- cypherpunks-legacy - lists.cpunks.org

Re: Radio Free Cypherpunks... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 15 Dec 1997 15:49:40 -0800 > From: Steve Schear <schear(a)lvdi.net> > Subject: Re: Radio Free Cypherpunks... (fwd) > > Over a year ago I started a heated thread on the Telecom Regulation list,= > "Basis of FCC jurisdiction," which posited that the Commerce Clause basis= > for FCC authority might not hold for very low power and tens of GHz= > transmissions. My argument, in short, was that if a transmission couldn't= > reasonably be expected to be detectable (using common receiver technology)= > across state lines then the FCC shouldn't have jurisdition. So, are you considering such a broadcast? What I envision is a text-to-speech and/or a digital format. ____________________________________________________________________ | | | | | We built your fort. We will not have it used against us. | | | | John Wayne - Allegheny Uprising | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 3

Re: Comparing PGP to Symantec's Secret Stuff
by Vin McLellan 17 Dec '03

17 Dec '03

(I just posted this in a discussion on alt.security.pgp, and thought it might also be of interest to the List. _Vin) ALCO Jakarta <alcojkt(a)bit.net.id> queried the Newsgroup: > Could anyone give me a quick trun-down on the difference between these two > programs and which one is more secure? Is the latter more practical to use > than PGP 2.6.2? That's comparing real crypto vs a sophisticated version of the Captain Crunch crypto ring. PGP in all of its forms uses strong crypto, which is why it is difficult to legally export it from the US to any overseas entity, except branches and subsidiaries of US firms. (Thus, the effort to sustain the international version of PGP, and PhilZ's long travail while the US govt tried to investigate how those sneaky non-Yanks got their hands on this oh-so-useful RSA/IDEA utility.) Norton Secret Stuff secures the data using the 32-bit Blowfish encryption algorithm -- which is why it's approved for unrestricted export outside the US by the U.S. government. It's far better than, say, ROT13 -- but it would not provide meaningful confidentiality or security for anything of any worth, or anything which might otherwise spur a curious and clever grad student to spend somewhere between a couple hours (with a college computer lab at his proposal) to a few days (on a fast PC) doing a brute force search of all possible 32-bit keys. A more complex comparison would put PGP against Norton's YEO, but that too is an apples to oranges matchup, albiet with strong crypto on both sides. PGP was designed to be a mail encyptor. YEO -- with RSA + RC4, RC5, DES, DES3, and Blowfish too, I think -- was designed as a file and disk encryptor. Each is optimized for its primary function. The lack of published source code is an issue, but if you see such a product being purchased by multinationals or US defense contractors you can be certain the implementation -- which is the real arena of vulnerability, once the algorithm is chosen -- has been carefully studied by informed cryptographers. (For non-American product, look for similar purchases by government-connected agencies in the vendor's nation.) You don't sound like the source code is going to do _you_ any good, right? Like most buyers, you have to trust the judgement of talented pros somewhere. > > I use PGP and don't find it's use so difficult to master even as a rookie > in cryptographic matters. But this Secret Stuff program is commerical so I > don't trust it's degree of security to gov't snooping based on my suspicion > of corporate submission to gov't will. Is that a reasonable assumption? Actually, corporate or commercial products are better than that. Secret Stuff is overtly weak crypto. It's also free from Symantec. Norton YEO from Symantec, or any competitive heavy-duty product like RSA SecurPC, will be clearly labelled as to the relative strength (key length) of their crypto -- strong for domestic user; weak for the intl mass market -- in terms anyone with a basic understanding of crypto and crypto export regs can understand. Export permits for the strong domestic versions of products like these will be all but impossible to obtain for mass market sales to non-American individuals. (Neither of these firms probably sells or even tries to sell the export version overseas; the weaker products exist largely because US corporate buyers demand an interoperable product that _can_ be shipped to overseas associates.) Export permits to ship the strong-crypto version of these products American corporations will require that the vendor have a key recovery mechanism -- no big deal, since we are dealing with stored files, so backup access is a standard requirement for disaster recovery -- which is to be held by the US firm in a location which makes it accessible to legal US court orders. Any and all US firms will respond to a legal court order to provide information. (Commercial firms in other nations will provide any info they hold when confronted with a court order too, right?) It is always rash to expect any commercial firm in any nation to be either a martyr or an arbiter of moral or political issues. Corporate officers have fiduciary responsibilities and they can be replaced. Corporations get a set of rules from the society in which they operate, and then -- within the context of those rules -- they seek to maximize their profit and their stockholders' return on investment with a certain degree of ruthless intensity. That's the nature of the beast. When corporate self-interest and some corporate executive's personal philosophy line up, we get some interesting fireworks -- sometimes even heroic moments which dramatically change the course of a government's industrial policy, as in the US banks vehement rejection of the NSA's CCEP and Clipper programs. The apparent exception really validates the rule. It's really rare for the US govt to try to overtly challenge or crush an American firm like they did with RSADSI for a decade. The NSA tried to bully the US banking industry and got handed its collective head -- and got branded as naive and turned into something of a laughingstock as well. On the other hand, commercial vendors which provide a product for sale have to describe and warranty that product as having certain properties. If those products are used by individuals or commercial customers and fail to measure up to their advance billing, the vendor is thereafter liable for significant (even company-threatening) losses, in both recompense and punitive damages. That's commercial law in the US -- no matter what sort of mealy-mouth language might be in the shrink-wrap license. US lawyers get a blueprint of an altar upon which they can sacrifice such firms when they get their law degree. Corporate "submission to gov't will" is a real issue, particularly for vendors of privacy and security tech -- but for US firms, it is far more likely to play out formally (as with a court order for a message recovery key) or in some negotiated backroom deal where the government demands some feature added, or asks for some feature to be removed from free-market product, before the vendor is given some commercial advantage like a government contract, or GSA approval, or an export permit. You see the whole American IT industry being put through this sort of blackmail in the current US crypto export policy. Only vendors which have or agree to design key/message "recovery" mechanisms in file or communications crypto apps get export permits to ship their 56-bit versions of their crypto products -- or (among other vendors,) crypto-enhanced applications like RDBSs and operating systems -- to the international market. Nothing subtle or secret about that -- and historically, the model has probably been pretty much the same, if less blatent. US export controls in crypto exist to bludgeon the vendors, so that the US govt can obtain something it wants in that company's domestic or overseas product lines. (It certainly does not restrict the international bad guy's access to strong crypto, no matter what the latest Four Horseman propaganda is.) Today, I think this leverage is probably being applied more on the big US vendors of operating systems and networking software and major applications -- all of which require crypto for their commercial products today -- than it is upon the puny crypto vendors (who are, relatively speaking, small potatos and aren't allowed to sell strong versions of their products -- even with message-recovery -- to anyone interesting, anyway;-) In commercial encryption products, the hidden backdoors of myth and legend are far less likely, given the liability issue and US commercial law. Overt and well-labelled backdoors are a different story. <sigh> Surete, _Vin "Cryptography is like literacy in the Dark Ages. Infinitely potent, for good and ill... yet basically an intellectual construct, an idea, which by its nature will resist efforts to restrict it to bureaucrats and others who deem only themselves worthy of such Privilege." _ A thinking man's Creed for Crypto/ vbm. * Vin McLellan + The Privacy Guild + <vin(a)shore.net> * 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

