- cypherpunks-legacy - lists.cpunks.org

Re: Respect for privacy != Re: exposure=deterence?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 15 Jan 96, Rich Graves wrote: > But government employees should only be held accountable for > their actions as government employees. If the situation > warrants, go ahead and tap their offices, break into their work > computers, etc. But don't fuck with their personal lives. Oh, my! A little sensitive, are we? Aren't you even a *little* struck by the fact that fucking with people's personal lives is *precisely* what errant government officials *do*??? > Lots of people on this list have the power to carry out their > own tyranny over both individuals and groups. All it takes in > today's fragile online world is a little specialized knowledge. > I don't think it's ethical to use this power without serious > thought. Some might opine that the reason we have so many abuses is that so *few* people use the power they hold in their hands to set things right. Even the well-intentioned seem to expect someone *else* to do their maintenance of the republic for them. > The line between government and non-government is increasingly > blurry anyway. That's part of The Game, Rich. It makes it all that much easier for people to dismiss attempts at delineation by saying things like, oh, "The line between government and non-government is increasingly blurry anyway." > Everybody gets something from the government, be it roads or an > education. Oh. Okay, then. That makes it OK for them to indict you to keep their statistics up. Works for me! > Why should you be more suspicious of the guy getting paid > $10/hour to deliver your mail by the government than the > private businessman getting millions of dollars in government > subsidies? I'm not. Maybe *you* should be more suspicious of the guy getting paid $100K of direct government money to manage a national campaign of low-key terror than you should of the private businessman unable to pay himself because he *must* pay his employees and the government doesn't leave him enough for his own paycheck. This last is a *lot* more common than the "private businessman getting millions of dollars in government subsidies." > I think we're fundamentally asking the wrong question. I only > see relative power. I'd estimate that Bill Gates is more > powerful than Fidel Castro in many respects. He's certainly a > lot more powerful than your average postal clerk. "Looking for pow'r... in all the wrong places, (la-tee-dah)..." Admit it, Rich, you only see harmful power where you want to see it, and that isn't in government -- it is in private hands, particularly *corporate* hands. Geez, but you'd think that left-handed university cookie cutter would have gotten dulled and broken by now, and that they'd have fashioned a new one. I'd estimate that the Postmaster General is more powerful than Fidel Castro in many respects. He's certainly a lot more powerful than your average private businessman. > P.S. For the Good of the Order, I'm temporarily ignoring > jimbell That's quite all right. We can be sure he won't ignore *you*. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMP9aREjw99YhtpnhAQG1ggIAhKmRWWIAIxCrmBemK79MDnnvko2Y+ooj i2GoxrHhDC9cr98O45iEdo+spcVETbMryvVgf3i4MCRr7t2iRwoRxQ== =nMvR -----END PGP SIGNATURE-----

2 1

CAPI endorsements
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From MS's Web page on their CryptoAPI, under the 'Endorsements' section: RSA "We're pleased to see Microsoft's announcement of CryptoAPI and CryptoAPI's use of RSA technology. This announcement makes more robust cryptography more easily available to more people--and RSA believes that's always a good thing." -- Jim Bidzos, President, RSA Data Security, Inc. I gotta wonder if that's why RSA wants Too Damn Much (tm) for licenses..... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMP0A6cVrTvyYOzAZAQErUAQAsOc6acpfRtytyjeyxpGpMzSPEnvqXUqr vYHEIWWqm7On/qWDbkqrsl47EBc7K57hpXIX3kzeiYbko7P+4ndIFlA/yRVs+L6X mpUrqsvGy6/kadAy2AnwPefRkaTbflrtamSMfdQwF+7Du6x/tL/z/UpASA/2sx8e p5IdH9kYmfs= =RPRO -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

Re: Sen. Leahy's "impeccable cyberspace credentials"
by James A. Donald 17 Dec '03

