- cypherpunks-legacy - lists.cpunks.org

Book review: Codebreakers, the Inside Story of Bletchley Park
by gnu 17 Dec '03

17 Dec '03

This is NOT David Kahn's excellent book "The Codebreakers". This is a British volume full of personal stories of thirty people who worked at Bletchley Park or at British code-breaking in the field during WW2. I found it a very touching and personal book. Each person tells their own story in a five- or six-page essay, and the stories cover a whole range of activities, from cryptanalytical work to typing-and-filing to the people who constructed and maintained the physical buildings. As the introduction says, "...few of the events described here were chronicled at the time, and those who worked at Bletchley and its outstations were forbidden to talk or write about it -- almost to remember it. The compiling of this book has rested almost entirely on personal memories; and that is unusual in an account which pretends to any sort of accuracy. Moreover, nobody who worked at Bletchley can now be under 65; several contributors are in their mid-80s. For all of us clear and accurate recollection of highly specialized Top Secret facts across fifty years has been a demanding task, requiring much cross-checking." There are lots of details about how real live wartime code-breaking worked fifty years ago -- details I have seen nowhere else. I recommend this book to any cypherpunk. Codebreakers: the inside story of Bletchley Park. ed. by Francis Harry Hinsley and Alan Stripp. Oxford, England: Oxford University Press, 1994 (hardback issued in 1993). ISBN 0-19-285304-X. US$13.95, at my local bookstore. -- John Gilmore gnu(a)toad.com -- gnu(a)cygnus.com -- gnu(a)eff.org A well-regulated intelligentsia, being necessary to the security of a free State, the right of the people to keep and bear books, shall not be infringed.

2 1

I'm back. :)
by Lile Elam 17 Dec '03

17 Dec '03

Hi folks, I finally got back on cypherpunks. Have been incredibly busy but wanted to keep intouch as several artist friends of mine want to start using art as a encryption vehical... Should be fun... Happy New Years. Let's hope it's a good one for cryptography. -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "a brush in hand, a wisp of wind, she sighs lile(a)art.net | knowing that this will be the great one..." http://www.art.net | -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Anonymous payment scheme
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:21 PM 1/2/95, Hal wrote: >I'm not sure what you do in this situation if they ask to see some ID >when you try to use the card. This would be rather embarrassing, it >seems to me. Sorry, I guess I left my drivers license in my other >pants... Or, never mind, try this card. That other one was from before I >changed my name... Why not, "It's a pseudonym."? Looks like an evangelistic opportunity to me. Pseudonyms can't be illegal, or Mark Twain and Bob Dylan would have written from prison. ;-). I also don't believe that you are legally required to produce ID for a credit card purchase. That was the point about those pictures on the front of Citibank cards. Citicorp did that to get around the legal restrictions on demanding ID to cope with the much larger issue of fraud. Most (smaller) vendors hardly check the signature on the back, much less validating it against a state ID, however. Hmmm. What if you produced a pseudonym card *with* your picture on the front? I smell a market opportunity. Or not... >And personally, I am more concerned about the >bank and gov't tracking my spending patterns than whether the guy I buy >gas from knowing my name. The bank has a lot more information about me >which is much more threatening to my privacy. A nom de guerre VISA or >debit card does not seem to help this problem. Indeed. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

exponential relationship of crytographer and cryptanalyst
by Peter F Cassidy 17 Dec '03

17 Dec '03

- I'm writing a piece on the politics of surveillance/privacy technologies for OMNI, essentially a survey of their advance since the 1967 proposal for the National Data Center. I cover cryptography, deriving the narrative from Clipper Chip initiative. The point I'm trying to make is that given the market forces pushing commerce onto the public networks and the increasing power of available encryption, the cold war national apparatus will have to mobilize quickly a la digital telephony to stomp it - yet the nature of computing puts them in a loosing position in the long run. Toward the latter part of this thesis, I've been told - and want check with youz - of the exponential relationship of crytographer and cryptanalyst. The heart of this relationship has been explained to me as follows: Increasing the key by one bit effectively doubles the number of keys and proportionally increases the power required to break it in a brute force attack. Is this true? Is there a truer way of stating it? Are there complicating factors this excludes that I should discuss? - Regards, - Peter Cassidy

