- cypherpunks-legacy - lists.cpunks.org

No Subject
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Excerpt from the Canadian Firearms Digest, V2 #612 ================ begin forwarded opinion =============== Date: Mon, 28 Sep 1998 13:40:01 -0600 From: someone(a)somewhere.net Subject: RCMP now have .50 cal. BMG's I have just learned from a highly reliable confidential source that in addition to the .50 cal McMillian sniper rifles and the untalked about Barrett Light .50's, the RCMP have now added to their arsenal a number of .50 cal. Browning Machine Guns. Staff from the RCMP are headed to Belgium to be trained in the armoring of these military heavy machine guns. Machine guns may at some point be used against the Canadian public, possibly to quell a native disturbance or other civil unrest. If we were attacked by outside forces the military would be the pressed into service, as this is not the role of the RCMP. This leads one to ask what use the RCMP, who are a police force not an army in occupation, would have for such heavy armament ...... or is it possible that I have it wrong, possibly they are now an army in occupation. Is it possible that the RCMP are now the political policing arm of the Government. The lethality of this weapon makes pepper spray look like a Sunday shower. Maybe this is the next weapon demonstrators will be facing at the orders of the PM's office. ================ end forwarded opinion ================ Ciao all. Definition: FASCISM: n.: a political and economic movement, strongly nationalistic, magnifying the rights of the state as opposed to those of the individual, in which industry, though remaining largely under private ownership, and all administrative political units, are controlled by a strong central government. ------------------------------------------------- "One of the ordinary modes by which tyrants accomplish their purpose, without resistance, is by disarming the people and making it an offense to keep arms". - Joseph Story, U.S. Supreme Court Justice. ------------------------------------------------- the German gun control laws were enacted by the "liberal" Weimar Republic government that preceded Hitler, and were a strong aid to his coming to power -- because they disarmed Hitler's opponents, and Hitler's adherents ignored them -- as criminals have always ignored gun control laws. Disarming the public is a frequent first step toward dictatorships and genocides. Once the disarming is complete, the public is helpless against those who have the guns. ------------------------------------------------- PGP keys: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C

1 0

Re: Surf-filter lists
by declan＠well.com 17 Dec '03

17 Dec '03

>Vlad: How can consumers make an informed decision as to which filter >they wish to purchase, if they are not told exactly what information >each product is filtering out? > >Meeks et al may be guilty of flamboyant, emotionalistic prose, but I >find the concept that the public is expected to buy various filters >without knowing what they filter...frankly, ridiculous. Flamboyant prose? Moi? Never! More to the point, as I wrote at the end of the original CWD, it's a bait-and-switch maneuver. Go after porn, they say, but the censor political information. And you don't know about it. -Declan