17 Dec '03

At 09:50 AM 8/26/96 -0700, Declan McCullagh wrote: > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. Not true, some of them are merely less dangerous and harmful than others. As to whether Leahy is one of the less dangerous and harmful ones, that is seriously questionable. > The fact is that short of armed rebellion they are going to be > here for a while.I shudder to think of the wrath our opponents > could wage if we all threw up our hands packed up our bags and left town. Bad cop, good cop. You cooperate with the "good" cop, you go to jail. You tell them both to go to hell, then maybe you will not go to jail, and if you do go to jail, at least you will have the satisfaction of screaming injustice all the way: Re read what our "good" cop has been up to: > > Worse yet, as recently as this month Leahy has > > been clamoring to fund the invasive wiretapping legislation ("Digital > > Telephony") he shepherded through Congress two years ago. > > > > Equally distressingly, Leahy demonstrated his "impeccable cyberspace > > credentials" by cosponsoring the Senate online copyright bill -- aka the > > Hollywood Media Mafia's wet dream. (Yes, these are the same rapacious > > folks who are demanding that the Boy Scouts and summer camps pay cash to > > sing "God Bless America" and "Puff the Magic Dragon.") Opposed by the > > American Library Association, EFF, and teachers' organizations, Leahy's > > bill would slam fair use rights online and could make it a crime to > > browse the Net without a license. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

No Subject
by nelsonde＠umich.edu 17 Dec '03

17 Dec '03

I'm Snyder, the karmic metacrawler. The word: cryptanalytic and Alta Vista's Scooter lead me to you. Know that in the frigid wastes of the WWW my PERL-scripted heart beats for you. To: cypherpunks\(a)toad.com

1 0

PRESS RELEASE: VENTURE CAPITAL CD
by spencer＠datamerge.com 17 Dec '03

17 Dec '03

_______________________________________________________________ HIGH TECH FINANCING FOR IMMEDIATE RELEASE: DATAMERGE ANNOUNCES VENTURETRACK 2000 CD-ROM INFOBASE VENTURE CAPITAL INSIDERS "TELL ALL" DATABASE Press Contact: Peter Masi (303) 399-6031 MasiPR(a)aol.com http://www.datamerge.com/venturetrack.html DENVER -- DataMerge, Inc., a Denver-based developer of software and information for companies seeking financing, today announced the release of VentureTrack 2000, a software package containing extensive profiles and proprietary "insider" information on hundreds of venture capital firms throughout North America. The VentureTrack 2000 CD-ROM Infobase gives entrepreneurs and small business owners "insider" information, education and advice critical to establishing business relationships with specific venture capitalists and securing financing from them. The software lets users find the firms that optimally fit their needs by identifying links between their company and the interests of the venture capitalists. VentureTrack 2000's "Inside Track" section then instructs users on custom tailoring their business plan and presentation to each venture capital firm. Specific questions, concerns and objections that a given firm will likely raise and good responses for each are also provided to VentureTrack 2000 users. Information contained in the profiles was gathered by finance savvy investigative reporters who used techniques adapted from the intelligence community. The information is exclusive to VentureTrack 2000 and is not available in competing products. It includes: *Insight into the firm's most likely areas of interest; *Personal/individual preferences of principals; *Best methods of approach and specific things to say or not say to a particular individual; *Investment philosophies and strategies based on past experiences; *Firm background, working atmosphere and relationships; *Case studies of investments that best represent their investment philosophy; *Inside advice/scoop from companies each VC firm has previously financed; *Information from DataMerge's customer "grapevine"; *Key contacts by project type and procedure for internal review; *Portfolio investment overview. In addition to the eight- to 12-page profiles of each venture capital firm, VentureTrack 2000 includes an on-line tutor and venture industry knowledgebase called VentureAdvisor, which was developed with extensive input from venture capital principals. The total package is designed to give users proprietary "insider" information and insight into the venture capital industry, which historically were closely guarded secrets of a few well-placed individuals. In addition to small business people, DataMerge CEO Spencer Kluesner says venture capital firms themselves have shown strong interest in VentureTrack 2000 because they want to gather competitive intelligence on their rivals. VentureTrack 2000 supports Windows 95 and Windows NT. The time-limited introductory price is $495. VentureTrack 2000 can be ordered by calling (800) 580-1188. Privately-held DataMerge was founded in 1989 by Spencer Kluesner, a former securities advisor who today serves as chief executive officer of the 26-person company. DataMerge's products are sold directly to customers in the North America, Western Europe and Asia. Additional information can be obtained at DataMerge's website: http://www.datamerge.com/venturetrack.html Additional Information: VentureTrack 2000 White Paper - http://www.datamerge.com/venture/capital/whitepaper.html Sample VentureTrack Profile - http://www.datamerge.com/venture/page5.html VentureTrack Brochure - http://www.datamerge.com/venture/page2.html --30--