1 0

Re: Anonymous payment scheme
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Samuel Kaplin wrote: >Let's suppose myself and 10,000 of my closest friends form the First >National Cypherpunk Bank and Trust. We go through all of the hassles in >order to be the issuer of a Master Card or Visa. Now instead of having a >credit line, it is set up as a debit card. The card's limit is how ever >much you have prepaid the bank in advance. Once you have hit your prepaid >amount the card no longer gets approved. Now because everything is prepaid, >there is no risk to me, so I'll put any name you want on the card. The >questions I have are: > >Is this legal in the U.S.? > >If so, is anyone doing it? This type of card is issued with just about every checking accunt in Oregon. I don't know about other states, except that here in California I know of only two that are doing it: Charles Schwaab and Glendale Federal. There may be more, but I have yet to hear about them. In Oregon you get such an ATM/Visa card instead of your regular ATM card. Good credit, bad credit, no credit. Now if I could just remember what its called... -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: Anonymous payment scheme
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 03:52 AM 1/2/95 -0600, Samuel Kaplin wrote: >... I was looking at at the bigger picture. Any merchant who accepts Visa or MC >could now accept anonymous payments. No hassle at all on their part. They >probably wouldn't even know that it was an anonymous account. It fits into >the existing infrastructure very nicely. If you can convince BankAmerica or MasterCard International to deal with you. > ... Walk into the issuing authority, plunk your $9999.99 on the counter and > ask for your card. When you've spent it all, toss the card. Right there you imply one of the requirements you'd need to fulfill--the reporting requirements on cash transactions over $10K. If you accepted many deposits over $5K, you probably get asked a lot of questions about how you're preventing people from structuring transactions to avoid the reporting requirement. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

key servers list
by dave.hodgins＠canrem.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Does anyone have an up-to-date list of pgp keyservers available? Is there a fingerable keyserver, like wasabi(a)io.com used to be? Thanks in advance, Dave Hodgins. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLwh0YJbACHtihSGlAQGxAwQAmCTfolPaXfyRIKWl+u8fzSrlLxv25GjB k/+50n11ErwRbJHRPsSAS8okZ9xq8CiVuCUiiOdFe3R7K3idCLVSVQeYWpBcy7ZO F1vUqcUrsqiar3IxUDAW0UAK5eIf/B5CIsN9TgYMxj7gd0r1UkSXjfgXq+PR9Iqf tMyBOICzwpU= =4FTc -----END PGP SIGNATURE----- **EZ-PGP v1.07 --- * RM 1.3 00820 * Internet:Dave.Hodgins@Canrem.com Rime->118 Fido(1:229/15)

1 0

Comments on Key Capture Survey
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