3 2

Cookie alternatives
by Hal 17 Dec '03

17 Dec '03

There has been quite a bit of discussion recently about the "cookies" used by Netscape Navigator and their effects on privacy of users. Here is some background and some thoughts on alternatives. I think the term "cookie" goes back to the 1960's. According to legend, there was a virus-like program called "cookie monster" which would occasionally pop up on people's terminals and say "gimme cookie". You then had to type the word "cookie" to satisfy the program, and it would go away. The program was hidden in the core memory of the large, multi-user computer systems which were common in those days. I first heard "cookie" used similarly to its current context in the 1970's. It referred to a data item which would be given by a service to a client of that service, and which would be used on later interactions. I think the usage comes from the cookie monster, where you imagine the client saying "gimme cookie" to the server. The cookie is an "opaque" data item, that is, its structure if any is not visible or documented for the client. It has meaning only to the service. There is a similar concept in cryptography, the "nonce". A nonce is a random value which is generated by one party in a cryptographic protocol and which is exchanged at later stages of the protocol. The purpose of the nonce is to prevent replay attacks and to maintain continuity during the (possibly) many exchanges of data which make up the protocol. When the client sends a request to a service it includes a nonce, and the return reply includes the same nonce. This way the client can make sure that this is a reply to its current request and not something which is replayed from an earlier interaction. Cookies seem a little more general than nonces, in that nonces are pretty clearly supposed to be just random numbers, while cookies are more general and could have internal structure which is known by one of the parties, although it is usually opaque to the other. However I think in current usage on the web cookies are most commonly used basically as nonces, random values whose purpose is to maintain continuity in a series of interactions. When a server gives a cookie to a web browser, that browser supplies the cookie on future interactions with the server. The cookie probably does not have any specific data about the user or the interaction, but is used only to link up the interactions which take place. It is most probably used as an index into a database maintained on the server itself. Its only requirements for this purpose are that it is unique and that it can easily be used as such an index. One typical usage would be to maintain a "shopping cart" while browsing at a store. If I am visiting an online clothing store, I may choose to buy some pants, a shirt, and a jacket as I browse around. Each time I click on the "buy" button, my browser includes the cookie I received when I first visited the site. This indexes into a database on the server which is keeping track of what I have bought. With each new item, the cookie allows the server to add it to the correct virtual shopping cart. Then when I "check out", again the cookie allows the server to display everything I bought. Given that cookies generally work this way it is clear that the notion of editing cookies doesn't make much sense. If cookies are opaque data structures, changing them is just going to make them invalid. You might as well just delete them. This also implies that you don't have much control over what kinds of information the server is maintaining in its database which is indexed by your cookie. In the shopping cart example, the cookie is sent on every transaction, not just when you click to make a purchase. This will allow the server to track your progress through the site, see which if any ads you have seen, and generally record many details about your interactions. More generally, cookies are used for this purpose even on sites which do not need them for shopping carts. As a user of the web, I would prefer to have more control over the kind of information which servers gather about my browsing habits. Of course, since web interactions are voluntary, a server is free to put whatever restrictions it wishes on clients in return for letting them access its information. It can require clients to accept cookies, to register with their names and addresses, or to FedEx their firstborn children to the store, for that matter. Nevertheless to the extent that I have bargaining clout in these interactions, I will prefer systems which do not infringe so much upon my privacy. It is interesting to consider how shopping carts might be done without cookies and similar technologies which allow servers to get more information about me than necessary. I would prefer a system where the list of things I have chosen to buy is saved on my own computer, in a format I can clearly see, and without linking my purchase decisions to other browsing I may have done on that site. Consider a system where when I click on "buy", a dialog box pops up in the corner of my screen which is my virtual shopping cart. It holds a list of the items I have selected for purchase, with each new item appended to the list. When I go to check out, the contents of this dialog box are uploaded (with my permission) to the site, where payment arrangements are made. Since I can see what is being put into the dialog box and what is being uploaded, I know that I am controlling exactly what information is being revealed about me. I don't have to trust the server to protect my privacy by not recording excessive information about my browsing. (Given the difficulties in creating new protocols for this kind of support, I think a step in the right direction would be to change the user interface so that cookies are only sent upon user request. Maybe you have to shift-click or use some other key modifier to send a cookie. Then shopping pages could ask you to shift-click the buy button to add the item to your shopping cart.) All this is in accord with the general principle that we support here, of protecting privacy by limiting the collection of infringing data, rather than trying to pass laws to restrict the dissemination and sharing of such information. We support ecash since it allows transactions without identification, rather than using credit cards but trying to put legal restrictions on what the CC companies can do with their transaction data. Cookies allow many kinds of privacy infringing data to be collected. I would prefer to see alternate mechanisms to allow for the kinds of transactions that cookies are needed for, which allow users to protect their own privacy. Are there other uses of cookies for which alternatives are needed? Hal

5 4

Re: Larry Gilbert, AOLers, and the Hyper-real flamer
by Anonymous 17 Dec '03

17 Dec '03

(Depreciated toad.com address replaced with algebra.com.) On Sat, 19 Sep 1998 AIMSX(a)aol.com wrote: > > wow.. you really do think I do all those things - spamming, mailbombing... and > all that other huh? No. Actually, we're convinced that you're just a lamer. Usually spamming and mailbombing goes along with that. > You really give me way to much credit, as I only use it for internet access, > and access to a UNIX machine You need 100 accounts on the same ISP for that? Your implied claims of being Internet savvy are pretty suspect considering that you haven't even figured out how to quote yet. Besides, all having 100 accounts usually means is that you installed a password sniffer on a university LAN or you ran crack on a passwd file.

