- cypherpunks-legacy - lists.cpunks.org

Re: Access to Storage and Communication Keys
by Marc Horowitz 17 Dec '03

17 Dec '03

Bill Stewart <stewarts(a)ix.netcom.com> writes: >> An interesting perspective, but I don't know that it works. >> For this to make sense, either the business needs to have access to >> the stored received email if the user gets run over by a police car, >> or else the business needs to know that it doesn't _need_ access - >> either because the mail isn't business related, or because the >> business-related parts have been transferred to other systems >> using a convenient user interface. It is impossible to know if a given email is business related or not automatically. Probably the best idea is to have my business email key escrowed (by my MIS department, not uncle sam!), but to have my personal email key not escrowed. Probably, I want to use two completely different email addresses. This does require that the sender use the correct address and key when sending me personal email. I do believe that there is a case for private key escrow here. Some of you will say that the sender should just encrypt the message to me and to the MIS message-escrow key. This is ok, too, but it still requires that the sender remember to do this for business email and not for personal email, so you've just changed the nature of the burden slightly, not removed it. >> >The *only* reason to escrow communications keys is to spy on people; >> >there is never an opportunity for data loss here. >> >> Yeah! (Actually, the other reason to escrow them is because >> you're using the same keys for communication and storage, This sort of thing is where we as cryptographic engineers need to keep on our toes. If we never use the same key for communications and storage encryption, this issue never comes up. >> of storage keys, but that's only the case if you're not using >> a sufficiently flexible cryptosystem and are using key backup >> instead of data backup, which is really the preferred approach anyway.) Key backup is far more practical than data backup in a large environment. ObCryptoIdea: a backup system which lets me set a public key associated with my directory/disk/whatever. The backup system will encrypt the backup in a symmetric key encrypted by this public key. If a restore is needed, the backup system and I engage in a dialog to disclose the relevant symmetric key. For mission-critical data, the public key must come with a certificate indicating that the private key has been escrowed, so that if I get hit by a truck, the data can be recovered. For personal data, I keep the private key to myself. This means that I can have the safety of knowing my data is being backed up, but I never have to worry about archives of my data coming back to haunt me (unless the company/school/ISP is malicious and keeps it's own records of the symmetric keys, but then I'm screwed in any case). Marc

1 0

The Great Awakening - Final Post (hopefully)
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jim Choate wrote: >Then you should go back and read them some more. In fact, if you still have >the originals they include in the header the URL where I got the data from. >Take the 10 minutes and go over and take a look at them. All three were >related to religous revivalism in one form or another. The 1st (which >itself some consider to be the second occurance of a previous movement >as indicated in the title) did not occur in the 1800's which was the >original precis that somebody threw out Bob Hettinga said it was in the 1800's. You said you thought it started in the 1500's, going no later than the early 1700's. Bob retorted that he thought you were confusing the Renaissance with the Great Awakening. I chimed in by quoting Norton's Anthology which stated that the period was in the early 18th century. Take 10 minutes to "check the archives." >I did some looking around as well and other then Norton, yourself, and >whoever it was that made the original claim all references I can find to >the Great Awakening refer to the 1700-1750 event(s) as the first one to >occur in the America's. If I can find my Norton Anthology I'll take a >look at it, though it is 15+ years old. If you look back at my post, you will see that this is what I (and Norton) were claiming. The early eighteenth century = the early 1700's! Read my first post which included the quote from Norton's Anthology. In other words, we both agree that the Great Awakening ended by the middle of the eighteenth century (a.k.a., 1700's), not the middle of the nineteenth century (a.k.a., 1800's) as Bob was claiming. >> >Subject: 1st Great Awakening >> [...] >> > X-within-URL: http://www.fourthturning.com/html/great_awakening.html > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> > The Great Awakening (Second Turning, 1727-1746) began as a spiritual > ^^^^^^^^^^^^^^^^^^^^^^^^^ "Second Turning" has to due with the cyclical theory that the authors of the web page you cited have written about. The fact is that they refer to that time period (early 1700's/18th c.) as the Great Awakening, not the Second Great Awakening. If you read the other pages at the site *more carefully* you will see that they were stuffing the Great Awakening into their theory under the category named the Second Turning (out of four, thus the site's name: fourthturning.com) Notice your Subject: line says 1st Great Awakening, but that you're using the parenthetically referenced Second Turning as a justification to contradict what I (and you) have been saying all along. What's going on here? How can we have any meaningful discussion on this list when we don't pay any attention to what we are writing or what others wrote? Nerthus -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNHTymeFWwZe05jcJAQGyswf+PhJIbFZlR7om8rWF6dogcsJf25bz9mHo OHj5k0j7RuEzx0s2j17Ico2ZckWOAdVhwg1fv9AWo4om1lUmysxpqTUHineJk3M2 A2Mw+Y9ogMps1V9nrrVsGmDswKulmBMA222XT8v6Si0X3r4D19qgSRqgH4rs8qs2 as51/AqxEeayx+Yphskys0HsU8ZjY/4w76dZP/TbakwWT+R5V4Yx3yQkcnsxh+iR Rk0D0q13SIk0xnc2+Ao3jkD0Og+t/QXFNLAjhXmlNHhvGvC8dcDHZuA7Lf3SAPcw Yp5qCyrTGBH1Gi0OEABHapg18Yo5WlwHx0nStKN3nl1z2vPJQdEbLQ== =GaMe -----END PGP SIGNATURE----- ^^^^ Dig that!