I am the author of the Last Resort keystroke capture program for the Macintosh, published by Working Software, Inc.. I am writing up the surveys for LR for Mac, DOS and Windows and will send them shortly. I have a couple of comments, which the list might be interested in hearing. Your entries for the Macintosh should record the file type and creator code, which are, for Last Resort, 'cdev' and 'mIKE' respectively (case is significant). If someone were to write an automated scanner meant to protect a disk against such utilities, it would be much more reliable if it looked for the creator codes, as Mac programs are usually written to not depend on having a particular file name. These codes live in the file system, but are not part of the name space as '.EXE' would be on DOS. You can view them with ResEdit's "Get File/Folder Info" item from the File menu. We spent a lot of time pondering the problem of password theft. We decided that the benefit to the consumer of having this utility available to save data outweighed the obvious danger of password and text theft. The problem increases, though, if one is not aware that Last Resort is installed. The Read Me file on the distribution disks has a discussion of this problem (as well as the problem of people snarfing your files when you share your disk to the whole company or campus), and there is a way to disable key capture temporarily, for password entry. I'm not real happy with the ease one can sneak Last Resort onto someone's machine, but I take a little ironic solace in knowing that similar programs that are "more hidden" than LR are available in source code form from Phrack, at least for DOS. On the plus side, I have gotten many, many letters, e-mails and phone calls from people who say it saved their butts when a piece of critical information would have been lost. I had the habit of taking customer orders over the phone while in the middle of debugging a program (like Last Resort!) and would frequently crash before the order could be saved or printed. LR saved my company real money in this case. David Pogue's book _Hard Drive_ is based in part on Last Resort, in that a key capture utility is used to recover a password that saves the world. I was quite tickled by this. I'm sad to say, though, that I know of one case in which Last Resort precipitated the end of a relationship, in which a fellow discovered the love letters his girlfriend had e-mailed to someone else in his Last Resort files. This particular fellow was glad that he found out about it, but I still feel a twinge of guilt when I think about it. I certainly support any effort made to document the existence of these programs. I might suggest that one way to defend against them would be to watch for the patching of certain system calls - patching GetNextEvent or installing a jGNEFilter on the Mac, and warning the user if this happens. It's easy to detect such patching; for the most part it will be innocent, but a hacker who had a fair amount of Mac programming knowledge could make a keystroke capture program in an evening of work, so attempting to catalog them all will provide only moderate protection against them. BTW... most of those other commercial keystroke capture programs (no names here) are clones of Last Resort. Some of them even had the gall to use our logo in their advertising (in a claim they were better than us). LR might not do as much as some of them, but I know that it is more reliable than the competitors I have tested. So if you are going to actually _use_ a key capture program for your own (legitimate!) use, consider getting The Real Thing, the One True Key Capture Program, the Saviour of Data: Last Resort. I don't work for WSI any more, but we remain friends, and they can be reached at: Working Software, Inc. PO Box 1844 Santa Cruz, CA 95061-1844 (408) 423-5696 (800) 229-9675 (408) 423-5699 FAX working(a)scruznet.com 76004.2072(a)compuserve.com Cheers, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Re: Exporting cryptographic materials, theory vs. practice
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

What do I have to do if I want to bring cryptographic equipment _into_ the USA temporary (for use or demo) and want to take it back home after some days or weeks. Since I am in America then I am under american law. The _export_ of my own crypto stuff is not temporary. Does the american law allow me (a foreigner!) to take out any cryptographic material, even if it is my own thing? Hadmut

1 0

Press attack on anonymity.
by James A. Donald 17 Dec '03

17 Dec '03

Yesterday an "opinion" article appeared in the SF Chronicle, written by some unimportant person who knew absolutely nothing about the internet. Today a similar, but better informed article, appeared in many newspapers, originating from the New York Times. Articles written for newspapers are written to survive arbitrary truncation, hence key points first, lesser points later. The interesting thing is that the two articles, despite different authors, had equivalent key points, implying that some single higher authority gave out a list of points to be made, but left the headline and overall spin to the columnist. Indeed, when one reads beyond the key points that were equivalent in both articles, it is as if one suddenly encounters a different journalist. There is an abrupt change of tone and style when one reads from the uniform part to lesser points. The key points in both articles are that the government should do something coercive to stop anonymity on the internet, and that there is widespread support for such a move. Note that since both articles are obviously tentacles, there is a mysterious and anonymous powerful person -- the single higher authority of which I spoke earlier -- who is anonymously attacking anonymity. In my opinion when a mysterious anonymous and powerful voice proclaims that the government should coerce someone, it is usually the government speaking -- a government department with guns is running up a trial balloon. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we James A. Donald are. True law derives from this right, not from the arbitrary power of the omnipotent state. jamesd(a)netcom.com

2 1