- cypherpunks-legacy - lists.cpunks.org

Re: TEMPEST
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 12:32 PM 1/18/95, Timothy C. May wrote: > ... And if nothing is seen with our $10K of equipment, what does this >prove against an attacker who can easily afford to spend 20 or 30 >times that amount to equip a van? > >Cypherpunks have been exploiting technology that is comparatively >_much cheaper_ and which changes the equation. > > ... In general, for reasons many of us have written about here before, and in >particular, because I think spending $10,000 to prove what we already >know--that RF emissions can be detected and demodulated--is a poor use >of money. That $10K would go a long way to getting PGP Phone finished. ... I'm not sure how encryption chages the equation if that van on the street can read the data off your screen and/or printer. Just as cryptanalysis is a necessary component of good cryptography, some sort of VanEck analysis would seem to be required in order to evaluate the utility of methods to block it. What exactly would one need to do to block Van Eck monitoring? I've seen computer rooms that were completely lined with copper sheathing. Is it really necessary to go to that extent? Will aluminum foil and power line conditioning handle it? You can't really tell how effective counter-measures are unless you have some way to see what reduction in emitted signal they provide. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Re: JP vs Homer
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> We are capable of controlling mail bombs, for instance, in the >following way: > > Take an incoming message, capture From: line. Strip header. MD5 body. >Add to sorted table [From: MD5(message) date]. Check for repetition of >first two fields. If reps = 1, forward message. If reps = 2, send message >to From: "Possible error. Two copies of message <message> received." If >reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or >spam. <reps> copies of <message> received from <From:> at your site in the >past week." Clear table of entries more than a week old every midnight. > > > If all remailers did this, then no matter where the net was entered, >the messages would be rejected. And spammers/bombers would be spamming/ >bombing their own postmaster. Probably a bad idea. If not all did it, >then add special handling to hit remailer-operator@. This would encourage >the operator to auto-magically handle the spam-bomb himself. This works only if one assumes that the exact same message is posted using the exact same path. Granted, it would probably be effective for novice spammers. Consider a premail/chain type script and a cleartext spam message. The script is executed once every five minutes, say. When it runs, it creates a new random path through the remailers, adding encryption wrappers for each hop. Your spam detector would miss this one completely unless your remailer was used as the terminal remailer for a significant number of spams. More significantly, the MD5 hashes of each message would be different even if the same path were used more than once because the PGP session key would be different (again, unless your remailer would be the terminal remailer in the particular path that repeated).

1 0

"Disclosing" private email
by Arthur Chandler 17 Dec '03

17 Dec '03

Greetings! I'd like to solicit your/our best thoughts on the following message. San Francisco State University is considering a policy of "disclosing" private email to outside agencies. I'm aware that such a policy is yet another argument for using crypto; and the last cypherpunks meeting gave some encouraging instances of "transparent" encryption schemes that are not a hassle or a fear-barrier for newbies. But if you could post or private email me your thoughts about the legal/ethical aspects of "disclosure," I'd be much obliged. I've put a few of my own concerns at the end of the enclosed quote. ---------- Forwarded message ---------- >From: "Deirdre C. Donovan" <deirdre(a)mercury.sfsu.edu> > >I am rewriting the information handouts which we here in San Francisco >give out to our students when they apply for Internet access accounts. >The issue with which I am struggling is one of privacy. I have heard of >universities (anecdotally only) where the administration reserves the >right to read E-mail. Here, we are leaning more toward something like the >paragraph below, which is taken verbatim from an Indiana University draft >document. > > IU computing centers will maintain the confidentiality of all > information stored on their computing resources. Requests for > disclosure of confidential information will be reviewed by the > administrator of the computer system involved. Such requests > will be honored only when approved by University officials > authorized by the [President] of the campus involved, or when > required by state or federal law. Except when inappropriate, > computer users will receive prior notice of such disclosures. > I'm uneasy about the chain of "prior notice": 1) Does this policy give university administrators the power to read private email before the decision is made to "disclose" it to outside persons or agencies? 2) Does this "prior notice" mean "We're going to do it" or "We plan to do it, and if you disagree, let's discuss it before we release it"? 3) What constitutes "inappropriate"?

1 0

Command confirmation request (057CCA)
by L-Soft list server at CCI (1.8b) 17 Dec '03

17 Dec '03

Your command: SIGNOFF NEWSLETTER has been received. For security reasons, you are now required to reply to this message, as explained below, to confirm the execution of your command. If you have problems with this procedure, you can contact the list owner directly (NEWSLETTER-request(a)MAIL.COMPCURR.COM) and ask to be manually removed from the list. To confirm the execution of your command, simply reply to the present message and type "ok" (without the quotes) as the text of your message. Just the word "ok" - do not retype the command. This procedure will work with any mail program that fully conforms to the Internet standards for electronic mail. If you receive an error message, try sending a new message to LISTSERV(a)MAIL.COMPCURR.COM (without using the "reply" function - this is very important) and type "ok 057CCA" as the text of your message. Finally, your command will be cancelled automatically if you do not confirm it within 48h. After that time, you must start over and resend the command to get a new confirmation code. If you change your mind and decide that you do NOT want to confirm the command, simply discard the present message and let the command expire on its own.

1 0

Water supplies
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

It should be easy to poison a water supply and kill many people. Yet, this never happens. Why would this be? Surely, there are malicious folks who want to do it.