1 0

Stego Software
by sparks＠bah.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cypherpunks(a)toad.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMeudE+J+JZd/Y4yVAQFk1gQKA34V+zLw4kfr2kGFy4mLIVQ64cvY6LIo hnqAbX83gIkIgyDcs7DTEpwcanxsdGM4b0ggulvuAFJVPv3VgkK3iw/9lXhEeswG UA6En0v0s9apR5JFGiGIqSnqRt11X+jehgSLMDI/IVALazn9SE9bbw03osv4xF33 Lh/Z7HOKS4071g== =SjHE -----END PGP SIGNATURE----- Charles E. Sparks Booz Allen & Hamilton http://www.clark.net/pub/charley/index.htm In God we trust, All Others we encrypt Public Key at: http://www.clark.net/pub/charley/cp_1.htm

1 0

A question from Seattle
by Thompson, Christopher W NWS 17 Dec '03

17 Dec '03

hey, I'm a 28 year old living in Seattle and I've been having quite the fantasy of watching and or participating in father/son activities...or big brother and little brother interaction. Do you have any suggestions where/who I might contact in the Seattle metro area? Thanks

1 0

TruthMonger key's password! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 19 Sep 1998 19:46:43 +0100 > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: TruthMonger key's password! Note the magic circle comment as a potential passphrase, he did say 'others'. > What is going on here? Is Toto still at large, drunk behind the > keyboard? Is Toto not one person? Or have the IRS extracted Carl > Johnson's passphrases from him and got busy playing mind-games with > us? Or more likely there is one or more persons who have an arrangement. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