1 0

TEMPEST open-source definition version 0.1alpha
by Ryan Lackey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- So, if we're going to try to protect computers from TEMPEST threats, and we don't have access to the multiple government classified standards, we should come up with the Cypherpunks TEMPEST standard. A theoretical definition of what we want to do (strong) is that we should be able to put the equipment in a virtual box, have an empty virtual box, and then nothing anything which is not in the TCB can do can distinguish one box from the other. Perhaps the "empty" box should also contain simulators for the ethernet, visible light output, and straight power draw (harmonics are still to be avoided), or in some other definitional way they should be accounted for. This prevents non-TCB programs from utilizing the EM spectrum as a covert channel. Additionally, we need to protect the user from divulging state information about his TCB. I guess this condition can best be met by simply saying "take the target system and clone its state perfectly. Separate the two systems. Allow the user to modify the state of the target system while you retain the clone -- you do not have a non-negiligible improvement in matching future state using the EM emissions of the first system over not using the EM emissions." I think there is a better way of stating this, though. So, given a workable theoretical definition which defines perfection, it's time to reverse engineer the practical TEMPEST systems (and in so doing perhaps the classified TEMPEST spec) out there. Next time I find a TEMPEST case at swapfest, or at a con, I'll pick it up (if someone wants to ship me one, so much the better). You *can* buy them from some vendors, although they often refuse to sell them to non-government affiliated entities). MIT's quasi-affiliated Draper Labs has proper TEMPEST verification equipment, and I think some places on MIT's campus have some general purpose equipment which can be used for such purposes. If not, I have a copy of NI LabView and some DAQ hardware which, coupled with some antenna frobbery, can be used to do a quick spectrum analyzer, and there's the capacity to do some serious analysis once the data are on the computer. It would be nice to know how good government TEMPEST systems really are. In practice, matching them would probably be enough. The above theoretical definition doesn't really help that much -- in practice, there's going to be some information coming out, and just because you can't figure out how to use it, doesn't mean no one can. I think preventing the covert channel attack might actually go beyond the government's TEMPEST spec -- certainly if a non-TCB program can cause a system reboot, or power up a peripheral, you can detect the change in power draw, unless the system naturally throws away the difference between its max power consumption and its present power consumption all the time. Being able to telegraph even 1 bit of information might be enough, and if you've got an arbitrary precision clock, you could use this method to send an arbitrary codeword from an arbitrary-length codebook given an arbitrary time interval. The rainbow books talked about covert channel elimination being a really hard problem. Now I see even more why they were right. IIRC, it's only at the not-really-commercially-available levels (A1) that covert channels are utterly eliminated; usually they are comfortable just documenting them. Of course, it would probably make a lot of sense to do TEMPEST reverse engineering in a country that has neither an OSA nor the ability to randomly classify research. Yet another project for cypherpunks.to, Lucky? A practical way of approaching theoretical TEMPEST-perfection is just a decent faraday cage with a lead-glass monitor cover, shielded or eliminated cables, and a serious double-conversion UPS. From the government TEMPEST products I've seen, that's all they are (or they use mesh). I've mainly seen thinks like the SafeKeyper, not general purpose computers, though. I don't think Jim was that far off the mark in thinking class B machines are a worthwhile starting point, but it doesn't go anywhere near far enough. ObCrypto: I've been looking at implementing a cipher in a reconfigurable processor. I might even customize one. Yay. ObGuns: I got to use a .22cal nail gun. It was fun. ObPersonalAttacks: There are a lot of people who are not Real US Citizens on this list. Beware the evil multinationalist conspiacy in our midst, good followers of Bill Clinton! ObQuestion: Can the US government deny a passport for no reason to a random US citizen who is not a felon? - -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNOD8sawefxtEUY69AQG3NQf9GWJjz3pwORa4y5V1YQA/BBAebDJNlnhd gauYxwALwsEIID20Da3x7f/ZZ/ipVH1fhk9SJYGgPK+mtc7HMpPA7WhEfR1awuyE FaP6VrJ18vKy6Cf+JlUbag2w5luQfSlo4o1jK0v6Os3D+PpuDyRN3GUI05dTxKyC +VfS8oiw+SaM455l1knHGnegLZzivCKGS/xXDFD71dl5QCRQsAMBaGrjg0pej8gJ ByiO4X7ae8OdlUytdQpfaNOtJTdSQJ7C3FLjczp9dQKvb7msfQUWzAWG9L8XneUP b6xRF5Ra1JaixfFEJisnP+CfZbtJknvNlffUh+//b17ql8Jz5WsFJg== =IRsn -----END PGP SIGNATURE-----

