- cypherpunks-legacy - lists.cpunks.org

Re: The end of public key cryptography as we know it?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199507132009.AA15283(a)tyrell.net>, pgf(a)tyrell.net (Phil Fraering ) wrote: > From: Doug Hughes <Doug.Hughes(a)eng.auburn.edu> > Date: Thu, 13 Jul 1995 13:46:10 -0500 > > An article posted on sci.crypt stated that quantum factoring > is real and that an article was posted in this month's Science > magazine. The author of the post says this would make factoring > a 10 bit number the same time as factoring a 100000000 bit number. > >You can bet your ass and your mother's and grandmother's donatable >organs that if this were possible, then the legislative initiatives >currently underway would not be: they'd just let us use RSA and get >a false sense of security. Even with a quantum computer, factoring is still an extra step that is not required with GAK. Besides, factoring will always be more expensive than GAK, at least for the other side. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMAW0VSoZzwIn1bdtAQG9QQF+OWci7VK8X9/ropNlf5dGW5/jbHWo+4cR 2GvuYpDvoAbDRQmDcpFR7u8hBog7KIet =c/wa -----END PGP SIGNATURE-----

1 0

Re: The end of public key cryptography as we know it?
by unicorn＠polaris.mindport.net 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >In article <199507132009.AA15283(a)tyrell.net>, pgf(a)tyrell.net (Phil >Fraering ) wrote: > >> From: Doug Hughes <Doug.Hughes(a)eng.auburn.edu> >> Date: Thu, 13 Jul 1995 13:46:10 -0500 >> >> An article posted on sci.crypt stated that quantum factoring >> is real and that an article was posted in this month's Science >> magazine. The author of the post says this would make factoring >> a 10 bit number the same time as factoring a 100000000 bit number. >> >>You can bet your ass and your mother's and grandmother's donatable >>organs that if this were possible, then the legislative initiatives >>currently underway would not be: they'd just let us use RSA and get >>a false sense of security. You give them too much credit. Still, there's always IDEA and suchlike. The legislation would stand in any event. >Even with a quantum computer, factoring is still an extra step that is not >required with GAK. Besides, factoring will always be more expensive than >GAK, at least for the other side. > >- -- >- -- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. >- --- >[This message has been signed by an auto-signing service. A valid signature >means only that it has been received at the address corresponding to the >signature and forwarded.] > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Gratis auto-signing service > >iQBFAwUBMAW0VSoZzwIn1bdtAQG9QQF+OWci7VK8X9/ropNlf5dGW5/jbHWo+4cR >2GvuYpDvoAbDRQmDcpFR7u8hBog7KIet >=c/wa >-----END PGP SIGNATURE-----

1 0

Re: OTP server..
by unicorn＠polaris.mindport.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >How about WWW one time pad servers? You browse to your >favorite OTP server, which has a random number generator >running in the background. You tell it to give you a block >of X bytes, and mail it to persons 1, 2, 3, ... N. > >These people then use this OTP for encrypting a document. >It wouldn't be illegal because you aren't encoding any data >and distributing it.. You're generating raw data. You wouldn't >have to distribute any crypto software, you just xor your >data file with the number of bytes that you were sent >in the mail from the OTP server.. Enough of these things >would be REALLY tough to monitor.. Plus, you could connect >8 different times and just pick one of the sets.. Or you >could just use a portion of the set that you and the receiving >party agreed upon. > >Or, instead of using email, you could have a application/x-otp >browser that would collect the OTP that the server sent out >to you over HTTP. (this would be really hard to differentiate >from other data if the server was doing other things at the >same time). > >Thoughts? > I think you're trusting the server a GREAT deal. > Doug Hughes Engineering Network Services > doug(a)eng.auburn.edu Auburn University -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMAcXby1onm9OaF05AQEUpggApWiVdcA4UAsVIXKEor3JnM6PkEZleO6b CpbyXYVZNRmUuePTuUMf9KQkI0accFm/sjnc7t12Hujs60utILWYM2F71GSrHZ0/ POx/oExL5TgcR9m6e0cYM58k9xZT2golXXHukTXnU6FlCNSNMfWnBziTgsSwCj1q mZO8xQnbSWteWL50g7cFBMvGbyDSygOZu9MPqzRRvUVoF/kL78G0SAwT8HzGadfk yIV40wDicBfuPH1GcaPlbGW+0Adips0WHAETBSRmUXSBdu+uQcs6LhEhddvbKmzF Rh4qpIR0FYKcnyax0kqk6eBBWqo7oVCdm9nYMHc2yg6I9dQLGWnQIA== =b9lf -----END PGP SIGNATURE-----

