- cypherpunks-legacy - lists.cpunks.org

Re: all.net
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

This is the message that I got when I mistakenly typed "telnet all.net" [previously quoted message not repeated...] P.S. At this time, there is what appears to be a criminal conspiracy underway to excersize our detection system. Criminal because it is an attempt to attack a Federal Interest Computer - conspiracy because some of the participants have, after the fact, decided to participate in the criminal activity by refusing to identify the source of the attack. This is a result of a posting to a mailing list by someone who was apparently upset at having their activities detected. A recent threat to break into this site was posted, and we have contacted federal authorities. As this incident quantitatively increases, the level of our work to check out each part of the incident (by administrators such as yourself) may reach a total of $5,000. At that point, the FBI will be called in and participants in this activity may find that they are under federal investigation. Please advise your users to cease and desist and advise them to advise others to do so as well. It would also help us to limit the damage and establish culpability (and innocence) if you could get copies of the posting sent to your users so we can track down the source of the threat and determine what response, if any, is appropriate regarding your users who may be innocent victims of (and accidental conduits for) this attack. March 1996 - FC -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

2 1

Why escrow? (was Re: How would Leahy bill affect crypto over HAM
by Deranged Mutant 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> > Well, okay, but we've really got to define whose key is being escrowed, > anyway. Most corporations will probably handle it themselves, OR they will > only give an ENCRYPTED escrowed key to the escrow agent. This would prevent [..] They may use secret sharing or splitting methods and handle parts by different organizations within themselves and hand other parts to an outside agent. Sometimes this makes sense when there are political rivalries within an organization. They want the ability to get into Dilbert's files if he drops dead, but they want an objective party to hold part of the key so his rivals don't try to steal his files. Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by Bill Stewart 17 Dec '03

17 Dec '03

>On Mon, 11 Mar 1996 savron(a)world-net.sct.fr wrote: >> I began testing PGP a few days ago ( I'm a PGP newbie ) and I found >> that it gives out the key ID of an encrypted message . From this you >> can get the identification of the recipient of the message , if it's >> someone who has publicaly distributed his key (keyserver , homepage >> ...) . So even if you are unable to decode the message you can find >> who is the recipient of a given message . I think this is a big >> privacy problem . How much of a problem it is depends on the application you're using PGP for, but yes, it's a concern. There's a program called "stealth" by "Harry Hastur" which lets you remove or hide this information, as well as hiding most of the PGP headers. (There are some aspects of PGP file structure that are difficult to hide, at least without doing almost as much work as PGP was already doing, and I don't know if it adjusts for the mathematical properties of RSA-encrypted data which make it possible to identify the public key over some number of messages.) When the new PGP 3.0 comes out, there will be some support for shorter keyIDs (which isn't perfect, but for instance a 4-bit keyID would let you not try to decrypt 15/16ths of the messages, while not really fingering you as the recipient.) Also, if you have someone you frequently correspond with on some topic (perhaps a mailing list) and want to be able to send them messages that don't identify them, have them generate a public key they use just for that application. You can send your request by anonymous remailer, and they can send you a reply by anonymous remailer or post to alt.anonymous.messages. This still permits traffic analysis (nobody knows who keyid 0x12345678 is, but they know you sent him ten messages in the last month.) >> The problem is carried along when you encrypt a message for multiple >> recipients , you get the key IDs of all the recipients and same >> problem as above . I think something like 'blind email copy' should >> be used , because the recipients don't have to know the identity of >> each other . markm(a)voicenet.com replied: >You could just encrypt a message to different key ID's seperately, rather than >in one pass of PGP. The would have the effect of Bcc. Yep. That was the original PGP approach (i.e. "do nothing special"), and multiple-recipients were added as an efficiency measure. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Anon email accounts available
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just letting folks know that shellback.com is offering anon email accounts. Price is $5/month, prepaid via cash or money order. Weekly notices starting 30 days before account expires. See our page at http://www.shellback.com/anonmail.htm (yes, we're really leaving the last 'l' off :-) Also want to let folks know that the remailer is not _yet_ functioning (saw a couple messages try to fly through while setting up the mail server). Real Soon Now. Honest. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUbmAMVrTvyYOzAZAQEE0QP/Tg5wqn49bFVx8hwYbGP9UK3SsU7bgh+U yt6rZRrxTfIpJk01emWY6SXPL1XjCSSV8YXnukaScJdpmIJ9vRZkG1wpznNFWeER GtLP8YTdcyQxOzC7qY9UWwebweVTNjwH998x09jiUhp2wY1qkTjHqk2qMxSStZrZ 2U1IQc/BDt0= =uH+x -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

House Votes to Weaken Anti Terror Bill
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