1 0

Re: web pages sucking secrets from your hard drive
by Michael Sattler 17 Dec '03

17 Dec '03

At 17:13 2/9/95, jltocher(a)CCGATE.HAC.COM wrote: >While you're connected to your favorite Web page, it's also connected >to you, and could be copying all sorts of information off your hard >drive, say industry experts. Wrong. >In fact, it happened last year when >Central Point Software used registration software developed by >Pipeline Communications Can you tell the difference between a web session and an installer? -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | You couldn't get a clue during the clue mating season in | a field full of horny clues if you smeared your body with clue musk | and did the clue mating dance. - Edward Flaherty |

1 0

GSM and cellular crypto
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Richard Parrett (?) wrote: > GSM uses less than strong encryption, by the way. I forget the > technical details, but it is of the level that governments can > fairly readily crack, but beyond the reach of most private > organisations. (So no more 'Squidgy-gate'). It would, however, > be quite feasible to add additional second stage encryption > to phones (since the dataflow is digital point-point). I wonder > if Nokia, a Finnish company well outside the scope of COCOM, > might offer a feature like this. All operaters of cellular networks in India are to use GSM, and Nokia has been running an enormous ad campaign, it is very likely to be the market leader in instruments. I don't know about any encryption provided, though. ----------------------------------------------------------------------------- For Electric Dreams subscriptions and back issues, send a mail to rishab(a)arbornet.org with 'get help' as the message Subject. Rishab Aiyer Ghosh rishab(a)dxm.ernet.in rishab(a)arbornet.org Vox +91 11 6853410 Voxmail 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: 2047 bit keys in PGP
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 19:52 1/3/96 -0500, Rick Busdiecker wrote: >Another point to realize is that PGP uses a combination of ciphers. >When encrypting, the RSA key is only used to encrypt an IDEA key. >That IDEA key is used to encrypt your message. Somewhere between 2048 >and 4096, you're making the RSA key stronger (harder to brute force) >than the IDEA key. At that point, the extra time that you're using >for super-big RSA keys is totally wasted. To nitpick: Getting the RSA key will give you ALL the IDEA keys. That is probably worth 200-10000 times the effort. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Sarcasm for Jody. [WAS: Top Ten Corporate Security Needs?]
by attila＠primenet.com 17 Dec '03

17 Dec '03

In <199611151336.IAA00800(a)clipper.hq.tis.com>, on 11/15/96 at 08:35 AM, Jody C Patilla <jcp(a)tis.com> said: :> "The Top Ten Corporate Security Needs of MIS" :> :Since Mark Riggins wants free assistance in doing his marketing research, :I can certainly oblige, but I would have to say that my clients tell me :there are only three things they want: :1. Total security. :2. Totally transparent access from everywhere. :3. And all of it for free. :and there you have it, sports fans! :- jcp ...truer words were never spoken; and, when there is a problem, the man will call up and say "It dont work!..." to which you ask: "OK, _what_ does not work?..." and this sequence is repeated again and again -ad nauseum-- "..._IT_ dont work! I keep telling you!" The call escalates all the way to your head freak, who has never suffered fools well... (and should never be permitteed to talk to a real customer, much less a prospective customer)... The probably simple problem (Maybe ...it was unplugged?) is resolved by the guru asking the client: "...why in the fuck would you do something as 'stupid and ignorant' as _that_?!?). Of course, the resolution is a lost customer.... "Minor problem,.." says the guru: "he's a jerk, we dont need him...." And, redder than a russian beet, cradling the talking instrument with plastic shattering impact, our beloved peter-principle corporate honcho screams at his staff: "...I told you stupid nerds you should have gone with Bill Gates --someone smart!" -attila -- Cyberspace and Information are Freedom! FUCK your WIPO, too. -attila

1 0

Re: Guerilla Internet Service Providers (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 08:09 PM 1/2/96 -0600, you wrote: >> For the "last mile" to the ISP user, wireless could be a better bet. >> Have antenna, will surf. > >I can easily visualize mobile and portable systems linking to an ISP, >downloading email via encrypted POP/UUCP/whatever, using itinerant 2m or >450 MHz frequencies. A mobile system connects to any ISP, gets a login: >prompt, enters "xyz(a)host.domain", gets thrown into a POP session on >host.domain, uploads/downloads, then disconnects. All it would really >require is implementing "exec rlogin -l xyz host.domain" into getty (a >very simple patch) and suitable crypto protocols... >- -- >Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com As a ham, too (N7IJS) I recognize your implicit selection of 2m or 450 MHz. But I gently object to this, for reasons that I think will be obvious. First, technology has been marching on in the last 10-20 years, and communications frequencies of 2 GHz and more are technically do-able and comparatively empty. (and with modern IC technology, even easy) Secondly, ham gear tends to be used for long-range communication (miles and watts) and generally has little or no ability to frequency hop/time hop or to automatically turn down transmitter power to be able to share frequencies over short distances (low milliwatts or even microwatts). Those high gigahertz frequencies would be ideal for communication over a few blocks distance. (Sure, packet has been done for years but it is a still-born development; they still think 9600 bps is a "fast" modem speed.) I forsee locally-owned boxes that are the equivalent of a wireless phone switch implementing re-used freuqency microcells; the cost SHOULD be far lower than the current copperline phone systems, once the telephones are paid for. And they shouldn't cost much more than current 900 MHz cordless telephones, too.

2 1