1 0

LPWA
by Michael Stutz 17 Dec '03

17 Dec '03

http://www.wired.com/news/technology/story/4375.html Covering Your Tracks via a Helping Hand by Michael Stutz 6:02pm 10.Jun.97.PDT Ironically, when it comes to privacy on the Net, you often have to turn to middlemen for help. In the latest in a long string of software and services that act as intermediaries for two parties when at least one of the parties wants anonymity, a technology demonstration was announced by Lucent Technologies on Tuesday. The Lucent Personalized Web Assistant enables users to maintain Web anonymity even on sites that require email registration. The LPWA acts as an anonymous proxy server, handling HTTP requests between a user and a Web site so that the user remains anonymous, said Alain Mayer, one of LPWA's developers. LPWA also filters the HTTP protocol so that no unwanted information goes out from the user, he said. Unlike the Anonymizer, a popular anonymous Web browsing service, it cannot perform temporary, nonproxy, anonymous Web sessions, but it does allow for anonymous accounts on Web sites that require it. "It computes on your behalf all kinds of username and passwords you'll need at different Web sites, in such a way that they will appear completely unrelated. On top of that, it will assign you a different email address" for each site that is visited. The problem, Mayer says, is that many commercial Web sites require online registration before you can access their information. Besides the fact that many people do not like this - and choose not to visit those sites - this poses a number of logistical problems. "One problem is that you have to remember all the username and passwords that you give out the next time you come back," said Mayer. "And if you always use the same set of username and passwords, these sites can potentially can get together and see wherever you're going and trace you down." The goal in designing LPWA was to address "where convenience and privacy can go hand-in-hand," Mayer said. "If you design privacy in software, it entails that you have to give on the convenience side. Our main goal was to combine these two possibly antagonistic goals." Currently, Lucent stores no information about LPWA users, since the anonymous usernames and passwords are generated by a cryptographic function. When a user connects to a site that requires a login, "\U" is entered for a username and "\P" for a password; LPWA then interprets this and supplies the cryptographically generated username and password to the site. Unlike some anonymous remailers, which store translations of users on hard disks, nothing would be retrieved from an LPWA should it be compromised by a government or other entity. But could commercial sites ban LPWA access by their own means? Mayer doesn't think so. "Potentially, a Web site can always refuse email from certain domains," he said, "but we can always find different domains, not just lpwa.com. What we hope is that commercial Web sites don't see us as an enemy but as a friend, because if users feel more secure in having certain things protected that they feel strongly about, then they also hopefully will feel better about giving certain other demographic information that the Web site can use. If this system gets popular, both sides will gain." While LPWA is now online, it should just be considered a demo; future versions may evolve into a commercial product that corporations could use with their firewalls, or ISPs could provide as an added benefit. LPWA is built on top of the popular Apache server software and runs on Unix - so it is plausible that in the future, individuals will run it on their own machines. "It's technically feasible to have this run on your laptop," said Mayer, "and if you're willing to live with the performance degradation you can even have it connect to another one and another one, so you don't have to trust anybody." Justin Boyan, author of the Anonymizer, imagines that schemes like chains of proxies are conceivable, but you'll always have to trust the community you are connected with. "It is a matter of trust. It's an issue of, 'Do you trust the people or the organization behind the middleman?' [LPWA] does require you to trust Lucent if you use it, and it requires you to trust anonymizer.com if you want to use us." But why trust Lucent? Mayer thinks that's a very good question. "You shouldn't," he said. "This is only a demonstration, and hopefully will generate enough interest that this will be put in places that are not in our hands. We don't even want to have this responsibility - it's not our business. Do you trust your ISP? That's a question you have to ask yourself anyway." Copyright © 1993-97 Wired Ventures, Inc. and affiliated companies. All rights reserved.