4 5

Re: Identity, Persistence, Anonymity, and Accountability--Part I of II
by Brian B. Riley 17 Dec '03

17 Dec '03

On 12/15/97 11:13 PM, Greg Broiles (gbroiles(a)netbox.com) passed this wisdom: >>>But note that there absolutely is no requirement in the United >>>States for ageneral form of identification. Non-drivers need not >>>have any form of I.D. And as we have seen in court cases, a la >>>Lawson v. Kolender (where a blackman in dreadlocks used to like to >>>walk the streets of San Diego...the copsstopped him many times and >>>jailed him for not having I.D. on him...the court ruled that people >>>don't have to present credentials issued by the state to walk the >>>public streets). >> >> In New Jersey there is a criminal offense called "failure to >>properly identify" ... I don't know if its ever been tested, or if it >>is still on the books, but as of ten years ago it was there. I think >>it was a misdemeanor (in NJ the term is "petty disorderly persons >>offense) I cannot imagine it as a felony. > >There's an important distinction between a requirement that you identify >yourself accurately, and a requirement that you carry a particular form of >identification. It is constitutional for the police to ask you what your >name is, under certain circumstances - and you can face criminal charges if >you lie. It is not, however, constitutional to require that you keep or >carry identity cards or documents. (Modulo, of course, participation in >activities like carrying a concealed weapon or driving. There are some >people who believe that carrying special credentials should not be required >when undertaking those activities, but very few or none of those people sit >as judges, so their beliefs are comforting or pleasing but also >insufficient to prevent conviction.) I guess I am curious about being required to identify yourself ... if the cops have no probable cause to arrest you then what right do they have to know who you are? ... and should they have probable cause, why should you have to help them know who you are. I could see circumstances where forcing you to identify yourself would come under self-incrimination. I am sure they have ways of dealing with this ... what legal precedents are there concerning this? Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "One of the deep mysteries to me is our logo, the symbol of lust and knowledge, bitten into, all crossed with in the colors of the rainbow in the wrong order. You couldn't dream of a more appropriate logo: lust, knowledge, hope, and anarchy." -- Gassee - Apple Logo

