- cypherpunks-legacy - lists.cpunks.org

Re: Fighting the cybercensor
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

jim bell wrote: > > At 01:03 AM 1/28/97 -0600, Igor Chudov @ home wrote: > >jim bell wrote: > >> > >> At 10:21 PM 1/26/97 -0800, blanc wrote: > >> >From: jim bell (in response to Dimitri Vulis') > >> >Look, I've proposed what I consider to be a remarkably consistent method to > >> >prevent the kind of political tyranny that you criticize, and I don't see > >> >any recognition of this fact. > >> >........................................................ > >> > > >> >1) Jim, why do you insist on discussing this on an forum for encryption? > >> > >> Because it's on-topic, that's why. Because it's not merely a list > >> concerning METHODS of encryption, it's also about the _reasons_ for using > >> encryption, as well as the _effects_ (both small-scale and large-scale) of > >> using encryption. > > > >Actually AP is one of the more interesting topics here. I think that there > >is a clear need for an AP bot. > > > >Do you feel like writing it? > > Desire? Yes. Ability? Maybe. Time? No. > You can hire someone to write it. - Igor.

1 0

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Sean Roach 17 Dec '03

17 Dec '03

At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: >On Tue, 28 Jan 1997, Mark Rosen wrote: > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically >> about "unrestricted FTP sites." My program, Kremlin, is available for > >You should check the exact text yourself, but the way I read the EAR, you >are not "exporting" strong cryptographic software without a license (exept >to Canada, which needs no license) if you do things "such as" >(1) have the guests to your site acknowledge that the EAR restricts >export, (2) have the guests affirm that they can legally get the software >(proper citizenship or residency & location), and (3) "check the address >of the destination computer to see if it is in the USA" or Canada. The >last one, I interpret rather loosely to mean that if the guest's email >address domain isn't one commonly used in the USA or Canada, then I deny >access. We all know that not all .com addresses are North American, but >chances are really good that if the address ends in .ru, then the >destination machine is probably not in North America. This is not a >perfect way to prevent export, of course, but it is what the regulations >say, as I read them. For a pointer to the regulations and to my access >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm ... An easy crack to that would be to request access from a hotmail, or similair, account. This account would show up as being on US soil while the account holder would not necessarily be so. In this way, someone with an account ending in your .ru would get through because h[is/er] e-mail request originated from inside the U.S.

1 0

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Sean Roach 17 Dec '03

17 Dec '03

At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: >On Tue, 28 Jan 1997, Mark Rosen wrote: > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically >> about "unrestricted FTP sites." My program, Kremlin, is available for > >You should check the exact text yourself, but the way I read the EAR, you >are not "exporting" strong cryptographic software without a license (exept >to Canada, which needs no license) if you do things "such as" >(1) have the guests to your site acknowledge that the EAR restricts >export, (2) have the guests affirm that they can legally get the software >(proper citizenship or residency & location), and (3) "check the address >of the destination computer to see if it is in the USA" or Canada. The >last one, I interpret rather loosely to mean that if the guest's email >address domain isn't one commonly used in the USA or Canada, then I deny >access. We all know that not all .com addresses are North American, but >chances are really good that if the address ends in .ru, then the >destination machine is probably not in North America. This is not a >perfect way to prevent export, of course, but it is what the regulations >say, as I read them. For a pointer to the regulations and to my access >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm ... An easy crack to that would be to request access from a hotmail, or similair, account. This account would show up as being on US soil while the account holder would not necessarily be so. In this way, someone with an account ending in your .ru would get through because h[is/er] e-mail request originated from inside the U.S.

1 0

Log File a security hole?
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

Is there a way to disable the \WINDOWS\PGPW_32.LOG? In subtle ways it's a security hole if left to accumulate over time, since it keeps records of which keys you encrypted messages to. (Imagine somebody using an anonymous remailer but g-d forbid is unaware of this log file, and somebody discovers that messages were encrypted to such a beast...) I understand in certain group/corporate environs one would want logging; in others, one doesn't need it or should have the option (in an easily found place) to wipe it every once in a while. ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Re: Cats Out of Bags
by Jamie Lawrence 17 Dec '03

17 Dec '03

At 6:39 PM -0800 on 1/30/97, Vladimir Z. Nuri wrote: > those laws are effective or not. cpunks seem to think that a govt > can only have *effective* laws. but there is obviously no such > constraint. No such constraint in the _making_ of laws, of course. We have laws on the books forbidding the utterance of "Oh boy", the carrying of an ice cream cone in one's pocket, and the act of driving without insurance, all functioning to varying degrees of effectiveness, 'on the books' in various states. The question Sandy seems to me to be raising is not whether a group of people can issue a decree, but rather whether the interaction of the law books, the interested parties on either side of the debate, and the mostly disinterested real world will intersect such that the laws passed can be used to effectively hamper the activities of the parties who wish to go about the business proscribed. This is not an either/or question, as you so aptly note (I hope Kirkegaard doesn't mind). Of course, methods of this nature specifically regarding the uses of privacy is what this list is all about. Not an argument; just a clarification. -j -- "This analogy is like lifting yourself by your own bootstraps." -Douglas R. Hofstadter _______________________________________________________________ Jamie Lawrence foodie(a)netcom.com