5 4

Re: mac share/freeware app for overwriting unused hd space?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 2:27 PM 7/27/95, j. ercole wrote: >Can anyone point me towards a program that's freeware or shareware that >will overwrite all the unused i.e., "trashed" space on my hard drive(s)? I >sincerely apologise if this is a faq. I know norton's will do it but I >don't presently have that installed on my machine. Thanks oodles, Well, getting the commercial products (fairly cheap, for Norton) is the first line of defense if you're paranoid. Erasing a file and then filling the disk with other files (even copies of existing files) will do the same thing, albeit only once. At the most serious level of attack (the "threat model"), such as the FBI labs in Quantico or the NSA, there are reports that specialized disk drive heads are used to recover earlier signals that are not erased even with N active overwrite steps (apparently the head jitter in most drives means that each write cycle is slightly different, even on the same disk region, and a slight "shadow" or "ghost" of previous writes can sometimes be extracted). --Tim May, who hopes this will not reignite the thread about how to use thermite to permanently erase disk drives .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Universal Password System?
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

I was thinking some more (look out, this could be dangerous) about the concept of using some kind of H(challenge+password) system to keep passwords away from ____(your threat model here)____, when it hit me that we could devise a standard password system, which would allow Joe Schmoe to have a single password for all of his interactions with puters. Ideally, Joe would need a "smart card" or PDA with IR link (this could even be the proverbial Windows Watch) that would not need to keep the actual passphrase at all (but would insure against a compromised system recording keystrokes) that would keep the pubkeys of all systems with which he has accounts. It would also need to be able to display in decimal and hex for systems without the IR link. When he is making connections to a new system, the system will give him its S and RSA or other public key K, so that the smart card can compute K( H(S+P) ), and send that as the password. To the system, Q = K"( K( H(S+P) ) ) =is= the password, but Joe only needs to remember P for everything. From then on, logons will include the system sending S and a non-reproducible challenge <C,D,....> (where C is iterated less-frequently and D is time.of.day) and the smart card responding with K( H( D + H(C+Q) ) ). As you may recall, the idea of the multi-part challenge was so as to allow the admin of the system to store Q remotely, and keep C -of-the-day and H(C+Q) for each user on the system itself. With appropriate safeguards (a physical switch on the case of the system which kills the NVRAM chip with the key for the secure file system, this would seem to be Pretty Secure. The system is extensible, allowing further nesting of challenge parts within the hash/concatenation function, so that layers of security can be used, if anyone can find an application for them. The basic principle of the master passphrase for all uses would make it easier to get Joe to use one that he can remember, without giving up anything to corrupt administrators (I have a hell of a time remembering all the passwords for every system, and must let the comm program remember them, protecting it with another password. Messy.) Comments? * Tribble: * Punk Tribble: Y Tribble Contortionist: & --- * Monster(a)FAmend.Com *