3 2

http://www.nuyenta.com
by NuYenta 17 Dec '03

17 Dec '03

Dear Friend, NuYenta (www.nuyenta.com) is an online service designed to provide traditional Jewish matchmaking to the Gay, Lesbian, Bisexual and Transgender friends and members of the world-wide Jewish community. As a guest you can look for a match and get your own profile... and it's FREE! At NuYenta members and guests begin to know about each other by matching profiles. You can even include a photograph of yourself. NuYenta provides you with anonymous email and chat rooms for contacting other members and guests. We even have a bookstore specializing in books specifically written for the Gay, Lesbian, Bisexual and Transgender friends and members of the Jewish community. If you are looking for that special someone or would like to make some new friends then visit NuYenta. As a guest you can look for a match and get your own profile... and it's FREE! Visit NuYenta at http://www.nuyenta.com

1 0

Re: UCENET II and Peter duh Silva
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- politas(a)dynamite.com.au (Politas) wrote: > Surely that isn't the important thing. More important is that the > person really has an email address of "john_smith(a)hotmail.com". Then > it's up to Hotmail to be able to trace that email address back to the > previous step, assuming that they are being forced to do so by a > warrant or some other legal reason. > > Personally, I think that all messages should be able to be traced to a > real person, although this tracing should not be possible without > legal action. Are you saying that Hotmail should be made a guarantor of the identity of its accountholders, or merely that they could be required, under certain circumstances, to divulge what information (if any) it possesses, regardless of its accuracy? AFAIK, the latter case is currently operative, since Hotmail's records are presumably already subject to subpoena (in the USA, at least -- I just realized you're posting from an Aussie domain). IOW, when you sign up for a hotmail.com account, you're presumably required to give them a "name". If I signed up as "John Smith", should they be required to verify that I'm really John Smith, or merely disclose that the account belongs to someone who identified him/herself as "John Smith"? If you're saying what I hope you're NOT saying, it would amount to a form of "identity escrow", and I suspect that Hotmail would probably choose to discontinue offering free e-mail accounts rather than take on that sort of responsibility. - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNJaaXwbp0h8ZvosNAQHqtQf+LGGPWLQFPGfGgwKIHKOTAXQ74S08rGqt i8yiuSY2RgC+CXzbXJaMmDQ9gAcPMmCKJqzc2O4bkresg+hz6/Cl6d+m+3FO4Nz+ HKeaEMlg3EXHuxTnhsx4vSAWubdbpC+OfkU6kQHf1YU1zWZnIV9c7SbWmSNeaYhq sXLl6+YlPFwwZ0N5bUBqNkOsAQQveNFd/91mYGAZBi2R6P95F+RDV3/Jv3elhXgu egBb2Igf7imK/U6zFhgm6+jCdFdpGOfJ030UAMulezFi/czaiNdLNR3jE4nnfrwQ 4qexxqUkwzNrNWX0M9T/YQ7wl+jIWi3KKj4s4QLHTKXhoHNDY7hPsw== =W6Zl -----END PGP SIGNATURE-----

1 0

A gauntlet thrown down by PC-Magic?
by Alex Woolfson 17 Dec '03

17 Dec '03

Hey guys Just FYI here is the response I got from PC-Magic. -----Original Message----- From: Scott Chaney <scott(a)pc-magic.com> To: Alex Woolfson <abdiel(a)worldnet.att.net> Date: Monday, December 15, 1997 4:02 PM Subject: Re: Encrypted Magic Folders >Thanks for the feedback. We are considering an established standard. > >BTW, for all the "crap" we get from supposed crypto experts no one has >come close to breaking our method. It does make for humorous reading >tho. > >Scott > > Anyone care to take him up on his challenge? Please say yes. :-) Alex

3 2

Could you please PGP sign this MD5 sum?
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

I would like to kindly ask you to sign this md5 sum with your PGP keys, and return it to me signed. I would also appreciate a copy of your PGP key. Thank you very much. ``I testify that I did see this MD5 checksum around Dec 16, 1997. f3bffc327bf88846bc1d790c56da0ffb caleidoscope.fixed.txt. '' Signed, -