1 0

PGPMail 4.5 Released!
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- PGPMail 4.5 is now available for ordering from PGP Inc. If you have Digicash or a credit card, you can order from the home page. (I would not recommend the credit card option though. The form claims that it is encrypted with SSL, but the info will be sent in the clear. Someone needs to have a talk with their web master... This is not the first security problem with their pages.) In using the betas, I have been pretty impressed. It works with Eudora seamlessly. (Enough that I did not notice that it had installed itself automatically instead of having to do a seperate install as the documentation claimed.) The program beats out any of the plug-ins and front-ends for integrating PGP and e-mail that I have seen yet. And for $29.95 for PGP 2.6.2 users, well worth the price... Disclaimer: I have no financial stake in PGP Inc, not do I have controling interest in the financial affairs of Mr. Zimmerman, liens on the souls of the damned, control of the Aluminum Bavariati, eyes as big as my stomach, or the rites to reproduce the descriptions of major league baseball games without permission of the commisioner of Gotham City. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAwUBMvGgneQCP3v30CeZAQH6Twf9HiZQKt7j0SaB+bNRfrZv/zM3/K7F019Y BfLE/OipkeWQQQNDm4KNbz36y58lBhZdXPTuJuyPoICrR3ixNbTz1+DVi3We3ARz 9OspLf74X9hGCw+oJxLTpG2zznBARH6rQ2Bsjh7orvrnvYLlmhjhnEkrShb2BhW6 WuDSdmBfz7yk9iUFVzK6TAcxDv/gLH/hjS6PoTFtwoPKDp9aca4jPzr9scLUhETo 66qPdtLF8TYwzc5+G5/m6w7PJTCf/uyba7OyJ0EYqBDKR4AzqTaL4ZPMUQ8gw1DN F0O/RhbaJMfRDtTQMNaMjR8tZXtO8fFrnQg9SC0jeoZ0/rhOy+0BnA== =0TfD -----END PGP SIGNATURE----- --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

PGP Mail
by Toto 17 Dec '03

17 Dec '03

Does anyone know if PGP Mail works well with Netscape? I remember hearing about some problems, but don't recall seeing anything indicating they were fixed. Toto

1 0

misc. security url
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

forwarded message... In> Subject: Computer Crime and Investigations Center In> I have put together a Computer Crime and Investigations Center In> URL: http://www.ovnet.com/~dckinder/crime.htm In> This page points you to sources of information pertaining to various In> issues relevant to Computer Crime and Security. In> Topics covered include: In> What Problems Can Arise In> An Ounce of Prevention... In> How it is done In> Detecting whether you have a problem In> Search and Seizure of Computer Equipment In> Is Big Brother Watching You? In> The Enigma of Encryption In> Viruses In> NT Security In> What issues are specific to the World Wide Web? In> Law Reviews In> General Sites In> Duncan Kinder In> dckinder(a)ovnet.com

1 0

Supporting JackBoots
by Toto 17 Dec '03

17 Dec '03

Webmaster, I would like to know if all of the material on your website is as suspect as that which concerns John Gilmore. The current jackboot censorship of what he has now declared to be his own private cypherpunks list has marked him as a laughable hypocrite. Is the EFF a joke, as well? Toto

2 1

Re: RC5-12/32/5 contest solved
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Jim Bell rote: >Assuming it's possible to build a chip which tests solutions in a >massively-pipelined mode, the 400,000 or so solutions per second tried (for >what is probably a $2000 machine) would probably increase to 100 million per >second per chip (at a cost of maybe $100 per chip, if implemented in >parallel). That's 5000 times more economical, which would translate to a >find in 2-3 days if the same dollars in hardware were invested. Hi Jim, still on your list 8*) Funny thing is that 3 1/2 hours for a 40 bit search is the "real world" number I was using two years ago (can look it up in various archives) so is interesting that the first real test came out exactly the same. Is why I said 40 bits should not protect anything worth more than U$250.00 Have good reason to believe your estimate for a purpose built machine this year (expect 600,000,000 to 1,000,000,000 kps per sieve - these will not be cheap chips but will be commecially available). Expect 400 arrays would be required to do DES in a day (average) but is a lot more achievable than the 65k postulated by the gang of nine. Still would not be too concerned about using DES so long as every message encrypted (including orders for a tuna on rye) and each uses a different key - is "security by obscurity" in a way but am comfortable with it. Besides, if really concerned will just superencrypt. Warmly, Padgett "I love it when a plan comes together."

2 1