1 0

Trolling for Children, Cypherpunks, or LEA's?
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

se7en, Grand Protector of "Us", wrote: > > When I stopped lurking on this list and became a > regular poster, one of the things I quickly became known for was my > on-line harrassment of those who hurt us as a group. Thank you for your harrassment of the victims of your harrassment on my behalf. > Many old-timers here will remember my harrassment of a > a worldwide volunteer force that searched out indecency > on the net So it is a good thing to harrass people who do this? Thanks, I'll remember that. > As many of you know, I make a living as a professional speaker, with > federal government, military and intelligence communities as my core > audience. I am certain that you tell them what the federal government and military think they need to hear an are well received. > I recently went off on a serious rant with three different audiences on a > topic I felt was seriously exaggerated/over-hyped/fearmongered/bullshit. But you would never do that again, right? > some idiot from an anonymous address > sent me a child porn .jpg file. Trust me when I say it was child porn Nope. Afraid I like to check facts for myself. > I looked around on IRC on #teensex, and found: > #preteensexpics > #littlegirlsex > #100%preteensexpics > #100%preteensexfuckpics > #!!!!!!preteensexpics I looked too, but didn't find it. > I joined several of these channels and found that > upon entering each one, I was auto messaged about special kiddie porn > servers dedicated to trading, e.g., > PreTeenSexPics - FTP at 130.67.80.230 l/p ncc/ncc [|] I couldn't confirm this myself. Looked like pretty normal files to me. > I started logging the channels. I wanted to silently gather IP addresses > and email addresses. These people needed some genuine hacker terror. And to think that a short time ago, they didn't even exist, according to your rants. > I logged out of IRC, and then went to USENET, in such rooms as: > alt.binaries.erotica.children.pre-teen I couldn't find this "room" either. Are you sure this stuff doesn't exist only on your computer? > Several messages also pointed to some WWW sites, such as: > http://www.nudebooks.com Did you check it out? I did. I saw a lot of art. I didn't see any age discrimination. Maybe they need to be harrassed. Perhaps you could start by harassing the naturalists who have pictures of their families taken in the buff because they don't seem to realize that their bodies are vile, disgusting things. Then you could harrass those who document the photography of Lewis Carroll, who took pictures that aren't acceptable to present day moralists because our children now live long enough that we can stunt their sexual growth without dire consequences for survival of the species. > Well, this whole situation is unacceptable. First, I would like to > apologize to all those who have hired me in the past, and were subject to > my emotional rants about how the whole subject was bullshit and not real. But now we should liste to your emotional rants about the whole subject demands that we harrass people over it? Right. > I know this type of activity is > not tolerated by us. Which type? The type of activity where naturalists take pictures of themselves and their families? The type of activity where those who celebrate the human physique in their art don't use an artificial cut-off date to decide when art becomes obscenity? > I have given you enough information above to start > identifying the players in this and the places they congregate. No you haven't. > Yes, I am advocating malicious, destructive hacking activity against > these people. And this time you're not *wrong* like you were before, right? > These people need to be eradicated from the Internet. I'll rent the Ryder truck, you buy the fertilizer. We'll only kill the "guilty," right? TruthMonger