UK privacy case: Munden
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

interesting story I hadn't heard before. this guy complained about a bad bank balance and went to jail for it. touches issues such as security of bank software, government oppression, crypto, judicial evidence legality, etc. ------- Forwarded Message Date: Thu, 11 Jul 1996 04:38:27 -0700 (PDT) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: John Munden freed X-URL: http://communication.ucsd.edu/pagre/rre.html [This case is so outrageous that it wouldn't even work as a "Dilbert" strip. Fortunately the guy is now free, having had his life ruined for complaining about the theft of his bank deposits.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 10 Jul 1996 11:00:11 -0800 From: Jon Callas <jon(a)worldbenders.com> To: "The Eristocracy" <Eristocracy(a)mv.mv.com> Subject: Munden set free [Editor's note: I sent out an article about the Munden case when it was current -- in late '94. For those who don't remember, John Munden is a British policeman who was jailed for complaining about his bank balance being wrong. No, you didn't read that incorrectly. Read on for more details. I certainly hope that the next chapter will be some sort of restitution paid to Munden. -- jdcc] Date: Tue, 09 Jul 1996 12:13:28 +0100 From: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> To: set-discuss(a)commerce.net Subject: Important UK court case +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ At a trial in England yesterday, a judge decided that if a bank was not prepared to let their computer systems be examined by a hostile expert witness, then they could not even present bank statements in evidence. At least SET has been done right - I believe it is the first significant banking protocol to have undergone an open design review. I hope that there will be implementations that have also undergone credible scrutiny. I append a note of the case that I posted to our supporters. Ross Anderson ********************************************************************* John Munden is acquitted at last! At twenty past two today, John Munden walked free from Bury Crown Court. This resolved a serious miscarriage of justice, and ended an ordeal for John and his family that has lasted almost four years. In a judgment loaded with significance for the evidential value of cryptography and secure systems generally, His Honour Justice John Turner, sitting with two assessors, said that when a case turns on computers or similar equipment then, as a matter of common justice, the defence must have access to test and see whether there is anything making the computers fallible. In the absence of such access, the court would not allow any evidence emanating from computers. As a result of this ruling, the prosecution was not in a position to proceed, and John Munden was acquitted. John was one of our local policemen, stationed at Bottisham in the Cambridge fenland, with nineteen years' service and a number of commendations. His ordeal started in September 1992 when he returned from holiday in Greece and found his account at the Halifax empty. He complained and was told that since the Halifax had comfidence in the security of its computer system, he must be mistaken or lying. When he persisted, the Halifax reported him to the police complaints authority for attempted fraud; and in a trial whose verdict caused great surprise, he was convicted at Mildenhall Magistrates' Court on the 12th February 1994. I told the story of this trial in a post to comp.risks (see number 15.54 or get ftp.cl.cam.ac.uk/users/rja14/post.munden1). It turned out that almost none of the Halifax's `unresolved' transactions were investigated; they had no security manager or formal quality assurance programme; they had never heard of ITSEC; PIN encryption was done in software on their mainframe rather than using the industry-standard encryption hardware, and their technical manager persisted in claiming (despite being challenged) that their system programmers were unable to get at the keys. Having heard all this, I closed my own account at the Halifax forthwith and moved my money somewhere I hope is safer. But their worships saw fit to convict John. An appeal was lodged, but just before it was due to be heard - in December 1994 - the prosecution handed us a lengthy `expert' report by the Halifax's accountants claiming that their systems were secure. This was confused, even over basic cryptology, but it was a fat and glossy book written by a `big six' firm with complete access to the Halifax's systems - so it might have made an impression on the court. We therefore applied for, and got, an adjournment and an order giving me - as the defence expert witness - `access to the Halifax Building Society's computer systems, records and operational procedures'. We tried for nine months to enforce this but got nowhere. We complained, and the judge ordered that all prosecution computer evidence be barred from the appeal. The Crown Prosecution Service nonetheless refused to throw in the towel, and they tried to present output such as bank statements when the appeal was finally heard today. However, the judge would have none of it. For the computer security community, the moral is clear: if you are designing a system whose functions include providing evidence, it had better be able to withstand hostile review. Ross ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. - - --- end forwarded text - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

Re: Surf-filter lists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:06 PM 7/16/96, David Sternlight wrote: >YOU and I may find it so, but you simply don't understand the mentality of >those who will buy such filters without question. Vast numbers of people >take the word of their minister, government, morality "guide", guru, or >teacher without question. Why do you think Scientology has gone as far as >it has? Furthermore, I saw absolutely nothing "surprising" in the topics filtered by the NetNinny and similar filters. That is, it is not surprising to me that G-rated filters would filter all mentions of homosexuality, "safe sex," condoms, anal sex, sex in general, etc. There may be those who think that children need to be exposed to proper condom use in the third grade (California's public schools think this, for example), and those that think abortion information should not be blocked, but there are clearly many parents who are happy to have little Johnny not exposed to any of the above and similar topics. If this means little Johnny is denied access to the NOW web page, or the NAMBLA safe sex page, so be it. If enough people want detailed explanations of what is being blocked, and will vote with their dollars, then probably some filter vendors will choose to make this information available. Sounds fair to me. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: My impending death
by Remo Pini 17 Dec '03

17 Dec '03

At 08:22 PM 7/14/96 EDT, you wrote: >> Since Vulis decided to drag in a disagreement from elsewhere, I have a brief >> invitation. > >The cripple is lying again, as usual. Twice he reposted to cypherpunks >his Usenet lies with no cryptographic relevance just to slime me. Since >not even Perry told the demented cripple to quit, I'll respond in kind. > I don't want to seem overly squemish, but wouldn't you agree, that stuff that get's so "personal" as this discussion doesn't really belong here? (Personally I even think, that such primitive mudslinging doesn't belong anywhere) Calm down, relax, have a cigar and be a nice boy. ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0