1 0

IRC encryption
by sdw＠lig.net 17 Dec '03

17 Dec '03

I've ducked out of the IRC world mostly after the first couple years, but this looks like you could setup pgp/rsa.perl/something that would be interesting: *** Help on ENCRYPT Usage: ENCRYPT [<nickname>|<channel> [<key>]] ENCRYPT allows you to hold an encrypted conversations with a person or a whole channel. Once a nickname/channel and key is specified, all messages you send to that nickname/channel will automatically be encrypted using the given key. Likewise, any messages from that nickname/channel will automatically be decrypted. ircII is smart enough to know if the incoming message isn't encrypted and will not attempt to decrypt it. If you received an encrypted message from someone for whom you haven't specified a key, it will be displayed as [ENCRYPTED MESSAGE]. The <key> can be any text which is to be used an they key for encryption/decryption of the conversation. It is up to you and the people you wish to talk to about how to agree upon a key and how to communicate it to one another. For example, if user CheeseDog wishes to talk encryptedly with user DogCheese, they must first agree on an encryption key (case sensitive), say foo. Then user CheeseDog must issue a ENCRYPT DogCheese foo and user DogCheese must issue a ENCRYPT CheeseDog foo Thereafter, all messages sent between CheeseDog and DogCheese will be encrypted and decrypted automatically. If ENCRYPT is given with a nickname but no key, then encrypted conversation is ended with that user. If ENCRYPT is given with no arguments, the list of encrypted user and keys are displayed. IrcII uses a built in encryption method that isn't terribly secure. You can use another if you so choose, see SEE ENCRYPT_PROGRAM for information about this. If you are sending encrypted messages to a user or channel, you can toggle it off and on in a message line by inserting the control-E character in the input line. This is usually done by hitting control-Q then control-E. An inverse video E will appear in the input line. Note: Control-q is bound (see BIND) to quote_character by default. It is frequently necessary to change this to some other char. See Also: SET ENCRYPT_PROGRAM *** You have new email. *** No help available on encrypt_program: Use ? for list of topics *** Help on ENCRYPT_PROGRAM Usage: SET ENCRYPT_PROGRAM <encryption program path> Sets the program used to encrypt and decrypt messages. The program selected must take an encryption key as the first command line argument to work with IRCII. sdw -- Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw(a)lig.net http://www.lig.net/sdw Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011 OO/Unix/Comm/NN ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95

1 0

CDT report on Senate and House hearings on Online Pornography
by Christopher E. Stefan 17 Dec '03