House Votes to Weaken Anti Terror Bill Washington, March 13 (Reuter) -- The House of Representatives Wednesday removed major provisions of an anti-terrorism bill in a vote that sponsors of the legislation said would gut the measure. An amendment, adopted 246-171 by conservative Republicans and some liberal Democrats, removed language that would give the government authority to label groups as terrorist so foreign members can be deported more easily. It also prohibits use of wiretap evidence obtained without a warrant. "We do not need to give our government vast new powers," Georgia Republican Bob Barr, the amendment's author, said before the vote. He said current laws were strong enough. "With the Barr amendment this is not a real anti-terrorism bill," said Republican Henry Hyde of Illinois, the bill's main sponsor and chairman of the House Judiciary Committee. Hyde said an unusual coalition of groups including the conservative National Rifle Association and the liberal American Civil Liberties Union were opposing the bill because they thought it gave the federal government too much power. Hyde said one Republican colleague told him privately, " 'I trust Hamas (the militant Islamic group) more than my own government.' "

1 0

e$ and markets and meta-markets. quote with little comment
by bryce＠digicash.com 17 Dec '03

17 Dec '03

I just thought I would re-print this extract from the recent press release regarding the EUNet/Merita ecash roll-out. Favorite phrase: "interesting new possibilities." Follow-ups directed toward e$. If you post to cpunks without Cc'ing me I probably won't see it. Bryce ******* begin quote from the "companies that accept ecash" section SOM -- SOM, the Finnish Securities and Derivatives Exchange and Clearing House, established in 1987, serves as a neutral integrated securities and derivatives exchange and clearing house. SOM offers real-time financial market information on stocks, options and futures via the Internet, with invoices payable in ecash. Somtel for Windows -the application that offers real-time feed, as well as simulation and position-analysis functions-, is already available via leased line. "The use of money makes stock trading less complicated, with money acting as a practical intermediary between the transactions." states Asko Schrey, President of SOM. "However, since stock trades, as well as the shares themselves, are electronic nowadays, this conventional transmission of money has actually become a bottleneck and a threat to the development of the financial world. Therefore, SOM actively participates in projects to promote and improve the efficiency of payment traffic. We believe that electronic money will offer interesting new possibilities."

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 4:12 3/13/96, Matthew Richardson wrote: >On Wed, 13 Mar 1996 00:28:48 -0500, "Robert A. Rosenberg" ><hal9001(a)panix.com> wrote: > >>There is also the problem of knowing WHICH key to use (ie: Even when you >>know the message is intended for you, you must do a test run with each of >>your keys until one works). > >I believe that provided all your keys are in your secret keyring, PGP >will automatically pick the correct one for you. I know that. The situation was that the hypothetical message format itself contained NO INDICATION of who is was for or what key was used to encode it. PGP selects the right key by using the indication that is in the message of what key is to be used.

1 0

Re:LACC: PC Phones Home? -Reply
by Raymond Mereniuk 17 Dec '03

17 Dec '03

Jim Writes >A few questions: >1- How does the PC know where it is? >2- How does the PC know it has been stolen? ...deleted text... > #1 is the use of CallerID on the line when the software calls, >which is defeated by the use of line blocking by the thief. The ...deleted text... >Obvious solution for potential thieves: wipe the disks and reinstall >an OS once you steal a PC. This should be done anyway to remove any >bits of data which might identify the original owner. >Conclusion: Yet another useless piece of software riding the >computer security bandwagon. >jim You should visit their web site at http://absolute.com for more information as they can do what they say they can. A high level format does not change bad track assignments and neither will fdisk so if you hide something in an assigned bad track (cylinder or cluster or whatever it is called) nothing will see it. Now all you have to do is activiate the software in the bad track, I don't know how that is done (trade secret??) but maybe someone has figured out how to do it. Calls to 1-800 numbers can not block caller-ID, call-blocking will not stop the calling number from being passed to the appropriate equipment setup at the receiving end. Maybe these people have developed the ultimate virus, you can't detect it, you can't remove it, and you don't know it even exists. I don't really know how well this software package works but your comments had many errors. Normally Lurking Raymond

1 0

RE: Leahy bill, legalize crypto
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 AM 3/14/96 -0800, Timothy C. May wrote: >At 2:41 PM 3/14/96, Robichaux, Paul E wrote: >>Tim May said: >Besides which, I think the "scarce resource" argument against crypto over >the airwaves is clearly a fig leaf. Only amateur, non-corporate users are >affected. The intent of the rules, never repealed, seems more of an attempt >to limit the widespread deployment of ham radio for espionage purposes >(e.g., a ham sitting above a harbor area reporting on ship movements). I think Tim is absolutely right. If you look at "The Code Breakers" that kind of thinking was common in the WW1-WW2 era. The age of the 30 minute war somewhat diminished the strength of the argument. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: How's that again?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 11:37 PM 3/12/96 -0800, Bill Stewart wrote: > I guess it's no surprise that one of the more-or-less "good guys" > in the Senate can propose a law so ambiguously worded that it > looks good on the face until a good lawyer takes the time to rip > it apart Looking for "good guys" in Washington is like Ronald Reagan looking for "moderates" in Iran. On crypto, and on taxes, our interests and their their interests are completely opposed. We should not care about, or take any interest in, the slight difference between the "moderate" and extremist members of the Senate and the House of Representatives. The best bill we can ever hope to get out of Washington is no bill at all. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0