2 1

The naming of the Presidential Pooch
by Declan McCullagh 17 Dec '03

17 Dec '03

The stakeout before the press conference. Note the hard-hitting questions from DC political reporters: Q There he is. So what's his name? PRESIDENT CLINTON: Isn't he pretty? Q But what's his name? PRESIDENT CLINTON: Press conference. Press conference. Q (Laughs.) His name is "press conference"? PRESIDENT CLINTON: Huh? Q His name is "press conference"? PRESIDENT CLINTON: That's a good idea. That's probably what I should have called him. (To the puppy) Do you want to go see them? Q Mr. President, where does he sleep? Where does the puppy sleep? PRESIDENT CLINTON: Upstairs. Q Upstairs? Does he have his own little doggy bed? PRESIDENT CLINTON: He has a little house in the kitchen. He's sleeping in the kitchen right now. Q Does he sleep in a little dog house? PRESIDENT CLINTON: Yeah, he sleeps in a little dog house. And we got another - Q He is really trained? PRESIDENT CLINTON: You may get a chance to see here in a minute! (Laughter.) Yes, he's done quite well, so far. Hi, Jimmy. Q And what can he do? PRESIDENT CLINTON: (Commands the puppy) Sit! THE PRESS: Oh! All right! PRESIDENT CLINTON: (To the puppy) That's good. Very good. Q What's he eating, Mr. President? PRESIDENT CLINTON: A little dog biscuit. He's pretty well trained. And, you know, I get up in the morning and take him for a walk early, at 7:00. And then I give him breakfast, then we go for another walk. And then he has lunch and goes for another walk. Q Who takes him at lunch time? PRESIDENT CLINTON: Well, so far, I have. Q He likes the press, Mr. President. PRESIDENT CLINTON: Yeah, he does. So do I. Q He doesn't bother your allergies? PRESIDENT CLINTON: No. I've never been - yeah twice, three times. I'm trying to work this out. Q It's going to take awhile. PRESIDENT CLINTON: It's going to take awhile. It's kind of like peace in Ireland or the Middle East, you know - (chuckles) - it's - Q What happened when they met? PRESIDENT CLINTON: Socks was a little scared of him, I think. And yesterday - you could have had a great picture yesterday. She jumped way up - he jumped way up on my shoulder. Socks climbed right up and got up on my shoulders so that they would have an appropriate distance. But we're giving them items that the two of them have, you know, to try to get used to the scent. And I'll get it worked out. Q What's his name? Q He likes grass. PRESIDENT CLINTON: He can hang out in the - he can hang out nearly anywhere. We've got a little flexible cage back in the dining room now in the White House. He comes over to the Oval Office with me in the morning. He does fine. Q Without telling us the name, can you tell us if it came from a senator? PRESIDENT CLINTON: No. In the end, it didn't. It didn't. I'll tell you about - I'll answer questions about it at the press conference. Q What were your finalist names? Can you give us any of that? PRESIDENT CLINTON: I'll do that too, at the press conference. Yeah, we went through - we went through about - you know, we got thousands of names. It was great! And I had so much fun reviewing them. And then we went - (to the puppy) - don't eat that, you just had lunch! - (returning) - and we got down to about seven or eight, and then we got down to three and finally made a decision. (To the puppy) Come on, kiddo. Come on. Let's go. Q He's beautiful. PRESIDENT CLINTON: Thank you. I think he's beautiful, too. END

2 1

NYT Account Request
by forgot＠nytimes.com 17 Dec '03

17 Dec '03

You have requested your ID and password for The New York Times on the Web. Please follow the instructions below. 1. Please make a note of your subscriber ID: nifft 2. Next, to get the password for this account, using your Web browser go to this unique URL: http://www1.nytimes.com/forgot/snp.cgi?ul=nifft~475280 This page will allow you to choose a new password. Make sure you have copied the address EXACTLY as it appears here. (If you're getting an "Error" page, the address was probably entered incorrectly. See "Help With Copying and Pasting" at the bottom of this e-mail.) 3. Follow the instructions on the screen to choose a new password. After you have entered a password you will automatically enter our Web site. The New York Times on the Web Customer Service forgot(a)nytimes.com ******************** Help With Copying and Pasting 1. Using the mouse, highlight the entire Web address, (e.g. http://www1.nytimes.com/forgot/snp.cgi?ul=nifft~475280) shown above in step 2. It's essential to highlight the entire address, even if it extends over two lines. 2. Under the Edit menu at the top of your screen, select "Copy". 3. Go into your Web browser (open it if it's not already opened). 4. Click in the "Netsite" or "Address" bar -- the place in your Web browser where it says what Web address you're currently looking at -- and delete the address that's currently there. 5. In the blank "Netsite" or "Address" bar, paste the address by selecting the "Edit" menu at the top of your screen and choosing "Paste". 6. Press Enter. 7. Follow the instructions to choose a new password. ******************** If you did not request your ID and password for your NYT Web registration, someone has mistakenly entered your e-mail address when requesting their password. Please simply ignore this message, or, if you wish, you may go to the address above to select a new password for your account.

1 0

Re: UK spooks invent RSA, DH in 1973
by John Young 17 Dec '03

17 Dec '03

Peter Gutmann wrote: >There's an interesting paper at http://www.cesg.gov.uk/ellisint.htm which >claims that UK spooks invented both RSA and DH in 1973 and 1974 respectively. We've converted the Ellis Postscript doc to HTML: http://jya.com/ellisdoc.htm

10 12