17 Dec '03

Somewhat interesting it seems, an ultra-conservative House is the First Amendment's bigest friend on the Online "porn" issue, while a much more moderate Senate is it's biggest enemy ... -- Christopher E Stefan * flatline(a)ironhorse.com * finger for PGP key ---------- Forwarded message ---------- ------------------------------------------------------------------------------- ------------------------------------------------------------------------ ****** ******** ************* ******** ********* ************* ** ** ** *** POLICY POST ** ** ** *** ** ** ** *** July 26, 1995 ** ** ** *** Number 22 ******** ********* *** ****** ******** *** CENTER FOR DEMOCRACY AND TECHNOLOGY ------------------------------------------------------------------------ A briefing on public policy issues affecting civil liberties online ------------------------------------------------------------------------ CDT POLICY POST Number 22 July 26, 1995 CONTENTS: (1) Senate Judiciary Committee Holds Cyberporn Hearing (2) House Science Subcommittees Hold Hearing to Explore Parental Control Technology -- Law Enforcement Officials Say Exon CDA is Wrong Approach (3) Subcribe To The CDT Policy Post Distribution List (4) About CDT, Contacting US This document may be re-distributed freely provided it remains in its entirety. ------------------------------------------------------------------------- (1) SENATE JUDICIARY COMMITTEE HOLDS CYBERPORN HEARING SUMMARY On Monday July 24, 1995 the Senate Judiciary Committee held the first every hearing on the issue of children's access to inappropriate material on the Internet. The principal focus of the hearing was to discuss Senator Grassley's "Protection of Children from Computer Pornography Act of 1995" (S. 892). CDT Executive Director Jerry Berman testified before the panel. Senator Grassley (R-IA) deserves praise for holding the first Congressional hearing on this important issue, as well as for taking great pains to ensure that both sides of the issue were represented. Although CDT may disagree with Senator Grassley's approach, we believe that this hearing represented an essential step towards advancing the dialogue on what has become an over-hyped and dramatically misunderstood issue. Senator Grassley's legislation, which has been co-sponsored by several other prominent members such as Dole, Hatch, and Thurmond, would impose criminal penalties on a service provider that "knowingly" transmits indecent material to a minor, or who "willfully" permits its network to be used to transmit indecent material to a minor (S. 892, Sec (b)(2) & (b)(3)). Two important points emerged from the testimony: 1. Current law prohibits the distribution of obscenity and child pornography, as well as online stalking and solicitation of minors. As troubling and disturbing as some of the testimony was, no evidence was presented that there are gaps in current law which would be filled by the Grassley legislation. 2. Serious questions exist as to the constitutionality of the Grassley Bill. Although Senator Grassley has repeatedly stated that his bill is narrowly drawn and targets only the bad actors, no evidence was presented to establish that a court would not interpret the statute more broadly, resulting in a complete ban on constitutionally protected speech online. WITNESSES Witnesses testifying before the panel included: * Donnelle Gruff, a 15 year old Florida girl described as a victim of an online stalker, * Patricia Shao, a mother of two from Baltimore MD and volunteer for Enough Is Enough * Dr. Susan Elliot, a mother from McLean VA * Bill Burrington, Assistant General Counsel, America Online * Barry Crimmins, a children's rights advocate * Stephen Balkam, Executive Director, Recreational Software Advisory Counsel * Jerry Berman, Executive Director, Center for Democracy and Technology * Michael S. Hart, Executive Director of Project Gutteberg, Professor of Electronic Texts, Illinois Benedictine College * Dee Jepson, Enough Is Enough (an anti-pornography group) DOES THE GRASSLEY BILL PROTECT CHILDREN? The testimony of 15 year old Donnelle Gruff focused on her experience as the victim of a stalker, while Dr. Elliot and Ms. Shao, two mothers of young children, described how their children had used commercial online services to access files they deemed inappropriate. Donnelle Gruff testified that she had been harassed and stalked by the sysop of a Florida BBS she had visited. The sysop had obtained her name, age, and address from her records and reportedly stalked Gruff while she was at home. During questioning however, Gruff's step-father told Senator Leahy that Florida law enforcement officials were currently investigating the case, and that they had given no indication that current law is insufficient with respect to prosecuting such cases. Senator Leahy noted that, as difficult and disturbing as Gruff's case is, it illustrates a need for additional law enforcement resources and education, but is not an issue of gaps in current federal or state laws. Senator Patrick Leahy (D-VT) noted similar recent prosecutions in Florida, and noted that the Grassley legislation does not explicitly prohibit online stalking of minors. In addition, Senator Leahy questioned whether government content restrictions would be an effective solution to protecting children online. "I hear a lot of rhetoric (from Congress) about getting government out of our lives, but here it seems as if the rhetoric is a little off of reality. Parents, not the government, should make the choices" about what their children should be permitted to access. Both Dr. Elliot and Ms. Shao testified that their children had stumbled across