1 0

Anon E-mail article in WSJ
by Alan 17 Dec '03

17 Dec '03

In today's (06/18/97) Wall Street Journal there is an article on Anonymous e-mail in the corporate environment. Talks about companies who have set up systems to recieve anonymous e-mail from employees to deal with specific situations in the workplace. Interesting stuff and very positive. (A few negatives were listed, but more as sidenotes than anything.) Page B-1 has the article. This time I will be making a copy... alano(a)teleport.com | "Those who are without history are doomed to retype it."

1 0

BAY AREA CYPHERPUNKS, JUNE 14, AT PGP Inc. IN SAN MATEO
by Bill Stewart 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks June 97 Physical Meeting Announcement (SF Bay Area, Northern California chapter) Date: 14 June 1997 (second Saturday as usual) Time: 12pm - 4pm Host: Pretty Good Privacy, Inc. Contact: Dave Del Torto - 415.596.1781 voice Agenda for 14 June 97 (subject to slight variations): 1.Angelos Keromytis & Hugh Daniel on their Linux IPSEC work: Hot news from the recent IPSEC interoperability bake-off in Michigan 2.PGP 5.0 Source Code Release & Public Review: The first release of *all* final PGP 5.0 source code to the People! PGP engineers will be present to discuss technical details and answer specific questions. A number of copies will be available (free) to attendees who wish to review the cryptography code (note: we recommend that you bring a box or bag, as it's 14 volumes and nearly 7,000 pages). 3.HIP97 Trip Planning Committee: A group from California is planning on attending the Hacking in Progress '97 event sponsored by XS4ALL in the Netherlands (8/9/10 Aug). This event is followed by the IETF meeting in Munich, and some will continue on. We'll discuss our cooperative travel plans. Cf. N.B.: Contact ASAP for flight info as flights are being booked up rapidly (high tourist season). [Editors Note: _High_ tourists in Amsterdam??] 4. Ian Goldberg's Cool Canadian Crypto Software for Pilot Organizers If somebody from Berkeley can give Ian a ride, he'll demo the crypto libraries and applications he wrote while out of the US. PGP Building Access: This is an Open Meeting on US Soil and it is free for anyone to attend. There is a minor building security formality due to the facilities being in a bank building: anytime after 12 noon, approach the Bayview Building's Information window (in the plaza, see below for directions), and ask the Guard on Duty to let you up to the 2nd Floor for the Cypherpunks meeting (use the passphrase "cypherpunks release code"). If you have any difficulty (eg. if the guard is on a break), simply call me at 415.730.3583 and I'll let you in. You can arrive at any time during the scheduled meeting hours, though earlier is better if you want to hear the interesting stuff. Directions to PGP: Pretty Good Privacy's HQ is located at: 2121 South El Camino Real 9th Floor - (the meeting is on the 2nd Floor) San Mateo CA 94403, USA Directions available here http://www.pgp.com/pgpcorp/contactpgp.cgi#head or follow DDT's Directions to PGP's HQ in San Mateo (fossil fuel version): MACRO From the North Bay: Hwy 101 South (use right lanes after passing SFO) EXIT Fwy 92 West (move to center lane immediately after ramp)... or 280 South (take Hwy 92 East toward the Bay)... From the South Bay: 101 North - EXIT Fwy 92 West (toward Half Moon Bay)... 280 North - EXIT Hwy 92 East (toward the Bay)... From the East Bay: San Mateo Bridge (Hwy 92 West) GO past Hwy 101... MICRO Once you're on Hwy 92 (from either 280 or 101) EXIT at SOUTH El Camino Real (From 101 it's about a mile, and there are two El Camino exits!) (From 280 it's about 7 miles, after you've come down a steep grade, levelled out and passed under an overpass) Curve around and down under freeway: you're now travelling south on El Camino Real. Get in the LEFT lane *immediately*. (Directly in front of you, you can see the Bayview Building a couple of blocks away: it's the only highrise around.) LEFT on 20th (The very first traffic light after exit ramp. Taco Bell is on left). RIGHT turn at next stop sign (residential street: Palm). PROCEED 1.5 blocks. (Parking Garage entrance at rear of Bayview building is on your right.) PARK on the 2nd level. NANO Once you've parked your vehicle in the Garage (it's free): STAIRS (or Elevator) to the main level, step out and... WALK WEST across the courtyard to the main (tallest) building. PASS through the doorway in the stand-alone exterior "glass wall" and approach the "Information" window (also the Guard Station) on the north side of the building. GET the guard's attention (preferably *not* by waving a firearm). Use the passphrase and you'll be admitted. If the guard's on a break, call me at 415.730.3583. ELEVATOR to 2nd Floor. (The meeting room is on left side, slightly down the hall) Public Transit For CalTrain, get off at the San Mateo station near the Bay Meadows horse racing track and head for the tallest building around with the huge "Bayview" sign on top. It's a short walk or cab ride. By bus, take any line running on El Camino Real to the intersection of 20th in San Mateo and dismount. Look up: you're there. - ------------------ Announcement also available at http://www.pgp.com/newsroom/cpunk-info.cgi -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQBVAwUBM54YkvthU5e7emAFAQFF8AH+M0LItG6OfTn4h8BNF+51RLsuQHWq1TgY IN+R3j+A7AJno7lUxP612Ctm5m/3V2dAa5HrScyCfm3KUiPDxOqozQ== =gMPf -----END PGP SIGNATURE-----