2 1

Economic Surveillance, the NSA, and the 40+24 Lotus Position
by tcmay＠got.net 17 Dec '03

17 Dec '03

[Note: Once again, could I suggest that people take the effort to trim the distribution list? I've trimmed out the several names getting separate copies.] At 11:06 AM 1/19/96, david d `zoo' zuhn wrote: >// Now how about the percentage of *foreign* people who trust the US govt.? >// Given that it has said that it'll spy commercially... (if memory >// serves). > >Memory serves me oppositely -- denial that it has done so in the past and >saying that they would not do so in the future. This came a couple of >months ago during trade negotiations with the Japanese government. I don't think anything is resolved on this "economic espionage" issue. I've been interested in this topic since around 1988 (for an unfinished novel I was working on then--don't ask). Here are a few misc. points: * There is direct information that business information was intercepted by the NSA and other SIGINT agencies and used by the U.S. for economic advantage. This goes back to the 1940s, with intercepts of ITT and other cable traffic, and continues up to the present. Bamford gives a bunch of examples. * However, there is no direct knowledge that I am aware of that non-DOD-linked companies (i.e., ordinary American companies) received significant amounts of economic intelligence on their competitors. Thus, I doubt that General Motors was fed production data on Nissan that NSA plucked out of the ether in its Japanese listening posts (such as the huge NSA SIGINT facility at Misawa). Some companies may have received selected intercepts, sub rosa, but I doubt that this was a matter of regular policy. * Reports came out in the last couple of years that the NSA aided the U.S. trade negotiators in talks with Japan by providing intercepts covering the Japanese trade position. (I'm not sure if this was denied by the Administration, or acknowledged, or what. But it's pretty likely to be true. This is of course a different type of economic intelligence than helping individual American companies, though the effects are similar.) * Over the past 5-7 years there have been noises coming out of the intelligence community about redefining their mission to include economic espionage of various sorts (from the type they have always done, as above, to more direct aid to American industry). I first heard comments on this circa 1990, and they may have even come from a current or former DIRNSA...I can't recall. (I took meticulous notes on what I was reading in the press, but these notes are squirrelled away in "Tornado Notes" (Info Select) on an old Toshiba laptop!) * Shifting to more active economic intelligence gathering has *NOT* been announced as a new mission for the NSA, despite rumors here on the Cypherpunks list. If anyone can show us a real statement, or a plausible report that deduces this to be a new mission, I would be grateful. Rather, what I think we've been hearing are a bunch of reports and rumors that such a shift is being considered. (One list member contacted me by phone when I expressed similar doubts, some months back, and offered to put me in touch with a friend of his who claims to have evidence that such a shift has occurred. Not being an investigative reporter, and not being in the Beltway, I declined.) * Having said all this, that a certain type of economic surveillance and espionage is unlikely (e.g., Intel isn't being informed of Japanese chip yields), certainly other types of surveillance of foreign companies is likely. The NSA and its affiliated agencies are of course likely to surveil Western companies for evidence of arms shipments to other countries (a la Toshiba's propeller-quieting technology shipped the U.S.S.R., France's shipments of Exocets to various countries, nerve gas precursors, etc.). In this sense, economic surveillance _is_ one of the main missions of the NSA. I think it unlikely that the "NSA-enabled" Lotus solution will fly in these countries. Will Matra really be happy to use the "40+24" solution for sensitive inter-site communications, knowing full well about the many large NSA SIGINT dishes scattered throughout Europe? Knowing that the NSA has the 24-bit extra key material and that 40-bit keys are easily breakable? Somehow I think that these foreign governments, notably Germany and France, will explicitly block these products from being imported into their countries. A matter of national pride and all. (After all, imagine a product made in Japan that is known to be "Chobetsu-enabled." The U.S. government would not be too happy to see U.S. companies embracing such a product.) By making crypto restrictions "slide down easily," Lotus and IBM have not done us any favors. Fortunately, I think their scheme is doomed. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