material while surfing the Internet that they, as parents, felt should not be accessible to children. Both described how their children had accessed "pornographic" images, and had been propositioned for "cybersex" while visiting a chat room on a commercial online service. In addition, Dr. Elliot described some of the images as representing 'bestiality and sodomy'. Barry Crimmins, a child protection advocate, testified that he has found numerous images of child pornography on America Online. Crimmins accused AOL of neglecting to adequately police its network. When questioned by Senator Leahy, Crimmins acknowledged that the distribution of child pornography and stalking or solicitation of minors is prohibited under current law. Crimmins added that while he thought the commercial online service should do more to remove such material, he believes that more vigorous enforcement of existing law would help to address his concerns. WHAT IS THE SCOPE OF THE ISSUE -- IS CURRENT LAW SUFFICIENT? Often in the course of the debate on this issue, the term "pornographic" is assumed to be interchangeable with both "indecency" and "obscenity". However as Senator Feingold (D-WI) noted, "pornography" has no legal standing, and when legislating in this area Congress must be careful to avoid confusing these legal distinctions. In determining what material would be considered illegal under current law, the distinction between "obscene" and "indecent" material must be made completely clear. When pressed by Senator Feingold, Dr. Elliot agreed that precise definitions are important, but argued that the files that her child downloaded from the Internet that depicted bestiality and sodomy that would be, "obscene by any standard". Images of bestiality and sodomy, as Dr. Elliot described, would be considered obscene in virtually every community in the United States, and hence are illegal under current law. Though it raises difficult jurisdictional questions, obscenity has been clearly defined by the Courts. Moreover, current law already prohibits trafficking in obscenity (18 USC Sec 1462, 1464, 1466) as well as child pornography (18 USC Sec 2252) have been successfully applied to punish conduct on computer networks. As Senator Leahy pointed out in his statement, the Justice Department is currently prosecuting cases involving material similar to that described by Dr. Elliot. Indecent material, on the other hand, is constitutionally protected and is much more difficult to define. The most common understanding of what constitutes indecent material includes the 7 dirty words, images of nudity, and other suggestive material. Moreover, the Supreme Court has ruled that any attempts by government to restrict access to indecent material must be accomplished in the "least restrictive means", and the determination of this standard is entirely dependent on the medium (see Sable Communications v. FCC, 492 US 115; 109 S.Ct. 2829; 106 L.Ed. 2d 93 (1989). Some of the material described by the witnesses would be considered obscene, and hence is already prohibited under current law. Other examples, including Ms. Shao's description of her daughter being propositioned for "cybersex", would likely not be considered obscene. Senator Russ Feingold (D-WI) urged the committee to carefully consider the distinctions between "obscene" and "indecent" speech, and urged his colleagues to "exercise caution and restraint." How broadly should we define indecency, Feingold asked Dr. Elliot, "Where should we draw the line? Should we prohibit playboy? swearing? The Catcher In The Rye? What about a discussion forum about how to avoid getting AIDS?". Because technologies currently exist to screen out messages such as those described by Ms. Shao, it is unlikely that a broad prohibition on such messages would pass constitutional muster. In this case, Congress must look to other, less restrictive methods of preventing children from having access to such materials -- including promoting the development and availability of user control technologies. CONSTITUTIONAL ISSUES Throughout the hearing, Senator Grassley stated that his legislation is carefully crafted and narrowly drawn in order to preserve the first amendment rights of adults while protecting children from inappropriate material. Grassley stated that his bill would hold an online service provider liable only in cases where they "knowingly" allow their network to be used to transmit indecent material to a minor or "willfully" allow an individual to use their network to do so. However, as CDT's Jerry Berman and America Online's Bill Burrington argued the wording of the statute and the variety of possible interpretations could lead to severe chilling effect on the free flow of legitimate information in cyberspace and force online service providers to limit or remove certain areas of their service. BROAD KNOWLEDGE REQUIREMENT The scope of the "knowing" standard in the Grassley bill is an issue of some dispute. Senator Grassley and his staff maintain that it is intended to apply narrowly, but no evidence was presented that demonstrated why a court would apply a narrow interpretation. Instead, a court is likely to interpret the "knowing" requirement broadly. Berman cautioned that because of this uncertainty, online service providers would be forced to rely on the broadest possible interpretation of the statute in order to avoid liability, resulting in a severe chilling effect on all online communications: "The threat of a broad interpretation of this new statute would compel all who provide access to the Internet to restrict *all* public discussion areas and public information sources from subscribers, unless they