a "peace process", etc. /* Or forcing a certain group to the discussion table. */ Any Obcrypto I could add at this point would be preaching to the choir. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)crash.suba.com

1 1

Re: Rivest's Wheat & Chaff - A crypto alternative
by Dave Emery 17 Dec '03

17 Dec '03

There are two bills before Congress. One (HR2369) concerns radio signal privacy and restrictions on scanners and receiving radio signals without authority, the other (HR2460 and S493) concerns use of scanners to capture ESNs for the purposes of cloning cellphones. Both passed the House, and the anti-cloning bill also passed the Senate. On Mon, Mar 30, 1998 at 09:36:55AM -0800, David Wagner wrote: > > A bill banning mere ownership (and modification, sale, and so on; no need > for prosecutors to show any ill intent) of cellular capable scanners has > passed the House by a vote of 414-1. A very similar version also passed the > Senate easily, and the two are being reconciled. There's no opposition; > this is fasttrack noncontroversial stuff, on the Hill. I'm told the bill is > as good as signed. > That is not my information. HR2369 (the Tauzin bill) does not ban mere possession of cell capable scanners. It bans manufacture, assembly, sale, import, export, or distribution of *any* radio equipment (not just cellphone capable scanners) "intended" for the unauthorized receipt, interception, or divulgance of communications in violation of the amended section 605 (which bans interception or divulgance rather than the previous *and* divulgance). This very clearly does not ban possession, and also very clearly speaks to intent. What this draconian language means with respect to a wide band radio receiver such as a scanner that can tune in certain signals it is not legal to listen to is not clear at the moment, as it turns on what "intended" means. Penalties for violation of this are 5 years in jail and $500,000 fine per sale... (the law was basicly expanded from one forbidding the sale of satellite TV piracy gear - and similar language has been the law since 1988, but less clear). According to Thomas and my other sources, HR2369 is still in the Senate Commerce Committee and has not been marked up - apparently Sen Hollings of SC has put a hold on it for further study. There is a bill (S493) which establishes 15 years in prison for "knowingly and with *intent to defraud* uses, produces, traffics in, has control or custody of, or possess" a scanning receiver "to intercept an electronic serial number, mobile identification number or other identifier of any telecommunications service, equipment or instrument. This later bill clearly concerns ESN theft for purposes of cloning, but it is broad enough so it conceivably might be applied to possession of radio receivers capable of capturing any kind of identifying information for any radio signal - but I think it is probably true that there would have to be a specific demonstrable intent to defraud demonstrated before a conviction under this language could happen. This bill is tough, however, and does provide for "forfeiture of any personal property used or intended to be used to commit the offense". S493 does make it illegal to merely possess "hardware or software, knowing it has been configured to insert or modify telecommunications identifying information associated with or contained in a telecommunications instrument so that such instrument may be used to obtain telecommunications service without authorization". No requirement of intent to defraud need be demonstrated here, but there is an affirmative defense "(which the defendant must establish by a preponderance of the evidence) that the conduct charged was engaged in for research or development in connection with a lawful purpose." This bill, is one of the first I know of to outlaw mere *possession* of software. And they can take seize your computer, your car, and Lord knows what else if they find the illegal software on your laptop hard drive. They need not prove you had any intention of using it to clone cellphones, just that you knew it was configured for illegal ESN alteration and you did not have it for "research and development in connection with a lawful purpose." To quote the Committee report on the bill... [S493} amends section 1029 of Title 18 of the United States Code, relating to fraud and related activity in connection with access devices. The bill amends subsection (a)(8) of section 1029 by deleting the `intent to defraud' requirement which exists under current law in order to prove a violation of that section. This section relates to persons who knowingly use, produce, traffic in, have custody or control of, or possess hardware or software which has been configured for altering or modifying a telecommunications instrument. As a result of the amendments made by the bill, in order to prove a violation of section 1029, law enforcement officials will no longer have to prove that a defendant possessing such hardware or software did so with the intent to defraud another person. The amendment to the statute is being made because law enforcement officials occasionally have been thwarted in proving true violations of the statute by the `intent to defraud' requirement. But as the hardware and software in question can be used only for the purpose of altering or modifying telecommunications instruments, persons other than those working in the telecommunications industry have no legitimate reason to possess the equipment. Therefore, requiring the government to prove an `intent to defraud' in order to prove a violation of the section for possessing this equipment is not necessary. By eliminating this requirement from existing law this bill will make it easier to obtain convictions against criminals who possess this equipment before they actually use it for illegal purposes. ............................. The statute, as amended, also does not prohibit persons from simply possessing equipment that only intercepts electronic serial numbers or wireless telephone numbers (defined as `scanning receivers' under section 1029, as amended by the bill). For example, companies which produce technology to sell to carriers or state and local governments that ascertains the location of wireless telephones as part of enhanced 911 services do not violate section 1029 by their actions. Under new subsection (a)(8), however, it will continue to be illegal to use, produce, traffic in, have custody or control of, or possess a scanning receiver if such act was done with the intent to defraud another person. This also is current law, and it remains unchanged by the bill. > > The law enforcement industry couldn't care less whether the cellphone > airlinks are private. All wiretaps are done at the base station or > inside the network, where no scanners are needed. > Sadly, this is only true of *legal* wiretaps by authorized *US* entities. Ask any of the dealers and manufacturers of cellphone interception gear and high end scanners who buys this stuff (with cell phone band enabled). Lots of LEA types have this gear, some of which is specialized enough so it could have no other purpose. > I suspect the cellphone industry wants these laws primarily because they find > them useful at fighting fraud. When you broadcast a reusable "password" > (the MIN/ESN pair) over the air in the clear (as analog phones do), devices > to snoop on conversations start to look very much like devices to steal those > valuable "passwords". Of course. They could care less about privacy (or they would have encrypted years ago), but fraud costs them big money. > > Of course, we all know that these laws are pretty ineffective at protecting > privacy, though they are effective at making it easier to snow the public into > thinking their cellphones are secure. (This is only, what, the fourth such > law? It just gets worse and worse.) -- Dave Emery N1PRE, die(a)die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18

1 0