1 0

unsubscribe tmoore48@ix.netcom.com
by Giggles 17 Dec '03

17 Dec '03

unsubscribe tmoore48(a)ix.netcom.com

1 0

ADDENDUM: BAY AREA CYPHERPUNKS, JUNE 14, AT PGP Inc. IN SAN MATEO
by Bill Stewart 17 Dec '03

17 Dec '03

Please refer to the official announcement at http://www.pgp.com/newsroom/cpunk-info.cgi in case any of the PGP-related details change....

1 0

[off-topic] LEA announcement about children & computers (long)
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Cpunx: For your amusment - nicked from the local Telco web site. I especially enjoy the link between role playing games, satanism and computing. ----------------------------------------------------------------------- CHILDREN AND COMPUTERS: THE HIDDEN DANGER Dear Parent: With the never ending development of computer technology and as an increasing number of people become computer literate, it is much more likely that our children may be victimized or exploited in a computer environment. If your child has a home computer (or access to someone elseÆs computer), especially those equipped with a modem, then please take the time to review this guide and become familiar with the behavioural warning signs. It will only take a few minutes and may prevent devastating problems in the future. Keep in mind, however, that no matter how ôawareö you are of these warning signs, the most important safeguard is to monitor the contacts that your children are making in this unrestricted environment and regulate their computer related activities. In addition, do not allow your children to isolate themselves from family or friends by engaging in solitary computer activities for hours on end. A computer should never become a substitute for social interaction. 1984 Government Study TodayÆs children are being weaned on video games and quickly move to computers. Society has high hopes for this technically literate generation, but the proliferation of microcomputers and computer literacy also means that more and more assets will be stored on computer systems and the community of potential computer criminals will increase astronomically. Tips for Safe Computing PARENTS Please advise your children to observe the following safety rules whenever they are ôon-lineö. Remind them that no matter how safe and/or friendly the BBS seems (and this includes the major services as well as the Internet), there is always a potential for danger. They Should: òNever give out any personal information about themselves - particularly full names, addresses, phone numbers, financial information, etc. to anyone they meet on line. òAvoid responding to anyone who leaves them obnoxious, sexual or menacing E-mail. They should not become involved in public ôFlameö sessions as they have no idea who they are dealing with and what access an individual may have to their account information. òReport all electronic harassment and/or abuse to their parents. As parents, you should notify the SYSTEM OPERATOR (SYSOP) of the problem. If the SYSTEM OPERATOR does not give you satisfaction in stopping this abuse, the police should be notified. òNever set up face to face meetings alone with anyone they have met on the BBS. They should always take someone with them and always meet in a public place. òNever have someone come to their house until they get to know them and until they are satisfied