prove that they are over the age of eighteen. Under this statute, a service provider could note even provide Internet access to a minor *with the approval* of the child's parent. Since every online service provider would have to similarly restrict access to minors, this proposed statute would create two separate Internets, one for children and one for adults." America Online's Bill Burrington agreed, stating that the potential for a broad interpretation of the statute would compel AOL and other online service providers to adhere to the broadest possible reading in order to avoid potential liability. Burrington argued that would force AOL to shut down many parts of their service and place providers in the unenviable position of national censor. "Constitutional guarantees of free speech and press should be cautiously guarded," Burrington stated, "The online service provider industry should be encouraged to provide *voluntary* editorial control over its service and to continue its research and development of parental empowerment technology tools. This industry should not be cast in the role of national censor, determining which information may be fit for children, but nonetheless subject to criminal liability if it guesses incorrectly in any given instance." Senator Dewine (R-OH) asked several questions of many of the witnesses, and expressed concerned about the potential for an overly board interpretation of the knowledge standard. BROAD INTERPRETATION OF 'INDECENCY' As addressed earlier, a precise definition of 'indecent' speech has never been firmly established, and whether material would be considered indecent depends largely on the nature of the medium it is communicated through. Because of this, and because under the Grassley bill carriers would be liable for transmitting indecent speech, carriers would be forced to adhere to the broadest, most inclusive definition of indecency. This would include, among other things, the 7 dirty words, description of genitalia, nudity, and other material which is protected in other media. This issue was raised by Michael Hart, Executive Director of Project Gutteberg, who stressed that broad restrictions on indecency would prevent people from enjoying serious works of fiction on the Internet. Project Gutteberg makes electronic texts of books available on the Internet. Hart stated, with great emotion, that the proposed indecency restrictions contemplated by the Grassley bill would force him to remove some of Shakespeare's plays, The Catcher In The Rye, Lady Chattily's Lover, Alice in Wonderland, and other books which have been classified as indecent in some parts of the United States. Although such an effect may not be intended by the drafters of the Grassley legislation, no evidence was offered at the hearing to counter Mr. Hart's concerns. EXON vs. BERMAN CDT's Jerry Berman urged the Committee to act cautiously before voting to further restrict First Amendment guarantees of freedom of speech. Berman urged the Senate to fulfill its traditional role as the "deliberative body", and to carefully consider the implications before enacting broad new statutes to cover new media. Referring to both the Exon CDA and the Grassley bill, Berman stressed that the country would be better served if the Senate did not enact legislation simply to "provide the illusion that the United States Senate could do something in this area". This remark drew a sharp rebuttal from Senator Exon, who, though not a member of the Judiciary Committee, sat in on the hearing on the invitation of Senator Grassley. Exon defended his bill and accused CDT and others of launching "viscous attacks" against him and his legislation. Berman was not given a chance to respond. "We are concerned about the situation", Exon argued, yet "we are viscously attacked for trying to have a rational discussion. We don't want to create a false sense of security [but] we have a responsibility to protect children". In addition, Exon dismissed parental control technologies as too little too late, arguing that "for every block there is a way around that block", and that such technologies may not be available in every home, allowing children to access inappropriate material at the homes of neighbors who may not employ such tools. WHAT WAS LEARNED? Although the hearing did illustrate that sexually explicit material can be found on the Internet, no substantial evidence was presented to indicate that law enforcement is currently unable to prosecute violations of obscenity, child pornography, stalking, or child solicitation laws. Moreover, although Senator Grassley intends his legislation to be narrow, serious questions were raised about whether other, more board interpretations are possible. In our opinion, the hearing illustrated that current law is sufficient to prosecute those who stalk or solicit children online, and that complex constitutional issues are raised by congressional attempts to restrict indecent material on the Internet. PATHS TO RELEVANT DOCUMENTS Testimony is available for most of the witnesses from CDT's Communications Decency Act Issues page*: URL:http://www.cdt.org/cda.html or from our ftp archive*: URL:ftp://ftp.cdt.org/pub/cdt/policy/freespeech *Due to the volume, these materials may take several days to appear on our site. --------------------------------------------------------------------------- (2) HOUSE SCIENCE SUBCOMMITTEE HOLDS 'PARENTAL CONTROL TECHNOLOGY' HEARING Two subcommittees of the House Science Committee held a joint hearing today (July 26, 1995) on the availability of parental control technologies to prevent children from accessing inappropriate material on the Internet. The