QLG_ate
by John Young 17 Dec '03

17 Dec '03

Two articles comment on the creation of a quantum logic gate by NIST researchers, as reported in Physical Review Letters recently: "Quantum leap for code-cracking computers," Mark Ward, New Scientist, 23 Dec 95. "Approaching the Quantum Gate," David Voss, Science, 12 Jan 96. QLG_ate

1 0

Re: Elitism on Cypherpunks
by Corey Bridges 17 Dec '03

17 Dec '03

At 08:55 PM 1/18/96 -0800, Alan Olsen wrote: >It has been said that "Cypherpunks write code". They must do more than >that. Cypherpunks need to teach. Just remember you brought this up... Not all of us even write code. Some of us write (horrors!) books! Yes, my brethren, I earn my pay as a lowly scribe. Do I code? Nope. Am I a Cypherpunk? Christ, I don't care. I'm on this mailing list; that works fine for me. My brain expands almost daily from contact with such seditious sods. Do I contribute to the health and growth of this list? Maybe. Do I preach the Cypherpunk doctrine through my work at my company? Definitely. Just thought I'd point out that we aren't all code-monkeys. (And I mean that in the best sense of the word.) Corey Bridges Security Documentation Netscape Communications Corporation home.netscape.com/people/corey 415-528-2978

2 1

Re: Democracy...
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/15/98 10:27 PM, Jaeger (Jaeger(a)hempseed.com) passed this wisdom: > >hey, would you care to show us where "seperation of church and state" is >to be found in the constitution/bill of rights? absolute right and >wrong is not a religious belief (necessarily).. your religious beliefs >do not affect the nature of reality. there are absolute truths by [snip] >> Ever heard of seperation of church and state? Democracy? the rights of >> >> the individual? While you certainly have the right to practice your >> religion in what ever manner you so choose demanding that everyone >> else >> does, or that the president of the us of ais subject to you PERSONAL >> faith decisions is outragous The first amendment states only that there shall not be 'an establishment of religion' it says nada about 'separation of church and state.' The intention was simple; that there would never be an 'official' state religion. It didn't say religion had no place. They were escaping a regime with an established state religion that used the goverment to stamp out religious deviationism. That was the sole reason for that clause in the 1st amendment. Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "...if you drink much from a bottle marked "poison." and it is almost certain to disagree with you, sooner or later" _Alice in Wonderland_: (Lewis Carroll)

1 0