that they have given accurate personal information about the individual. òSafeguard all credit card and telephone card numbers. They should pay for BBS services by money order whenever practical. PARENTS: Notify the police of all attempts by adults to set up meetings with your children. This is by far the most dangerous situation for children and should be prosecuted when appropriate. ôThe modern thief can steal more with a computer than with a gun, and tomorrowÆs terrorist may be able to do more damage with a keyboard than with a bombö. National Research Council Washington, D.C. Some Child Behavioural Warning Signs: Computer Addiction òWithdraws from friends, family etc. May lose interest in social activities. òUse of new (unusual) vocabulary, heavy with computer terms, satanic phrase or sexual reference (or sudden interest in related posters, music, etc.) Look for related doodling or writing. òUse of words such as: hacking, phreaking or any words with ôphö replacing ôfö. òLack of interest in self and appearance or indications of lack of sleep, (which might indicate late night modem-play). Other Potential Danger Signs òComputer and modem running late at night (even when unattended). òStoring of computer files ending in: GIF, JPG, MPG, AVI, MOV, BMP, TIF, PCX, DL, GL or unusual CDÆs; these are video or graphic image files and parents should know what they illustrate. òNames on communications programs which seem satanic or pornographic. òObsession with fantasy adventure games, (Dungeons and Dragons, Trade Wars, Sexcapade, etc). òUse of computer to scan or run telephone numbers or credit card numbers, (look for ôsequential diallingö programs). What you can do to Protect your Children Talk to your children about their use of the computer Know What They are Doing òIf possible, keep the computer in a ôcommonö area of your home, such as a family room or den. òYou decide if your child has a legitimate need for a modem. òIf a modem is being used, control the activity by monitoring times used and numbers dialled. Closely Monitor your Long Distance Bill òIf the computer is left running unattended, check the screen. òIf it is showing a series of four digit numbers, the computer is trying to identify calling card ôPINö numbers. òIf it is showing a series of sixteen digit numbers, the computer is trying to validate credit card numbers. òIf you are not computer literate, make sure you at least learn the basics about computers, take a course or have your child teach you. Courtesy of: Chief Alfred O. Olsen Warwick Township Police Department Lititz, Pennsylvania, USA

1 0

Feds have lost battle against encryption
by Bill Frantz 17 Dec '03

17 Dec '03

There is an editorial in the June 11 San Jose Mercury News titled, "Feds have lost battle against encryption". It mentions the Sun/Elvis+ deal, and representative Goodlatte's bill. It says, "Government warriors should pack up their rusty cannons, admit that they've lost this battle, and learn to live in the 1990s." It speaks favorably of increased sentencing for criminal use of encryption. It says the bill does not go far enough in removing export controls. Try http://www.sjmercury.com for a copy. (I haven't looked, so no guarantees.) ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz(a)netcom.com | from hostile governments. | Los Gatos, CA 95032, USA

5 4