hearing, held by the Subcommittee on Basic Research, Chaired by Rep. Schiff (R-NM) and the Subcommittee on Technology, Chaired by Rep. Constance Morella (R-FL) provided an important counter-balance to Monday's Senate Judiciary Committee Hearing. Witnesses testifying before the committee included: Witnesses Demonstrating Technology Solutions * Tony Rutkowski, Executive Director of the Internet Society * Ann Duvall, President of SurfWatch Software * Steve Heaton, General Counsel and Secretary, Compuserve Law Enforcement Witnesses * Kevin Manson, Federal Law Enforcement Training Center * Mike Geraghty, Trooper, New Jersey State Police * Lee Hollander, Assistant States Attorney, Naples Florida LAW ENFORCEMENT OFFICIALS SAY CURRENT LAW SUFFICIENT, EXON BILL FLAWED Today's hearing marked the first time law enforcement officials have testified on the issue of children's access to inappropriate material on the Internet. All three law enforcement witnesses agreed that, in their experience, current law is sufficient to prosecute online stalking, solicitation of minors, and the distribution of pornography and child pornography. All three said that they are vigorously prosecuting such cases. Instead of enacting new law, New Jersey State Trooper Mike Geraghty said that protecting children is "a matter of training law enforcement officers, prosecutors, lawyers and judges about how to enforce existing laws [with respect to computer networks]. The laws are good, we have to learn how to enforce them". The three law enforcement witnesses further argued that the Senate-passed Exon/Coats Communications Decency Act is the wrong approach to addressing an issue that is already covered under existing law. "I have several problems with the Exon bill as a prosecutor, both in terms of its practical enforcement and its constitutionality" said Florida Assistant States Attorney Hollander said. TRANSACTIONAL PRIVACY PROTECTIONS CRITICIZED In an slightly unrelated asside, Florida Assistant States Attorney Lee Hollander criticized privacy protections for online transactional information privacy protections as a hindrance to law enforcement. As part of last years Digital Telephony legislation, the standard for law enforcemetn access to online transactional records (logs that indicate what files an individual accessed from online archives and electronic mail transactions) was raised from a requirement of a mere subpoena to a court order from a judge based on the showing of "specific and articulable facts" that such records are "relevant and material to an ongoing criminal investigation". The higher standard was widely seen as a victory for online privacy. In response to a question of what Congress could do to help aid enforcement of existing law, Hollander noted that the higher standard for online transactional records adds an additional burden to law enforcement investigations. Calling it part of a "ballance between privacy and law enforcement", Hollander did not suggest that Congress should repeal the court order requirement, only that it made prosecutions more difficult (*NOTE: Members of CDT staff worked closely on this issue, and consider the court order standard to be a tremendous victory for online privacy). EXON CDA CONDEMNED BY ALL Condemnation of the Senate-passed CDA was not limited to the law enforcement witnesses. Not a single member of the Subcommittee stated support for the CDA, and all expressed concern that the issue had not received sufficient public consideration by Congress. Chairwoman Morella stressed that Congress should consider technological options to empower parents to exercise control over what their children access online before rushing to enact new laws. Rep. Geren (D-TX) expressed concern about the First Amendment implications of the CDA. Rep. Vern Elhers (R-MI) stated that he would "oppose bills that make network access providers (legally) responsible for the content they carry". In what was perhaps the strongest condemnation of the Senate-passed Communications Decency Act, Rep. Zoe Loefgren (D-CA) said, "While well intentioned, the Exon bill a totally wrong approach and a complete misunderstanding of the Technology." PARENTAL CONTROL TECHNOLOGY IS THE ONLY EFFECTIVE SOLUTION Internet Society Executive Director Tony Rutkowski provided Committee members with a basic overview of the Internet and described Internet Society (ISOC) and Internet Engineering Task Force (IETF) are currently looking at content tagging and other voluntary rating systems for future Internet protocols. Rutkowski stressed that centralized, command and control style content restrictions would be ineffective in the global, distributed network environment of the Internet. Rutkowski further noted that objectionable material constitutes a minuscule amount (less than .05%) of the total traffic on the network. Because of the global reach of the Internet and the millions of potential content providers, Rutkowski argued, the only effective means of addressing the availability of inappropriate material is to provide user control applications to empower parents to block and filter what the and their children access. SurfWatch President Ann Duvall, demonstrated SurfWatch, and described the product as "just one example of the computer industry responding to needs created by the explosive growth of technology". Duvall stressed that the industry is developing solutions which are simple to use, inexpensive, and empower parents to make their own choices about what they or their children should see. Expressing concern about legislative efforts to control content online, Duvall noted that 30% of the sites blocked by SurfWatch reside outside the

1 0

Re: RC4
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >So, does anyone know for certain if this is the true letter of the law? >Since RC4 has been reverse engineered (or leaked) to the public, do they >have any claim on it if there is no patent? Seeing the legal web that >surrounds a lot of the current crypto situation in the US, it's not >surprising that RSA would try to smoke screen everyone into thinking that >there would be a clear violation (prosecutable by law) if anyone used RC4 >without getting a license. (It's also not surprising that no one's tried >as well...) A acquaintance of mine at a now-defunct company compared the reverse engineered RC4 work-alike that was released on the net with the source they had licensed from RSADSI. She noted that the implementations were quite different (structure and variable names were both very different), so the work-alike released on the net was indeed most likely reverse engineered. Someone else queried two or three other BSAFE source licensees, and found all agreed that the code was not cribbed from BSAFE sources. Sadly, I no longer have copies of the (anonymous) post. Still, I'm not rich enough to punch through RSADSI's smoke screen... Richard -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMBky1fobez3wRbTBAQHh2AP/dPCZxvp8W2CXG/mqN7iuYc1oH+t0XiH8 wAnNQ2+0BbWzVyzt3YalUp6/JPXDBm1kGVWxmy+UUY8y0dfYpsi78T4aQxoPpG13 Kfc7MQat77SGvhRzNAcMei0h+hyMUmwGqnaetuSGIbFcyPbcnn4F8nq8JBOHXHcF 03+m959OKVk= =wTxS -----END PGP SIGNATURE-----

1 0

Re: New release (v1.3) of CFS Unix encrypting file system now available
by Alex de Joode 17 Dec '03

17 Dec '03

Matt Blaze sez: : Source code for the latest version (release 1.3) of CFS, the Cryptographic : File System, is now available upon request for research and experimental : use in the US and Canada. [..] : If you would like a copy of the CFS source code, please read to the end : of this message and then send email to: : cfs(a)research.att.com : DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement : that you are in the US or Canada, are a citizen or legal permanent : resident of the US or Canada, and have read and understand the license : conditions stated above. Be sure to include an email address in a US- : or Canada-registered domain. The code will be sent to you via email in : a "shar" shell archive (a little over 300K bytes long). Now, this would be very handy, unfortunately I'm no American or Canadian. -- Alex de Joode Fear Uncertainty and Doubt, Inc.

1 0

Re: PS/2 passwd bypassed at bootup?
by jon cameron 17 Dec '03

17 Dec '03

On Fri, 28 Jul 1995, Gary Merinstein wrote: > > I have my crummy IBM PS/2 passwd protected upon turning it on. > > I know that removing the battery in a PS/2 deletes the password. > > But can it be bypassed by an MIS-type if that person has an > > administration-type of diagnostic/setup/boot-up floppy? > > > > Jon C. > > > > when you type the power-on passwd, adding a slash to the end of it should > delete it for future power-ons: > > passwd/new-passwd changes password > passwd/ removes password (actually it changes it to the > null string. > > if you remove the password, you will then need the setup disk if you want to > re-install the power-on password. > I understand how that works, but how did the admin-dude bypass my passwd (a combo of six letters/numbers only known to me)? My log file says that he only made one attempt at getting in. Can CMOS store my passwd AND perhaps an admin passwd established in CMOS before I received the crummy PS/2? Is it encrypted? Do CMOSes in general encrypt their passwds ==> can code be added where the passwd is stored? How much space is in the "memory" of CMOS? Thanks for all the replies... Jon C.

1 0